exec: move code executed after fork into exec_child()

This factors out one conditional branch that has grown way too big, and
makes the code more readable by using return statements rather than jump
labels.

1 files changed, 458 insertions, 453 deletions

diff --git a/src/core/execute.c b/src/core/execute.c
index e683fa5e16..0a5914759f 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1223,561 +1223,566 @@ static int build_environment(
         return 0;
 }
 
-int exec_spawn(ExecCommand *command,
-               const ExecContext *context,
-               const ExecParameters *exec_params,
-               ExecRuntime *runtime,
-               pid_t *ret) {
-
-        _cleanup_strv_free_ char **files_env = NULL;
-        int *fds = NULL; unsigned n_fds = 0;
-        int socket_fd;
-        char *line, **argv;
-        pid_t pid;
-        int r;
+static int exec_child(ExecCommand *command,
+                      const ExecContext *context,
+                      const ExecParameters *params,
+                      ExecRuntime *runtime,
+                      char **argv,
+                      int socket_fd,
+                      int *fds, unsigned n_fds,
+                      char **files_env,
+                      int *error) {
+
+        _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
+        const char *username = NULL, *home = NULL, *shell = NULL;
+        unsigned n_dont_close = 0;
+        int dont_close[n_fds + 3];
+        uid_t uid = (uid_t) -1;
+        gid_t gid = (gid_t) -1;
+        int i, err;
 
         assert(command);
         assert(context);
-        assert(ret);
-        assert(exec_params);
-        assert(exec_params->fds || exec_params->n_fds <= 0);
+        assert(params);
+        assert(error);
 
-        if (context->std_input == EXEC_INPUT_SOCKET ||
-            context->std_output == EXEC_OUTPUT_SOCKET ||
-            context->std_error == EXEC_OUTPUT_SOCKET) {
+        rename_process_from_path(command->path);
 
-                if (exec_params->n_fds != 1)
-                        return -EINVAL;
+        /* We reset exactly these signals, since they are the
+         * only ones we set to SIG_IGN in the main daemon. All
+         * others we leave untouched because we set them to
+         * SIG_DFL or a valid handler initially, both of which
+         * will be demoted to SIG_DFL. */
+        default_signals(SIGNALS_CRASH_HANDLER,
+                        SIGNALS_IGNORE, -1);
 
-                socket_fd = exec_params->fds[0];
-        } else {
-                socket_fd = -1;
-                fds = exec_params->fds;
-                n_fds = exec_params->n_fds;
+        if (context->ignore_sigpipe)
+                ignore_signals(SIGPIPE, -1);
+
+        err = reset_signal_mask();
+        if (err < 0) {
+                *error = EXIT_SIGNAL_MASK;
+                return err;
         }
 
-        r = exec_context_load_environment(context, &files_env);
-        if (r < 0) {
-                log_struct_unit(LOG_ERR,
-                           exec_params->unit_id,
-                           "MESSAGE=Failed to load environment files: %s", strerror(-r),
-                           "ERRNO=%d", -r,
-                           NULL);
-                return r;
+        if (params->idle_pipe)
+                do_idle_pipe_dance(params->idle_pipe);
+
+        /* Close sockets very early to make sure we don't
+         * block init reexecution because it cannot bind its
+         * sockets */
+        log_forget_fds();
+
+        if (socket_fd >= 0)
+                dont_close[n_dont_close++] = socket_fd;
+        if (n_fds > 0) {
+                memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
+                n_dont_close += n_fds;
+        }
+        if (runtime) {
+                if (runtime->netns_storage_socket[0] >= 0)
+                        dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
+                if (runtime->netns_storage_socket[1] >= 0)
+                        dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
         }
 
-        argv = exec_params->argv ?: command->argv;
+        err = close_all_fds(dont_close, n_dont_close);
+        if (err < 0) {
+                *error = EXIT_FDS;
+                return err;
+        }
 
-        line = exec_command_line(argv);
-        if (!line)
-                return log_oom();
+        if (!context->same_pgrp)
+                if (setsid() < 0) {
+                        *error = EXIT_SETSID;
+                        return -errno;
+                }
 
