summaryrefslogtreecommitdiffstats
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #27527 from mrc0mmand/fuzz-manager-serializeLuca Boccassi2023-05-063-91/+167
|\ | | | | core: a couple of follow-ups for issues found by fuzz-manager-serialize
| * core: check the unit type more thoroughly when deserializingFrantisek Sumsal2023-05-051-1/+3
| | | | | | | | Resolves: #27523
| * shared: refuse fd == INT_MAXFrantisek Sumsal2023-05-051-0/+14
| | | | | | | | | | | | | | Since we do `FD_TO_PTR(fd)` that expands to `INT_TO_PTR(fd) + 1` which triggers an integer overflow. Resolves: #27522
| * core: use extract_first_word() instead of sscanf()Frantisek Sumsal2023-05-051-90/+150
| |
* | basic/audit-util: make a test request before enabling use of auditNick Rosbrook2023-05-051-1/+60
|/ | | | | | | | | | | | | | | | | | If a container manager does not follow the guidance in https://systemd.io/CONTAINER_INTERFACE/ regarding audit capabilities, then the current check may not be sufficient to determine that audit will function properly. In particular, when calling bind() on the audit fd, we will get EPERM if running in a user-namespaced container. Expand the check to make an AUDIT_GET_FEATURE request on the audit fd to test if it is working. If this fails with ECONNREFUSED, we know it is because the kernel does not support the use of audit outside of the initial user namespace. Note that the approach of this patch was suggested here: https://github.com/systemd/systemd/pull/19443#issuecomment-829566659 Fixes: #6519
* Merge pull request #27536 from dtardon/checked-fd-parsingLuca Boccassi2023-05-0514-47/+75
|\ | | | | Always check parsed fds for validity
| * main: improve log messageDavid Tardon2023-05-051-1/+1
| |
| * tree-wide: use parse_fd()David Tardon2023-05-0511-47/+46
| |
| * test: add a test for parse_fd()David Tardon2023-05-051-0/+13
| |
| * fd-util: introduce parse_fd()David Tardon2023-05-052-0/+16
| | | | | | | | | | It's a simple wrapper for safe_atoi() that returns error if the parsed fd is < 0 .
| * main: add missing returnDavid Tardon2023-05-051-1/+1
| | | | | | | | Follow-up-for: 2b5107e1625e0847179da0d35eb544192766886f
* | tpm2 PCRs: fix unchecked attempt to set PCR[24]OMOJOLA2023-05-052-2/+3
|/
* execute: remove credentials dir again when emptyLennart Poettering2023-05-042-0/+6
| | | | | | | | | | | | | | | This is closely related to the previous commit: if the credentials dir is empty and nothing mounted on it, let's remove it again. This will in particular happen if we decided to not actually install the mount we prepared for the credentials because it is empty. In that case the mount point inode is already there, and with this we'll remove it. Primary effect, users will see ENOENT rather than EACCESS when trying to access it, which should be preferable, given we already handle that nicely in our credential consumption code. This should also be useful on systems where we lack any privs to create mounts, and thus operate on a regular dir anyway.
* execute: suppress credentials mount if emptyLennart Poettering2023-05-041-7/+25
| | | | | | | | | | | | | Let's avoid creating another mount in the system if it's empty anyway. This is mostl a cosmetic thing in one (pretty common) special case: if creds settings are used in a unit but no creds actually available to be passed. (While we are at it this also does one more minor optimization: it adjusts the MS_RDONLY/MS_NOSUID/… flags of the source mount we are about to MS_MOVE into the right place only if we actually really move it, and if we instead unmount it again we won't bother with the flags either)
* run: change sd_bus_call_method to bus_call_method (#27518)Arthur Shau2023-05-041-8/+6
| | | Migrates the sd_bus_call_method code in run.c to use bus-locator.h api
* core: fix use of uninitialized valueYu Watanabe2023-05-041-1/+1
| | | | Fixes https://github.com/systemd/systemd/pull/27504#issuecomment-1533354787.
* cryptsetup: downgrade a bunch of log messages that to LOG_WARNINGLennart Poettering2023-05-031-38/+24
| | | | | In all these cases we ignore the failure, hence per our rule the log level should be below LOG_ERR. Fix that.
* mount-util: simplify mount_switch_root() a bitLennart Poettering2023-05-033-37/+80
| | | | | | | | | | | | | There's no need to fchdir() out of the rootfs and back into it around the umount2(), hence don't. This brings the logic closer to what the pivot_root() man page suggests. While we are at it, always operate based on fds, once we opened the original dir, and pass the path string along only for generating messages (i.e. as "decoration"). Add tests for both code paths: the pivot_root() one and the MS_MOUNT.
