POSIX queue creation bypasses the path hooks. Its resource accounting must
keep the creator's user namespace alive while the queue exists, or
nsresourced could recycle IDs still recorded in the queue's inode.
Let's check that no namespace-free notification arrives after the creator
exits and the namespace descriptors are closed, then require the
notification after unlinking the queue.
(cherry picked from commit 4b10f0a649)
Btrfs subvolume creation bypasses the path and inode creation hooks. A
managed user namespace can therefore leave a subvolume root owned by its
transient range on a file system that outlives the namespace.
Let's apply the existing creation restrictions to the native and compat
ioctl calls for subvolume creation. The tests check persistent and idmapped
mounts, nested user namespaces, unrelated ioctls and other file systems.
The compat ioctl hook is absent on older kernels. Let's preserve the
native policy when that hook isn't available.
(cherry picked from commit bdd20e5ff6)
The restriction tests don't cover unnamed files or whiteout creation.
Let's check that O_TMPFILE and RENAME_WHITEOUT follow the named-file
restrictions on host, private and idmapped file systems, including
O_TMPFILE with O_EXCL.
Let's probe O_TMPFILE support before checking the host directory and use
link_fd() so the positive link checks also work on kernels before 6.10.
(cherry picked from commit d0f0c1290a)
renameat2() with RENAME_WHITEOUT leaves a whiteout in place of the
source. That's a character device owned by the caller's fsuid and fsgid
which the file system creates from its ->rename() method, so it never
passes the path_mknod hook. Since Linux 5.8 this doesn't require any
privileges either.
So a managed user namespace that can rename an entry on a file system
that outlives it, e.g., in a world-writable directory the user prepared
from the outside, can leave a whiteout owned by its transient range
behind.
The only hook that sees this is path_rename, which gets the flags.
Refuse RENAME_WHITEOUT there whenever validate_mount() would refuse a
mknod in the source directory.
(cherry picked from commit 075c364273)
O_TMPFILE creates an inode without calling the path creation hooks, so a
managed user namespace can leave a file owned by its transient range on a
file system that outlives it. O_EXCL prevents linking the inode, but a host
process can reopen it through /proc/self/fd without retaining credentials
that keep the creator's user namespace alive.
Let's apply the named-file restrictions from the file_open hook to every
O_TMPFILE, including O_EXCL, so an unnamed file can't outlive its IDs.
(cherry picked from commit 304c9d3d9e)
If it is already disconnected, we cannot setup the API bus anyway,
and shows several spurious errors for e.g. failure in
sd_bus_negotiate_creds().
Co-authored-by: Alvaro Leiva Geisse <aleivag@gmail.com>
(cherry picked from commit f96742e512)
sd_bus_negotiate_timestamp() and sd_bus_negotiate_creds() used
assert_return() to reject calls once the bus is closing/closed. But
that state is reachable during normal operation, not just caller
misuse: a pending async call's reply callback can still run after the
bus has entered BUS_CLOSING (flushed with a synthetic error reply),
and may then try to negotiate creds/timestamps on the same bus object.
In developer-mode builds, a failed assert_return() aborts the process,
so this turns an expected race into a crash. Replace the assertion
with a plain state check that returns -EPERM, as before, without
aborting.
Fixes the following failure (the log is rebreaked):
```
systemd[1]: Failed to process message type=error sender=org.freedesktop.DBus
destination=n/a path=n/a interface=n/a member=n/a cookie=4294967295
reply_cookie=1 signature=s error-name=org.freedesktop.DBus.Error.Timeout
error-message=Connection terminated: Connection timed out
systemd[1]: Failed to query API bus instance ID, not deserializing subscriptions: Connection terminated
systemd[1]: Assertion '!({ _Bool _found = 0; static const typeof(+bus->state)
__assert_in_set[] __attribute__((__unused__)) = { BUS_CLOSING, BUS_CLOSED };
_Static_assert((__builtin_choose_expr( !__builtin_types_compatible_p(typeof(__assert_in_set),
typeof(&*(__assert_in_set))), sizeof(__assert_in_set)/sizeof((__assert_in_set)[0]), ((void)0))) <= 22,
"ELEMENTSOF(__assert_in_set) <= 22"); switch (bus->state) { case BUS_CLOSING: case BUS_CLOSED:
_found = 1; break; default: ; } _found; })'
failed at src/libsystemd/sd-bus/sd-bus.c:385, function sd_bus_negotiate_creds(). Aborting.
systemd[1]: Caught <ABRT>, from our own process.
```
(cherry picked from commit 6cadc7f86b)
Ubuntu now ships upki, and contains patches for openssl4, curl, and
others, to perform extra certificate validation. One consequence of this
is that using a self-signed cert for both the server's identity, and the
client's trust anchor fails validation.