-        log_struct_unit(LOG_DEBUG,
-                        exec_params->unit_id,
-                        "EXECUTABLE=%s", command->path,
-                        "MESSAGE=About to execute: %s", line,
-                        NULL);
-        free(line);
+        exec_context_tty_reset(context);
+
+        if (params->confirm_spawn) {
+                char response;
+
+                err = ask_for_confirmation(&response, argv);
+                if (err == -ETIMEDOUT)
+                        write_confirm_message("Confirmation question timed out, assuming positive response.\n");
+                else if (err < 0)
+                        write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
+                else if (response == 's') {
+                        write_confirm_message("Skipping execution.\n");
+                        *error = EXIT_CONFIRM;
+                        return -ECANCELED;
+                } else if (response == 'n') {
+                        write_confirm_message("Failing execution.\n");
+                        *error = 0;
+                        return 0;
+                }
+        }
 
-        pid = fork();
-        if (pid < 0)
-                return -errno;
+        /* If a socket is connected to STDIN/STDOUT/STDERR, we
+         * must sure to drop O_NONBLOCK */
+        if (socket_fd >= 0)
+                fd_nonblock(socket_fd, false);
 
-        if (pid == 0) {
-                _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
-                const char *username = NULL, *home = NULL, *shell = NULL;
-                unsigned n_dont_close = 0;
-                int dont_close[n_fds + 3];
-                uid_t uid = (uid_t) -1;
-                gid_t gid = (gid_t) -1;
-                int i, err;
-
-                /* child */
-
-                rename_process_from_path(command->path);
-
-                /* We reset exactly these signals, since they are the
-                 * only ones we set to SIG_IGN in the main daemon. All
-                 * others we leave untouched because we set them to
-                 * SIG_DFL or a valid handler initially, both of which
-                 * will be demoted to SIG_DFL. */
-                default_signals(SIGNALS_CRASH_HANDLER,
-                                SIGNALS_IGNORE, -1);
-
-                if (context->ignore_sigpipe)
-                        ignore_signals(SIGPIPE, -1);
-
-                err = reset_signal_mask();
+        err = setup_input(context, socket_fd, params->apply_tty_stdin);
+        if (err < 0) {
+                *error = EXIT_STDIN;
+                return err;
+        }
+
+        err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin);
+        if (err < 0) {
+                *error = EXIT_STDOUT;
+                return err;
+        }
+
+        err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin);
+        if (err < 0) {
+                *error = EXIT_STDERR;
+                return err;
+        }
+
+        if (params->cgroup_path) {
+                err = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0);
                 if (err < 0) {
-                        r = EXIT_SIGNAL_MASK;
-                        goto fail_child;
+                        *error = EXIT_CGROUP;
+                        return err;
                 }
+        }
 
-                if (exec_params->idle_pipe)
-                        do_idle_pipe_dance(exec_params->idle_pipe);
+        if (context->oom_score_adjust_set) {
+                char t[16];
 
-                /* Close sockets very early to make sure we don't
-                 * block init reexecution because it cannot bind its
-                 * sockets */
-                log_forget_fds();
+                snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
+                char_array_0(t);
 
-                if (socket_fd >= 0)
-                        dont_close[n_dont_close++] = socket_fd;
-                if (n_fds > 0) {
-                        memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
-                        n_dont_close += n_fds;
-                }
-                if (runtime) {
-                        if (runtime->netns_storage_socket[0] >= 0)
-                                dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
-                        if (runtime->netns_storage_socket[1] >= 0)
-                                dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
+                if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
+                        *error = EXIT_OOM_ADJUST;
+                        return -errno;
                 }
+        }
 
-                err = close_all_fds(dont_close, n_dont_close);
-                if (err < 0) {
-                        r = EXIT_FDS;
-                        goto fail_child;
+        if (context->nice_set)
+                if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
+                        *error = EXIT_NICE;
+                        return -errno;
                 }
 
-                if (!context->same_pgrp)
-                        if (setsid() < 0) {
-                                err = -errno;
-                                r = EXIT_SETSID;
-                                goto fail_child;
-                        }
+        if (context->cpu_sched_set) {
+                struct sched_param param = {
+                        .sched_priority = context->cpu_sched_priority,
+                };
 
