SD_JSON_BUILD_STRING() and everything else can deal with it, make sure
SD_JSON_BUILD_STRING_UNDERSCORIFY() can too.
(cherry picked from commit a77a95665f)
(cherry picked from commit 29f4fba3c6)
(cherry picked from commit a09efa6cf5)
vsnprintf() can, under some circumstances, return negative value, namely
during encoding errors when converting wchars to multi-byte characters.
This would then wreak havoc in the arithmetics we do following the
vsnprintf() call. However, since we never do any wchar shenanigans in
our code it should never happen.
Let's encode this assumption into the code as an assert(), similarly how
we already do this in other places (like strextendf_with_separator()).
(cherry picked from commit 774a9f440b)
(cherry picked from commit 066c5e56b5)
(cherry picked from commit 1898ba5965)
This also drops unnecessary zero assignments.
(cherry picked from commit 366e1d264a)
(cherry picked from commit ff35fc2616)
(cherry picked from commit 34da6e7dcc)
The NOTES section in os-release(5) contains an unusual formatting.
Switch function and ulink tags and remove a newline within ulink text to
keep the entry formatting in sync with others. Also, this preserves the
formatting within the text itself.
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
(cherry picked from commit 4d2847dcc2)
(cherry picked from commit 5511017f4b)
(cherry picked from commit a29c5ab031)
LoadFile() with a NULL buffer is supposed to return the file size
without acquiring the data and return EFI_BUFFER_TOO_SMALL.
However it appears some firmware returns EFI_SUCCESS in case the file is
empty, i.e. the file size returned is zero. And I guess that's even
fine.
Let's handle this gracefully hence.
(cherry picked from commit c40f254cca)
(cherry picked from commit 990ec9da53)
(cherry picked from commit a764290f32)
When figuring out which menu entry to pick by default, let's not
consider any with a profile number > 0. This reflects that fact that
additional profiles are generally used for
debug/recovery/factory-reset/storage target mode boots, and those should
never be auto-selected. Hence do a simple check: if profile != 0, simply
do not consider the entry as a default.
We might eventually want to beef this up, and add a property one can set
in the profile metadata that controls this behaviour, but for now let's
just do a this simple fix.
(cherry picked from commit a93fa2c6b4)
(cherry picked from commit 2897eaf648)
(cherry picked from commit a7f3f2241e)
fd_is_fs_type() returns < 0 for errors, 0 for false, and > 0 for true, so
in the r > branch we'd most likely report EPERM together with the error
message which is misleading.
(cherry picked from commit c859d41232)
(cherry picked from commit 973ade990f)
(cherry picked from commit a513464dfb)
If range is NULL (i.e. when PrivateUsers= doesn't contain ':'),
both later error paths will then pass NULL to log_syntax():
~# cat foo.nspawn
[Exec]
PrivateUsers=9999999999999999999
~# SYSTEMD_LOG_LEVEL=debug systemd-nspawn -D foo |& grep foo.nspawn
Found settings file: /root/foo.nspawn
/root/foo.nspawn:2: UID/GID shift invalid, ignoring: (null)
or
~# cat foo.nspawn
[Exec]
PrivateUsers=4294967294
~ # SYSTEMD_LOG_LEVEL=debug systemd-nspawn -D foo |& grep foo.nspawn
Found settings file: /root/foo.nspawn
/root/foo.nspawn:2: UID/GID shift and range combination invalid, ignoring: (null)
Let's just use rvalue in both of these cases instead.
(cherry picked from commit d651df8283)
(cherry picked from commit 967fec09a2)
(cherry picked from commit a7705c8034)
Unfortunately empty_to_null(t) where t is char[] fails. But it
works with &t[0].
(cherry picked from commit 067aa9b767)
(cherry picked from commit e1a30036b5)
(cherry picked from commit 219edc81f7)
iov.iov_len doesn't change after calling recvmsg() so it remains set to
sizeof(ntpmsg), which makes the check for a short packet always false.
Let's fix that by checking the actual size of the received data instead.
(cherry picked from commit 335cc8f39c)
(cherry picked from commit ff5b71f38f)
(cherry picked from commit 57ff31cc49)
This simply mirrors the same overflow check we already have in
strrepa(), in case someone passed us a sufficiently long string.
strrep() is currently used only in tests, so this is just hardening.
(cherry picked from commit b22daa97e1)
(cherry picked from commit d8f2a2fb92)
(cherry picked from commit e0d0c93f65)
Ensure only privileged users can call the system scope machined's
APIs that get data out of a machine
Follow-up for 1bd979dddb
Follow-up for 9153b02bb5
(cherry picked from commit 3e716178cc)
(cherry picked from commit 6e6aa47f46)
(cherry picked from commit b808894777)
Various types have been made opaque, so we need to use some accessor
functions.
