Currently libcryptsetup's look treats ENOANO special because it's used
to signal PIN requirement. But the bad PCR set can also contain ENOANO
for a mismatch from a PolicyOR branch.
To continue iterating, remap the bad PCR set to EPERM early. This would
in theory also allow us to simplify the matching for the iteration
condition but we leave this as is for now to prevent a future
regression.
(cherry picked from commit d09e025b85)
When we enroll two UKIs with different PCR pub keys into one LUKS slot/
token each, we can encounter the wrong one and should not give up
but continue iterating.
(cherry picked from commit 19eac27e62)
We already report foreign TPM keys (wrapped for different parent) but
this is not enough because when also a different template was used, we
don't get TPM2_RC_INTEGRITY but TPM2_RC_SIZE.
Also cover TPM2_RC_SIZE to report EREMOTE so that we can continue to
iterate over LUKS tokens instead of giving up.
(cherry picked from commit 0f1ee40986)
When we have many LUKS slots and not all are for our TPM, we can get an
NV index error when it's missing or has wrong content.
Instead of fully erroring out, map these encounters to EREMOTE like we
do for a foreign TPM key.
(cherry picked from commit ac5f02cc76)
When we encounter a key for a foreign TPM we report that as EREMOTE in
tpm2_load but not yet in tpm2_import. This causes cryptsetup to give up
on using the TPM instead of being able to continue with out tokens.
Do the same mapping as in tpm2_load in tpm2_import to report EREMOTE on
foreign keys.
(cherry picked from commit 93bc6a3415)
When we enroll two UKIs with different PCR pub keys into one LUKS slot/
token each, then we can encounter the wrong one and should not give up
but continue iterating instead of requiring the passphrase. Similarly,
a pcrlock token might be for another UKI and we should continue the
search. Same for a token that is meant for another TPM (e.g., external
storage). While this is mainly about cryptsetup's automatic unlocking
from the initrd, it also matters for usage in the system, e.g., for
other storage and when cryptenroll should unlock using the TPM.
There are two code paths, one is the libcryptsetup plugin and the other
is the fallback when that's not available.
To let the libcryptsetup loop continue to iterate, remap the above
error conditions to EPERM. For the fallback path check all of them (no
remapping) and continue iteration. For better log output, include the
token ID to be able understand which token fails.
(cherry picked from commit 9213de2e06)
When we enroll two UKIs with different PCR pub keys into one LUKS slot/
token each, then we can encounter the wrong one and should report it
with a clearer error than the generic "Failed to unseal secret using
TPM2".
So when we don't have the right signature, report this as separate
error.
(cherry picked from commit 58d38f6360)
With no console= given the kernel will use the graphical console and if
we give one console= then that will be used instead. But sometimes we
want both a serial console and a graphical one to work. This would be
consistent with the EFI menu and sd-boot showing on both already. It
also makes the impact of a wrongly detected-but-missing VirtIO console
lower when we emit it alongside of the other consoles we detect.
Collect all detected consoles and emit them via console= with the same
priority we used before to select them. This means for the main console
there is no change but we get additional ones enabled. This helps with
boot output and having a login presented, yet the main console is still
special and gets the emergency output at boot (we should somehow surface
that on the additional consoles but that's another topic). If we only
see the graphical console (or none), we don't need to emit anything a
the kernel already selects it itself. This also avoids suppressing the
non-x86 kernel serial console detection. As mentioned above, the VirtIO
console being wrongly added is now also less impactful. But for non-x86
ACPI case we could detect the serial so that console=hvc0 won't stop the
kernel serial auto-detection.
(cherry picked from commit 924552cfba)
When nested mounts appear under a sysext hierarchy like this:
mkdir -p /opt/trigger/
mount -t tmpfs tmpfs /opt/trigger
mkdir -p /opt/trigger/inner
mount -t tmpfs tmpfs /opt/trigger/inner
Then systemd-sysext merge will lose the inner mount because it uses a
regular bind mount with propagation and then unmounts the source,
unmounting all children with it which propagates (as found out in
https://github.com/flatcar/Flatcar/issues/2111).