To fix this, build a simple CA and sign a certificate for the server,
and use the CA cert as the client trust anchor.
This fixes the test on newer Ubuntu, but should still work everywhere.
(cherry picked from commit 7ad5ff04a9)
The functions returned -EPERM for every failure. The callers only test
for a negative value, so this is cosmetic.
(cherry picked from commit 4a2967f950)
Here the logging was fine, but the bogus r == -1 value was propagated
as the return value. The parent then logged
"Remounting '…' failed abnormally, child process … failed: Operation not permitted"
whatever the real error was, and returned -EPERM. Do what
umount_with_timeout() already does with umount2().
(cherry picked from commit 8087660ccc)
If --no-block is specified, the waiter is not allocated. But
bus_wait_for_units_run() was called unconditionally, and it asserts that
its argument is not NULL.
Only wait for the units when the waiter is allocated, as verb_kill()
does.
(cherry picked from commit 893d9cfb50)
libcurl regularly asks for very short timeouts, most prominently a
timeout of 0 to kick off a new transfer. We so far armed the curl timer
with the default accuracy of 250ms, which means every such kick-off might
be delayed by up to 250ms.
Rather than disabling the accuracy logic altogether, pick the accuracy
dynamically: if the timeout is closer than the default accuracy, request
maximum accuracy, otherwise go back to the default accuracy, so that
longer curl timeouts can still be coalesced with other wakeups.
To make this possible, export the default accuracy constant of sd-event
as EVENT_DEFAULT_ACCURACY_USEC in event-util.h.
This is based on the analysis and fix by Joe Kurokawa in #44544, which
set the accuracy to 1ms unconditionally. The test case
test_curl_glue_start_latency() is taken from that PR as-is, written by
Joe Kurokawa.
Fixes: #44478
Alternative to: #44544
(cherry picked from commit 07dbaa6ab0)
search_ipc() returns a positive value when IPC objects exist, which is not
an error. Passing it to log_debug_errno() made the message end in
"Operation not permitted".
(cherry picked from commit 5e8b5bbc9b)
Make that caveat from the previous commit more obvious with a logged
warning, and document the workaround (or really, the fix) of disabling
`net.ipv4.conf.all.rp_filter` globally.
Signed-off-by: Martin Pitt <martin@amutable.com>
(cherry picked from commit cec6bc4ea6)
With `systemd.imds.network=locked`, imdsd cannot reach IMDS at all. Our
sysctl.d/50-default.conf enables IPv4 reverse path filtering for all
links. Locked mode adds a "prohibit" route for the IMDS address to the
main table. imdsd's marked sockets use their own table, so its
_requests_ get out. But IMDS's _replies_ carry no mark: the reverse path
filter checks their source against the main table, finds the prohibit
route, and drops them.
To fix this, turn off reverse path filtering on the configured links in
locked mode. The prohibit route still blocks direct access for everybody
else.
Caveat: This does not help where `net.ipv4.conf.all.rp_filter` is on, as
the kernel applies the maximum of that and the link's setting. Ubuntu
does that by default, so for now this only works out of the box on
Debian, Fedora, etc. Cover that case in the tests, and expect a
timeout/failure with `all.rp_filter > 0`.
Fixes#44602
Signed-off-by: Martin Pitt <martin@amutable.com>
(cherry picked from commit 9d7ae503d9)
Talk to it via a veth pair, instead of a dummy link on the same "host"
(network namespace). This makes it subject to routing and thus starts
getting controlled by the `systemd.imds.network=locked` setting.
This models what a real cloud instance does much more realistically.
Model a cloud instance instead:
Signed-off-by: Martin Pitt <martin@amutable.com>
(cherry picked from commit c78a83a69f)
Cover state files with socket cookie, state files named without it as
written by older versions, and state files of other streams with the same
inode number, both with a different cookie and without cookie.
(cherry picked from commit 593fcfa5e0)
Stream state files in /run/systemd/journal/streams/ are named after the
device and inode number of the stream socket. Socket inode numbers are
handed out by get_next_ino(), a 32-bit counter shared with pipes and other
pseudo files, which wraps around within a couple of days on busy systems.
Once it has, a new stream can get the inode number of a long-running one.
Its state file then overwrites the long-running stream's, and is removed
when the new stream ends. On the next journald restart the long-running
stream's fd has no state file and is closed as unknown, while PID 1 keeps
its copy in the fd store: the service's stdout ends up connected to a
socket nobody reads from, and the service blocks once the buffer is full.
Append the socket cookie, which is never reused, to the state file name of
new streams and match it on restore. The device and inode numbers stay in
front so that older versions, which only parse those, can still restore
streams after a downgrade. State files named without cookie by older
versions are still accepted and matched by device and inode number only,
skipping sockets that have a state file with cookie of their own.
