summaryrefslogtreecommitdiffstats
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* core: Introduce PrivatePIDs=Daan De Meyer2024-11-0518-25/+513
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new setting allows unsharing the pid namespace in a unit. Because you have to fork to get a process into a pid namespace, we fork in systemd-executor to get into the new pid namespace. The parent then sends the pid of the child process back to the manager and exits while the child process continues on with the rest of exec_invoke() and then executes the actual payload. Communicating the child pid is done via a new pidref socket pair that is set up on manager startup. We unshare the PID namespace right before the mount namespace so we mount procfs correctly. Note PrivatePIDs=yes always implies MountAPIVFS=yes to mount procfs. When running unprivileged in a user session, user namespace is set up first to allow for PID namespace to be unshared. However, when running in privileged mode, we unshare the user namespace last to ensure the user namespace does not own the PID namespace and cannot break out of the sandbox. Note we disallow Type=forking services from using PrivatePIDs=yes since the init proess inside the PID namespace must not exit for other processes in the namespace to exist. Note Daan De Meyer did the original work for this commit with Ryan Wilson addressing follow-ups. Co-authored-by: Daan De Meyer <daan.j.demeyer@gmail.com>
* exec-invoke: Add debug logging for setup_private_users()Daan De Meyer2024-11-041-7/+7
|
* efi-loader: add missing stub for efi_stub_get_device_part_uuid()Franck Bui2024-11-041-0/+4
|
* json: add json_dispatch_ifindex() helper (#34982)Lennart Poettering2024-11-047-45/+37
|\ | | | | Inspired by: #34640
| * tree-wide: port things over to new json_dispatch_ifindex()Lennart Poettering2024-11-044-28/+16
| |
| * json-util: generalize json_dispatch_ifindex()Lennart Poettering2024-11-043-17/+21
| | | | | | | | | | | | | | | | Let's move the helper from nss-resolve.c to generic code, as it's going to be useful in #34640. Also, let's tighten the rules, and refuse negative ifindexes, because they are invalid.
* | pcrlock: Pad pe hash to a multiple of 8 bytesDaan De Meyer2024-11-041-0/+4
| | | | | | | | | | All other tools (sbsigntools, osslsigncode, sbctl, goblin) do this as well so let's follow suite.
* | network: refuse new requests on stop (#35004)Luca Boccassi2024-11-047-5/+28
|\ \ | | | | | | split-out of #34989..
| * | network: free DHCP client and friends in link_free()Yu Watanabe2024-11-033-5/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No functional change, at least now. Preparation for later commits. But we are planning to extend KeepConfiguration= and also keep addresses and so on assigned by other dynamic configuration protocol like DHCPv6 or NDisc. However, when link_free_engines() is called here, acquired addresses so on by NDisc will be removed, even if link_stop_engines() handles restarting networkd or KeepConfiguration= gracefully. So, let's not free engines here, but free them later in link_free(). It is not necessary to be called here anyway.
| * | network: refuse further requests when manager is in MANAGER_STOPPEDYu Watanabe2024-11-034-0/+26
| | | | | | | | | | | | | | | In that case, requests will never be processed anyway. But further more, we cannot call link_ref() at that stage. Otherwise, we trigger assertion.
* | | network: cleanups for IPv4LL (#34995)Luca Boccassi2024-11-042-18/+21
|\ \ \ | | | | | | | | split-out of #34989.
| * | | network/ipv4ll: not necessary to set initial address on each startYu Watanabe2024-11-022-13/+16
| | | |
| * | | network/dhcp4: do not restart IPv4LL client when KeepConfiguration=dhcpYu Watanabe2024-11-021-5/+5
| | | | | | | | | | | | | | | | | | | | When KeepConfiguration=dhcp, we do not remove acquired address, hence not necessary to restart IPv4LL client.
* | | | test-dhcp-client: utilize log_info instead of printfColin Foster2024-11-041-11/+11
| |_|/ |/| | | | | | | | | | | log_info appears to be the preferred method to convey information from tests. Convert all the printfs to log_info to follow this standard.