To solve this, clone the sub mount with MS_PRIVATE to decouple sub
mounts from the original mount. Then attach the cloned mount instead of
doing regular bind mounts. For old kernels we still attach the cloned
mount but we fallback to cloning without MS_PRIVATE. This change also
affects mount_private_apivfs which is used for private /proc, /sys, and
cgroupfs but I think it makes sense there, too, instead of only doing
mount_setattr for sysext alone because, e.g., a container and the host
should not be leaking mount actions into each other for these mounts.
(cherry picked from commit f6a7a9ec3d)
When nested mounts appear under a sysext hierarchy like this:
mkdir -p /opt/trigger/
mount -t tmpfs tmpfs /opt/trigger
mkdir -p /opt/trigger/inner
mount -t tmpfs tmpfs /opt/trigger/inner
Then systemd-sysext merge hit an assertion reported in
https://github.com/flatcar/Flatcar/issues/2111 because when it iterates
over the list of sub mounts it doesn't expect entries with NULL in the
path from the dropped entries.
Instead of having to deal with entries with path NULL, better sort the
holes from dropping to the end and then reduce the array length.
(cherry picked from commit 7eabeaed0e)
For the new systemd.credentials_boot_policy= setting we need
to be able to differenciate if its a firstboot or not early.
But `manager_set_first_boot` is run after `initialize_runtime()`
which imports the credentials. So we need to touch the file
so that the credentials_boot_policy setting can work.
Unfortunately we cannot just move manager_set_first_boot() earlier
because there is no manager yet at this point.
(cherry picked from commit eb8227c671)
Patterns such as foo_@v/bar.efi are documented to
match files in versioned subdirectories,
but pattern_match() assumed that a field is
always followed by a literal when another element exists.
Handle a following slash as a delimiter too,
and request another recursion step
when the current path ends before that slash.
Fixes#42895.
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit add910a838)
By chance (because I had this mistake in my own commit) I noticed
that there are a bunch of duplicated works like "the the" in the
code and man-pages.
This commit fixes them and some similar issues with "and and" etc.
(cherry picked from commit c944af8459)
Recursive credential directory loading intentionally
includes socket entries, but load_credential()
only enabled AF_UNIX socket handling for absolute paths.
Let the recursive directory path request socket
connections explicitly, and update the stale comment for directory-fd reads.
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit 944b160007)
When lock-pe or lock-uki read from stdin,
copy non-regular input to a seekable temporary fd before hashing it.
Fixes#42893.
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit 8cbae52fc9)
When copying a directory into an image, open an existing destination
with O_NOFOLLOW before passing it to copy_tree_at(). This rejects a
symlink used as the final destination component without a separate
stat-before-use check.
Previously the pre-opened destination followed that symlink. That
allowed --copy-to to be redirected outside the image root when the
image was a directory tree.
If the destination does not exist yet, keep delegating creation to
copy_tree_at(). Real existing directories still use COPY_MERGE through
the opened directory fd.
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit 4839cb914e)
With vmspawn --console=gui and similar one has the case where the VirtIO
PCI device is present for something else than the console and the logic
in sd-stub added console=hvc0 even though it didn't exist. This caused
tty0 to be empty during boot.
Always prefer the graphical console before a potential virtio console.
The virtio console is still preferred over a serial console and we can
get the same problem there, e.g., qemu-guest-agent is used causing the
PCI device but without a virtio console and instead a serial console is
used. This is not solved here.
(cherry picked from commit 2f76050c5c)
session_start() calls seat_read_active_vt() before setting
s->started = true. seat_read_active_vt() can reach
seat_triggered_uevents_done() synchronously via:
seat_active_vt_changed -> seat_set_active -> seat_trigger_devices
-> seat_triggered_uevents_done
When seat_trigger_devices() produces no pending uevents,
seat_triggered_uevents_done() runs in the same call stack as
session_start() and tests session->started before the assignment
further down. The check fails, session_device_resume_all() is
skipped, and the compositor never receives DRM master.
Set started before seat_read_active_vt() so the gate sees the
correct value, and document the ordering constraint at the call
site to prevent regression.
Reproducible with greetd plus a Wayland compositor on the same VT
on kernel 6.19+.
Fixes: #41562
Signed-off-by: countgitmick <263313427+countgitmick@users.noreply.github.com>
(cherry picked from commit ce043cdfdb)
This handling with tmpfiles was dropped in
29444df23b. So let's stop the build system
to create that directory. Actually it is create by the service just
fine, including correct access mode.