(cherry picked from commit 693ecaac7e)
(cherry picked from commit bf29422d62)
(cherry picked from commit d082d842e2)
The varlink method checks for polkit authorization, so also
update the D-Bus method to match it.
Follow-up for cf01bbb7a4
(cherry picked from commit b1d9127c39)
(cherry picked from commit d5129d8433)
(cherry picked from commit b8d6b85609)
We might be running in an nspawn container booted with --suppress-sync,
so make sure we handle that scenario gracefully.
(cherry picked from commit 31441cb782)
(cherry picked from commit 4f974b5492)
(cherry picked from commit 6c2be56375)
Otherwise the test fails if a TTY is attached to stdio.
(cherry picked from commit 9c0abfaf15)
(cherry picked from commit fc4159dd95)
(cherry picked from commit ccd3975ae4)
The addition of hwdb.d/40-imds.hwdb is dropped. (Corresponding changes
in hwdb_parse.py are kept, they are not a problem.)
(cherry picked from commit deb3b034e2)
(cherry picked from commit a2e4f29a82)
With old libcurl versions file:// can get redirects which can be messy, while
the new version rejects them. Set an option to explicit block them.
(cherry picked from commit 275ec1160b)
(cherry picked from commit 7cb8d612ef)
(cherry picked from commit 154e1a669e)
When --trust=all disables CURLOPT_SSL_VERIFYPEER, the residual
CURLOPT_SSL_VERIFYHOST check is ineffective since an attacker can
present a self-signed certificate with the expected hostname. Disable
both for consistency and log that server certificate verification is
disabled.
Follow-up for 8847551bcb
(cherry picked from commit f125fc6a22)
(cherry picked from commit 20e7ffd9d4)
(cherry picked from commit 5278c63c2e)
Instead of interpolating the user name directly into the sh -c script
body via asprintf %s, pass it as a positional parameter ($1) in a
separate argv entry. This avoids the user string being parsed as part
of the shell script syntax.
Also validate the user name in bus_machine_method_open_shell() with
valid_user_group_name(), matching the validation already done on the
Varlink path via json_dispatch_const_user_group_name().
Follow-up for 49af9e1368
(cherry picked from commit a9e9288288)
(cherry picked from commit df18d26c37)
(cherry picked from commit 50e3b71952)
method_set_wall_message() and the property setter only checked the
message length but not its content. Since wall messages are broadcast
to all TTYs, control characters in the message could interfere with
terminal state. Reject messages containing control characters other
than newline and tab.
Follow-up for 9ef15026c0
Follow-up for e2fa5721c3
(cherry picked from commit 4bf9db7314)
(cherry picked from commit 32bfd96324)
(cherry picked from commit e21bfed990)
Units might have different access rules, so check the access on each
unit when querying the full list.
(cherry picked from commit 04f32dddd7)
(cherry picked from commit 0952b4e793)
(cherry picked from commit a806377739)
Add mac_selinux_unit_access_check_varlink() to the unit enumeration
loop in vl_method_list_units(), silently skipping units the caller
is not permitted to see, matching the D-Bus ListUnits behavior.
Add mac_selinux_access_check_varlink() to vl_method_describe_manager().
Follow-up for 472abf7bec
Follow-up for 736349958e
(cherry picked from commit 26fd286210)
(cherry picked from commit de05ec8318)
(cherry picked from commit caae0bf26c)
The commit 6d7cb9a6b8 fixes the assignment
of the these options when specified through SendOption=. However, it
breaks when specified through UserClass= or SendVendorOption=.
When UserClass= or SendVendorOption= is specified, the option length is
calculated from the sd_dhcp_client.user_class or .vendor_options. Hence,
we can use 0 for the length in that case.
Follow-up for 6d7cb9a6b8.
(cherry picked from commit 55f2fdd508)
(cherry picked from commit 98983d4f67)
(cherry picked from commit 5e19255a6c)
Add the auto keyword as documented in the help message and man pages of
`kernel-install`, `bootctl` and `systemd-pcrlock`.
(cherry picked from commit 7208a74a2b)
(cherry picked from commit acc71ff6ca)
(cherry picked from commit 329a3d27e4)
The loop used the byte offset end (struct_off + struct_size) as the
iteration limit, but cursor[i] indexes uint32_t words. This reads
past the struct block when end > size_words.
Use size_words (struct_size / sizeof(uint32_t)) which is the correct
number of words to iterate over.