-                exec_context_tty_reset(context);
+                err = sched_setscheduler(0,
+                                         context->cpu_sched_policy |
+                                         (context->cpu_sched_reset_on_fork ?
+                                          SCHED_RESET_ON_FORK : 0),
+                                         &param);
+                if (err < 0) {
+                        *error = EXIT_SETSCHEDULER;
+                        return -errno;
+                }
+        }
 
-                if (exec_params->confirm_spawn) {
-                        char response;
-
-                        err = ask_for_confirmation(&response, argv);
-                        if (err == -ETIMEDOUT)
-                                write_confirm_message("Confirmation question timed out, assuming positive response.\n");
-                        else if (err < 0)
-                                write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
-                        else if (response == 's') {
-                                write_confirm_message("Skipping execution.\n");
-                                err = -ECANCELED;
-                                r = EXIT_CONFIRM;
-                                goto fail_child;
-                        } else if (response == 'n') {
-                                write_confirm_message("Failing execution.\n");
-                                err = r = 0;
-                                goto fail_child;
-                        }
+        if (context->cpuset)
+                if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
+                        *error = EXIT_CPUAFFINITY;
+                        return -errno;
                 }
 
-                /* If a socket is connected to STDIN/STDOUT/STDERR, we
-                 * must sure to drop O_NONBLOCK */
-                if (socket_fd >= 0)
-                        fd_nonblock(socket_fd, false);
+        if (context->ioprio_set)
+                if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
+                        *error = EXIT_IOPRIO;
+                        return -errno;
+                }
 
-                err = setup_input(context, socket_fd, exec_params->apply_tty_stdin);
-                if (err < 0) {
-                        r = EXIT_STDIN;
-                        goto fail_child;
+        if (context->timer_slack_nsec != NSEC_INFINITY)
+                if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
+                        *error = EXIT_TIMERSLACK;
+                        return -errno;
                 }
 
-                err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), exec_params->unit_id, exec_params->apply_tty_stdin);
-                if (err < 0) {
-                        r = EXIT_STDOUT;
-                        goto fail_child;
+        if (context->personality != 0xffffffffUL)
+                if (personality(context->personality) < 0) {
+                        *error = EXIT_PERSONALITY;
+                        return -errno;
                 }
 
-                err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), exec_params->unit_id, exec_params->apply_tty_stdin);
+        if (context->utmp_id)
+                utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
+
+        if (context->user) {
+                username = context->user;
+                err = get_user_creds(&username, &uid, &gid, &home, &shell);
                 if (err < 0) {
-                        r = EXIT_STDERR;
-                        goto fail_child;
+                        *error = EXIT_USER;
+                        return err;
                 }
 
-                if (exec_params->cgroup_path) {
-                        err = cg_attach_everywhere(exec_params->cgroup_supported, exec_params->cgroup_path, 0);
+                if (is_terminal_input(context->std_input)) {
+                        err = chown_terminal(STDIN_FILENO, uid);
                         if (err < 0) {
-                                r = EXIT_CGROUP;
-                                goto fail_child;
+                                *error = EXIT_STDIN;
+                                return err;
                         }
                 }
+        }
 
-                if (context->oom_score_adjust_set) {
-                        char t[16];
+#ifdef HAVE_PAM
+        if (params->cgroup_path && context->user && context->pam_name) {
+                err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
+                if (err < 0) {
+                        *error = EXIT_CGROUP;
+                        return err;
+                }
 
-                        snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
-                        char_array_0(t);
 
-                        if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
-                                err = -errno;
-                                r = EXIT_OOM_ADJUST;
-                                goto fail_child;
-                        }
+                err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
+                if (err < 0) {
+                        *error = EXIT_CGROUP;
+                        return err;
                 }
+        }
+#endif
 
-                if (context->nice_set)
-                        if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
-                                err = -errno;
-                                r = EXIT_NICE;
-                                goto fail_child;
-                        }
+        if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
+                char **rt;
 
-                if (context->cpu_sched_set) {
-                        struct sched_param param = {
-                                .sched_priority = context->cpu_sched_priority,
-                        };
+                STRV_FOREACH(rt, context->runtime_directory) {
+                        _cleanup_free_ char *p;
 
