• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

systemd / systemd / 16082515961

04 Jul 2025 08:23PM UTC coverage: 72.095% (-0.1%) from 72.193%
16082515961

push

github

poettering
seccomp-util: allowlist open_tree() as part of @file-system

Now that we make use of open_tree() in places we previously used
openat() with O_PATH, it makes sense to move it from @mount to
@file-system. Without the OPEN_TREE_CLONE flag open_tree() is after all
unprivileged.

Note that open_tree_attr() I left in @mount, since it's purpose is
really to set mount options when cloning, and that's clearly a mount
related thing, not so much something you could use unpriv.

Follow-up for: c5de7b14a

This addresses an issue tracked down by Antonio Feijoo: since the commit
that started to use open_tree() various apps started to crash because
they used seccomp filters and sd-device started to use open_tree()
internally.

300842 of 417287 relevant lines covered (72.09%)

715300.57 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

91.07
/src/basic/unit-def.c
1
/* SPDX-License-Identifier: LGPL-2.1-or-later */
2

3
#include <stdio.h>
4

5
#include "alloc-util.h"
6
#include "bus-label.h"
7
#include "glyph-util.h"
8
#include "string-table.h"
9
#include "string-util.h"
10
#include "unit-def.h"
11
#include "unit-name.h"
12

13
char* unit_dbus_path_from_name(const char *name) {
105,642✔
14
        _cleanup_free_ char *e = NULL;
105,642✔
15

16
        assert(name);
105,642✔
17

18
        e = bus_label_escape(name);
105,642✔
19
        if (!e)
105,642✔
20
                return NULL;
21

22
        return strjoin("/org/freedesktop/systemd1/unit/", e);
105,642✔
23
}
24

25
int unit_name_from_dbus_path(const char *path, char **name) {
450,639✔
26
        const char *e;
450,639✔
27
        char *n;
450,639✔
28

29
        e = startswith(path, "/org/freedesktop/systemd1/unit/");
450,639✔
30
        if (!e)
450,639✔
31
                return -EINVAL;
32

33
        n = bus_label_unescape(e);
442,551✔
34
        if (!n)
442,551✔
35
                return -ENOMEM;
36

37
        *name = n;
442,551✔
38
        return 0;
442,551✔
39
}
40

41
const char* unit_dbus_interface_from_type(UnitType t) {
189,578✔
42

43
        static const char *const table[_UNIT_TYPE_MAX] = {
189,578✔
44
                [UNIT_SERVICE]   = "org.freedesktop.systemd1.Service",
45
                [UNIT_SOCKET]    = "org.freedesktop.systemd1.Socket",
46
                [UNIT_TARGET]    = "org.freedesktop.systemd1.Target",
47
                [UNIT_DEVICE]    = "org.freedesktop.systemd1.Device",
48
                [UNIT_MOUNT]     = "org.freedesktop.systemd1.Mount",
49
                [UNIT_AUTOMOUNT] = "org.freedesktop.systemd1.Automount",
50
                [UNIT_SWAP]      = "org.freedesktop.systemd1.Swap",
51
                [UNIT_TIMER]     = "org.freedesktop.systemd1.Timer",
52
                [UNIT_PATH]      = "org.freedesktop.systemd1.Path",
53
                [UNIT_SLICE]     = "org.freedesktop.systemd1.Slice",
54
                [UNIT_SCOPE]     = "org.freedesktop.systemd1.Scope",
55
        };
56

57
        if (t < 0)
189,578✔
58
                return NULL;
59
        if (t >= _UNIT_TYPE_MAX)
189,578✔
60
                return NULL;
61

62
        return table[t];
189,578✔
63
}
64

65
const char* unit_dbus_interface_from_name(const char *name) {
27✔
66
        UnitType t;
27✔
67

68
        t = unit_name_to_type(name);
27✔
69
        if (t < 0)
27✔
70
                return NULL;
71

72
        return unit_dbus_interface_from_type(t);
27✔
73
}
74

75
static const char* const unit_type_table[_UNIT_TYPE_MAX] = {
76
        [UNIT_SERVICE]   = "service",
77
        [UNIT_SOCKET]    = "socket",
78
        [UNIT_TARGET]    = "target",
79
        [UNIT_DEVICE]    = "device",
80
        [UNIT_MOUNT]     = "mount",
81
        [UNIT_AUTOMOUNT] = "automount",
82
        [UNIT_SWAP]      = "swap",
83
        [UNIT_TIMER]     = "timer",
84
        [UNIT_PATH]      = "path",
85
        [UNIT_SLICE]     = "slice",
86
        [UNIT_SCOPE]     = "scope",
87
};
88

