summaryrefslogtreecommitdiffstats
path: root/src/partition/repart.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Simplify random number selectionJason A. Donenfeld2022-05-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We currently have a convoluted and complex selection of which random numbers to use. We can simplify this down to two functions that cover all of our use cases: 1) Randomness for crypto: this one needs to wait until the RNG is initialized. So it uses getrandom(0). If that's not available, it polls on /dev/random, and then reads from /dev/urandom. This function returns whether or not it was successful, as before. 2) Randomness for other things: this one uses getrandom(GRND_INSECURE). If it's not available it uses getrandom(GRND_NONBLOCK). And if that would block, then it falls back to /dev/urandom. And if /dev/urandom isn't available, it uses the fallback code. It never fails and doesn't return a value. These two cases match all the uses of randomness inside of systemd. I would prefer to make both of these return void, and get rid of the fallback code, and simply assert in the incredibly unlikely case that /dev/urandom doesn't exist. But Luca disagrees, so this commit attempts to instead keep case (1) returning a return value, which all the callers already check, and fix the fallback code in (2) to be less bad than before. For the less bad fallback code for (2), we now use auxval and some timestamps, together with various counters representing the invocation, hash it all together and provide the output. Provided that AT_RANDOM is secure, this construction is probably okay too, though notably it doesn't have any forward secrecy. Fortunately, it's only used by random_bytes() and not by crypto_random_bytes().
* basic: split out dev_t related calls into new devno-util.[ch]Lennart Poettering2022-04-131-2/+2
| | | | | | | | | | | | | | No actual code changes, just splitting out of some dev_t handling related calls from stat-util.[ch], they are quite a number already, and deserve their own module now I think. Also, try to settle on the name "devnum" as the name for the concept, instead of "devno" or "dev" or "devid". "devnum" is the name exported in udev APIs, hence probably best to stick to that. (this just renames a few symbols to "devum", local variables are left untouched, to make the patch not too invasive) No actual code changes.
* repart: use sd_device_open()Yu Watanabe2022-04-101-39/+46
| | | | Then, we can safely open devices even if symlinks are not yet created by udevd.
* Move path_simplify_and_warn() to new shared/parse-helpers.cZbigniew Jędrzejewski-Szmek2022-04-071-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a high-level function, and it belongs in libsystemd-shared. This way we don't end up linking a separate copy into various binaries. It would even end up in libsystemd, where it is not needed. (Maybe it'd be removed in some optimization phase, but it's better to not rely on that.) $ grep -l -r -a 'path is not absolute%s' build/ build/libnss_systemd.so.2 build/pam_systemd_home.so build/test-dlopen build/src/basic/libbasic.a.p/path-util.c.o build/src/basic/libbasic.a build/src/shared/libsystemd-shared-249.so build/test-bus-error build/libnss_mymachines.so.2 build/pam_systemd.so build/libnss_resolve.so.2 build/libnss_myhostname.so.2 build/libsystemd.so.0.32.0 build/libudev.so.1.7.2 $ grep -l -r -a 'path is not absolute%s' build/ build/src/shared/libsystemd-shared-251.a.p/parse-helpers.c.o build/src/shared/libsystemd-shared-251.a build/src/shared/libsystemd-shared-251.so No functional change.
* strv: declare iterator of FOREACH_STRING() in the loopZbigniew Jędrzejewski-Szmek2022-03-231-2/+1
| | | | | | | | | | | Same idea as 03677889f0ef42cdc534bf3b31265a054b20a354. No functional change intended. The type of the iterator is generally changed to be 'const char*' instead of 'char*'. Despite the type commonly used, modifying the string was not allowed. I adjusted the naming of some short variables for clarity and reduced the scope of some variable declarations in code that was being touched anyway.