-                        r = sched_setscheduler(0,
-                                               context->cpu_sched_policy |
-                                               (context->cpu_sched_reset_on_fork ?
-                                                SCHED_RESET_ON_FORK : 0),
-                                               &param);
-                        if (r < 0) {
-                                err = -errno;
-                                r = EXIT_SETSCHEDULER;
-                                goto fail_child;
+                        p = strjoin(params->runtime_prefix, "/", *rt, NULL);
+                        if (!p) {
+                                *error = EXIT_RUNTIME_DIRECTORY;
+                                return -ENOMEM;
                         }
-                }
 
-                if (context->cpuset)
-                        if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
-                                err = -errno;
-                                r = EXIT_CPUAFFINITY;
-                                goto fail_child;
+                        err = mkdir_safe(p, context->runtime_directory_mode, uid, gid);
+                        if (err < 0) {
+                                *error = EXIT_RUNTIME_DIRECTORY;
+                                return err;
                         }
+                }
+        }
 
-                if (context->ioprio_set)
-                        if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
-                                err = -errno;
-                                r = EXIT_IOPRIO;
-                                goto fail_child;
-                        }
+        if (params->apply_permissions) {
+                err = enforce_groups(context, username, gid);
+                if (err < 0) {
+                        *error = EXIT_GROUP;
+                        return err;
+                }
+        }
 
-                if (context->timer_slack_nsec != NSEC_INFINITY)
-                        if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
-                                err = -errno;
-                                r = EXIT_TIMERSLACK;
-                                goto fail_child;
-                        }
+        umask(context->umask);
 
-                if (context->personality != 0xffffffffUL)
-                        if (personality(context->personality) < 0) {
-                                err = -errno;
-                                r = EXIT_PERSONALITY;
-                                goto fail_child;
-                        }
+#ifdef HAVE_PAM
+        if (params->apply_permissions && context->pam_name && username) {
+                err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
+                if (err < 0) {
+                        *error = EXIT_PAM;
+                        return err;
+                }
+        }
+#endif
 
-                if (context->utmp_id)
-                        utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
+        if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
+                err = setup_netns(runtime->netns_storage_socket);
+                if (err < 0) {
+                        *error = EXIT_NETWORK;
+                        return err;
+                }
+        }
 
-                if (context->user) {
-                        username = context->user;
-                        err = get_user_creds(&username, &uid, &gid, &home, &shell);
-                        if (err < 0) {
-                                r = EXIT_USER;
-                                goto fail_child;
-                        }
+        if (!strv_isempty(context->read_write_dirs) ||
+            !strv_isempty(context->read_only_dirs) ||
+            !strv_isempty(context->inaccessible_dirs) ||
+            context->mount_flags != 0 ||
+            (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
+            context->private_devices ||
+            context->protect_system != PROTECT_SYSTEM_NO ||
+            context->protect_home != PROTECT_HOME_NO) {
+
+                char *tmp = NULL, *var = NULL;
+
+                /* The runtime struct only contains the parent
+                 * of the private /tmp, which is
+                 * non-accessible to world users. Inside of it
+                 * there's a /tmp that is sticky, and that's
+                 * the one we want to use here. */
+
+                if (context->private_tmp && runtime) {
+                        if (runtime->tmp_dir)
+                                tmp = strappenda(runtime->tmp_dir, "/tmp");
+                        if (runtime->var_tmp_dir)
+                                var = strappenda(runtime->var_tmp_dir, "/tmp");
+                }
 
-                        if (is_terminal_input(context->std_input)) {
-                                err = chown_terminal(STDIN_FILENO, uid);
-                                if (err < 0) {
-                                        r = EXIT_STDIN;
-                                        goto fail_child;
-                                }
-                        }
+                err = setup_namespace(
+                                context->read_write_dirs,
+                                context->read_only_dirs,
+                                context->inaccessible_dirs,
+                                tmp,
+                                var,
+                                context->private_devices,
+                                context->protect_home,
+                                context->protect_system,
+                                context->mount_flags);
+                if (err < 0) {
+                        *error = EXIT_NAMESPACE;
+                        return err;
                 }
+        }
 
