summaryrefslogtreecommitdiffstats
path: root/src/shared/dissect-image.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* gpt-auto-generator: "translate" errno codes into proper messagesZbigniew Jędrzejewski-Szmek2023-04-181-0/+1
| | | | | | | | | | | | E.g. in logs on jammy-ppc64el in https://github.com/systemd/systemd/pull/27294: Apr 16 17:42:50 H systemd-gpt-auto-generator[300]: Failed to dissect partition table of block device /dev/sda: No message of desired type Apr 16 17:42:50 H (sd-execu[295]: /usr/lib/systemd/system-generators/systemd-gpt-auto-generator failed with exit status 1. ee0e6e476e61d4baa2a18e241d212753e75003bf made this particular condition not an error. But for other errnos we want to print a better message too. dissect_loop_device_and_warn() already does this, but it always prints the error at error level. We want to suppress some of the errors, so let's make the print helper public and do the error suppression in the caller.
* dissect: disallow empty partition tablesLennart Poettering2023-04-051-0/+1
| | | | | | | | If we don't find a single useful partition table, refusing dissection. (Except in systemd-dissect, when we are supposed to show DDI information, in that case allow this to run and show general DDI information, i.e. size, UUID and name at least)
* dissect: add dissect_image_file_and_warn()Lennart Poettering2023-04-051-0/+1
| | | | | | This is to dissect_image_file() what dissect_loop_device_and_warn() is to dissect_loop_device(), i.e. it dissects the image file and logs an error string if that fails instead of just returning an error.
* dissect: actually enforce policyLennart Poettering2023-04-051-0/+1
|
* tree-wide: hook up image dissection policy logic everywhereLennart Poettering2023-04-051-10/+9
|
* dissect-image: set MS_NOSYMFOLLOW for ESP/XBOOTLDRLennart Poettering2023-03-091-0/+2
| | | | | | | | | | | | | | When we mount a DDI, let's set MS_NOSYMFOLLOW for ESP/XBOOTLDR. They are generally untrusted territory, (i.e. outside of encryption/authentication via dm-crypt/dm-verity). Moreover they are generally FAT, where symlinks don't exist anyway. Let's hence disable symlinks for them. This slightly refactors how we put together mount options for mounts, splitting this out into a new helper call dissected_partition_pick_options(), which we should be able to reuse later in gpt-auto-generator, to ensure mounts via loopback as DDI and those on bare metal get the same options.
* dissect: add new helper dissected_partition_fstype()Lennart Poettering2023-03-091-0/+6
| | | | Initially we only have one user, but following patches will add more.
* dissect: show intended architecture of a disk imageLennart Poettering2023-03-011-0/+2
| | | | | We already determine the architecture of disk images and make a choice, and store it per partition. Let's make this accessible globally.
* dissect-image: Return mount point fd if requestedDaan De Meyer2023-02-171-1/+1
|
* homework: when creating/resizing GPT partitions, also set sector size explicitlyLennart Poettering2023-01-181-0/+1
|
* loop-util: always tell kernel explicitly about loopback sector sizeLennart Poettering2023-01-181-0/+2
| | | | | | Let's not leave the sector size unspecified: either set a user supplied value, or auto-detect the right size by probing the disk image accordingly.
* dissect-image: add probe_sector_size() helper for detecting sector size of a ↵Lennart Poettering2023-01-181-0/+2
| | | | | | | | | | | | | | GPT disk image When we operate with DDIs with sector sizes != 512 we need to configure the loopback device to match it, otherwise the image and the kernel block device will disagree what things are. Let's add a prober that tries to determine the sector size of a GPT DDI. It does this by looking for the GPT partition table header at the various byte offsets they must be located on, given a specific sector size. It will try sector size 512, 1024, 2048 and 4096. Of these only the 512 and 4096 really make sense IRL I guess, but let's be thorough.
* dissect-image: optionally, reference dissected partition device nodes by diskseqLennart Poettering2022-12-231-0/+1
| | | | | | | | | | | | | | This is useful to make the dissection logic at boot a bit safer, as we can reference device nodes by diskseq. This locks down dissection a bit, since it makes it harder to swap out the backing device between the time we dissected and validated it, until we actually mounted it. This is not complete though, as /bin/mount would have to verify the diskseq after opening the diskseq symlink again. See: https://github.com/util-linux/util-linux/issues/1786
* dissect-image: let's lock down fstypes a bitLennart Poettering2022-12-221-0/+2
| | | | | | | | | | | | | | | | | When we dissect images automatically, let's be a bit more conservative with the file system types we are willing to mount: only mount common file systems automatically. Explicit mounts requested by admins should always be OK, but when we do automatic mounts, let's not permit barely maintained, possibly legacy file systems. The list for now covers the four common writable and two common read-only file systems. Sooner or later we might want to add more to the list. Also, it might make sense to eventually make this configurable via the image dissection policy logic.