(cherry picked from commit fc99dc4c42)
efi_get_boot_option() validates the overall Boot#### variable size and
the advertised device-path byte count, but then walks each device-path
node without first checking that the node header and subtype payload fit
in the remaining buffer.
A malformed Boot#### variable could make the parser read past the end of
the current node, or past the available device-path data.
Limit parsing to the bytes that are actually present, and stop walking
the device path when a malformed node is encountered. This keeps the
previous best-effort behaviour for fields parsed before the anomaly while
avoiding out-of-bounds reads.
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit d13b002aec)
dns_resource_record_clamp_ttl() may patch the TTL in place when the
record has a single reference. dnssec_fix_rrset_ttl() also updates TTLs
after canonical wire-format data may have been cached.
If a record already has cached wire-format data, that cache still
contains the old TTL and dns_resource_record_to_wire_format() will keep
reusing it.
Add a small helper to clear the cached wire-format state, and use it
whenever the TTL changes. This makes subsequent serialization match the
record fields.
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit ccae5c7a4f)
dnstls_stream_connect_tls() reads the manager-wide dns_over_tls_mode
field directly, so when the global mode was 'no' or 'opportunistic' but
a link was configured with strict DNSOverTLS=yes, the DoT connection
was established without SSL_VERIFY_PEER or hostname/IP checks.
Use dns_server_get_dns_over_tls_mode() which honours the per-link
override.
(cherry picked from commit 052ff5fb5d)
When a rate limit is armed, for example via StartLimitInterval=, and the
machine is suspended, the rate limit's "clock" is suspended as well,
since the elapse checks use CLOCK_MONOTONIC. This then causes unexpected
situations where a rate limit armed via StartLimitInterval=1h, followed
by a 10 hour suspend, would elapse after 11 hours total.
Let's avoid this by switching the rate limits to CLOCK_BOOTTIME, which
works the same as CLOCK_MONOTONIC, but accounts for the time spent in
suspend as well.
There's one slight concern when it comes to upgrade path - the old
"begin" value of the rate limit is stored as CLOCK_MONOTONIC, but after
upgrading systemd and serializing/deserializing the state it will be
suddenly compared against now(CLOCK_BOOTTIME), which might cause some
rate limits to elapse "prematurely". But this is just a one-time thing,
after which the rate limit timers should re-assess themselves.
Resolves: #42912
(cherry picked from commit 9ae50c78cc)
fsck_mode_from_string() and fsck_repair_from_string() return -EINVAL
on a bad value. Store the result in a local variable first, and only
update the global state on success.
Otherwise an invalid value is logged as ignored, but still leaves a
negative enum value behind. In the fsck.repair case that makes
fsck_repair_option_to_string() return NULL and truncates the fsck
command line.
Follow-up for a85428b1d3
Follow-up for 059afcadfd
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit da9a330dfd)
In commit 38433a6d06 ("bootctl: rework bootctl-install.c in preparation of varlinkification"),
the `first` argument of install_boot_option() was reworked to use the
new InstallContext struct/InstallOperation. `first` was intended to
indicate if we were on the install path, so the check should be
== INSTALL_NEW, not != INSTALL_NEW.
Fixes: 38433a6d06 ("bootctl: rework bootctl-install.c in preparation of varlinkification")
(cherry picked from commit 1b03303998)
The structure length comes from the firmware SMBIOS table and the only
bound before the fixed-offset wake_up_type write was an assert(), which
is a no-op in release sd-boot builds.
Whether the field is present is governed by the formatted-area length
header->length, not the total size which also covers the trailing string
set. A too-short record (an old SMBIOS 2.0 one, or a crafted 6-byte
header) makes the offset-24 write land past the xmemdup() copy; a record
with a short formatted area but long string set instead gets a stable
string byte zeroed in the copy. Key the guard off header->length and the
field offset, matching get_smbios_table(), and measure such records
as-is. Zero only the part of the field that lies within the formatted
area, and collapse the two measure_smbios_raw() call sites by selecting
what to measure via a pointer.
Signed-off-by: Syed Mohammed Nayyar <jmestwa@gmail.com>
(cherry picked from commit 636b173035)
marker_matches_images() was declared to return bool, but several of its
paths return a negative errno (OOM, parse errors, etc.). A negative int
coerces to true, so every such failure was reported as a "match".