89
DEFINE_STRING_TABLE_LOOKUP(unit_type, UnitType);
76,552,099✔
90

91
static const char* const unit_load_state_table[_UNIT_LOAD_STATE_MAX] = {
92
        [UNIT_STUB]        = "stub",
93
        [UNIT_LOADED]      = "loaded",
94
        [UNIT_NOT_FOUND]   = "not-found",
95
        [UNIT_BAD_SETTING] = "bad-setting",
96
        [UNIT_ERROR]       = "error",
97
        [UNIT_MERGED]      = "merged",
98
        [UNIT_MASKED]      = "masked",
99
};
100

101
DEFINE_STRING_TABLE_LOOKUP(unit_load_state, UnitLoadState);
5,466✔
102

103
/* Keep in sync with man/unit-states.xml */
104
static const char* const unit_active_state_table[_UNIT_ACTIVE_STATE_MAX] = {
105
        [UNIT_ACTIVE]       = "active",
106
        [UNIT_RELOADING]    = "reloading",
107
        [UNIT_INACTIVE]     = "inactive",
108
        [UNIT_FAILED]       = "failed",
109
        [UNIT_ACTIVATING]   = "activating",
110
        [UNIT_DEACTIVATING] = "deactivating",
111
        [UNIT_MAINTENANCE]  = "maintenance",
112
        [UNIT_REFRESHING]   = "refreshing",
113
};
114

115
DEFINE_STRING_TABLE_LOOKUP(unit_active_state, UnitActiveState);
29,926✔
116

117
static const char* const freezer_state_table[_FREEZER_STATE_MAX] = {
118
        [FREEZER_RUNNING]            = "running",
119
        [FREEZER_FREEZING]           = "freezing",
120
        [FREEZER_FREEZING_BY_PARENT] = "freezing-by-parent",
121
        [FREEZER_FROZEN]             = "frozen",
122
        [FREEZER_FROZEN_BY_PARENT]   = "frozen-by-parent",
123
        [FREEZER_THAWING]            = "thawing",
124
};
125

126
DEFINE_STRING_TABLE_LOOKUP(freezer_state, FreezerState);
53,425✔
127

128
/* Maps in-progress freezer states to the corresponding finished state */
129
static const FreezerState freezer_state_finish_table[_FREEZER_STATE_MAX] = {
130
        [FREEZER_FREEZING]           = FREEZER_FROZEN,
131
        [FREEZER_FREEZING_BY_PARENT] = FREEZER_FROZEN_BY_PARENT,
132
        [FREEZER_THAWING]            = FREEZER_RUNNING,
133

134
        /* Finished states trivially map to themselves */
135
        [FREEZER_RUNNING]            = FREEZER_RUNNING,
136
        [FREEZER_FROZEN]             = FREEZER_FROZEN,
137
        [FREEZER_FROZEN_BY_PARENT]   = FREEZER_FROZEN_BY_PARENT,
138
};
139

140
FreezerState freezer_state_finish(FreezerState state) {
×
141
        assert(state >= 0);
×
142
        assert(state < _FREEZER_STATE_MAX);
×
143

144
        return freezer_state_finish_table[state];
×
145
}
146

147
static const char* const unit_marker_table[_UNIT_MARKER_MAX] = {
148
        [UNIT_MARKER_NEEDS_RELOAD]  = "needs-reload",
149
        [UNIT_MARKER_NEEDS_RESTART] = "needs-restart",
150
};
151

152
DEFINE_STRING_TABLE_LOOKUP(unit_marker, UnitMarker);
×
153

154
static const char* const automount_state_table[_AUTOMOUNT_STATE_MAX] = {
155
        [AUTOMOUNT_DEAD]    = "dead",
156
        [AUTOMOUNT_WAITING] = "waiting",
157
        [AUTOMOUNT_RUNNING] = "running",
158
        [AUTOMOUNT_FAILED]  = "failed",
159
};
160

161
DEFINE_STRING_TABLE_LOOKUP(automount_state, AutomountState);
367✔
162

163
static const char* const device_state_table[_DEVICE_STATE_MAX] = {
164
        [DEVICE_DEAD]      = "dead",
165
        [DEVICE_TENTATIVE] = "tentative",
166
        [DEVICE_PLUGGED]   = "plugged",
167
};
168