(cherry picked from commit 5da9fa80fd)
Move an older mount below a newer one, on top of a symlink pointing outside of
the prefix, and verify that umount_recursive() with MNT_DETACH leaves the mount
the symlink leads to alone.
Also verify that a busy mount reached first doesn't keep an older one from being
unmounted.
(cherry picked from commit fd481dc26d)
umount_recursive_full() broke out of the mountinfo iteration on the first
successful umount2(), so the outer loop re-parsed all of /proc/self/mountinfo
from scratch for every mount it removed. Tearing down N mounts below a prefix
therefore cost N full parses of the entire mount table.
Unmount everything reachable from a single snapshot instead, and only re-parse
when a pass made progress. Mounts that are still busy (e.g. a parent reached
before its child) are retried on the next pass.
An unmount can invalidate later entries of the snapshot though: with
MNT_DETACH a parent takes its children along, and their old paths then resolve
through whatever the parent was covering. If that contains a symlink, the path
can lead to an unrelated mount outside of the prefix or on the keep list. So
before unmounting, check that the path still refers to the mount ID we read
from the table. If anything looks off after we unmounted something, go for a
fresh snapshot. In a snapshot without unmounts of ours, skip an entry that does
not match or cannot be unmounted, so that one stuck mount doesn't block the
others, and if the check itself fails try umount2() anyway, as that might work
even if we cannot look at the mount.
Timing umount_recursive_full() with an equal number of unrelated mounts
present, on an -O0 build (mean of 5 runs): 100 mounts below the prefix go from
20.0ms to 1.6ms, 300 from 145.1ms to 4.0ms, and 600 from 538.2ms to 8.0ms.
(cherry picked from commit 97bb0a5981)
Fixes a bug reported in #43975, where Transfer.Cancel is authorized by
import1.pull policy, which should be import1.cancel instead.
(cherry picked from commit d38eca0d2d)
pidfd_get_inode_id_self_cached() keys its cache on the PID only. This is
not sufficient to detect that we are in a different process: if we are
PID 1 of a PID namespace and fork off a child into a new PID namespace,
the child will be PID 1 too, and would then continue to use the parent's
cached pidfd ID. For example, a nested nspawn running as PID 1 would fill
the cache in sd_listen_fds() (which checks $LISTEN_PIDFDID), and then
pass its own ID to the payload, which would in turn drop the fds passed
to it.
Fix this by explicitly flushing the cache from reset_cached_pid(), i.e.
the pthread_atfork() child handler and from raw_clone(), the same way we
already flush the cached PID.
Also add a test that covers the PID 1 → PID 1 case.
(cherry picked from commit b7ab919eba)
Quite a few places read an integer sysctl and parse it manually, each in
its own way: some via read_one_line_file() on a hand-built /proc/sys/
path, some via sysctl_read() followed by safe_atoX(), parse_boolean() or
even a plain string comparison, and parsing into various integer types
(int, unsigned, unsigned long, uint64_t).
Add three helpers, sysctl_read_int(), sysctl_read_unsigned() and
sysctl_read_uint64(), plus a sysctl_read_uint32() alias for
sysctl_read_unsigned() for places where the value is stored in a
strictly 32-bit type (such as uid_t/gid_t), and a sysctl_read_lu()
wrapper that maps to sysctl_read_uint32() or sysctl_read_uint64(),
depending on the size of unsigned long. Then port all these users over:
- kernel.cap_last_cap (cap_last_cap() and test-capability-util)
- kernel.random.poolsize (random_pool_size())
- fs.nr_open (read_nr_open())
- kernel.pid_max and kernel.threads-max (procfs_get_pid_max(),
procfs_get_threads_max())
- net.unix.max_dgram_qlen (PID 1's bump_unix_max_dgram_qlen())
- kernel.overflowuid and kernel.overflowgid (PID 1's taint logic)
- fs.protected_hardlinks (tmpfiles)
- kernel.apparmor_restrict_unprivileged_userns (test-execute)
Note that fs.protected_hardlinks is read as integer instead of boolean
now, since the kernel exposes it as such (even if it only accepts 0 and
1 for now). This matters even more for its siblings fs.protected_regular
and fs.protected_fifos which accept 0, 1 and 2, and hence cannot be
parsed via parse_boolean().
PID 1 keeps tainting itself if kernel.overflowuid/kernel.overflowgid
cannot be parsed, as before, but not if they cannot be read at all.
(cherry picked from commit 9ccd43072e)
enroll_context_done() frees every string of the context except
tpm2_public_key_policyref, so it leaked whenever
--tpm2-public-key-policyref= was used. Free it as well.