Return int with the tristate semantics the callers already expect.
When detaching by image name instead of the original path, path_pick() may
not resolve a concrete path (e.g. a runtime overlay). Keep comparing the
caller-provided image name, and use the picked path only as an additional
canonical match when it exists.
Follow-up for 907952bbc9
(cherry picked from commit c70f09853e)
manager_open_syslog_socket() may be called again with an already open
syslog fd. In that case the old syslog event source still watches the
fd, so adding a new IO source for the same fd fails with -EEXIST and
leaves the old source installed.
Disable and unref the old event source before adding the replacement.
This keeps reopening idempotent and avoids leaving a stale event source
around.
Follow-up for f9a810beda
(cherry picked from commit a77bd724d3)
manager_process_native_message() looks up the sender's ClientContext with
client_context_get(), which does not pin it.
A native message may carry an OBJECT_PID=, which makes
manager_dispatch_message_real() perform a nested client_context_get() for that
PID. On a cache miss this runs client_context_try_shrink_to(), whose pid-flush
branch frees every unpinned cache entry whose PID has already been reaped,
including the borrowed sender context. manager_dispatch_message_real() then keeps
using it (it reads c->uid, and the built iovecs still alias the context's
fields).
Pin the sender context with client_context_acquire() for the duration of the
dispatch and release it afterwards, mirroring what the stdout stream path
already does.
Follow-up for 22e3a02b9d
(cherry picked from commit 0b4a90765c)
Commit edea370222 (portable: remove drop-in configs even if the main unit file does not exist)
taught detach to handle leftover .service.d directories
after the main unit symlink was removed.
portable_get_state_internal() still had the same blind
spot: it only considered regular unit entries, so portablectl
is-attached could report detached while a portable drop-in directory was still present.
Handle those drop-in-only entries like detach does, preserve
the existing unit-file based enabled checks when the
main unit file is still present, and add TEST-29 coverage.
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit a977bf4d06)
The inclusion of padding bytes in the signature size can lead to the signature
being rejected by strict PKCS7 parsers. Meanwhile, according to [1], the parser
of the WIN_CERTIFICATE structure is expected to round up the value of dwLength
to an 8-byte multiple. This also matches the behaviour of the sbsign tool from
sbsigntools.
Fixes#42884
[1] https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-attribute-certificate-table-image-only
Signed-off-by: Vsevolod Kozlov <zaba@mm.st>
(cherry picked from commit 93aadbf968)
Synchronize OCI layer directories and generated metadata
when IMPORT_SYNC is enabled, matching the raw and tar pull paths.
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit d8c1f1d105)
Once link_tmpfile_at() succeeds, the target path
has been published. Avoid unlinking it on later
close or parent fsync failures when COPY_REPLACE
was used, as that can remove the replaced target.
Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit 366fa466d2)
* 57cbcf979c Also enable report-standalone for OBS builds
* d69c17b165 Enable report-standalone for upstream builds
(cherry picked from commit e785d81c1b)
* 45c16dd369 Use uniform format for %rhel conditionals
* 034fa693f2 Print the build status also in %build
* 3cc7e03365 Restore definitions of helper macros
* 2382c910b7 Disable the standalone report yet again
* 2d6fd95c70 Restore explicit requires for Centos Stream 9 and 10
* 521ab0fb09 test: skip the integration test suite on Fedora ELN (for now)
* 453447b79b rpminspect: ignore test-coredump-stacktrace in annocheck
* 9d4edaa576 test: work around a kernel bug in virtio/vsock
* c53b2fb307 test: cap the number of parallel tests
* 9bd26bb71f Fix ntpvendor for ELN
* de7b685908 Disable reqs for dlopen'ed libraries on CentOS
* 4830641844 Move portabled to systemd-container subpackage
* 893fcd9978 Add missing conditionalization and more debugging
* c783e74791 split-files: improve error message
* ee2dff42d6 Add systemd-report-standalone
* 9c87a3f8ad Load libssl.so.4 rather than libssl.so.3
* 714b0799d2 Version 261.1
* 054158500a Update to load openssl-4 rather than openssl-3
* 5a3e750ef8 Version 261
* 4faee7ab7d Version 261~rc4
* 8ff635a921 Rebuilt for openssl 4.0
* 0064f73d97 Rebuilt for openssl 4.0
* 14a9aac87e Use dlopen notes again
* 720fa8259a Do not check ownership of /var/lib/systemd/timesync/ in rpm -V
* 06bd9926f2 Version 261~rc3
* 6ddbd499e8 Drop unused tree build dependency
* bd81a14bfc Version 261~rc2
(cherry picked from commit 47af1efe40)
mdns_maintenance_query() takes a ref on the browser's varlink link but
never installs itself as that link's userdata. dns_query_free() then
unconditionally runs sd_varlink_set_userdata(varlink_request, NULL),
so freeing any maintenance query wipes the browse query's registration
on the shared sb->link slot, disabling the abort paths in
vl_on_disconnect() and dns_service_browser_free(). The maintenance
query also never takes a reference on the DnsServiceBrowser, so a client
disconnect could free the browser while a maintenance query was still
in flight, leaving the per-service schedule_event timer and the raw
service->service_browser back-pointer dangling (use-after-free on the
next timer tick or query completion).