* | | udev-builtin-path_id: SAS wide ports must have num_phys > 1Martin Wilck2024-11-041-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some kernel SAS drivers (e.g. smartpqi) expose ports with num_phys = 0. udev shouldn't treat these ports as wide ports. SAS wide ports always have num_phys > 1. See comments for sas_port_add_phy() in the kernel sources. Sample data from a smartpqi system to illustrate the issue below. Here the phy device is attached to port 0:0, which has no end devices attached and the SAS end device (where sda is attached) is associated with SAS port 0:1, which has no associated phy device. Thus num_phys for port-0:1 is 0. This is arguably wrong, but it's how smartpqi has always set up its devices in sysfs. /sys/class/sas_phy/phy-0:0 -> ../../devices/pci0000:46/0000:46:02.0/0000:47:00.0/host0/scsi_host/host0/phy-0:0/sas_phy/phy-0:0 /sys/devices/pci0000:46/0000:46:02.0/0000:47:00.0/host0/scsi_host/host0/port-0:0/phy-0:0 -> ../phy-0:0 /sys/devices/pci0000:46/0000:46:02.0/0000:47:00.0/host0/scsi_host/host0/phy-0:0/port -> ../port-0:0 /sys/class/sas_device/end_device-0:1 -> ../../devices/pci0000:46/0000:46:02.0/0000:47:00.0/host0/scsi_host/host0/port-0:1/end_device-0:1/sas_device/end_device-0:1 /sys/class/block/sda -> ../../devices/pci0000:46/0000:46:02.0/0000:47:00.0/host0/scsi_host/host0/port-0:1/end_device-0:1/target0:0:0/0:0:0:0/block/sda Signed-off-by: Martin Wilck <mwilck@suse.com>
* | | bootctl: Add --secure-boot-auto-enrollDaan De Meyer2024-11-038-4/+343
| | | | | | | | | | | | | | | | | | When specified, bootctl install will also set up secure boot auto-enrollment. For now, We sign all variables using the same certificate and key pair.
* | | openssl-util: Query engine/provider pin via ask-passwordDaan De Meyer2024-11-034-168/+334
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In mkosi, we want to support signing via a hardware token. We already support this in systemd-repart and systemd-measure. However, if the hardware token is protected by a pin, the pin is asked as many as 20 times when building an image as the pin is not cached and thus requested again for every operation. Let's introduce a custom openssl ui when we use engines and providers and plug systemd-ask-password into the process. With systemd-ask-password, the pin can be cached in the kernel keyring, allowing us to reuse it without querying the user again every time to enter the pin. We use the private key URI as the keyring identifier so that the cached pin can be shared across multiple tools. Note that if the private key is pin protected, openssl will prompt both when loading the private key using the pkcs11 engine and when actually signing the roothash. To make sure our custom UI is used when signing the roothash, we have to also configure it with ENGINE_ctrl() which takes a non-owning pointer to the UI_METHOD object and its userdata object which we have to keep alive so we introduce a new AskPasswordUserInterface struct which we use to keep both objects alive together with the EVP_PKEY object. Because the AskPasswordRequest struct stores non-owning pointers to its fields, we change repart to store the private key URI as a global variable again instead of the EVP_PKEY object so that we can use the private key argument as the keyring field of the AskPasswordRequest instance without running into lifetime issues.
* | | efivars: Remove STRINGIFY() helper macrosDaan De Meyer2024-11-0220-83/+79
| | | | | | | | | | | | | | | | | | | | | | | | The names of these conflict with macros from efi.h that we'll move to efi-fundamental.h in a later commit. Let's avoid the conflict by getting rid of these helpers. Arguably this also improves readability by clearly indicating we're passing arbitrary strings and not constants to the macros when we invoke them.
* | | ask-password: Add $SYSTEMD_ASK_PASSWORD_KEYRING_TYPEDaan De Meyer2024-11-021-1/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | Currently ask_password_auto() will always try to store the password into the user keyring. Let's make this configurable so that we can configure ask_password_auto() into the session keyring. This is required when working with user namespaces, as the user keyring is namespaced by user namespaces which makes it impossible to share cached keys across user namespaces by using the user namespace while this is possible with the session keyring.
* | | ask-password: Drop "default" for SYSTEMD_ASK_PASSWORD_KEYRING_TIMEOUT_SECDaan De Meyer2024-11-021-1/+1
| | | | | | | | | | | | Users can simply unset the environment variable to achieve the same effect.
* | | ask-password: Use default timeout if ↵Daan De Meyer2024-11-021-4/+2
| |/ |/| | | | | | | | | SYSTEMD_ASK_PASSWORD_KEYRING_TIMEOUT_SEC is unset Follow-up for d9f4dad986dcebd51bdaeb8ba3d2c00cdc0d701e
* | pam: quiet a spurious debug messageRonan Pigott2024-11-024-8/+9
| | | | | | | | | | This singular debug message gets printed even if debug is not enabled. Quiet this message when debug is not enabled for consistency.