169
DEFINE_STRING_TABLE_LOOKUP(device_state, DeviceState);
74,292✔
170

171
static const char* const mount_state_table[_MOUNT_STATE_MAX] = {
172
        [MOUNT_DEAD]               = "dead",
173
        [MOUNT_MOUNTING]           = "mounting",
174
        [MOUNT_MOUNTING_DONE]      = "mounting-done",
175
        [MOUNT_MOUNTED]            = "mounted",
176
        [MOUNT_REMOUNTING]         = "remounting",
177
        [MOUNT_UNMOUNTING]         = "unmounting",
178
        [MOUNT_REMOUNTING_SIGTERM] = "remounting-sigterm",
179
        [MOUNT_REMOUNTING_SIGKILL] = "remounting-sigkill",
180
        [MOUNT_UNMOUNTING_SIGTERM] = "unmounting-sigterm",
181
        [MOUNT_UNMOUNTING_SIGKILL] = "unmounting-sigkill",
182
        [MOUNT_FAILED]             = "failed",
183
        [MOUNT_CLEANING]           = "cleaning",
184
};
185

186
DEFINE_STRING_TABLE_LOOKUP(mount_state, MountState);
21,597✔
187

188
static const char* const path_state_table[_PATH_STATE_MAX] = {
189
        [PATH_DEAD]    = "dead",
190
        [PATH_WAITING] = "waiting",
191
        [PATH_RUNNING] = "running",
192
        [PATH_FAILED]  = "failed",
193
};
194

195
DEFINE_STRING_TABLE_LOOKUP(path_state, PathState);
1,028✔
196

197
static const char* const scope_state_table[_SCOPE_STATE_MAX] = {
198
        [SCOPE_DEAD]         = "dead",
199
        [SCOPE_START_CHOWN]  = "start-chown",
200
        [SCOPE_RUNNING]      = "running",
201
        [SCOPE_ABANDONED]    = "abandoned",
202
        [SCOPE_STOP_SIGTERM] = "stop-sigterm",
203
        [SCOPE_STOP_SIGKILL] = "stop-sigkill",
204
        [SCOPE_FAILED]       = "failed",
205
};
206

207
DEFINE_STRING_TABLE_LOOKUP(scope_state, ScopeState);
1,132✔
208

209
static const char* const service_state_table[_SERVICE_STATE_MAX] = {
210
        [SERVICE_DEAD]                       = "dead",
211
        [SERVICE_CONDITION]                  = "condition",
212
        [SERVICE_START_PRE]                  = "start-pre",
213
        [SERVICE_START]                      = "start",
214
        [SERVICE_START_POST]                 = "start-post",
215
        [SERVICE_RUNNING]                    = "running",
216
        [SERVICE_EXITED]                     = "exited",
217
        [SERVICE_RELOAD]                     = "reload",
218
        [SERVICE_RELOAD_SIGNAL]              = "reload-signal",
219
        [SERVICE_RELOAD_NOTIFY]              = "reload-notify",
220
        [SERVICE_REFRESH_EXTENSIONS]         = "refresh-extensions",
221
        [SERVICE_STOP]                       = "stop",
222
        [SERVICE_STOP_WATCHDOG]              = "stop-watchdog",
223
        [SERVICE_STOP_SIGTERM]               = "stop-sigterm",
224
        [SERVICE_STOP_SIGKILL]               = "stop-sigkill",
225
        [SERVICE_STOP_POST]                  = "stop-post",
226
        [SERVICE_FINAL_WATCHDOG]             = "final-watchdog",
227
        [SERVICE_FINAL_SIGTERM]              = "final-sigterm",
228
        [SERVICE_FINAL_SIGKILL]              = "final-sigkill",
229
        [SERVICE_FAILED]                     = "failed",
230
        [SERVICE_DEAD_BEFORE_AUTO_RESTART]   = "dead-before-auto-restart",
231
        [SERVICE_FAILED_BEFORE_AUTO_RESTART] = "failed-before-auto-restart",
232
        [SERVICE_DEAD_RESOURCES_PINNED]      = "dead-resources-pinned",
233
        [SERVICE_AUTO_RESTART]               = "auto-restart",
234
        [SERVICE_AUTO_RESTART_QUEUED]        = "auto-restart-queued",
235
        [SERVICE_CLEANING]                   = "cleaning",
236
        [SERVICE_MOUNTING]                   = "mounting",
237
};
238

