Builds a systemd-stub addon from the addon stub we ship, with an
optional .cmdline and .initrd section and the same .sbat section ukify
adds, using the PE writer.
systemd-firstboot wants to wrap the archive into a PE section rather
than pass a file to a VMM, hence split the memory part out of the temp
file writer, which becomes a wrapper around it.
repart populates vfat file systems through mtools, as we have no vfat
library, and the wrappers for that lived as static functions in
mkfs-util.c, next to the mkfs invocation. systemd-firstboot is about to
need the same thing for placing a file in the ESP of an image without
mounting it. Move the code into vfat-util.c with a small public API:
copying a whole tree (what repart did so far), creating a directory
with its parents, and copying a single file. The functions take the
image path and the byte offset of the file system in it, so that a
partition inside a larger image can be addressed. That mtools is doing
the work underneath, and that the offset is passed to it with its "@@"
syntax, stays an implementation detail that could be replaced.
The helper that formats $SOURCE_DATE_EPOCH for child processes is
needed by both callers now, hence move it next to
parse_source_date_epoch().
Add a test that writes into a vfat image at an offset and reads the
result back with mtype.
Ubuntu now ships upki, and contains patches for openssl4, curl, and
others, to perform extra certificate validation. One consequence of this
is that using a self-signed cert for both the server's identity, and the
client's trust anchor fails validation.
To fix this, build a simple CA and sign a certificate for the server,
and use the CA cert as the client trust anchor.
This fixes the test on newer Ubuntu, but should still work everywhere.
The tree opens files via the xopenat() family, but nothing stops new
code from calling open() directly, and the repart manifest code already
did so after the migration. Let's port the tests, fuzzers and the two remaining
direct calls in chase and repart to xopenat(), and then add open(), openat()
and creat() to bugprone-unsafe-functions so that clang-tidy reports new
direct calls.
The functions that implement xopenat() and fd_reopen(), the seccomp tests
and the O_EMPTYPATH probe in test-fd-util.c keep calling the syscalls
directly and suppress the check. openat2() can't be covered, since it's a
macro for openat2_shim() and the check ignores calls from macro expansions.
journald keeps track of stream metadata in files identified by dev and
inode numbers. However for sockets, the kernel returns a number that's
truncated to 32 bits. On busy systems, that number can overflow and be
attributed to another service, which will remove the file on exit. When
journald gets restarted, when trying to restore objects, it will see
that the file is missing and emit an error: `systemd-journald[228270]: 1
unknown file descriptors passed, closing`. PID 1 will then retain the fd
and future writes from the daemon that was using that stream will end up
being stuck in the socket that nothing drains.
This PR fixes this by appending `SO_COOKIE` to the name of the stream.
If supports old style streams so that upgrades work and older builds
will load the stream by looking only at the dev and inode, so that
rollbacks work.
Some systems, Supermicro in particular, place the serial number on the
Baseboard (DMI type 2) rather than System Information (DMI type 1).
Two new flags for hwdb are added:
* ID_PRODUCT_SERIAL_IS_RUBBISH
* ID_BOARD_SERIAL_IS_RUBBISH
Tested on:
* Supermicro X10DRW-iT
* Supermicro X11SPW-CTF
Signed-off-by: Pat Riehecky <riehecky@fnal.gov>
It's RouteMetric=, not RouteTable=. Use 'lvalue' so that the string can be
deduplicated.
When extract_first_word() returned 1 but nothing followed the separator,
the word count was passed as the error, so the message ended in
": Operation not permitted". Passing 0 to log_syntax() is OK, but passing
a positive success value is not.
Also don't pass unrelated 'r' in some other cases.
If it is already disconnected, we cannot setup the API bus anyway,
and shows several spurious errors for e.g. failure in
sd_bus_negotiate_creds().
Co-authored-by: Alvaro Leiva Geisse <aleivag@gmail.com>
sd_bus_negotiate_timestamp() and sd_bus_negotiate_creds() used
assert_return() to reject calls once the bus is closing/closed. But
that state is reachable during normal operation, not just caller
misuse: a pending async call's reply callback can still run after the
bus has entered BUS_CLOSING (flushed with a synthetic error reply),
and may then try to negotiate creds/timestamps on the same bus object.
In developer-mode builds, a failed assert_return() aborts the process,
so this turns an expected race into a crash. Replace the assertion
with a plain state check that returns -EPERM, as before, without
aborting.
Fixes the following failure (the log is rebreaked):
```
systemd[1]: Failed to process message type=error sender=org.freedesktop.DBus
destination=n/a path=n/a interface=n/a member=n/a cookie=4294967295
reply_cookie=1 signature=s error-name=org.freedesktop.DBus.Error.Timeout
error-message=Connection terminated: Connection timed out
systemd[1]: Failed to query API bus instance ID, not deserializing subscriptions: Connection terminated
systemd[1]: Assertion '!({ _Bool _found = 0; static const typeof(+bus->state)
__assert_in_set[] __attribute__((__unused__)) = { BUS_CLOSING, BUS_CLOSED };
_Static_assert((__builtin_choose_expr( !__builtin_types_compatible_p(typeof(__assert_in_set),
typeof(&*(__assert_in_set))), sizeof(__assert_in_set)/sizeof((__assert_in_set)[0]), ((void)0))) <= 22,
"ELEMENTSOF(__assert_in_set) <= 22"); switch (bus->state) { case BUS_CLOSING: case BUS_CLOSED:
_found = 1; break; default: ; } _found; })'
failed at src/libsystemd/sd-bus/sd-bus.c:385, function sd_bus_negotiate_creds(). Aborting.
systemd[1]: Caught <ABRT>, from our own process.
```
GnuTLS returns its own negative error codes, so %m printed the strerror()
of an unrelated errno value and verify_cert_authorized() returned the
GnuTLS code as if it were a negative errno. Print the GnuTLS error text
instead.
r is the word count returned by extract_first_word(), i.e. 1, so an
unparsable fd made bpf_program_deserialize_attachment() return success
without setting the output, and the caller inserted a NULL program into
the set.
r is 0 here, the result of the successful decryption, so the refusal was
logged but pcrlock_policy_load_credential() returned success with the
output left untouched, and tpm2_pcrlock_policy_from_credentials() took the
zero-initialised policy as found.
stat() reports failures via errno, but the message used r, which is 0 from
the preceding calls. The log line said "Success" and make_filesystem()
returned 0 without ever running mkfs.btrfs.
fd_nonblock() returns a negative errno; the message used errno, and the
stale value was also recorded for the file and returned.
Also 'r' was set in a roundabout way in a few cases, simplify those.