* strv: make iterator in STRV_FOREACH() declaread in the loopYu Watanabe2022-03-191-3/+0
| | | | This also avoids multiple evaluations in STRV_FOREACH_BACKWARDS()
* list: make LIST_FOREACH() and LIST_FOREACH_BACKWARDS() saferYu Watanabe2022-03-191-1/+1
|
* list: declare iterator of LIST_FOREACH() in the loopYu Watanabe2022-03-191-30/+4
|
* repart: use assert() when no state is changedYu Watanabe2022-03-171-4/+4
|
* cryptenroll: add support for TPM2 pinGrigori Goronzy2022-03-151-1/+1
| | | | | | | | Add support for PIN enrollment with TPM2. A new "tpm2-pin" field is introduced into metadata to signal that the policy needs to include a PIN. v2: fix tpm2_make_luks2_json in sd-repart
* tpm2: support policies with PINGrigori Goronzy2022-03-151-1/+1
| | | | | | | | | | | Modify TPM2 authentication policy to optionally include an authValue, i.e. a password/PIN. We use the "PIN" terminology since it's used by other systems such as Windows, even though the PIN is not necessarily numeric. The pin is hashed via SHA256 to allow for arbitrary length PINs. v2: fix tpm2_seal in sd-repart v3: applied review feedback
* glyph-util: add new glyphs for up/down arrowsLennart Poettering2022-02-161-2/+2
|
* sd128: export sd_id128_to_uuid_string()Lennart Poettering2022-02-141-11/+11
| | | | | | | | | We expose various other forms of UUID helpers already, i.e. SD_ID128_UUID_FORMAT_STR and SD_ID128_MAKE_UUID_STR(), and we parse UUIDs, hence add a high-level helper for formatting UUIDs too. This doesn't add any new code, it just moves some helpers id128-util.[ch] → sd-id128.[ch], to make them public.
* repart: fix sector size handlingLennart Poettering2022-02-081-80/+132
| | | | | | | | | | | | | | | | | This queries the sector size from libfdisk instead of assuming 512, and uses that when converting from bytes to the offset/size values libfdisk expects. This is an alternative to Tom Yan's #21823, but prefers using libfdisk's own ideas of the sector size instead of going directly to the backing device via ioctls. (libfdisk can after all also operate on regular files, where the sector size concept doesn't necessarily apply the same way.) This also makes the "grain" variable, i.e. how we'll align the partitions. Previously this was hardcoded to 4K, and that still will be the minimum grain we use, but should the sector size be larger than that we'll use the next multiple of the sector size instead.
* repart: use real disk start/end for bar productionTom Yan2021-12-201-8/+6
| | | | | | | Partitions are not always within our aligned scope. Bar printing involves foreign partitions as well. Fixes #21817.
* repart: port to our home-grown hmac_sha256Kevin Kuehler2021-11-301-15/+8
| | | | | | | | | | | | This reduces dependencies. The speed of the code here is uimportant, because we hash only a tiny amount of input data. Debian and Ubuntu currently build without repart, see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976959 > repart requires openssl and so far I tried to avoid linking against > both gnutls and openssl. Co-authored-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
* tree-wide: fix typoYu Watanabe2021-11-301-1/+1
|
* repart,homed: split out disk cleanup macros into generic headerLennart Poettering2021-11-251-6/+1
|
* repart: fix free area calculations for unaligned partitionsLennart Poettering2021-11-091-5/+8
| | | | | | To properly detect how much space we have to distribute we need to take into account that both the partition offset and the partition size aren't aligned.
* repart: don't distribute space after unaligned partitionsLennart Poettering2021-11-091-3/+5
| | | | | | | | | | | | | | | | | | | | | If we operate on a disk that has a pre-existing unaligned partition (i.e. one that doesn't start on multiple of 4K, or doesn't have a size of multiple 4K), then the amount of space after it to distribute among partitions isn't a multiple of 4K either. So far we might end up passing the remaining fraction to any partition that wanted it, which was usually the first one after it that is newly defined. This then confused the later placement algorithm, since it assumed all partitions we newly allocate were properly aligned but by being extended by the fractional space they wouldn't be anymore. Let's hence fix that by ensuring we never pass space to later partitions so that things wouldn't be aligned anymore. Anything that is left-over then at the very end (i.e. typically exactly the remaining fraction) is added as padding to the existing, unaligned partition, so that it can't confuse anyone. Fixes: #20622
* repart: simplify stat machine we mostly go through linearlyLennart Poettering2021-11-091-8/+4
|
* repart: use LESS_BY() moreLennart Poettering2021-11-091-14/+3
|
* homework,repart: turn on cryptsetup logging before we have a contextLennart Poettering2021-10-291-0/+4
| | | | | | | | | | Otherwise we'll miss the log message from allocation of the context. We already made this change in most of our tools that interface with libcryptsetup, but we forgot two. As suggested: https://github.com/systemd/systemd/pull/21135#discussion_r738287504
* Merge pull request #20937 from poettering/sync-splitYu Watanabe2021-10-061-1/+3
|\ | | | | split up a few files in src/basic/
| * basic: spit out chase_symlinks() from fs-util.[ch] → chase-symlinks.[ch]Lennart Poettering2021-10-051-0/+1
| |
| * basic: split out glyph/emoji related calls from locale-util.[ch] into ↵Lennart Poettering2021-10-051-1/+1
| | | | | | | | | | | | | | | | glyph-util.[ch] These functions are used pretty much independently of locale, i.e. the only info relevant is whether th locale is UTF-8 or not. Hence let's give this its own pair of .c/.h files.
| * basic: split out sync() family of calls from fs-util.[ch] into new c/h fileLennart Poettering2021-10-051-0/+1
| | | | | | | | No changes in code, just some splitting out.