* | user-record: add missing comma to list of stringsLuca Boccassi2024-11-021-1/+1
|/ | | | Follow-up for ad03f2d5f0d7f87b775357e5a2727dbcbc973fce
* machine: introduce io.systemd.MachineImage.{Clone, Remove} methods (#34853)Luca Boccassi2024-11-027-38/+213
|\ | | | | | | This PR introduces io.systemd.MachineImage.Clone and Remove methods. They are 1:1 mapping to DBus alternatives.
| * machine: use ImageUpdateParameters in io.systemd.MachineImage.UpdateIvan Kruglov2024-11-011-17/+9
| |
| * machine: reuse VARLINK_DEFINE_IMAGE_LOOKUP_AND_POLKIT_FIELDS in ↵Ivan Kruglov2024-11-011-4/+2
| | | | | | | | io.systemd.MachineImage.Update declaration
| * machine: introduce io.systemd.MachineImage.Remove methodIvan Kruglov2024-11-014-1/+76
| |
| * machine: introduce io.systemd.MachineImage.Clone methodIvan Kruglov2024-11-014-2/+107
| |
| * machine: use report_errno_and_exit() in dbus codeIvan Kruglov2024-11-011-14/+2
| |
| * machine: introduce report_errno_and_exit()Ivan Kruglov2024-11-012-0/+17
| |
| * machine: align polkit verb of io.systemd.MachineImage.Update with the rest ↵Ivan Kruglov2024-11-011-1/+1
| | | | | | | | of the code
* | Add support for id-mapped mounts to Exec directories (#34078)Luca Boccassi2024-11-0210-13/+176
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, bind-mounted directories within a user/mount namespace get the uid/gid stored on their files. If the host creates a file in the source directory, it will still show as root in the namespace. Id-mapping is a filesystem feature that allows a mount namespace to show a different uid than what is actually stored on a file. Add support for id-mappings to exec directories, so that the files within the mount namespace are owned by the unprivileged uid/gid. Example: Using unit: ``` [Unit] Description=Sample service [Service] MountAPIVFS=yes DynamicUser=yes PrivateUsers=yes TemporaryFileSystem=/run /var/opt /var/lib /vol UMask=0000 ExecStart=/bin/bash -c 'while true; do echo "ping"; sleep 5; done' StateDirectory=andresstatedir:sampleservice [Install] WantedBy=multi-user.target ``` In the host namespace, creating a file "test": ``` root@abeltran-test:/var/lib/andresstatedir# ls -lah total 8.0K drwxr-xr-x 2 root root 4.0K Aug 21 23:48 . drwx------ 3 root root 4.0K Aug 21 23:47 .. -rw-r--r-- 1 root root 0 Aug 21 23:48 test ``` Within the unit namespace: ``` root@abeltran-test:/var/lib/sampleservice# ls -lah total 4.0K drwxr-xr-x 2 63750 63750 4.0K Aug 21 23:48 . drwxr-xr-x 3 root root 60 Aug 21 23:47 .. -rw-r--r-- 1 63750 63750 0 Aug 21 23:48 test ``` ``` root@abeltran-test:/# mount | grep and /dev/sda1 on /var/lib/private/andresstatedir type ext4 (rw,nosuid,noexec,relatime,idmapped,discard,errors=remount-ro,commit=30) ```
| * | core: add id-mapped mount support for Exec directoriesAndres Beltran2024-11-017-13/+112
| | |
| * | namespace-util: add util function to check if id-mapped mounts are supported ↵Andres Beltran2024-11-013-0/+64
| | | | | | | | | | | | for a given path
* | | logind: respect SD_LOGIND_ROOT_CHECK_INHIBITORS with weak blockers (#34969)Luca Boccassi2024-11-022-8/+21
|\ \ \ | |/ / |/| | | | | | | | | | | | | | | | | | | | The check for the old flag was not restored when the weak blocker was added, add it back. Also skip polkit check for root for the weak blocker, to keep compatibility with the previous behaviour. Partially fixes https://github.com/systemd/systemd/issues/34091 Follow-up for 804874d26ac73e0af07c4c5d7165c95372f03f6d
| * | logind: ensure the stronger inhibitor currently in place is taken into accountLuca Boccassi2024-11-011-4/+8
| | |
| * | logind: respect SD_LOGIND_ROOT_CHECK_INHIBITORS with weak blockersLuca Boccassi2024-11-011-4/+13
| |/ | | | | | | | | | | | | | | | | | | | | The check for the old flag was not restored when the weak blocker was added, add it back. Also skip polkit check for root for the weak blocker, to keep compatibility with the previous behaviour. Partially fixes https://github.com/systemd/systemd/issues/34091 Follow-up for 804874d26ac73e0af07c4c5d7165c95372f03f6d
* | core/service: don't propagate stop jobs if RestartMode=direct (#34768)Lennart Poettering2024-11-0119-136/+182
|\ \ | | | | | | Fixes https://github.com/systemd/systemd/issues/34758