* Merge pull request #27450 from poettering/switch-root-modernizeLennart Poettering2023-05-036-73/+81
|\ | | | | pid1: modernize switch root logic a bit
| * base-filesystem: unify common parts of base_filesystem_create_fd() branchesLennart Poettering2023-05-031-25/+13
| | | | | | | | | | | | | | The error handling and fchmodat() invocation is pretty much the same in the directory and symlink branches, hence make them the same. No real change in behaviour. Just refactoring.
| * base-filesystem: add new helper base_filesystem_create_fd() that operates on ↵Lennart Poettering2023-05-033-6/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | an fd, instead of a path This also changes the open flags from O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW to O_DIRECTORY|O_CLOEXEC. O_RDONLY is redundant, since O_RDONLY is zero anyway, and O_DIRECTORY pins the acces mode enough: it doesn't allow read()/write() anyway when specified. O_NONBLOCK is also pointless given that O_DIRECTORY is specified, it has no meaning on directories. (It is useful if we don't know much about the inode we are opening, and could be a device node or fifo, but the O_DIRECTORY excludes that case.) O_NOFOLLOW is dropped since there's really no point in blocking out the initial entrypoint being a symlink. Once we pinned the the root of the tree it might make sense to restrict symlink use below it, but for the entrypoint itself it doesn't matter.
| * switch-root: don't require /mnt/ when switching root into host OSLennart Poettering2023-05-034-42/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | So far, we invoked pivot_root() specifying /mnt/ as second argument, which then unmounted right-after. We'd create /mnt/ if needed. This sucks, because it means /mnt/ must strictly be pre-created on immutable images. Remove this limitation, by using pivot_root() with "." as source and target, which will result in two stacked mounts afterwards: the new one underneath, the old one ontop. We can then simply unmount the top one, and have what we want without needing any extra /mnt/ dir. Since we don't need /mnt/ anymore we can get rid of the extra unmount_old_root parameter and simply specify it as NULL if we don't want the old mount to stick around.
* | core: minor coding style modernization in mount.cLennart Poettering2023-05-031-4/+3
| |
* | sd-daemon: add sd_pid_notify_barrier() call and use it in systemd-notifyLennart Poettering2023-05-034-3/+13
| | | | | | | | | | Previously we'd honour --pid= from the main notification we send, but not from the barrier. This is confusing at best. Let's fix that.
* | Merge pull request #27510 from poettering/notify-barrier-pid-1-tweaksLennart Poettering2023-05-031-5/+6
|\ \ | | | | | | pid 1 notify barrier handling tweaks
| * | manager: add debug logging about BARRIER=1 messagesLennart Poettering2023-05-031-1/+3
| | |
| * | manager: simplify manager_process_barrier_fd() a bitLennart Poettering2023-05-031-4/+3
| |/
* / notify: don't send EXIT_STATUS= notify message from systemd-notifyLennart Poettering2023-05-031-0/+5
|/ | | | | | | | | | | | | | | | | | | In 623a00020f116d8e9c70608a9e4f7cc978342441 code was added that our various programs send a notification message with their exit status on exit. This is great, but it becomes utterly confusing in systemd-notify, whose primary purpose is to send such messages after all, and sending an implicit one in addition to the primary one is particularly confusing, when debugging things. Let's hence just drop the implicit message. systemd-notify's exit status is after all indicative primarily because sd_notify() failed, and hence it's pretty pointless to then send that fact as another sd_notify() message. (Primary reason for this patch is simply that it confused the hell out of me, when debugging sd_notify() issues) Follow-up for: 623a00020f116d8e9c70608a9e4f7cc978342441
* Merge pull request #27504 from mrc0mmand/fuzz-manager-serializeYu Watanabe2023-05-035-1/+56
|\ | | | | test: add a simple fuzzer for manager serialization
| * shared: reject empty attachment pathFrantisek Sumsal2023-05-031-0/+3
| |
| * shared: ignore invalid valink socket fd when deserializingFrantisek Sumsal2023-05-031-1/+3
| |
| * core: fix NULL pointer dereference during deserializationFrantisek Sumsal2023-05-031-0/+5
| |
| * test: add a simple fuzzer for manager serializationFrantisek Sumsal2023-05-032-0/+45
| |
* | Merge pull request #27499 from yuwata/sd-journal-fix-loopYu Watanabe2023-05-031-24/+13
|\ \ | | | | | | sd-journal: check .next_entry_array_offset earlier
| * | Revert "sd-journal: introduce simple loop detection for entry array objects"Yu Watanabe2023-05-021-19/+7
| | | | | | | | | | | | | | | | | | | | | This reverts commit a8fbcc0e3c033a43e511550052cace6b0dcf3df7. The commit is not necessary, as the invalid entry array object is filtered earlier by the previous commit.
| * | sd-journal: check .next_entry_array_offset earlierYu Watanabe2023-05-021-5/+6
| | | | | | | | | | | | | | | | | | | | | Then, if it is invalid, refuse to use the entry array object. Follow-up for a8fbcc0e3c033a43e511550052cace6b0dcf3df7. Fixes #27489.