* | repart: use right error variableLennart Poettering2021-10-051-2/+2
|/
* Merge pull request #20738 from mrc0mmand/ci-llvm-13Yu Watanabe2021-09-161-1/+2
|\ | | | | ci: build with clang-13
| * repart: mark an assert()-only variable as unusedFrantisek Sumsal2021-09-151-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | otherwise compilation with -Db_ndebug=true complains about a set-but-not-used variable: ``` ../src/partition/repart.c:907:33: error: variable 'left' set but not used [-Werror,-Wunused-but-set-variable] uint64_t start, left; ^ 1 error generated. ```
* | Fix error building repart with no libcryptsetup (#20739)Marcus Harrison2021-09-151-0/+5
|/
* tpm2: support RSA primary keys as fallback if TPM2 devices don't support ECCLennart Poettering2021-09-131-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | Previously, we hardcoded use of ECC as primary keys, since they are much faster (i.e. saving multiple seconds) to do TPM2 operations with. Alas, not all TPM2 chips appear to support ECC. Bummer. Let's hence add a fallback logic: if we can't create an ECC primary key, use an RSA key, and store that fact away. AFIU the security guarantees should be roughly the same, it's just that RSA primary keys is so much slower to work with than ECC. The primary key algorithm is used is stored in the JSON header of LUKS disks, in a new field. If the field is absent we assume to use ECC, to provide full compatibility with old systemd versions. The primary key algorithm is stored in a new field in the credentials file format (in fact, a previously unused zero space is used), too. Hopefully, this should ensure that TPM2 support will "just work" on more systems. Fixes: #20361
* repart: Support volatile-root for finding the root partitionKristian Klausen2021-09-011-12/+29
| | | | | | | | | The automatic logic can't always find the original root partition (ex: if the rootfs is copied to a ext4 fs backed by zram in the initramfs), so we want to support "/run/systemd/volatile-root" which is a symlink to the original root partition. Fix #20610
* tree-wide: port everything over to new sd-id128 compund literal blissLennart Poettering2021-08-201-10/+5
|
* tree-wide: port things over to FORMAT_PROC_FD_PATH()Lennart Poettering2021-08-191-11/+5
|
* shared/copy: add a new flag COPY_ALL_XATTRSAndrej Lajovic2021-08-111-3/+3
| | | | | | | | When the flag COPY_ALL_XATTRS is set, it causes the complete set of xattrs to be copied. If the flag is unset, only xattrs from the "user" namespace are copied. Fixes #17178.
* Drop the text argument from assert_not_reached()Zbigniew Jędrzejewski-Szmek2021-08-031-1/+1
| | | | | | | | | | | | | | | | | In general we almost never hit those asserts in production code, so users see them very rarely, if ever. But either way, we just need something that users can pass to the developers. We have quite a few of those asserts, and some have fairly nice messages, but many are like "WTF?" or "???" or "unexpected something". The error that is printed includes the file location, and function name. In almost all functions there's at most one assert, so the function name alone is enough to identify the failure for a developer. So we don't get much extra from the message, and we might just as well drop them. Dropping them makes our code a tiny bit smaller, and most importantly, improves development experience by making it easy to insert such an assert in the code without thinking how to phrase the argument.
* tpm2-util: auto-detect supported PCR banksLennart Poettering2021-07-301-2/+3
| | | | | | | | | | | | | | | | | | | Previously, we'd encode PCR policies strictly with the SHA256 PCR bank set. However, as it appears not all hw implement those. Sad. Let's add some minimal logic to auto-detect supported PCR banks: if SHA256 is supported, use that. But if not, automatically fall back to SHA1. This then changes both the LUKS code, and the credentials code to serialize the selected bank, along with the rest of the data in order to make this robust. This extends the LUK2 JSON metadata in a compatible way. The credentials encryption format is modified in an incompatible way however, but given that this is not part of any official release should be OK. Fixes: #20134
* tree-wide: add FORMAT_BYTES()Zbigniew Jędrzejewski-Szmek2021-07-091-39/+31
|
* Merge pull request #20163 from poettering/repart-root-fixLennart Poettering2021-07-081-53/+3
|\ | | | | repart: drop duplicate handling of /sysroot/ prefix
| * repart: don't prefix /sysroot/ twiceLennart Poettering2021-07-081-53/+3
| | | | | | | | | | | | | | | | | | | | | | For some reason I first commited a73b2ad041469bf20e3771725dcf70069451e116 and then 8f47e32a3eefa1a366510b5d752875dd56bd7708. But the latter makes the former obsolete and causes us to suffix paths twice. Let's hence revert a73b2ad041469bf20e3771725dcf70069451e116 and stick to 8f47e32a3eefa1a366510b5d752875dd56bd7708 as the latter is the ore generic solution of the two.