| * | core/service: don't propagate stop jobs if RestartMode=directMike Yuan2024-10-271-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The goal of RestartMode=direct is to make restarts invisible to dependents, so auto restart jobs shouldn't bring them down at all. So far we only skipped going through failed/dead states in service_enter_dead(), i.e. the unit would never be considered dead. But when constructing restart transaction, the stop job would be propagated to dependents. Consider the following 2 units: dependent.target: [Unit] BindsTo=a.service After=a.service a.service: [Service] ExecStart=bash -c 'sleep 100 && exit 1' Restart=on-failure RestartMode=direct Before this commit, even though BindsTo= isn't triggered since a.service never failed, when a.service auto-restarts, dependent.target is also restarted. Let's suppress it by using JOB_REPLACE instead of JOB_RESTART_DEPENDENCIES in service_enter_restart(). Fixes #34758 The example above is subtly different from the original report, to illustrate that the new behavior makes sense for less exotic use cases too.
| * | core: make refuse_late_merge a proper attr of Job and introduce ↵Mike Yuan2024-10-275-38/+65
| | | | | | | | | | | | TRANSACTION_REENQUEUE_ANCHOR
| * | core/manager: introduce manager_add_job_full() which takes extra ↵Mike Yuan2024-10-2714-50/+75
| | | | | | | | | | | | | | | | | | TransactionAddFlags No functional change. Preparation for later commits.
| * | core/job: trivial modernizationMike Yuan2024-10-272-15/+18
| | |
| * | core: drop effectively unused UNIT_ATOM_PROPAGATE_RESTARTMike Yuan2024-10-273-31/+21
| | | | | | | | | | | | | | | | | | | | | Restart jobs are always run as stop jobs initially, and later gets converted to start jobs by job engine. Hence UNIT_ATOM_PROPAGATE_STOP should and does cover the restart case, as currently all dep types with _RESTART also carries _STOP. Drop UNIT_ATOM_PROPAGATE_RESTART.
| * | core/service: use log_unit_* where appropriateMike Yuan2024-10-271-3/+3
| | |
* | | resolve: remove always-true superflous check and rename labelLuca Boccassi2024-11-011-8/+6
| |/ |/| | | | | Fixes https://github.com/systemd/systemd/security/code-scanning/2900
* | coredump: lock down EnterNamespace= mount even more (#34975)Luca Boccassi2024-11-011-3/+3
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | Let's disable symlink following if we attach a container's mount tree to our own mount namespace. We afte rall mount the tree to a different location in the mount tree than where it was inside the container, hence symlinks (if they exist) will all point to the wrong places (even if relative, some might point to other places). And since symlink attacks are a thing, and we let libdw operate on the tree, let's lock this down as much as we can and simply disable symlink traversal entirely.
| * | coredump: rename gather_pid_mount_tree_fd() → acquire_pid_mount_tree_fd()Lennart Poettering2024-11-011-2/+2
| | | | | | | | | | | | | | | | | | From my understanding of the english language "gather" imples there are multiple things to gather. But here there's only one, hence use "acquire"
| * | coredump: lock down EnterNamespace= mount even moreLennart Poettering2024-11-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's disable symlink following if we attach a container's mount tree to our own mount namespace. We afte rall mount the tree to a different location in the mount tree than where it was inside the container, hence symlinks (if they exist) will all point to the wrong places (even if relative, some might point to other places). And since symlink attacks are a thing, and we let libdw operate on the tree, let's lock this down as much as we can and simply disable symlink traversal entirely.
* | | util-lib/systemd-run: implement race-free PTY peer opening (#34953)Luca Boccassi2024-11-015-77/+165
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes use of the new TIOCGPTPEER pty ioctl() for directly opening a PTY peer, without going via path names. This is nice because it closes a race around allocating and opening the peer. And also has the nice benefit that if we acquired an fd originating from some other namespace/container, we can directly derive the peer fd from it, without having to reenter the namespace again.
| * | | machined: port to pty_open_peer_racefree()Lennart Poettering2024-10-301-5/+8
| | | |
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 09:21:46 +0100