shared, core: do not always accept numbers in string lookups

The behaviour of the common name##_from_string conversion is surprising.
It accepts not only the strings from name##_table but also any number
that falls within the range of the table. The order of items in most of
our tables is an internal affair. It should not be visible to the user.

I know of a case where the surprising numeric conversion leads to a crash.

We will allow the direct numeric conversion only for the tables where the
mapping of strings to numeric values has an external meaning. This holds
for the following lookup tables:
 - netlink_family, ioprio_class, ip_tos, sched_policy - their numeric
   values are stable as they are defined by the Linux kernel interface.
 - log_level, log_facility_unshifted - the well-known syslog interface.

We allow the user to use numeric values whose string names systemd does
not know. For instance, the user may want to test a new kernel featuring
a scheduling policy that did not exist when his systemd version was
released. A slightly unpleasant effect of this is that the
name##_to_string conversion cannot return pointers to constant strings
anymore. The strings have to be allocated on demand and freed by the
caller.

3 files changed, 54 insertions, 18 deletions

diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
index ed9784b58f..2010241e6a 100644
--- a/src/core/dbus-manager.c
+++ b/src/core/dbus-manager.c
@@ -352,17 +352,21 @@ static int bus_manager_set_log_target(DBusMessageIter *i, const char *property,
 }
 
 static int bus_manager_append_log_level(DBusMessageIter *i, const char *property, void *data) {
-        const char *t;
+        char *t;
+        int r;
 
         assert(i);
         assert(property);
 
-        t = log_level_to_string(log_get_max_level());
+        r = log_level_to_string_alloc(log_get_max_level(), &t);
+        if (r < 0)
+                return r;
 
         if (!dbus_message_iter_append_basic(i, DBUS_TYPE_STRING, &t))
-                return -ENOMEM;
+                r = -ENOMEM;
 
-        return 0;
+        free(t);
+        return r;
 }
 
 static int bus_manager_set_log_level(DBusMessageIter *i, const char *property, void *data) {
diff --git a/src/core/execute.c b/src/core/execute.c
index e502c2490f..e236d38e0f 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1769,21 +1769,37 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
                 if (c->rlimit[i])
                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
 
-        if (c->ioprio_set)
+        if (c->ioprio_set) {
+                char *class_str;
+                int r;
+
+                r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
+                if (r < 0)
+                        class_str = NULL;
                 fprintf(f,
                         "%sIOSchedulingClass: %s\n"
                         "%sIOPriority: %i\n",
-                        prefix, ioprio_class_to_string(IOPRIO_PRIO_CLASS(c->ioprio)),
+                        prefix, strna(class_str),
                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
+                free(class_str);
+        }
 
-        if (c->cpu_sched_set)
+        if (c->cpu_sched_set) {
+                char *policy_str;
+                int r;
+
+                r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
+                if (r < 0)
+                        policy_str = NULL;
                 fprintf(f,
                         "%sCPUSchedulingPolicy: %s\n"
                         "%sCPUSchedulingPriority: %i\n"
                         "%sCPUSchedulingResetOnFork: %s\n",
-                        prefix, sched_policy_to_string(c->cpu_sched_policy),
+                        prefix, strna(policy_str),
                         prefix, c->cpu_sched_priority,
                         prefix, yes_no(c->cpu_sched_reset_on_fork));
+                free(policy_str);
+	}
 
         if (c->cpuset) {
                 fprintf(f, "%sCPUAffinity:", prefix);
@@ -1818,12 +1834,26 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
-            c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE)
+            c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
+                char *fac_str, *lvl_str;
+                int r;
+
+                r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
+                if (r < 0)
+                        fac_str = NULL;
+
+                r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
+                if (r < 0)
+                        lvl_str = NULL;
+
                 fprintf(f,
                         "%sSyslogFacility: %s\n"
                         "%sSyslogLevel: %s\n",
-                        prefix, log_facility_unshifted_to_string(c->syslog_priority >> 3),
-                        prefix, log_level_to_string(LOG_PRI(c->syslog_priority)));
+                        prefix, strna(fac_str),
+                        prefix, strna(lvl_str));
+                free(lvl_str);
+                free(fac_str);
+        }
 
         if (c->capabilities) {
                 char *t;
diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
index 2504d730dc..5803044178 100644
--- a/src/core/load-fragment.c
+++ b/src/core/load-fragment.c
@@ -616,7 +616,8 @@ int config_parse_exec_io_class(
         assert(rvalue);
         assert(data);
 
-        if ((x = ioprio_class_from_string(rvalue)) < 0) {
+        x = ioprio_class_from_string(rvalue);
+        if (x < 0) {
                 log_error("[%s:%u] Failed to parse IO scheduling class, ignoring: %s", filename, line, rvalue);
                 return 0;
         }
@@ -675,7 +676,8 @@ int config_parse_exec_cpu_sched_policy(
         assert(rvalue);
         assert(data);
 
-        if ((x = sched_policy_from_string(rvalue)) < 0) {
+        x = sched_policy_from_string(rvalue);
+        if (x < 0) {
                 log_error("[%s:%u] Failed to parse CPU scheduling policy, ignoring: %s", filename, line, rvalue);
                 return 0;
         }
@@ -1452,11 +1454,11 @@ int config_parse_ip_tos(
         assert(rvalue);
         assert(data);
 
-        if ((x = ip_tos_from_string(rvalue)) < 0)
-                if (safe_atoi(rvalue, &x) < 0) {
-                        log_error("[%s:%u] Failed to parse IP TOS value, ignoring: %s", filename, line, rvalue);
-                        return 0;
-                }
+        x = ip_tos_from_string(rvalue);
+        if (x < 0) {
+                log_error("[%s:%u] Failed to parse IP TOS value, ignoring: %s", filename, line, rvalue);
+                return 0;
+        }
 
         *ip_tos = x;
         return 0;