239
DEFINE_STRING_TABLE_LOOKUP(service_state, ServiceState);
36,106✔
240

241
static const char* const slice_state_table[_SLICE_STATE_MAX] = {
242
        [SLICE_DEAD]   = "dead",
243
        [SLICE_ACTIVE] = "active",
244
};
245

246
DEFINE_STRING_TABLE_LOOKUP(slice_state, SliceState);
7,312✔
247

248
static const char* const socket_state_table[_SOCKET_STATE_MAX] = {
249
        [SOCKET_DEAD]             = "dead",
250
        [SOCKET_START_PRE]        = "start-pre",
251
        [SOCKET_START_OPEN]       = "start-open",
252
        [SOCKET_START_CHOWN]      = "start-chown",
253
        [SOCKET_START_POST]       = "start-post",
254
        [SOCKET_LISTENING]        = "listening",
255
        [SOCKET_DEFERRED]         = "deferred",
256
        [SOCKET_RUNNING]          = "running",
257
        [SOCKET_STOP_PRE]         = "stop-pre",
258
        [SOCKET_STOP_PRE_SIGTERM] = "stop-pre-sigterm",
259
        [SOCKET_STOP_PRE_SIGKILL] = "stop-pre-sigkill",
260
        [SOCKET_STOP_POST]        = "stop-post",
261
        [SOCKET_FINAL_SIGTERM]    = "final-sigterm",
262
        [SOCKET_FINAL_SIGKILL]    = "final-sigkill",
263
        [SOCKET_FAILED]           = "failed",
264
        [SOCKET_CLEANING]         = "cleaning",
265
};
266

267
DEFINE_STRING_TABLE_LOOKUP(socket_state, SocketState);
26,961✔
268

269
static const char* const swap_state_table[_SWAP_STATE_MAX] = {
270
        [SWAP_DEAD]                 = "dead",
271
        [SWAP_ACTIVATING]           = "activating",
272
        [SWAP_ACTIVATING_DONE]      = "activating-done",
273
        [SWAP_ACTIVE]               = "active",
274
        [SWAP_DEACTIVATING]         = "deactivating",
275
        [SWAP_DEACTIVATING_SIGTERM] = "deactivating-sigterm",
276
        [SWAP_DEACTIVATING_SIGKILL] = "deactivating-sigkill",
277
        [SWAP_FAILED]               = "failed",
278
        [SWAP_CLEANING]             = "cleaning",
279
};
280

281
DEFINE_STRING_TABLE_LOOKUP(swap_state, SwapState);
77✔
282

283
static const char* const target_state_table[_TARGET_STATE_MAX] = {
284
        [TARGET_DEAD]   = "dead",
285
        [TARGET_ACTIVE] = "active",
286
};
287

288
DEFINE_STRING_TABLE_LOOKUP(target_state, TargetState);
23,053✔
289

290
static const char* const timer_state_table[_TIMER_STATE_MAX] = {
291
        [TIMER_DEAD]    = "dead",
292
        [TIMER_WAITING] = "waiting",
293
        [TIMER_RUNNING] = "running",
294
        [TIMER_ELAPSED] = "elapsed",
295
        [TIMER_FAILED]  = "failed",
296
};
297