Also fix a pre-existing OOB in the FDT_BEGIN_NODE handler: the guard
i >= size_words is always false inside the loop (since the loop
condition already ensures i < size_words), so cursor[++i] at the
boundary reads one word past the struct block. Use i + 1 >= size_words
to check before incrementing.
Fixes: https://github.com/systemd/systemd/issues/41590
(cherry picked from commit 2c664b9531)
(cherry picked from commit 93e3c738d2)
(cherry picked from commit b3c8a71d78)
Bound image dimensions before computing row_size to prevent overflow
in the depth * x multiplication on 32-bit. Without this, crafted
dimensions like depth=32 x=0x10000001 wrap to a small row_size that
passes all subsequent checks.
Reject channel masks where all bits are set (popcount == 32), since
1U << 32 is undefined behavior and causes division by zero on
architectures where it evaluates to zero. Move the validation before
computing derived values for clarity. Use unsigned 1U in shifts to
avoid signed integer overflow UB for popcount == 31.
Also reject zero-width and zero-height images.
Fixes: https://github.com/systemd/systemd/issues/41589
(cherry picked from commit c3c9cc7adb)
(cherry picked from commit b23313a47e)
(cherry picked from commit 940e2016ed)
nss_count_strv() counts trailing NULL pointers in n. The pointer area
then used (n + 1), reserving one slot more than the size check
accounted for.
Drop the + 1 since n already includes the trailing NULLs, unlike the
non-shadow nss_pack_group_record() where n does not.
Fixes: https://github.com/systemd/systemd/issues/41591
(cherry picked from commit aa85a742fe)
(cherry picked from commit 97e3d2467b)
(cherry picked from commit c4b4eb8078)
We already have checks in place during compression that limit the data
we compress, so they shouldn't decompress to anything larger than
DATA_SIZE_MAX unless they've been tampered with. Let's make this
explicit and limit all our decompress_blob() calls in journal-handling
code to that limit.
One possible scenario this should prevent is when one tries to open and
verify a journal file that contains a compression bomb in its payload:
$ ls -lh test.journal
-rw-rw-r--+ 1 fsumsal fsumsal 1.2M Apr 12 15:07 test.journal
$ systemd-run --user --wait --pipe -- build-local/journalctl --verify --file=$PWD/test.journal
Running as unit: run-p682422-i4875779.service
000110: Invalid hash (00000000 vs. 11e4948d73bdafdd)
000110: Invalid object contents: Bad message
File corruption detected at /home/fsumsal/repos/@systemd/systemd/test.journal:272 (of 1249896 bytes, 0%).
FAIL: /home/fsumsal/repos/@systemd/systemd/test.journal (Bad message)
Finished with result: exit-code
Main processes terminated with: code=exited, status=1/FAILURE
Service runtime: 48.051s
CPU time consumed: 47.941s
Memory peak: 8G (swap: 0B)
Same could be, in theory, possible with just `journalctl --file=`, but
the reproducer would be a bit more complicated (haven't tried it, yet).
Lastly, the change in journal-remote is mostly hardening, as the maximum
input size to decompress_blob() there is mandated by MHD's connection
memory limit (set to JOURNAL_SERVER_MEMORY_MAX which is 128 KiB at the
time of writing), so the possible output size there is already quite
limited (e.g. ~800 - 900 MiB for xz-compressed data).
(cherry picked from commit 31d360fb0b)
(cherry picked from commit 02fdf1d0fe)
(cherry picked from commit ac9b00479e)
We already do that with other algorithms, so let's make
decompress_blob_lz4() consistent with the rest.
(cherry picked from commit 2cda5f6169)
(cherry picked from commit ae587dfa54)
(cherry picked from commit 6b0eb70ea4)
So we can access them from the code there as well.
(cherry picked from commit d830bb1fc1)
(cherry picked from commit 3b197747a2)
(cherry picked from commit 9c7ad0c3cf)
The existing iszero_safe guards at index 9 and 10 were added to
silence Coverity, but the same division-by-float-zero warning also
applies to the divisions at index 0 (DBL_MIN) and 1 (DBL_MAX).
CID#1587762
Follow-up for 7f133c996c
(cherry picked from commit 44296e41db)
(cherry picked from commit 96daa8d1b9)
(cherry picked from commit 5b5429eeb4)
Use overflow-safe INC_SAFE() instead of raw addition for idx
accumulation, so that Coverity can see the addition is checked.
CID#1548028
Follow-up for a05483a921
(cherry picked from commit 1afc0c6c60)
(cherry picked from commit 93ca4634bf)
(cherry picked from commit 5c848e427b)
Lennart Poettering