Otherwise on SELinux enabled systems with the "targeted" policy
the type is not set correctly when run via unconfined user and
the test fails.
(cherry picked from commit 57202fd181)
The primary motivation for this is to allow users of ukify to build
UKI-like objects, without having them later be detected as a UKI by
tools like kernel-install and bootctl.
The common code used by these tools to determine if a PE binary is a UKI
checks that both .osrel and .linux sections are present. Hence, adding
a mechansim to skip .osrel provides a way to avoid being labeled a UKI.
(cherry picked from commit 75890d949f)
Add a test for getsgnam_r to verify that sg_adm and sg_mem always point
to a NULL-terminated string vector.
Extend the gr_mem check of struct group for non-NULL values as well.
(cherry picked from commit 2eaca3ea5f)
Fill sg_adm and sg_mem in nss_pack_group_record_shadow to stay
compatible with other NSS getsgnam implementations which set these
members to NULL terminated string arrays.
Tools like shadow's sg would trigger a NULL pointer dereference with
groups only found through nss-systemd otherwise.
(cherry picked from commit 57682793da)
The sg_adm and sg_mem fields are supposed to point to a NULL terminated
string array. If these are NULL, some foreign tools like shadow's sg
trigger NULL pointer dereferences (or fortunately their asset() calls).
(cherry picked from commit 239903d44c)
The test passes but for two minutes the cleanup function just logs:
Failed to inspect home: No home for user homedsshtest known
Failed to inspect home: No home for user homedsshtest known
Failed to inspect home: No home for user homedsshtest known
...
Do not wait for the user to become inactive or remove the user if 'homectl
inspect' doesn't find the user. This brings a successfull run from 176 s
to 58 s here.
(cherry picked from commit 689391f8c8)
Let's explicitly check if NvPCRs are fully set up (allocated, anchored)
before we try to show them.
Alternative to: #40184
(cherry picked from commit 855b4cd731)
The current MAX_SERIAL_LEN value of 256 is insufficient for some SCSI
devices with non-standard serial number lengths. In do_scsi_page80_inquiry(),
the required buffer length is calculated as:
len = 1 + VENDOR_LENGTH + MODEL_LENGTH + buf[3]
= 1 + 8 + 16 + buf[3]
= 25 + buf[3]
where buf[3] contains the serial number length reported by the device.
According to the SCSI specification, this field is an unsigned 8-bit
value, meaning it can theoretically be up to 255 bytes. This results
in a maximum required length of 280 bytes, exceeding the current limit
of 256 bytes.
When this occurs, scsi_id fails with an error message like:
"length 256 too short - need 280"
This has been observed with certain vendor devices that report unusually
long serial numbers in VPD page 0x80.
Increase MAX_SERIAL_LEN to 512 to accommodate the maximum possible
serial number length plus all required prefixes (vendor, model, and
type identifiers), providing sufficient headroom for non-compliant
devices while maintaining reasonable memory usage.
Signed-off-by: tuhaowen <tuhaowen@uniontech.com>
(cherry picked from commit 3c586354aa)
$ ./tools/fetch-distro.py -u fedora
+ mkosi --json -d fedora summary
‣ Ignoring --distribution from the CLI. Run with -f to rebuild the image with this setting
Follow-up for 35f6e5c327
(cherry picked from commit 2791af18e4)
We should consider the whole init.scope trusted, and any
process trying to log on behalf of a unit there should be
attributed as so.
Follow-up for 4f25248b6e
Only with this commit is the change in effect.
(cherry picked from commit 7f9e3c5919)
The unix-domain socket to AF_VSOCK multiplexers in Firecracker and
vhost-device-vsock sends OK PORT response to the client, resulting
ssh clients to abort the connection with the additional response. This
patch addresses this issue by waiting and expecting the possible OK PORT
response from the multiplexer, if any, and then handover the socket fd
to the ssh client. It only checks if the response begins with OK and
consume the response till the first \n, for simplicity.
Signed-off-by: Miao Wang <shankerwangmiao@gmail.com>
(cherry picked from commit dc3e544104)
When a Yubikey or other fido2 device has FIPS mode enabled, UV will
always be required and cannot be disabled. Unhelpfully, when it is not
sent down, the hardware token (not the library) returns a generic
FIDO_ERR_MISSING_PARAMETER:
$ systemd-cryptenroll --fido2-device=auto --fido2-with-client-pin=no foo
<...>
libfido2: rx: payload_len=1
libfido2: fido_rx: buf=0x55c9ce170940, len=1
libfido2: 0000: 14
libfido2: cbor_parse_reply: blob[0]=0x14
libfido2: fido_dev_get_assert_rx: adjust_assert_count
Failed to ask token for assertion: FIDO_ERR_MISSING_PARAMETER
This can be set even when the token doesn't support UV (as in, fingerprint
reader), in which case using the PIN is required.
Check if 'alwaysUv' is set, and if not already configured, force
either UV (if available) or PIN when enrolling.
(cherry picked from commit 9a34971421)
The function clock_nanosleep() provides remaining time when failed with
EINTR. Let's continue sleeping in that case.
(cherry picked from commit b8241d3ca5)
When plymouth is enabled, the screen gets all garbled when firstboot
runs and asks questions. Disable the splash screen, but only when
actually asking questions.
(cherry picked from commit 75cb25c0b9)
In the initrd, order the generated `systemd-import@.service` units before the
initrd-specific sysext/confext units.
(cherry picked from commit 2f76b10b94)
The policy was added, but never hooked into meson to be installed,
so it's unused. Install it.
Follow-up for 066f6bfb62
(cherry picked from commit ce41216e49)
As reported in https://yeswehack.com/vulnerability-center/reports/705270,
YesWeHack issue #YWH-PGM9780-66, if a newline is injected into the message
field, it is passed through unmolested and lands in the .ini file. This
obviously would cause the parser to be confused.
Let's forbid any control characters or quotes in those fields. If we want
something more complicated in the future, we can add a custom validation
function and allow some escaping mechanism.
(cherry picked from commit f01c99c67e)
When link MTU is being adjusted in an IPv6 context (e.g., according to
the MTU received in an RA), the new MTU is clamped against link's
current MTU than link's max MTU. This means that the link MTU can never
be increased via an RA:
systemd-networkd[10068]: eth1: Reducing requested IPv6 MTU 8900 to the interface's maximum MTU 1500.
systemd-networkd[10068]: Setting '/proc/sys/net/ipv6/conf/eth1/mtu' to '1500'
systemd-networkd[10068]: No change in value '1500', suppressing write
Fix this check to make logical sense, and also to match a similar check
in src/network/networkd-setlink.c:link_adjust_mtu().
(cherry picked from commit 32417c1723)
Unlike other settings that takes multiple values, the setting takes
colon separated list of paths, but when specified as a DBus property,
it previously accepted space separated list of paths.
Let's also make the DBus property accepts colon separated lists.
Fixes#40513.
(cherry picked from commit da912e7f2f)
When udevd received a uevent or inotify event, we will queue or trigger
synthesized events. To minimize the race between processing these events
by udevd and user invocation of 'udevadm settle', let's create /run/udev/queue
file earlier.
On some errors, no event may be queued, but in that case, the file will
be removed by the post event source if nothing queued. See on_post().
Hopefully mitigate the issue #40499.
(cherry picked from commit dc709eff0b)