* | repart: when we can't fit the partitions in, report needed disk size current ↵Lennart Poettering2021-07-081-9/+23
|/ | | | | | | | | | | | disk size This improves error output in repart if we can't fit the defined partitions into the disk image. With this change we'll now show not only the disk size we need (as before), but also the current one, as well as the largest free area on disk. This should make it a bit easier to debug disk space issues that repart runs into.
* tree-wide: fix "the the" and "a a"Yu Watanabe2021-06-301-1/+1
|
* tree-wide: make specifier expansion --root= awareLennart Poettering2021-06-241-5/+5
| | | | | | | | | | | | | | | | | | | | | | This fixes repart's, systemctl's, sysusers' and tmpfiles' specifier expansion to honour the root dir specified with --root=. This is relevant for specifiers such as %m, %o, … which are directly sourced from files on disk. This doesn't try to be overly smart: specifiers referring to runtime concepts (i.e. boot ID, architecture, hostname) rather than files on the medium are left as is. There's certainly a point to be made that they should fail in case --root= is specified, but I am not entirely convinced about that, and it's certainly something we can look into later if there's reason to. I wondered for a while how to hook this up best, but given that quite a large number of specifiers resolve to data from files on disks, and most of our tools needs this, I ultimately decided to make the root dir a first class parameter to specifier_printf(). Replaces: #16187 Fixes: #16183
* repart: make No-Auto GPT partition flag configurable tooLennart Poettering2021-06-181-1/+15
| | | | | | | | | | | | | | This is useful for provisioning initially empty secondary A/B root file systems. We don't want those to ever be considered for automatic mounting, for example in "systemd-nspawn --image=", hence we should create them with the No-Auto flag turned on. Once a file system image is dropped into the partition the flag may be turned off by the updater tool, so that it is considered from then on. Thew new option for this is called NoAuto. I dislike negated options like this, but this is taken from the naming in the spec, which in turn inherited the name from the same flag for Microsoft Data Partitions. To minimize confusion, let's stick to the name hence.
* basic/efivars: replace dynanamic creation of efivar names with static stringsZbigniew Jędrzejewski-Szmek2021-06-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Creating those string dynamically at runtime is slow and unnecessary. Let's use static strings with a bit of macro magic and the let the compiler coalesce as much as possible. $ size build/src/shared/libsystemd-shared-248.so{.old,} text data bss dec hex filename 2813453 94572 4584 2912609 2c7161 build/src/shared/libsystemd-shared-248.so.old 2812309 94564 4584 2911457 2c6ce1 build/src/shared/libsystemd-shared-248.so A nice side-effect is that the same form is used everywhere, so it's easier to figure out all variables that are used, and where each specific variable is used. C.f. 2b0445262ad9be2a9bf49956ab8e886ea2e48a0a. Note: 'const char *foo = alloca(…);' seems OK. Our coding style document and alloca(3) only warn against using alloca() in function invocations. Declaring both stack variable and alloca at the same time should be fine: no matter in which order they happen, i.e. if the pointer variable is above the contents, or the contents are above the pointer, or even if the pointer is elided by the compiler, everything should be fine.
* tree-wide: add missing whitespace at the end of commentsYu Watanabe2021-06-151-1/+1
|
* repart: show partitions we don't grow/create as "unchanged"Lennart Poettering2021-06-141-1/+1
| | | | | | The previous string was "unknown", but that's wrong, because we *do* know what we are going to do with those partitions: we leave them unmodified, hence say "unchanged" in the output, to be clearer.
* repart: align all sizes in table to the rightLennart Poettering2021-06-141-1/+6
|
* repart: resolve $TMP specifiers tooLennart Poettering2021-05-261-10/+5
| | | | | | This might be useful for CopyFiles=, to reference some subdir of $TMP in a generic way. This allows us to use the new common system_and_tmp_specifier_table[].
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-11 13:19:13 +0100