* tree-wide: use -EBADF for fd initializationZbigniew Jędrzejewski-Szmek2022-12-191-1/+1
| | | | | | | | | | | | | | | | -1 was used everywhere, but -EBADF or -EBADFD started being used in various places. Let's make things consistent in the new style. Note that there are two candidates: EBADF 9 Bad file descriptor EBADFD 77 File descriptor in bad state Since we're initializating the fd, we're just assigning a value that means "no fd yet", so it's just a bad file descriptor, and the first errno fits better. If instead we had a valid file descriptor that became invalid because of some operation or state change, the other errno would fit better. In some places, initialization is dropped if unnecessary.
* dissect: add new helper verity_settings_data_covers()Lennart Poettering2022-12-031-0/+8
| | | | | | | | This function checks if the external verity data referenced in VeritySettings covers the specified partition (indicated via designator). Right now, we'll use that at one place, but in a later commit in more.
* dissect: pick up gpt partition flagsLennart Poettering2022-12-021-0/+1
| | | | | | | Let's store the GPT partition flags in the dissected partition info. Right now we won't actually use them for anything yet, but later we'll add that, when enforcing policy on dissection.
* dissect-image: probe file system via main block device fd/image file fdLennart Poettering2022-12-011-2/+2
| | | | | | | | | | | | | let's make sure we can probe file systems also when unprivileged: instead of probing the partition block devices for file system signatures, let's go via the original "whole" fd. libblkid makes this easy actually, as it allows us to specify the offset/size of the area to probe. And we have the partition offsets/sizes anyway, so it's trivial for us to make use of. This thus enables fs probing also when lacking privs and operating on naked regular files without loopback devices or anything like this.
* dissect: rework DISSECT_IMAGE_ADD_PARTITION_DEVICES + ↵Lennart Poettering2022-12-011-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DISSECT_IMAGE_OPEN_PARTITION_DEVICES Curently, these two flags were implied by dissect_loop_device(), but that's not right, because this means systemd-gpt-auto-generator will dissect the root block device with these flags set and that's not desirable: the generator should not cause the partition devices to be created (we don't intend to use them right-away after all, but expect udev to find/probe them first, and then mount them though .mount units). And there's no point in opening the partition devices, since we do not intend to mount them via fds either. Hence, rework this: instead of implying the flags, specify them explicitly. While we are at it, let's also rename the flags to make them more descriptive: DISSECT_IMAGE_MANAGE_PARTITION_DEVICES becomes DISSECT_IMAGE_ADD_PARTITION_DEVICES, since that's really all this does: add the partition devices via BLKPG. DISSECT_IMAGE_OPEN_PARTITION_DEVICES becomes DISSECT_IMAGE_PIN_PARTITION_DEVICES, since we not only open the devices, but keep the devices open continously (i.e. we "pin" them). Also, drop the DISSECT_IMAGE_BLOCK_DEVICE combination flag, since it is misleading, i.e. it suggests it was appropriate to specify on all dissected blocking devices, but that's precisely not the case, see the systemd-gpt-auto-generator case. My guess is that the confusion around this was actually the cause for this bug we are addressing here. Fixes: #25528
* dissect-image: do not try to close invalid fdYu Watanabe2022-11-131-0/+6
| | | | | | Fixes a bug introduced by f7725647bb41c3398a867f139efe526efe8aa1b3. Hopefully fixes #25348.
* Merge pull request #24803 from DaanDeMeyer/repart-copy-deny-listDaan De Meyer2022-11-111-144/+1
|\ | | | | repart: Don't descend into directories assigned to other partitions
| * gpt: Replace bitfields with designator field in GptPartitionTypeDaan De Meyer2022-11-101-144/+1
| | | | | | | | | | To achieve this we move the PartitionDesignator enum from dissect-image.h to gpt.h
* | dissect: also parse out the top-level GPT table uuid and expose this as ↵Lennart Poettering2022-11-101-0/+1
|/ | | | | | | | image UUID systemd-repart generates this in a suitably stable fashion, hence let's actually use it as an identifier for the image. As a first step parse it, and show it.
* dissect: officially support initrd DDIs (to implement 2nd stage initrds)Lennart Poettering2022-11-091-0/+1
| | | | | Let's complete support for DDI discovery, and also support 2nd stage initrds.
* dissect-image: introduce probe_filesystem_full() which can take file ↵Yu Watanabe2022-10-121-1/+4
| | | | | | | descriptor of device node In dissect_loop_device(), we have opened the device node. Let's reuse the file descriptor.
* dissect-image: open dissected or decrypted partitions and mount through the ↵Yu Watanabe2022-10-121-2/+6
| | | | | | | | | | | | | | | file descriptor If multiple services with the same encrypted image are simultaneously starting, one may deactivate the dm device while others using it. Or, similary, after (regular) partitions are dissected, another process may try to remove them before we mount them. To prevent such situations, let's keep the dissected and decrypted partitions opened. Then, use the file descriptors when we mount the partitions. Fixes #24617.
* portable: allow caller to override extension-release name checkLuca Boccassi2022-10-121-0/+1
| | | | | When the --force flag is used, do not insist that the extension-release file has to match the extension image name
* dissect-image: introduce dissect_image_file() which works for regular fileYu Watanabe2022-09-271-29/+29
|
* tree-wide: drop unused reference to DecryptedImageYu Watanabe2022-09-181-4/+3
|
* dissect-image: introduce dissected_image_relinquish()Yu Watanabe2022-09-181-0/+2
|
* Merge pull request #24720 from yuwata/dissect-image-take-referenceDaan De Meyer2022-09-181-5/+5
|\ | | | | dissect-image: make DissectedImage object take reference to DecryptedImage and LoopDevice
| * dissect-image: take a reference of LoopDevice into DissectedImageYu Watanabe2022-09-181-5/+3
| | | | | | | | | | | | To make LoopDevice object freed after DissectedImage is freed. At least currently, this should not change anything. Preparation for later commits.
| * dissect-image: take reference of DecryptedImage into DissectedImageYu Watanabe2022-09-181-0/+1
| | | | | | | | No functional changes. Preparation for later commits.
| * dissect-image: introduce reference counter for DecryptedImageYu Watanabe2022-09-181-0/+1
| |
* | dissect-image: introduce DISSECTED_PARTITION_NULLYu Watanabe2022-09-181-0/+6
|/ | | | | | Currently, it is not necessary to set partno or architecture in dissect_image_new(), but just for safety. Preparation for later commits.
* dissect-image: reuse LoopDevice.node in dissect_image()Yu Watanabe2022-09-071-1/+2
| | | | | | Currently, dissect_image() is only called through dissect_loop_device(), and the LoopDevice object has device name. Hence, it is not necessary to get device name in dissect_image().
* dissect-image: drop currently unused argumentsYu Watanabe2022-09-071-4/+1
|
* dissect-image: use loop backing file or device node as name of the imageYu Watanabe2022-09-071-2/+2
| | | | | | Note, currently, for each call of dissect_loop_device_and_warn(), the specified name is equivalent to the path passed to loop_device_make_by_path(). Hence, this should not change the current behavios.
* dissect-image: use backing_file stored in LoopDevice object to generate ↵Yu Watanabe2022-09-071-3/+12
| | | | | | | | image name Follow-up for e374439f4b8def786031ddbbd7dfdae3a335d4d2 (#24322). This also simplify the logic of generating image name from image path.
* Use original filename for extension name checkKai Lueke2022-09-051-3/+3
| | | | | | | | | | | | | The loading of an extension image from a symlink "NAME.raw" to "NAME-VERSION.raw" failed because the release file name check worked with the backing file of the loop device which already resolves the symlink and thus the found name "NAME-VERSION" mismatched "NAME". Pass the original filename and use it instead of the backing file when available. This fixes the loading of "NAME.raw" extensions which are a symlink to "NAME-VERSION.raw" as, e.g., may be the case when systemd-sysupdate manages multiple versions. Fixes https://github.com/systemd/systemd/issues/24293
* dissect-image: introduce dissect_loop_device() which takes LoopDevice objectYu Watanabe2022-09-021-1/+5
|
* dissect: drop partition removal codeLennart Poettering2022-09-011-4/+0
| | | | | | | | | | | | | | | | | | | This reverts a major chunk of 75d7e04eb4662a814c26010d447eed8a862f5ec1 Now that the loopback device code already destroys the partitions we don't have to do this here anymore. I am sure the right place to delete the partitions is in the loopback code, since we really only should do that for loopback devices, see bug #24431, and not on "real" block devices. I am also not convinced dropping partitions the dissection logic doesn't care about is a good idea, after all. The dissection stuff should probably not consider itself the "owner" of the block devices it analyzes, but take a more passive role: figure out what is what, but not modify it. Fixes: #24431
* dissect-image: Explicitly remove partitions when done with imageDaan De Meyer2022-05-231-0/+4
| | | | | | | | | | | | | | When closing a loop device, the kernel will asynchronously remove the probed partitions. This can lead to race conditions where we try to reuse a partition device that still needs to be removed by the kernel. To avoid such issues, let's explicitly try to remove any partitions using BLKPG_DEL_PARTITION when we're done with an image. To make sure we don't try to remove partitions when we want them to remain (e.g. systemd-dissect --mount), we add dissected_image_relinquish() in a similar vein to loop_device_relinquish() and decrypted_image_relinquish().