-#ifdef HAVE_PAM
-                if (exec_params->cgroup_path && context->user && context->pam_name) {
-                        err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, exec_params->cgroup_path, 0644, uid, gid);
-                        if (err < 0) {
-                                r = EXIT_CGROUP;
-                                goto fail_child;
+        if (params->apply_chroot) {
+                if (context->root_directory)
+                        if (chroot(context->root_directory) < 0) {
+                                *error = EXIT_CHROOT;
+                                return -errno;
                         }
 
+                if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
+                        *error = EXIT_CHDIR;
+                        return -errno;
+                }
+        } else {
+                _cleanup_free_ char *d = NULL;
 
-                        err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, exec_params->cgroup_path, 0755, uid, gid);
-                        if (err < 0) {
-                                r = EXIT_CGROUP;
-                                goto fail_child;
-                        }
+                if (asprintf(&d, "%s/%s",
+                             context->root_directory ? context->root_directory : "",
+                             context->working_directory ? context->working_directory : "") < 0) {
+                        *error = EXIT_MEMORY;
+                        return -ENOMEM;
                 }
-#endif
 
-                if (!strv_isempty(context->runtime_directory) && exec_params->runtime_prefix) {
-                        char **rt;
+                if (chdir(d) < 0) {
+                        *error = EXIT_CHDIR;
+                        return -errno;
+                }
+        }
 
-                        STRV_FOREACH(rt, context->runtime_directory) {
-                                _cleanup_free_ char *p;
+        /* We repeat the fd closing here, to make sure that
+         * nothing is leaked from the PAM modules. Note that
+         * we are more aggressive this time since socket_fd
+         * and the netns fds we don#t need anymore. */
+        err = close_all_fds(fds, n_fds);
+        if (err >= 0)
+                err = shift_fds(fds, n_fds);
+        if (err >= 0)
+                err = flags_fds(fds, n_fds, context->non_blocking);
+        if (err < 0) {
+                *error = EXIT_FDS;
+                return err;
+        }
 
-                                p = strjoin(exec_params->runtime_prefix, "/", *rt, NULL);
-                                if (!p) {
-                                        r = EXIT_RUNTIME_DIRECTORY;
-                                        err = -ENOMEM;
-                                        goto fail_child;
-                                }
+        if (params->apply_permissions) {
 
-                                err = mkdir_safe(p, context->runtime_directory_mode, uid, gid);
-                                if (err < 0) {
-                                        r = EXIT_RUNTIME_DIRECTORY;
-                                        goto fail_child;
-                                }
+                for (i = 0; i < _RLIMIT_MAX; i++) {
+                        if (!context->rlimit[i])
+                                continue;
+
+                        if (setrlimit_closest(i, context->rlimit[i]) < 0) {
+                                *error = EXIT_LIMITS;
+                                return -errno;
                         }
                 }
 
-                if (exec_params->apply_permissions) {
-                        err = enforce_groups(context, username, gid);
+                if (context->capability_bounding_set_drop) {
+                        err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
                         if (err < 0) {
-                                r = EXIT_GROUP;
-                                goto fail_child;
+                                *error = EXIT_CAPABILITIES;
+                                return err;
                         }
                 }
 
-                umask(context->umask);
-
-#ifdef HAVE_PAM
-                if (exec_params->apply_permissions && context->pam_name && username) {
-                        err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
+                if (context->user) {
+                        err = enforce_user(context, uid);
                         if (err < 0) {
-                                r = EXIT_PAM;
-                                goto fail_child;
+                                *error = EXIT_USER;
+                                return err;
                         }
                 }
-#endif
-                if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
-                        err = setup_netns(runtime->netns_storage_socket);
-                        if (err < 0) {
-                                r = EXIT_NETWORK;
-                                goto fail_child;
+
+                /* PR_GET_SECUREBITS is not privileged, while
+                 * PR_SET_SECUREBITS is. So to suppress
+                 * potential EPERMs we'll try not to call
+                 * PR_SET_SECUREBITS unless necessary. */
+                if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
+                        if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
+                                *error = EXIT_SECUREBITS;
+                                return -errno;
+                        }
+
+                if (context->capabilities)
+                        if (cap_set_proc(context->capabilities) < 0) {
+                                *error = EXIT_CAPABILITIES;
+                                return -errno;
                         }
-                }
 