(cherry picked from commit 4bc1fa7c06)
When no PCR public key is found, repart/cryptenroll proceed without
binding to a signed PCR policy, and they already leave out the policy
reference when calculating the sealing policy. They still passed it
to tpm2_make_luks2_json()/tpm2_unseal() which both assert that a policy
reference comes with a public key, causing a crash.
Pass the policy reference only when a public key is set, like for
the sealing policy.
(cherry picked from commit 511364b3cb)
Fixes a bug reported in #43975, where CreateMachineEx checks a nonexistent action org.freedesktop.machine1.create-machines.
(cherry picked from commit 1e5d6faf90)
Rearm stop timers during coldplug even when no control process is
running, so final-sigterm sockets continue timing out after reload.
Use TimeoutCleanSec when restoring a cleaning socket timer.
Extend regression coverage to reload after the control process exits
and verify the socket reaches failed state with the reloaded timeout.
Fixes#44457
(cherry picked from commit 889de5e955)
The packaging references are part of mkosi's configuration, so tine can't
build a checkout with the same pinned spec. Let's share the pins in one
JSON file keyed by distro and keep mkosi, the packaging updater and
Packit using it.
(cherry picked from commit 12d8bb84b1)
noble has a new enough autopkgtest, so use that instead of cloning from
git, as there are often transient regressions, and salsa availability
is also spotty
(cherry picked from commit 0d033931a4)
salsa is very flaky and CI jobs constantly fail when pulling from it.
Switch to github repo in our org so that it is more reliable
(if it's down, the CI jobs are down as well by definition, so no
combinatorial probability of outages
(cherry picked from commit feb1e5fbae)
As Ubuntu's autopkgtest cloud infra is disabled, we are lacking coverage for
Ubuntu's tests, which is problematic as regressions there are costly,
especially as the plan for Resolute is to upload stable point releases.
Switch the Semaphore job to cover it. It will give approximate coverage
for Debian which is sufficient, and mkosi's tests provide the rest.
(cherry picked from commit e6139ca955)
openssl_ask_password_ui_new() installs the new UI method as OpenSSL's
default, and openssl_ask_password_ui_free() asserts it still is the
default, and then resets the default to UI_OpenSSL(). This means two
OpenSSLAskPasswordUI objects cannot be alive at the same time: freeing
the second resets the default to UI_OpenSSL(), and then freeing the
first trips over the assertion.
Let's instead remember the default UI method in place when the object
is created, and restore it when it is freed, so that multiple objects
can be stacked, as long as they are freed in reverse order of creation.
(cherry picked from commit 14471a2a5f)
The crypttab, integritytab and veritytab generators look at errno after
fopen_unlocked() failed. Since fopen_unlocked() goes through
xopenat_full() errno isn't necessarily set when it fails, e.g. for an
empty $SYSTEMD_CRYPTTAB. Check the returned error instead.
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
(cherry picked from commit d059194685)
When nspawn is socket activated, it passes the file descriptors and sets
LISTEN_FDS and LISTEN_PID. However it would set the LISTEN_PID to 1 when
--as-pid2 was passed, so a program would not properly accept the file
descriptors, and LISTEN_{FDNAMES,PIDFDID} were not set.
Fixes https://github.com/systemd/systemd/issues/43764
(cherry picked from commit 2edf992e44)
The RestartSteps= documentation explains the ratio between two restart
delays. It doesn't say how long the service manager keeps restarting a
failing service, and that's what an operator usually wants to know. Once
the delays grow past 10s, the restarts never hit the built-in start rate
limit, and the service is restarted forever.
Let's document the sum of the delays until RestartMaxDelaySec= is reached,
using the formula proposed in #39197. Let's also show how to pick
StartLimitBurst= and StartLimitIntervalSec= so the unit fails once the delay
stops growing.
A successful restart doesn't reset the restart counter. Earlier starts in
the current start limit interval can change when the unit fails. Let's
state the example's assumptions and document how to reset the restart
counter and start rate limit.
(cherry picked from commit ca50a3cd2f)
When the encoded string does not fit, encode_devnode_name() returned
-EINVAL without terminating the output buffer. The callers in usb_id,
ata_id and scsi_id ignore the return value and add the buffer as a
property. With a USB product or manufacturer string that fills the
256-byte buffer in usb_id exactly (e.g. 85 three-byte UTF-8 characters
followed by one ASCII letter) udevd then reads past the end of the stack
array and copies adjacent stack bytes into ID_MODEL_ENC/ID_VENDOR_ENC.
Leave room for the NUL in each length check and terminate the truncated
output on failure. Output for strings that fit is unchanged.
(cherry picked from commit b2501ee485)
Luca Boccassi