mountfsd: support processing block devices with MountImage() (#37746)

Fixes: #35111

src/libsystemd/sd-varlink/varlink-util.c

@@ -59,9 +59,13 @@ int varlink_call_and_log(
         r = sd_varlink_call(v, method, parameters, &reply, &error_id);
         if (r < 0)
                 return log_error_errno(r, "Failed to issue %s() varlink call: %m", method);
-        if (error_id)
-                return log_error_errno(sd_varlink_error_to_errno(error_id, reply),
-                                         "Failed to issue %s() varlink call: %s", method, error_id);
+        if (error_id) {
+                r = sd_varlink_error_to_errno(error_id, reply); /* If this is a system errno style error, output it with %m */
+                if (r != -EBADR)
+                        return log_error_errno(r, "Failed to issue %s() varlink call: %m", method);
+
+                return log_error_errno(r, "Failed to issue %s() varlink call: %s", method, error_id);
+        }
 
         if (ret_parameters)
                 *ret_parameters = TAKE_PTR(reply);

src/mountfsd/mountwork.c

@@ -103,9 +103,16 @@ static int validate_image_fd(int fd, MountImageParameters *p) {
         assert(fd >= 0);
         assert(p);
 
-        r = fd_verify_regular(fd);
-        if (r < 0)
-                return r;
+        struct stat st;
+        if (fstat(fd, &st) < 0)
+                return -errno;
+        /* Only support regular files and block devices. Let's use stat_verify_regular() here for the nice
+         * error numbers it generates. */
+        if (!S_ISBLK(st.st_mode)) {
+                r = stat_verify_regular(&st);
+                if (r < 0)
+                        return r;
+        }
 
         fl = fd_verify_safe_flags(fd);
         if (fl < 0)
@@ -128,8 +135,6 @@ static int validate_image_fd(int fd, MountImageParameters *p) {
 }
 
 static int verify_trusted_image_fd_by_path(int fd) {
-        _cleanup_free_ char *p = NULL;
-        struct stat sta;
         int r;
 
         assert(fd >= 0);
@@ -148,11 +153,18 @@ static int verify_trusted_image_fd_by_path(int fd) {
                 return false;
         }
 
+        _cleanup_free_ char *p = NULL;
         r = fd_get_path(fd, &p);
         if (r < 0)
                 return log_debug_errno(r, "Failed to get path of passed image file descriptor: %m");
+
+        struct stat sta;
         if (fstat(fd, &sta) < 0)
                 return log_debug_errno(errno, "Failed to stat() passed image file descriptor: %m");
+        if (!S_ISREG(sta.st_mode)) {
+                log_debug("Image '%s' is not a regular file, hence skipping trusted directory check.", p);
+                return false;
+        }
 
         log_debug("Checking if image '%s' is in trusted directories.", p);
 

src/shared/dissect-image.c

@@ -67,6 +67,7 @@
 #include "time-util.h"
 #include "udev-util.h"
 #include "user-util.h"
+#include "varlink-util.h"
 #include "xattr-util.h"
 
 /* how many times to wait for the device nodes to appear */
@@ -4586,7 +4587,7 @@ int mountfsd_mount_image(
         }
 
         sd_json_variant *reply = NULL;
-        r = sd_varlink_callbo(
+        r = varlink_callbo_and_log(
                         vl,
                         "io.systemd.MountFileSystem.MountImage",
                         &reply,
@@ -4598,9 +4599,7 @@ int mountfsd_mount_image(
                         SD_JSON_BUILD_PAIR_CONDITION(!!ps, "imagePolicy", SD_JSON_BUILD_STRING(ps)),
                         SD_JSON_BUILD_PAIR("allowInteractiveAuthentication", SD_JSON_BUILD_BOOLEAN(FLAGS_SET(flags, DISSECT_IMAGE_ALLOW_INTERACTIVE_AUTH))));
         if (r < 0)
-                return log_error_errno(r, "Failed to call MountImage() varlink call: %m");
-        if (!isempty(error_id))
-                return log_error_errno(sd_varlink_error_to_errno(error_id, reply), "Failed to call MountImage() varlink call: %s", error_id);
+                return r;
 
         r = sd_json_dispatch(reply, dispatch_table, SD_JSON_ALLOW_EXTENSIONS, &p);
         if (r < 0)
@@ -4723,7 +4722,7 @@ int mountfsd_mount_directory(
 
         sd_json_variant *reply = NULL;
         const char *error_id = NULL;
-        r = sd_varlink_callbo(
+        r = varlink_callbo_and_log(
                         vl,
                         "io.systemd.MountFileSystem.MountDirectory",
                         &reply,
@@ -4735,9 +4734,7 @@ int mountfsd_mount_directory(
                                                           FLAGS_SET(flags, DISSECT_IMAGE_IDENTITY_UID) ? "identity" : "auto"),
                         SD_JSON_BUILD_PAIR_BOOLEAN("allowInteractiveAuthentication", FLAGS_SET(flags, DISSECT_IMAGE_ALLOW_INTERACTIVE_AUTH)));
         if (r < 0)
-                return log_error_errno(r, "Failed to call MountDirectory() varlink call: %m");
-        if (!isempty(error_id))
-                return log_error_errno(sd_varlink_error_to_errno(error_id, reply), "Failed to call MountDirectory() varlink call: %s", error_id);
+                return r;
 
         static const sd_json_dispatch_field dispatch_table[] = {
                 { "mountFileDescriptor", _SD_JSON_VARIANT_TYPE_INVALID, sd_json_dispatch_uint, 0, SD_JSON_MANDATORY },