-                if (!strv_isempty(context->read_write_dirs) ||
-                    !strv_isempty(context->read_only_dirs) ||
-                    !strv_isempty(context->inaccessible_dirs) ||
-                    context->mount_flags != 0 ||
-                    (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
-                    context->private_devices ||
-                    context->protect_system != PROTECT_SYSTEM_NO ||
-                    context->protect_home != PROTECT_HOME_NO) {
-
-                        char *tmp = NULL, *var = NULL;
-
-                        /* The runtime struct only contains the parent
-                         * of the private /tmp, which is
-                         * non-accessible to world users. Inside of it
-                         * there's a /tmp that is sticky, and that's
-                         * the one we want to use here. */
-
-                        if (context->private_tmp && runtime) {
-                                if (runtime->tmp_dir)
-                                        tmp = strappenda(runtime->tmp_dir, "/tmp");
-                                if (runtime->var_tmp_dir)
-                                        var = strappenda(runtime->var_tmp_dir, "/tmp");
+                if (context->no_new_privileges)
+                        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+                                *error = EXIT_NO_NEW_PRIVILEGES;
+                                return -errno;
                         }
 
-                        err = setup_namespace(
-                                        context->read_write_dirs,
-                                        context->read_only_dirs,
-                                        context->inaccessible_dirs,
-                                        tmp,
-                                        var,
-                                        context->private_devices,
-                                        context->protect_home,
-                                        context->protect_system,
-                                        context->mount_flags);
+#ifdef HAVE_SECCOMP
+                if (context->address_families_whitelist ||
+                    !set_isempty(context->address_families)) {
+                        err = apply_address_families(context);
                         if (err < 0) {
-                                r = EXIT_NAMESPACE;
-                                goto fail_child;
+                                *error = EXIT_ADDRESS_FAMILIES;
+                                return err;
                         }
                 }
 
-                if (exec_params->apply_chroot) {
-                        if (context->root_directory)
-                                if (chroot(context->root_directory) < 0) {
-                                        err = -errno;
-                                        r = EXIT_CHROOT;
-                                        goto fail_child;
-                                }
-
-                        if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
-                                err = -errno;
-                                r = EXIT_CHDIR;
-                                goto fail_child;
-                        }
-                } else {
-                        _cleanup_free_ char *d = NULL;
-
-                        if (asprintf(&d, "%s/%s",
-                                     context->root_directory ? context->root_directory : "",
-                                     context->working_directory ? context->working_directory : "") < 0) {
-                                err = -ENOMEM;
-                                r = EXIT_MEMORY;
-                                goto fail_child;
+                if (context->syscall_whitelist ||
+                    !set_isempty(context->syscall_filter) ||
+                    !set_isempty(context->syscall_archs)) {
+                        err = apply_seccomp(context);
+                        if (err < 0) {
+                                *error = EXIT_SECCOMP;
+                                return err;
                         }
+                }
+#endif
 
-                        if (chdir(d) < 0) {
-                                err = -errno;
-                                r = EXIT_CHDIR;
-                                goto fail_child;
+#ifdef HAVE_SELINUX
+                if (context->selinux_context && use_selinux()) {
+                        err = setexeccon(context->selinux_context);
+                        if (err < 0 && !context->selinux_context_ignore) {
+                                *error = EXIT_SELINUX_CONTEXT;
+                                return err;
                         }
                 }
+#endif
 
-                /* We repeat the fd closing here, to make sure that
-                 * nothing is leaked from the PAM modules. Note that
-                 * we are more aggressive this time since socket_fd
-                 * and the netns fds we don#t need anymore. */
-                err = close_all_fds(fds, n_fds);
-                if (err >= 0)
-                        err = shift_fds(fds, n_fds);
-                if (err >= 0)
-                        err = flags_fds(fds, n_fds, context->non_blocking);
-                if (err < 0) {
-                        r = EXIT_FDS;
-                        goto fail_child;
+#ifdef HAVE_APPARMOR
+                if (context->apparmor_profile && use_apparmor()) {
+                        err = aa_change_onexec(context->apparmor_profile);
+                        if (err < 0 && !context->apparmor_profile_ignore) {
+                                *error = EXIT_APPARMOR_PROFILE;
+                                return err;
+                        }
                 }
+#endif
+        }
 