* | | boot: Use correct memory type for allocationsJan Janssen2023-05-021-1/+1
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We were using the wrong memory type when allocating pool memory. This does not seem to cause a problem on x86, but the kernel will fail to boot at least on ARM in QEMU. This is caused by mixing different allocation types which ended up breaking the kernel or EDK2 during boot services exit. Commit 2f3c3b0bee5534f2338439f04b0aa517479f8b76 appears to fix this boot failure because it was replacing the gnu-efi xpool_print with xasprintf thereby unifying the allocation type. But this same issue can also happen without this fix somehow when the random-seed logic is in use. Fixes: #27371
* | core: check for SERVICE_RELOAD_NOTIFY in manager_dbus_is_runningmsizanoen12023-05-021-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | This ensures that systemd won't erronously disconnect from the system bus in case a bus recheck is triggered immediately after the bus service emits `RELOADING=1`. This fixes an issue where systemd-logind sometimes randomly stops receiving `UnitRemoved` after a system update. This also handles SERVICE_RELOAD_SIGNAL just in case somebody ever creates a D-Bus broker implementation that uses `Type=notify-reload`.
* | journal: handle EADDRNOTAVAIL in two more cases gracefullyLennart Poettering2023-05-022-0/+2
| | | | | | | | Follow-up for #27488.
* | Merge pull request #27493 from poettering/generate-sym-test-tweaksYu Watanabe2023-05-021-2/+27
|\ \ | | | | | | fixes/additions for generate-sym-test
| * | generate-sym-test: only look in .c and .h filesLennart Poettering2023-05-021-0/+2
| | | | | | | | | | | | | | | Otherwise it might find backup files and such, which triggered all kinds of false positives (at least on my devel machine).
| * | generate-sym-test: search for missing symbolsLennart Poettering2023-05-021-2/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This slightly extends the symbol file test and checks which symbols are listed in one list but missing in the other. This is tremendously useful to quickly determine which symbols wheren't exposed properly but should have been. (This is is implemented in pure C, no systemd helpers, to ensure we see libsystemd.so API as any other tool would.)
* | | Merge pull request #27492 from poettering/base-filesystem-000Mike Yuan2023-05-022-6/+4
|\ \ \ | | | | | | | | base-filesystem: create /proc, /sys, /dev mount points as 555
| * | | mount-setup: use size_t when iterating through array indexesLennart Poettering2023-05-021-3/+1
| | | |
| * | | base-filesystem: create /proc, /sys, /dev mount points as 0555Lennart Poettering2023-05-021-3/+3
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These inodes are going to be overmounted anyway, hence let's create them with access mode 555, so that they are as close to being immutable as regular UNIX access modes allow them to be. In other words: this takes the "w" mode away for root. This of course usually has little effect -- unless CAP_DAC_OVERRIDE is dropped. But at the very least it makes the point clear that inodes should be considered immutable. (I intended to make this 0000 originally, but that doesn't work, as many tools – including our own – have fallback paths that when they see ENOENT in /proc/ they can handle this gracefully. But changing the mode to 000 would turn this to EACCES - something they usually have no fallback path for)
* | | generators: skip private tmpfs if /tmp does not existLuca Boccassi2023-05-021-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | When spawning generators within a sandbox we want a private /tmp, but it might not exist, and on some systems we might be unable to create it because users want a BTRFS subvolume instead. Fixes https://github.com/systemd/systemd/issues/27436
* | | tree-wide: Handle EADDRNOTAVAIL as journal corruptionDaan De Meyer2023-05-023-9/+9
|/ / | | | | | | | | Journal corruption is not only indicated by EBADMSG but also by EADDRNOTAVAIL so treat that as corruption in a few more cases.
* | Merge pull request #27455 from yuwata/test-lib-symYu Watanabe2023-05-018-57/+114
|\ \ | | | | | | test: check all public functions are listed in .sym file
| * | test: also test all _public_ functions are listed in .sym filesYu Watanabe2023-05-014-31/+88
| | | | | | | | | | | | Co-authored-by: Frantisek Sumsal <frantisek@sumsal.cz>
| * | libsystemd: add missing _public_ attributesYu Watanabe2023-04-292-2/+2
| | |
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-06 02:58:03 +0100