Use rustix instead of libc

rustix provides safe alternatives to everything we do with libc and
lets us get rid of a bunch of weird code.

CHANGELOG.md

@@ -11,6 +11,11 @@ Run [`cargo-release`][cr] to publish a release.
 
 ## [Unreleased]
 
+### Changed
+- Depend on rustix instead of libc to get rid of unsafe code (see [GH-24]).
+
+[GH-24]: https://github.com/swsnr/systemd-journal-logger.rs/pull/24
+
 ## [2.0.0] – 2023-10-01
 
 ### Added

Cargo.toml

@@ -17,7 +17,7 @@ rust-version = "1.71"
 # feature unconditionally.  We require std for the set_boxed_logger field in
 # init_with_extra_fields.
 log = { version = "^0.4", features = ["std", "kv_unstable"] }
-libc = "0.2.148"
+rustix = { version = "0.38.19", default-features = false, features = ["std", "fs", "net"] }
 
 [dev-dependencies]
 similar-asserts = "1.5.0"

src/client.rs

@@ -8,11 +8,20 @@
 
 //! A journald client.
 
+use std::fs::File;
 use std::io::prelude::*;
 use std::os::fd::AsFd;
 use std::os::unix::net::UnixDatagram;
 
-use crate::{memfd, socket};
+use rustix::fs::fcntl_add_seals;
+use rustix::fs::memfd_create;
+use rustix::fs::MemfdFlags;
+use rustix::fs::SealFlags;
+use rustix::io::Errno;
+use rustix::net::sendmsg_unix;
+use rustix::net::SendAncillaryBuffer;
+use rustix::net::SendFlags;
+use rustix::net::SocketAddrUnix;
 
 const JOURNALD_PATH: &str = "/run/systemd/journal/socket";
 
@@ -39,7 +48,7 @@ impl JournalClient {
         self.socket
             .send_to(payload, JOURNALD_PATH)
             .or_else(|error| {
-                if Some(libc::EMSGSIZE) == error.raw_os_error() {
+                if Some(Errno::MSGSIZE) == Errno::from_io_error(&error) {
                     self.send_large_payload(payload)
                 } else {
                     Err(error)
@@ -51,11 +60,31 @@ impl JournalClient {
         // If the payload's too large for a single datagram, send it through a memfd, see
         // https://systemd.io/JOURNAL_NATIVE_PROTOCOL/
         // Write the whole payload to a memfd
-        let mut mem = memfd::create_sealable()?;
+        let mut mem: File = memfd_create(
+            "systemd-journal-logger",
+            MemfdFlags::ALLOW_SEALING | MemfdFlags::CLOEXEC,
+        )?
+        .into();
         mem.write_all(payload)?;
         // Fully seal the memfd to signal journald that its backing data won't resize anymore
         // and so is safe to mmap.
-        memfd::seal_fully(mem.as_fd())?;
-        socket::send_one_fd_to(&self.socket, mem.as_fd(), JOURNALD_PATH)
+        fcntl_add_seals(
+            &mem,
+            SealFlags::SEAL | SealFlags::SHRINK | SealFlags::WRITE | SealFlags::GROW,
+        )?;
+        // Send the FD over to journald.
+        let fds = &[mem.as_fd()];
+        let scm_rights = rustix::net::SendAncillaryMessage::ScmRights(fds);
+        let mut buffer = vec![0; scm_rights.size()];
+        let mut buffer = SendAncillaryBuffer::new(&mut buffer);
+        assert!(buffer.push(scm_rights), "Failed to push ScmRights message");
+        let size = sendmsg_unix(
+            &self.socket,
+            &SocketAddrUnix::new(JOURNALD_PATH)?,
+            &[],
+            &mut buffer,
+            SendFlags::NOSIGNAL,
+        )?;
+        Ok(size)
     }
 }

src/lib.rs

@@ -59,6 +59,7 @@
 //! output formats of `journalctl`, e.g. `journalctl --output=json`.
 
 #![deny(warnings, missing_docs, clippy::all)]
+#![forbid(unsafe_code)]
 
 use std::io::prelude::*;
 use std::os::fd::AsFd;
@@ -70,8 +71,6 @@ use log::{Level, Log, Metadata, Record, SetLoggerError};
 
 mod client;
 mod fields;
-mod memfd;
-mod socket;
 
 use fields::*;
 
@@ -364,7 +363,7 @@ impl Log for JournalLog {
         // We can't really handle errors here, so simply discard them.
         // The alternative would be to panic, but a failed logging call should
         // not bring the entire process down.
-        let _ = self.journal_send(record);
+        self.journal_send(record).unwrap();
     }
 
     /// Flush log records.