-                if (exec_params->apply_permissions) {
+        err = build_environment(context, n_fds, params->watchdog_usec, home, username, shell, &our_env);
+        if (err < 0) {
+                *error = EXIT_MEMORY;
+                return err;
+        }
 
-                        for (i = 0; i < _RLIMIT_MAX; i++) {
-                                if (!context->rlimit[i])
-                                        continue;
+        final_env = strv_env_merge(5,
+                                   params->environment,
+                                   our_env,
+                                   context->environment,
+                                   files_env,
+                                   pam_env,
+                                   NULL);
+        if (!final_env) {
+                *error = EXIT_MEMORY;
+                return -ENOMEM;
+        }
 
-                                if (setrlimit_closest(i, context->rlimit[i]) < 0) {
-                                        err = -errno;
-                                        r = EXIT_LIMITS;
-                                        goto fail_child;
-                                }
-                        }
+        final_argv = replace_env_argv(argv, final_env);
+        if (!final_argv) {
+                *error = EXIT_MEMORY;
+                return -ENOMEM;
+        }
 
-                        if (context->capability_bounding_set_drop) {
-                                err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
-                                if (err < 0) {
-                                        r = EXIT_CAPABILITIES;
-                                        goto fail_child;
-                                }
-                        }
+        final_env = strv_env_clean(final_env);
 
-                        if (context->user) {
-                                err = enforce_user(context, uid);
-                                if (err < 0) {
-                                        r = EXIT_USER;
-                                        goto fail_child;
-                                }
-                        }
+        if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
+                _cleanup_free_ char *line;
 
-                        /* PR_GET_SECUREBITS is not privileged, while
-                         * PR_SET_SECUREBITS is. So to suppress
-                         * potential EPERMs we'll try not to call
-                         * PR_SET_SECUREBITS unless necessary. */
-                        if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
-                                if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
-                                        err = -errno;
-                                        r = EXIT_SECUREBITS;
-                                        goto fail_child;
-                                }
+                line = exec_command_line(final_argv);
+                if (line) {
+                        log_open();
+                        log_struct_unit(LOG_DEBUG,
+                                        params->unit_id,
+                                        "EXECUTABLE=%s", command->path,
+                                        "MESSAGE=Executing: %s", line,
+                                        NULL);
+                        log_close();
+                }
+        }
+        execve(command->path, final_argv, final_env);
+        *error = EXIT_EXEC;
+        return -errno;
+}
 
-                        if (context->capabilities)
-                                if (cap_set_proc(context->capabilities) < 0) {
-                                        err = -errno;
-                                        r = EXIT_CAPABILITIES;
-                                        goto fail_child;
-                                }
+int exec_spawn(ExecCommand *command,
+               const ExecContext *context,
+               const ExecParameters *params,
+               ExecRuntime *runtime,
+               pid_t *ret) {
 
-                        if (context->no_new_privileges)
-                                if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
-                                        err = -errno;
-                                        r = EXIT_NO_NEW_PRIVILEGES;
-                                        goto fail_child;
-                                }
+        _cleanup_strv_free_ char **files_env = NULL;
+        int *fds = NULL; unsigned n_fds = 0;
+        char *line, **argv;
+        int socket_fd;
+        pid_t pid;
+        int err;
 
-#ifdef HAVE_SECCOMP
-                        if (context->address_families_whitelist ||
-                            !set_isempty(context->address_families)) {
-                                err = apply_address_families(context);
-                                if (err < 0) {
-                                        r = EXIT_ADDRESS_FAMILIES;
-                                        goto fail_child;
-                                }
-                        }
+        assert(command);
+        assert(context);
+        assert(ret);
+        assert(params);
+        assert(params->fds || params->n_fds <= 0);
 
-                        if (context->syscall_whitelist ||
-                            !set_isempty(context->syscall_filter) ||
-                            !set_isempty(context->syscall_archs)) {
-                                err = apply_seccomp(context);
-                                if (err < 0) {
-                                        r = EXIT_SECCOMP;
-                                        goto fail_child;
-                                }
-                        }
-#endif
+        if (context->std_input == EXEC_INPUT_SOCKET ||
+            context->std_output == EXEC_OUTPUT_SOCKET ||
+            context->std_error == EXEC_OUTPUT_SOCKET) {
 