298
DEFINE_STRING_TABLE_LOOKUP(timer_state, TimerState);
2,161✔
299

300
static const char* const unit_dependency_table[_UNIT_DEPENDENCY_MAX] = {
301
        [UNIT_REQUIRES]               = "Requires",
302
        [UNIT_REQUISITE]              = "Requisite",
303
        [UNIT_WANTS]                  = "Wants",
304
        [UNIT_BINDS_TO]               = "BindsTo",
305
        [UNIT_PART_OF]                = "PartOf",
306
        [UNIT_UPHOLDS]                = "Upholds",
307
        [UNIT_REQUIRED_BY]            = "RequiredBy",
308
        [UNIT_REQUISITE_OF]           = "RequisiteOf",
309
        [UNIT_WANTED_BY]              = "WantedBy",
310
        [UNIT_BOUND_BY]               = "BoundBy",
311
        [UNIT_UPHELD_BY]              = "UpheldBy",
312
        [UNIT_CONSISTS_OF]            = "ConsistsOf",
313
        [UNIT_CONFLICTS]              = "Conflicts",
314
        [UNIT_CONFLICTED_BY]          = "ConflictedBy",
315
        [UNIT_BEFORE]                 = "Before",
316
        [UNIT_AFTER]                  = "After",
317
        [UNIT_ON_SUCCESS]             = "OnSuccess",
318
        [UNIT_ON_SUCCESS_OF]          = "OnSuccessOf",
319
        [UNIT_ON_FAILURE]             = "OnFailure",
320
        [UNIT_ON_FAILURE_OF]          = "OnFailureOf",
321
        [UNIT_TRIGGERS]               = "Triggers",
322
        [UNIT_TRIGGERED_BY]           = "TriggeredBy",
323
        [UNIT_PROPAGATES_RELOAD_TO]   = "PropagatesReloadTo",
324
        [UNIT_RELOAD_PROPAGATED_FROM] = "ReloadPropagatedFrom",
325
        [UNIT_PROPAGATES_STOP_TO]     = "PropagatesStopTo",
326
        [UNIT_STOP_PROPAGATED_FROM]   = "StopPropagatedFrom",
327
        [UNIT_JOINS_NAMESPACE_OF]     = "JoinsNamespaceOf",
328
        [UNIT_REFERENCES]             = "References",
329
        [UNIT_REFERENCED_BY]          = "ReferencedBy",
330
        [UNIT_IN_SLICE]               = "InSlice",
331
        [UNIT_SLICE_OF]               = "SliceOf",
332
};
333

334
DEFINE_STRING_TABLE_LOOKUP(unit_dependency, UnitDependency);
64,596✔
335

336
void unit_types_list(void) {
27✔
337
        DUMP_STRING_TABLE(unit_dependency, UnitDependency, _UNIT_DEPENDENCY_MAX);
864✔
338
}
27✔
339

340
static const char* const notify_access_table[_NOTIFY_ACCESS_MAX] = {
341
        [NOTIFY_NONE] = "none",
342
        [NOTIFY_MAIN] = "main",
343
        [NOTIFY_EXEC] = "exec",
344
        [NOTIFY_ALL]  = "all",
345
};
346

347
DEFINE_STRING_TABLE_LOOKUP(notify_access, NotifyAccess);
7,692✔
348

349
static const char* const job_mode_table[_JOB_MODE_MAX] = {
350
        [JOB_FAIL]                 = "fail",
351
        [JOB_LENIENT]              = "lenient",
352
        [JOB_REPLACE]              = "replace",
353
        [JOB_REPLACE_IRREVERSIBLY] = "replace-irreversibly",
354
        [JOB_ISOLATE]              = "isolate",
355
        [JOB_FLUSH]                = "flush",
356
        [JOB_IGNORE_DEPENDENCIES]  = "ignore-dependencies",
357
        [JOB_IGNORE_REQUIREMENTS]  = "ignore-requirements",
358
        [JOB_TRIGGERING]           = "triggering",
359
        [JOB_RESTART_DEPENDENCIES] = "restart-dependencies",
360
};
361

362
DEFINE_STRING_TABLE_LOOKUP(job_mode, JobMode);
7,939✔
363

364
Glyph unit_active_state_to_glyph(UnitActiveState state) {
779✔
365
        static const Glyph map[_UNIT_ACTIVE_STATE_MAX] = {
779✔
366
                [UNIT_ACTIVE]       = GLYPH_BLACK_CIRCLE,
367
                [UNIT_RELOADING]    = GLYPH_CIRCLE_ARROW,
368
                [UNIT_REFRESHING]   = GLYPH_CIRCLE_ARROW,
369
                [UNIT_INACTIVE]     = GLYPH_WHITE_CIRCLE,
370
                [UNIT_FAILED]       = GLYPH_MULTIPLICATION_SIGN,
371
                [UNIT_ACTIVATING]   = GLYPH_BLACK_CIRCLE,
372
                [UNIT_DEACTIVATING] = GLYPH_BLACK_CIRCLE,
373
                [UNIT_MAINTENANCE]  = GLYPH_WHITE_CIRCLE,
374
        };
375

376
        if (state < 0)
779✔
377
                return _GLYPH_INVALID;
378

379
        assert(state < _UNIT_ACTIVE_STATE_MAX);
779✔
380
        return map[state];
779✔
381
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc