summaryrefslogtreecommitdiffstats
path: root/src/sysext (follow)
Commit message (Collapse)AuthorAgeFilesLines
* varlink: add helper varlink_error_invalid_parameter_name()Lennart Poettering2023-12-211-1/+1
|
* process-util: add new FORK_DEATHSIG_SIGKILL flag, rename FORK_DEATHSIG → ↵Lennart Poettering2023-11-021-1/+1
| | | | | | | | | | | | | | | | | | FORK_DEATHSIG_SIGTERM Sometimes it makes sense to hard kill a client if we die. Let's hence add a third FORK_DEATHSIG flag for this purpose: FORK_DEATHSIG_SIGKILL. To make things less confusing this also renames FORK_DEATHSIG to FORK_DEATHSIG_SIGTERM to make clear it sends SIGTERM. We already had FORK_DEATHSIG_SIGINT, hence this makes things nicely symmetric. A bunch of users are switched over for FORK_DEATHSIG_SIGKILL where we know it's safe to abort things abruptly. This should make some kernel cases more robust, since we cannot get confused by signal masks or such. While we are at it, also fix a bunch of bugs where we didn't take FORK_DEATHSIG_SIGINT into account in safe_fork()
* varlink,json: introduce new varlink_dispatch() helperLennart Poettering2023-11-021-12/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | varlink_dispatch() is a simple wrapper around json_dispatch() that returns clean, standards-compliant InvalidParameter error back to clients, if the specified JSON cannot be parsed properly. For this json_dispatch() is extended to return the offending field's name. Because it already has quite a few parameters, I then renamed json_dispatch() to json_dispatch_full() and made json_dispatch() a wrapper around it that passes the new argument as NULL. While doing so I figured we should also get rid of the bad= argument in the short wrapper, since it's only used in the OCI code. To simplify the OCI code this adds a second wrapper oci_dispatch() around json_dispatch_full(), that fills in bad= the way we want. Net result: instead of one json_dispatch() call there are now: 1. json_dispatch_full() for the fully feature mother of all dispathers. 2. json_dispatch() for the simpler version that you want to use most of the time. 3. varlink_dispatch() that generates nice Varlink errors 4. oci_dispatch() that does the OCI specific error handling And that's all there is.
* sysext: make some calls available via varlinkLennart Poettering2023-10-161-75/+431
|
* dissect: allow confext/sysext to be in the same imageLennart Poettering2023-10-111-1/+1
| | | | | | | | | | | | | | | | | This reworks the image discovery logic, and conceptually allows DDIs that are both confext and sysext to exist. Previously we'd only extract one type of exension data from a DDI, with this we allow to extract both if both exist. This doesn't add support for true "multi-modal" DDIs, that qualify as various things at once, it just lays some ground work that ensures we at least can dissect such images. This reworks 484d26dac1e8e543fc9e300e3c1fa36be0769f7d quite a bit. This changes systemd-dissect's JSON output, but given the version with the fields it changes/dops has never been released (as the above patch was merged post-v254) this shouldn't be an issue.
* sysext: fix some sysextisms in confext modeLennart Poettering2023-10-051-2/+2
| | | | | Nothing earth-shattering. Just make sure we never expose the string "sysext" in "confext" mode.
* dissect-image: optionally allow mounting via new kernel mount API in two stepsLennart Poettering2023-10-021-2/+3
| | | | | | | | | This adds support for the new fsmount() logic of the kernel: we'll first create an unattached fsmount fd, and then in a second step attach this to some real file system inode – as opposed to attaching file system directly. The benefit of this is that we can pass the open fsmount fds over some sockets if need be, to isolate the mounting code from the attaching code.
* sysext: validate against the right API levelLennart Poettering2023-09-291-6/+3
| | | | | | | Let's ake sure we check confexts against the confext api level, and sysext against the sysext api level. Previously the test would simply be skipped for confexts...
* sysext: skip the reload if `--root=` is providedMathieu Tortuyaux2023-08-291-0/+2
| | | | Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
* sysext: fix `--root=` supportMathieu Tortuyaux2023-08-291-2/+2
| | | | | | | | | | | | | when provided `--root=` was failing for `status`: ``` $ systemd-sysext --root=/mnt status Failed to open '/usr/.systemd-sysext/extensions': No such file or directory ``` path was not relative to the given `--root` - same goes for the `need_reload` as it was inspired from the `verb_status` section. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
* sysext: fix a memory leakFrantisek Sumsal2023-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduced by 41712cd1c0d. ================================================================= ==2194==ERROR: LeakSanitizer: detected memory leaks Indirect leak of 359856 byte(s) in 459 object(s) allocated from: #0 0x7ffff7511df4 (/usr/lib64/clang/16/lib/linux/libclang_rt.asan-powerpc64le.so+0x191df4) (BuildId: 47e1dd371a2b8525b6cb737760a4dc535f30ea10) #1 0x7ffff6bb5fb0 in message_from_header /systemd-meson-build/../root/systemd/src/libsystemd/sd-bus/bus-message.c:372:13 #2 0x7ffff6bb5fb0 in bus_message_from_malloc /systemd-meson-build/../root/systemd/src/libsystemd/sd-bus/bus-message.c:421:13 #3 0x7ffff6c23f54 in bus_socket_make_message /systemd-meson-build/../root/systemd/src/libsystemd/sd-bus/bus-socket.c:1222:13 #4 0x7ffff6c22d10 in bus_socket_read_message /systemd-meson-build/../root/systemd/src/libsystemd/sd-bus/bus-socket.c #5 0x7ffff6c4d414 in bus_read_message /systemd-meson-build/../root/systemd/src/libsystemd/sd-bus/sd-bus.c:2082:16 #6 0x7ffff6c4d414 in sd_bus_call /systemd-meson-build/../root/systemd/src/libsystemd/sd-bus/sd-bus.c:2480:21 #7 0x7ffff6682904 in bus_service_manager_reload /systemd-meson-build/../root/systemd/src/shared/bus-unit-util.c:2823:13 #8 0x1000d570 in daemon_reload /systemd-meson-build/../root/systemd/src/sysext/sysext.c:233:16 #9 0x100090f8 in merge /systemd-meson-build/../root/systemd/src/sysext/sysext.c:895:21 #10 0x10006ff4 in verb_merge /systemd-meson-build/../root/systemd/src/sysext/sysext.c:964:16 #11 0x7ffff69ae894 in dispatch_verb /systemd-meson-build/../root/systemd/src/shared/verbs.c:103:24 #12 0x10004570 in sysext_main /systemd-meson-build/../root/systemd/src/sysext/sysext.c:1194:16 #13 0x10004570 in run /systemd-meson-build/../root/systemd/src/sysext/sysext.c:1214:16 #14 0x10004570 in main /systemd-meson-build/../root/systemd/src/sysext/sysext.c:1217:1 #15 0x7ffff5f5a968 in generic_start_main.isra.0 (/lib64/libc.so.6+0x2a968) (BuildId: c218e04818632a05c23f6fdcca16f93e95ea7de2) #16 0x7ffff5f5ab00 in __libc_start_main (/lib64/libc.so.6+0x2ab00) (BuildId: c218e04818632a05c23f6fdcca16f93e95ea7de2) Indirect leak of 124984 byte(s) in 459 object(s) allocated from: ... #11 0x7ffff5f5a968 in generic_start_main.isra.0 (/lib64/libc.so.6+0x2a968) (BuildId: c218e04818632a05c23f6fdcca16f93e95ea7de2) #12 0x7ffff5f5ab00 in __libc_start_main (/lib64/libc.so.6+0x2ab00) (BuildId: c218e04818632a05c23f6fdcca16f93e95ea7de2) SUMMARY: AddressSanitizer: 493766 byte(s) leaked in 1383 allocation(s).
* sysext: support EXTENSION_RELOAD_MANAGER metadataMathieu Tortuyaux2023-08-211-1/+121
| | | | | | | | | | This metadata (EXTENSION_RELOAD_MANAGER) can be set to "1" to reload the manager when merging/refreshing/unmerging a system extension image. This can be useful in case the sysext image provides systemd units that need to be loaded. With `--no-reload`, one can deactivate the EXTENSION_RELOAD_MANAGER metadata interpretation. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
* meson: use install_emptydir() and drop meson-make-symlink.shYu Watanabe2023-08-081-3/+2
| | | | | | The script is mostly equivalent to 'mkdir -p' and 'ln -sfr'. Let's replace it with install_emptydir() builtin function and inline meson call.
* meson: move declaration of sysextYu Watanabe2023-07-311-1/+8
|
* Drop split-usr and unmerged-usr supportLuca Boccassi2023-07-281-2/+2
| | | | | | | | | | As previously announced, execute order 66: https://lists.freedesktop.org/archives/systemd-devel/2022-September/048352.html The meson options split-usr, rootlibdir and rootprefix become no-ops that print a warning if they are set to anything other than the default values. We can remove them in a future release.
* meson: do not create dead systemd-confext symlink if sysext is disabledYu Watanabe2023-07-281-3/+5
|
* confext: add dissect tool support for confext imagesMaanya Goenka2023-07-141-1/+1
| | | | | Allow image wide systemd tool support for confext images by adding dissect tool support for these images
* tree-wide: use _cleanup_set_free_ and friendsYu Watanabe2023-05-311-4/+4
| | | | Instead of _cleanup_(set_freep) or so.
* tre-wide: use FORMAT_DEVNUM() a bit moreLennart Poettering2023-04-211-1/+1
|
* systemd-confext: mount confexts as noexec and nosuidLuca Boccassi2023-04-131-1/+21
| | | | | | | | | Confexts should not contain code, so mount confexts with noexec. We cannot mount invidial extensions as noexec, as the overlay ignores it and bypasses it, we need to use the flag on the whole overlay for it to be effective. But given there are legacy scripts still shipped in /etc, allow to override it with --noexec=false.
* image-policy: introduce parse_image_policy_argument() helperYu Watanabe2023-04-131-9/+4
| | | | | | | | | Addresses https://github.com/systemd/systemd/pull/25608/commits/84be0c710d9d562f6d2cf986cc2a8ff4c98a138b#r1060130312, https://github.com/systemd/systemd/pull/25608/commits/84be0c710d9d562f6d2cf986cc2a8ff4c98a138b#r1067927293, and https://github.com/systemd/systemd/pull/25608/commits/84be0c710d9d562f6d2cf986cc2a8ff4c98a138b#r1067926416. Follow-up for 84be0c710d9d562f6d2cf986cc2a8ff4c98a138b.
* sysext: define a default image dissection policy for confext imagesLennart Poettering2023-04-121-1/+4
|
* Merge pull request #25608 from poettering/dissect-moarLennart Poettering2023-04-121-9/+45
|\ | | | | dissect: add dissection policies
| * sysext: default to a stricter image policy when reading /.extra/sysext/ DDIsLennart Poettering2023-04-051-1/+19
| |
| * tree-wide: hook up image dissection policy logic everywhereLennart Poettering2023-04-051-9/+27
| |
* | confext: add multi call functionality to sysextmaanyagoenka2023-04-052-28/+68
| | | | | | | | | | | | The confext concept is an extension of the existing sysext concept and allows to extend the host's filesystem or a unit's filesystem with signed images that add new files to the /etc/ directory using OverlayFS.
* | extension-release: establish compatibility between host file and ↵maanyagoenka2023-04-051-2/+3
| | | | | | | | | | | | | | | | | | extension-release file The release file that accompanies the confext images needs to be host compatible to be able to be merged into the host /etc/ directory. This commit checks for version compatibility between the image file and the host file.
* | os-util: add a new confext image type and the ability to parse their release ↵maanyagoenka2023-04-051-2/+2
|/ | | | | | | | | files Adds a new image type called IMAGE_CONFEXT which is similar to IMAGE_SYSEXT but works for the /etc/ directory instead of /usr/ and /opt/. This commit also adds the ability to parse the release file that is present with the confext image in /etc/confext-release.d/ directory.
* sysext: validate that they do not contain os-releaseLuca Boccassi2023-03-301-54/+36
| | | | | sysexts are not supposed to ship os-release files, enforce this when loading them
* rename extension-release.[c|h] -> extension-util.[c|h]Luca Boccassi2023-03-301-1/+1
| | | | | It will be used for other extension DDI validation, not just for extension-release validation
* chase-symlinks: Rename chase_symlinks() to chase()Daan De Meyer2023-03-241-9/+9
| | | | | | | | | Chasing symlinks is a core function that's used in a lot of places so it deservers a less verbose names so let's rename it to chase() and chaseat(). We also slightly change the pattern used for the chaseat() helpers so we get chase_and_openat() and similar.
* src: Fixup copy-paste error for terminal_urlify_manMorten Linderud2023-03-101-1/+1
| | | | Signed-off-by: Morten Linderud <morten@linderud.pw>
* loop-util: always tell kernel explicitly about loopback sector sizeLennart Poettering2023-01-181-0/+1
| | | | | | Let's not leave the sector size unspecified: either set a user supplied value, or auto-detect the right size by probing the disk image accordingly.
* tree-wide: have_effective_cap() may return negative errnoYu Watanabe2022-12-231-3/+13
|
* dissect: rework DISSECT_IMAGE_ADD_PARTITION_DEVICES + ↵Lennart Poettering2022-12-011-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DISSECT_IMAGE_OPEN_PARTITION_DEVICES Curently, these two flags were implied by dissect_loop_device(), but that's not right, because this means systemd-gpt-auto-generator will dissect the root block device with these flags set and that's not desirable: the generator should not cause the partition devices to be created (we don't intend to use them right-away after all, but expect udev to find/probe them first, and then mount them though .mount units). And there's no point in opening the partition devices, since we do not intend to mount them via fds either. Hence, rework this: instead of implying the flags, specify them explicitly. While we are at it, let's also rename the flags to make them more descriptive: DISSECT_IMAGE_MANAGE_PARTITION_DEVICES becomes DISSECT_IMAGE_ADD_PARTITION_DEVICES, since that's really all this does: add the partition devices via BLKPG. DISSECT_IMAGE_OPEN_PARTITION_DEVICES becomes DISSECT_IMAGE_PIN_PARTITION_DEVICES, since we not only open the devices, but keep the devices open continously (i.e. we "pin" them). Also, drop the DISSECT_IMAGE_BLOCK_DEVICE combination flag, since it is misleading, i.e. it suggests it was appropriate to specify on all dissected blocking devices, but that's precisely not the case, see the systemd-gpt-auto-generator case. My guess is that the confusion around this was actually the cause for this bug we are addressing here. Fixes: #25528
* basic: move version() to build.h+cZbigniew Jędrzejewski-Szmek2022-11-081-0/+1
|
* basic: create new basic/initrd-util.[ch] for initrd-related functionsZbigniew Jędrzejewski-Szmek2022-11-081-0/+1
| | | | | | | | | I changed imports of util.h to initrd-util.h, or added an import of initrd-util.h, to keep compilation working. It turns out that many files didn't import util.h directly. When viewing the patch, don't be confused by git rename detection logic: a new .c file is added and two functions moved into it.
* Merge pull request #24768 from keszybz/table-not-available-2Lennart Poettering2022-09-221-1/+1
|\ | | | | Adjust table n/a text in more places
| * shared/format-table: use enum instead of Table.empty_stringZbigniew Jędrzejewski-Szmek2022-09-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | All users were setting this to some static string (usually "-"), so let's simplify things by not doing strdup, but instead limiting callers to a fixed set of values. In preparation for the next commit, the function is renamed from "empty" to "replacement", because it'll be used for more than empty fields. I didn't do the whole string-table setup, because it's all used internally in one file and this way we can immediately assert if an invalid value is passed in. Some callers were (void)ing the error, others were ignoring it, and others propagating. It's nicer to remove the boilerplate.
* | tree-wide: drop unused reference to DecryptedImageYu Watanabe2022-09-181-2/+1
| |
* | tree-wide: use dissected_image_relinquish()Yu Watanabe2022-09-181-9/+4
|/
* dissect-image: use loop backing file or device node as name of the imageYu Watanabe2022-09-071-1/+0
| | | | | | Note, currently, for each call of dissect_loop_device_and_warn(), the specified name is equivalent to the path passed to loop_device_make_by_path(). Hence, this should not change the current behavios.
* dissect-image: introduce dissect_loop_device() which takes LoopDevice objectYu Watanabe2022-09-021-5/+2
|
* loop-util: rework how we lock loopback block devicesLennart Poettering2022-09-011-4/+1
| | | | | | | | | | | | | | | | | | | | Let's rework how we lock loopback block devices in two ways: 1. Lock a separate fd, instead of the main block device fd. We already did that for our internal locking when allocating loopback block devices, but do so for the exposed locking (i.e. loop_device_flock()), too, so that the lock is independent of the main fd we actually use of IO. 2. Instead of locking the device during allocation of the loopback device, then unlocking it (which will make udev run), and then re-locking things if we need, let's instead just keep the lock the whole time, to make things a bit safer and faster, and not have to wait for udev at all. This is done by adding a "lock_op" parameter to loop device allocation functions that declares the initial state of the lock, and is one of LOCK_UN/LOCK_SH/LOCK_EX. This change also shortens a lot of code, since we allocate + immediately lock loopback devices pretty much everywhere.
* dissect: drop partition removal codeLennart Poettering2022-09-011-1/+0
| | | | | | | | | | | | | | | | | | | This reverts a major chunk of 75d7e04eb4662a814c26010d447eed8a862f5ec1 Now that the loopback device code already destroys the partitions we don't have to do this here anymore. I am sure the right place to delete the partitions is in the loopback code, since we really only should do that for loopback devices, see bug #24431, and not on "real" block devices. I am also not convinced dropping partitions the dissection logic doesn't care about is a good idea, after all. The dissection stuff should probably not consider itself the "owner" of the block devices it analyzes, but take a more passive role: figure out what is what, but not modify it. Fixes: #24431
* sysext: add missing COMMAND to the help output and man synopsisAntonio Alvarez Feijoo2022-08-221-1/+1
|
* Add sys/file.h for LOCK_Pavel Zhukov2022-06-211-0/+1
| | | | | | | | Fixes build with musl: | ../git/src/shared/dissect-image.c: In function 'mount_image_privately_interactively': | ../git/src/shared/dissect-image.c:2986:34: error: 'LOCK_SH' undeclared (first use in this function) | 2986 | r = loop_device_flock(d, LOCK_SH); | | ^~~~~~~
* dissect-image: Explicitly remove partitions when done with imageDaan De Meyer2022-05-231-0/+1
| | | | | | | | | | | | | | When closing a loop device, the kernel will asynchronously remove the probed partitions. This can lead to race conditions where we try to reuse a partition device that still needs to be removed by the kernel. To avoid such issues, let's explicitly try to remove any partitions using BLKPG_DEL_PARTITION when we're done with an image. To make sure we don't try to remove partitions when we want them to remain (e.g. systemd-dissect --mount), we add dissected_image_relinquish() in a similar vein to loop_device_relinquish() and decrypted_image_relinquish().
* sysext: refuse empty release ID to avoid triggering assertionYu Watanabe2022-05-201-0/+4
| | | | | Otherwise, the assertion in extension_release_validate() will be triggered.
* stat-util: fix dir_is_empty() with hidden/backup filesLennart Poettering2022-05-041-2/+2
| | | | | | | | | | | | | | | | | | | | This is a follow-up for f470cb6d13558fc06131dc677d54a089a0b07359 which in turn is a follow-up for a068aceafbffcba85398cce636c25d659265087a. The latter started to honour hidden files when deciding whether a directory is empty. The former reverted to the old behaviour to fix issue #23220. It introduced a bug though: when a directory contains a larger number of hidden entries the getdents64() buffer will not suffice to read them, since we just allocate three entries for it (which is definitely enough if we just ignore the . + .. entries, but not ig we ignore more). I think it's a bit confusing that dir_is_empty() can return true even if rmdir() on the dir would return ENOTEMPTY. Hence, let's rework the function to make it optional whether hidden files are ignored or not. After all, I looking at the users of this function I am pretty sure in more cases we want to honour hidden files.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 05:59:11 +0100