-#ifdef HAVE_SELINUX
-                        if (context->selinux_context && use_selinux()) {
-                                err = setexeccon(context->selinux_context);
-                                if (err < 0 && !context->selinux_context_ignore) {
-                                        r = EXIT_SELINUX_CONTEXT;
-                                        goto fail_child;
-                                }
-                        }
-#endif
+                if (params->n_fds != 1)
+                        return -EINVAL;
 
-#ifdef HAVE_APPARMOR
-                        if (context->apparmor_profile && use_apparmor()) {
-                                err = aa_change_onexec(context->apparmor_profile);
-                                if (err < 0 && !context->apparmor_profile_ignore) {
-                                        r = EXIT_APPARMOR_PROFILE;
-                                        goto fail_child;
-                                }
-                        }
-#endif
-                }
+                socket_fd = params->fds[0];
+        } else {
+                socket_fd = -1;
+                fds = params->fds;
+                n_fds = params->n_fds;
+        }
 
-                err = build_environment(context, n_fds, exec_params->watchdog_usec, home, username, shell, &our_env);
-                if (r < 0) {
-                        r = EXIT_MEMORY;
-                        goto fail_child;
-                }
+        err = exec_context_load_environment(context, &files_env);
+        if (err < 0) {
+                log_struct_unit(LOG_ERR,
+                           params->unit_id,
+                           "MESSAGE=Failed to load environment files: %s", strerror(-err),
+                           "ERRNO=%d", -err,
+                           NULL);
+                return err;
+        }
 
-                final_env = strv_env_merge(5,
-                                           exec_params->environment,
-                                           our_env,
-                                           context->environment,
-                                           files_env,
-                                           pam_env,
-                                           NULL);
-                if (!final_env) {
-                        err = -ENOMEM;
-                        r = EXIT_MEMORY;
-                        goto fail_child;
-                }
+        argv = params->argv ?: command->argv;
 
-                final_argv = replace_env_argv(argv, final_env);
-                if (!final_argv) {
-                        err = -ENOMEM;
-                        r = EXIT_MEMORY;
-                        goto fail_child;
-                }
+        line = exec_command_line(argv);
+        if (!line)
+                return log_oom();
 
-                final_env = strv_env_clean(final_env);
-
-                if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
-                        line = exec_command_line(final_argv);
-                        if (line) {
-                                log_open();
-                                log_struct_unit(LOG_DEBUG,
-                                                exec_params->unit_id,
-                                                "EXECUTABLE=%s", command->path,
-                                                "MESSAGE=Executing: %s", line,
-                                                NULL);
-                                log_close();
-                                free(line);
-                                line = NULL;
-                        }
-                }
-                execve(command->path, final_argv, final_env);
-                err = -errno;
-                r = EXIT_EXEC;
+        log_struct_unit(LOG_DEBUG,
+                        params->unit_id,
+                        "EXECUTABLE=%s", command->path,
+                        "MESSAGE=About to execute: %s", line,
+                        NULL);
+        free(line);
+
+        pid = fork();
+        if (pid < 0)
+                return -errno;
+
+        if (pid == 0) {
+                int r;
 
-        fail_child:
+                err = exec_child(command,
+                                 context,
+                                 params,
+                                 runtime,
+                                 argv,
+                                 socket_fd,
+                                 fds, n_fds,
+                                 files_env,
+                                 &r);
                 if (r != 0) {
                         log_open();
                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
@@ -1794,7 +1799,7 @@ int exec_spawn(ExecCommand *command,
         }
 
         log_struct_unit(LOG_DEBUG,
-                        exec_params->unit_id,
+                        params->unit_id,
                         "MESSAGE=Forked %s as "PID_FMT,
                         command->path, pid,
                         NULL);
@@ -1804,8 +1809,8 @@ int exec_spawn(ExecCommand *command,
          * outside of the cgroup) and in the parent (so that we can be
          * sure that when we kill the cgroup the process will be
          * killed too). */
-        if (exec_params->cgroup_path)
-                cg_attach(SYSTEMD_CGROUP_CONTROLLER, exec_params->cgroup_path, pid);
+        if (params->cgroup_path)
+                cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
 
         exec_status_start(&command->exec_status, pid);