* dissect: rework how we wait for partition block devicesLennart Poettering2022-04-101-11/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This revisits the mess around waiting for partition block devices in the image dissection code. It implements a nice little trick: Instead of waiting for the kernel to probe the partition table for us and generate the block devices from it, we'll just do that ourselves. How can we do it? Via the BLKPG_ADD_PARTITION ioctl, that the kernel has supported for a while. This ioctl allows creating partition block devices off "whole" block devices from userspace, without the partitions necessarily being present in the partition table at all. So, whenever we want a partition to be there, we'll just issue BLKPG_ADD_PARTITION. This can either work, in which case we know the partition is there, and can use it. Yay. Or it can fail with EBUSY, which the kernel returns if a partition by the selected partition index already exists (or if an existing partition overlaps with the new one). But if that's the case, then that's also OK, because the partition will already exist. So, regardless if we win or the kernel wins, for us the outcome is the same: the partition block device will exist after invoking the ioctl. Yay. Net effect: we are not dependent on asynchronous uevent messages to wait for the devices. Instead we synchronously get what we need. This makes us independent of the (apparently less than reliable) netlink transport, and should almost always be quicker. Hopefully addresses #17469 even on older kernels. Fixes: #17469
* core: fix dm-verity auto-discovery in MountImageUnit()Luca Boccassi2022-04-071-1/+1
| | | | | | | | | The implementation of MountImageUnit()/systemctl mount-image was changed to use a /proc/self/fd path as the source, but that causes the dm-verity files autodiscovery to fail, as it looks for files in the same directory as the image. Use the original file path when setting up dm-verity.
* tree-wide: use 'Architecture' type consistently across the treeLennart Poettering2022-04-041-3/+3
| | | | | | | Some parts of our tree used 'Architecture' for storing architectures, others used ints. Let's unify on the former. Inspired by #22952's rework of the 'Virtualization' enum.
* Merge pull request #21487 from DaanDeMeyer/dissect-image-other-archLennart Poettering2021-11-251-1/+58
|\ | | | | Allow dissect_image() to dissect images from architectures other than the native one
| * shared: Add support for non-native architectures to dissect_image()Daan De Meyer2021-11-241-1/+58
| | | | | | | | | | | | | | | | | | | | To allow dissecting images of architectures other than the native (or secondary) one, we add a third designator 'OTHER' to represent architectures other than the native or secondary one. If no partitions of the native or secondary arch are available, we check if a root partition of any other arch is available and use that instead if we found one.
* | dissect-image: do not enable "verification" when trying to acquire metadataZbigniew Jędrzejewski-Szmek2021-11-241-1/+1
|/ | | | | | | | | The whole point of acquiring metadata is quite often to figure out why the image does not pass verification. Refusing to provide metadata is just being hostile to the user. When called from other places (e.g. image_read_metadata()), verification is still performed.
* extension-release.d/: add a new field SYSEXT_SCOPE= for clarifying what a ↵Lennart Poettering2021-11-231-1/+1
| | | | | | | | | | | | | | | | system extension is for This should make things a bit more robust since it ensures system extension can only applied to the right environments. Right now three different "scopes" are defined: 1. "system" (for regular OS systems, after the initrd transition) 2. "initrd" (for sysext images that apply to the initrd environment) 3. "portable" (for sysext images that apply to portable images) If not specified we imply a default of "system portable", i.e. any image where the field is not specified is implicitly OK for application to OS images and for portable services – but not for initrds.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 14:35:06 +0100