Take a service_browser_request reference instead, matching the browse
query path. dns_query_free() already drops it. The browser now outlives
its in-flight maintenance queries.
Follow-up for 8458b7fb91
(cherry picked from commit 46c15e88e0)
link_request_sr_iov_vfs() queued each request with a raw SRIOV* as
userdata and a NULL free_func, so the request did not own the object.
The SRIOV is owned by link->network->sr_iov_by_section, which is freed
by network_free() on reload while the RTM_SETLINK reply may still be in
flight (the floating netlink slot keeps the request alive but does not
keep the userdata alive). A later reply, or the 25s netlink timeout,
then dispatches sr_iov_handler() which reads the freed SRIOV.
Follow-up for cb8453cc51
(cherry picked from commit 134df27257)
worker_free() did not clear worker->event->worker, leaving an event
that was still attached to a worker pointing at freed memory once the
worker was gone. manager_free() frees the workers (hashmap_free())
before it walks manager->events to process them, and event_free() then
writes event->worker->event = NULL into the already-freed worker.
Clear the back-pointer in worker_free(), mirroring event_free() which
already clears the worker's pointer. The link used to be torn down by
the event_free(worker->event) call in worker_free(), which was dropped
when events became reference counted.
The Event and Worker definitions move to udev-manager.h (next to
Manager) so the unit test can construct and free a bound worker/event
pair.
Follow-up for cb16d47f30
(cherry picked from commit 7eb7d46f97)
add_object_vtable_internal() inserts BusVTableMember entries into the
global vtable_methods/vtable_properties sets as it walks the vtable, but
only sets node_vtable.node (which gates the disconnect-time cleanup)
after the loop. A failure mid-loop thus left the already-inserted
members behind, dangling once the slot's interface string and the node's
path were freed, so a later registration reading those keys hit a
use-after-free. Remove this slot's members on the fail path.
The test asserts the failed registration leaves no member behind.
Follow-up for 19befb2d5f
(cherry picked from commit b7b1303209)
The CAN_HASH branch of bus_match_run() that iterates the array values of
an argNhas= match dispatches a callback per value but, unlike the leaf
and manual-iteration branches, does not re-check bus->match_callbacks_modified
afterwards. A callback that adds or removes a match (freeing the node)
would then have the next hashmap_get(node->compare.children, ...) read
freed memory. Add the same check the sibling branches already have.
Follow-up for 198b158f49
(cherry picked from commit 058b0de7bf)
netlink_slot_allocate() links the slot into nl->slots and takes an nl
reference, but sd_netlink_call_async() and netlink_add_match_internal()
hold it in a _cleanup_free_, so an error after allocation frees the slot
with a bare free()
Follow-up for ee38400bba
(cherry picked from commit 25c016f472)
If dns_resolvers_to_dot_addrs() fails (e.g. OOM) it returns without
assigning *ret_addrs, so the CLEANUP_ARRAY() cleanup would free an
uninitialized dot_servers pointer on the error return.
Follow-up for 3fd6708cde
(cherry picked from commit 9cae6d9c56)
FORMAT_SUBST_LINKS passes the same 'l' (remaining size) to strpcpy for
each devlink and discards the returned remaining value, so the cursor
advances while the bound stays at the full size, overflowing dest.
Capture the return value.
Follow-up for f6caab8995
(cherry picked from commit a8d8009b7a)
Kai Lüke