From a589e1bd9e1fab1ad4bd6b7341abadabab08e476 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 5 Jun 2025 13:17:17 +0200 Subject: [PATCH 1/3] varlink-util: format system errors via %m in varlink_call_and_log() This kinda does what bee59ab901ca199d194f440cf37f7645004d3054 did for varlinkctl also for the generic varlink_call_and_log() handler. --- src/libsystemd/sd-varlink/varlink-util.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/libsystemd/sd-varlink/varlink-util.c b/src/libsystemd/sd-varlink/varlink-util.c index dfefe088628..cc18656d138 100644 --- a/src/libsystemd/sd-varlink/varlink-util.c +++ b/src/libsystemd/sd-varlink/varlink-util.c @@ -59,9 +59,13 @@ int varlink_call_and_log( r = sd_varlink_call(v, method, parameters, &reply, &error_id); if (r < 0) return log_error_errno(r, "Failed to issue %s() varlink call: %m", method); - if (error_id) - return log_error_errno(sd_varlink_error_to_errno(error_id, reply), - "Failed to issue %s() varlink call: %s", method, error_id); + if (error_id) { + r = sd_varlink_error_to_errno(error_id, reply); /* If this is a system errno style error, output it with %m */ + if (r != -EBADR) + return log_error_errno(r, "Failed to issue %s() varlink call: %m", method); + + return log_error_errno(r, "Failed to issue %s() varlink call: %s", method, error_id); + } if (ret_parameters) *ret_parameters = TAKE_PTR(reply); From 01e82dfa960945d2705955317e11c3d517022e9b Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 5 Jun 2025 13:18:45 +0200 Subject: [PATCH 2/3] dissect-image: port to varlink_callbo_and_log() --- src/shared/dissect-image.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c index 34877ffa565..20afa421d15 100644 --- a/src/shared/dissect-image.c +++ b/src/shared/dissect-image.c @@ -67,6 +67,7 @@ #include "time-util.h" #include "udev-util.h" #include "user-util.h" +#include "varlink-util.h" #include "xattr-util.h" /* how many times to wait for the device nodes to appear */ @@ -4586,7 +4587,7 @@ int mountfsd_mount_image( } sd_json_variant *reply = NULL; - r = sd_varlink_callbo( + r = varlink_callbo_and_log( vl, "io.systemd.MountFileSystem.MountImage", &reply, @@ -4598,9 +4599,7 @@ int mountfsd_mount_image( SD_JSON_BUILD_PAIR_CONDITION(!!ps, "imagePolicy", SD_JSON_BUILD_STRING(ps)), SD_JSON_BUILD_PAIR("allowInteractiveAuthentication", SD_JSON_BUILD_BOOLEAN(FLAGS_SET(flags, DISSECT_IMAGE_ALLOW_INTERACTIVE_AUTH)))); if (r < 0) - return log_error_errno(r, "Failed to call MountImage() varlink call: %m"); - if (!isempty(error_id)) - return log_error_errno(sd_varlink_error_to_errno(error_id, reply), "Failed to call MountImage() varlink call: %s", error_id); + return r; r = sd_json_dispatch(reply, dispatch_table, SD_JSON_ALLOW_EXTENSIONS, &p); if (r < 0) @@ -4723,7 +4722,7 @@ int mountfsd_mount_directory( sd_json_variant *reply = NULL; const char *error_id = NULL; - r = sd_varlink_callbo( + r = varlink_callbo_and_log( vl, "io.systemd.MountFileSystem.MountDirectory", &reply, @@ -4735,9 +4734,7 @@ int mountfsd_mount_directory( FLAGS_SET(flags, DISSECT_IMAGE_IDENTITY_UID) ? "identity" : "auto"), SD_JSON_BUILD_PAIR_BOOLEAN("allowInteractiveAuthentication", FLAGS_SET(flags, DISSECT_IMAGE_ALLOW_INTERACTIVE_AUTH))); if (r < 0) - return log_error_errno(r, "Failed to call MountDirectory() varlink call: %m"); - if (!isempty(error_id)) - return log_error_errno(sd_varlink_error_to_errno(error_id, reply), "Failed to call MountDirectory() varlink call: %s", error_id); + return r; static const sd_json_dispatch_field dispatch_table[] = { { "mountFileDescriptor", _SD_JSON_VARIANT_TYPE_INVALID, sd_json_dispatch_uint, 0, SD_JSON_MANDATORY }, From c882e7f1246785c2751fa446bf193469b01b47f6 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 5 Jun 2025 14:12:18 +0200 Subject: [PATCH 3/3] mountfsd: slightly relax check on image fds Fixes: #35111 --- src/mountfsd/mountwork.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/src/mountfsd/mountwork.c b/src/mountfsd/mountwork.c index 86e999efec4..0efdcf57c5e 100644 --- a/src/mountfsd/mountwork.c +++ b/src/mountfsd/mountwork.c @@ -103,9 +103,16 @@ static int validate_image_fd(int fd, MountImageParameters *p) { assert(fd >= 0); assert(p); - r = fd_verify_regular(fd); - if (r < 0) - return r; + struct stat st; + if (fstat(fd, &st) < 0) + return -errno; + /* Only support regular files and block devices. Let's use stat_verify_regular() here for the nice + * error numbers it generates. */ + if (!S_ISBLK(st.st_mode)) { + r = stat_verify_regular(&st); + if (r < 0) + return r; + } fl = fd_verify_safe_flags(fd); if (fl < 0) @@ -128,8 +135,6 @@ static int validate_image_fd(int fd, MountImageParameters *p) { } static int verify_trusted_image_fd_by_path(int fd) { - _cleanup_free_ char *p = NULL; - struct stat sta; int r; assert(fd >= 0); @@ -148,11 +153,18 @@ static int verify_trusted_image_fd_by_path(int fd) { return false; } + _cleanup_free_ char *p = NULL; r = fd_get_path(fd, &p); if (r < 0) return log_debug_errno(r, "Failed to get path of passed image file descriptor: %m"); + + struct stat sta; if (fstat(fd, &sta) < 0) return log_debug_errno(errno, "Failed to stat() passed image file descriptor: %m"); + if (!S_ISREG(sta.st_mode)) { + log_debug("Image '%s' is not a regular file, hence skipping trusted directory check.", p); + return false; + } log_debug("Checking if image '%s' is in trusted directories.", p);