systemd-run: make sure --nice=, --uid=, --gid=, --setenv= also work in --scope mode

4 files changed, 90 insertions, 12 deletions

diff --git a/man/systemd-run.xml b/man/systemd-run.xml
index 81d41dcc7..8bb587cf7 100644
--- a/man/systemd-run.xml
+++ b/man/systemd-run.xml
@@ -182,9 +182,7 @@ along with systemd; If not, see <http://www.gnu.org/licenses/>.
         <listitem><para>Runs the service process under the UNIX user
         and group. Also see <varname>User=</varname> and
         <varname>Group=</varname> in
-        <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. This
-        option has no effect in conjunction with
-        <option>--scope</option>.</para>
+        <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
         </listitem>
       </varlistentry>
 
@@ -193,9 +191,7 @@ along with systemd; If not, see <http://www.gnu.org/licenses/>.
 
         <listitem><para>Runs the service process with the specified
         nice level. Also see <varname>Nice=</varname> in
-        <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. This
-        option has no effect in conjunction with
-        <option>--scope</option>.</para>
+        <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
         </listitem>
       </varlistentry>
 
@@ -205,9 +201,7 @@ along with systemd; If not, see <http://www.gnu.org/licenses/>.
         <listitem><para>Runs the service process with the specified
         environment variables set. Also see
         <varname>Environment=</varname> in
-        <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. This
-        option has no effect in conjunction with
-        <option>--scope</option>.</para>
+        <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
         </listitem>
       </varlistentry>
 
diff --git a/src/run/run.c b/src/run/run.c
index e71ca7dc3..c6d3aabbd 100644
--- a/src/run/run.c
+++ b/src/run/run.c
@@ -27,6 +27,7 @@
 #include "strv.h"
 #include "build.h"
 #include "unit-name.h"
+#include "env-util.h"
 #include "path-util.h"
 #include "bus-error.h"
 
@@ -231,8 +232,8 @@ static int parse_argv(int argc, char *argv[]) {
                 return -EINVAL;
         }
 
-        if (arg_scope && (arg_remain_after_exit || arg_service_type || arg_exec_user || arg_exec_group || arg_nice_set || arg_environment)) {
-                log_error("--remain-after-exit, --service-type=, --user=, --group=, --nice= and --setenv= are not supported in --scope mode.");
+        if (arg_scope && (arg_remain_after_exit || arg_service_type)) {
+                log_error("--remain-after-exit and --service-type= are not supported in --scope mode.");
                 return -EINVAL;
         }
 
@@ -461,6 +462,7 @@ static int start_transient_scope(
 
         _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
         _cleanup_free_ char *name = NULL;
+        _cleanup_strv_free_ char **env = NULL, **user_env = NULL;
         int r;
 
         assert(bus);
@@ -484,7 +486,73 @@ static int start_transient_scope(
         if (r < 0)
                 return r;
 
-        execvp(argv[0], argv);
+        if (arg_nice_set) {
+                if (setpriority(PRIO_PROCESS, 0, arg_nice) < 0) {
+                        log_error("Failed to set nice level: %m");
+                        return -errno;
+                }
+        }
+
+        if (arg_exec_group) {
+                gid_t gid;
+
+                r = get_group_creds(&arg_exec_group, &gid);
+                if (r < 0) {
+                        log_error("Failed to resolve group %s: %s", arg_exec_group, strerror(-r));
+                        return r;
+                }
+
+                if (setresgid(gid, gid, gid) < 0) {
+                        log_error("Failed to change GID to " GID_FMT ": %m", gid);
+                        return -errno;
+                }
+        }
+
+        if (arg_exec_user) {
+                const char *home, *shell;
+                uid_t uid;
+                gid_t gid;
+
+                r = get_user_creds(&arg_exec_user, &uid, &gid, &home, &shell);
+                if (r < 0) {
+                        log_error("Failed to resolve user %s: %s", arg_exec_user, strerror(-r));
+                        return r;
+                }
+
+                r = strv_extendf(&user_env, "HOME=%s", home);
+                if (r < 0)
+                        return log_oom();
+
+                r = strv_extendf(&user_env, "SHELL=%s", shell);
+                if (r < 0)
+                        return log_oom();
+
+                r = strv_extendf(&user_env, "USER=%s", arg_exec_user);
+                if (r < 0)
+                        return log_oom();
+
+                r = strv_extendf(&user_env, "LOGNAME=%s", arg_exec_user);
+                if (r < 0)
+                        return log_oom();
+
+                if (!arg_exec_group) {
+                        if (setresgid(gid, gid, gid) < 0) {
+                                log_error("Failed to change GID to " GID_FMT ": %m", gid);
+                                return -errno;
+                        }
+                }
+
+                if (setresuid(uid, uid, uid) < 0) {
+                        log_error("Failed to change UID to " UID_FMT ": %m", uid);
+                        return -errno;
+                }
+        }
+
+        env = strv_env_merge(3, environ, user_env, arg_environment);
+        if (!env)
+                return log_oom();
+
+        execvpe(argv[0], argv, env);
         log_error("Failed to execute: %m");
         return -errno;
 }
diff --git a/src/shared/strv.c b/src/shared/strv.c
index 67706dc38..1ef0b26a2 100644
--- a/src/shared/strv.c
+++ b/src/shared/strv.c
@@ -527,3 +527,18 @@ void strv_print(char **l) {
         STRV_FOREACH(s, l)
                 puts(*s);
 }
+
+int strv_extendf(char ***l, const char *format, ...) {
+        va_list ap;
+        char *x;
+        int r;
+
+        va_start(ap, format);
+        r = vasprintf(&x, format, ap);
+        va_end(ap);
+
+        if (r < 0)
+                return -ENOMEM;
+
+        return strv_consume(l, x);
+}
diff --git a/src/shared/strv.h b/src/shared/strv.h
index 618951c5e..2dc2bc6c4 100644
--- a/src/shared/strv.h
+++ b/src/shared/strv.h
@@ -39,6 +39,7 @@ unsigned strv_length(char * const *l) _pure_;
 int strv_extend_strv(char ***a, char **b);
 int strv_extend_strv_concat(char ***a, char **b, const char *suffix);
 int strv_extend(char ***l, const char *value);
+int strv_extendf(char ***l, const char *format, ...);
 int strv_push(char ***l, char *value);
 int strv_consume(char ***l, char *value);