diff --git a/src/core/namespace.c b/src/core/namespace.c index 1a96989512..6e9c6a09f8 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -2050,15 +2050,20 @@ static int apply_one_mount( /* Hmm, either the source or the destination are missing. Let's see if we can create the destination, then try again. */ - (void) mkdir_parents(mount_entry_path(m), 0755); - - q = make_mount_point_inode_from_path(what, mount_entry_path(m), 0755); + q = mkdir_parents(mount_entry_path(m), 0755); if (q < 0 && q != -EEXIST) // FIXME: this shouldn't be logged at LOG_WARNING, but be bubbled up, and logged there to avoid duplicate logging - log_warning_errno(q, "Failed to create destination mount point node '%s', ignoring: %m", + log_warning_errno(q, "Failed to create parent directories of destination mount point node '%s', ignoring: %m", mount_entry_path(m)); - else - try_again = true; + else { + q = make_mount_point_inode_from_path(what, mount_entry_path(m), 0755); + if (q < 0 && q != -EEXIST) + // FIXME: this shouldn't be logged at LOG_WARNING, but be bubbled up, and logged there to avoid duplicate logging + log_warning_errno(q, "Failed to create destination mount point node '%s', ignoring: %m", + mount_entry_path(m)); + else + try_again = true; + } } if (try_again) diff --git a/src/portable/portable.c b/src/portable/portable.c index b65fa7467e..2b709f22f5 100644 --- a/src/portable/portable.c +++ b/src/portable/portable.c @@ -2047,7 +2047,7 @@ int portable_attach( if (!FLAGS_SET(flags, PORTABLE_REATTACH) && !FLAGS_SET(flags, PORTABLE_FORCE_ATTACH)) HASHMAP_FOREACH(item, unit_files) { - r = unit_file_exists(scope, &paths, item->name); + r = unit_file_exists_full(scope, &paths, SEARCH_IGNORE_TEMPLATE, item->name, /* ret_path= */ NULL); if (r < 0) return sd_bus_error_set_errnof(error, r, "Failed to determine whether unit '%s' exists on the host: %m", item->name); if (r > 0) diff --git a/src/run/run.c b/src/run/run.c index 3d72d7b4c3..04e643b209 100644 --- a/src/run/run.c +++ b/src/run/run.c @@ -61,7 +61,6 @@ #include "strv.h" #include "terminal-util.h" #include "time-util.h" -#include "uid-classification.h" #include "unit-def.h" #include "unit-name.h" #include "user-util.h" @@ -2248,9 +2247,6 @@ static int fchown_to_capsule(int fd, const char *capsule) { if (r < 0) return r; - if (uid_is_system(st.st_uid) || gid_is_system(st.st_gid)) /* paranoid safety check */ - return -EPERM; - return fchmod_and_chown(fd, 0600, st.st_uid, st.st_gid); } diff --git a/src/shared/bus-util.c b/src/shared/bus-util.c index c8d4c47f73..444c4df0fb 100644 --- a/src/shared/bus-util.c +++ b/src/shared/bus-util.c @@ -35,7 +35,6 @@ #include "string-util.h" #include "strv.h" #include "time-util.h" -#include "uid-classification.h" static int name_owner_change_callback(sd_bus_message *m, void *userdata, sd_bus_error *reterr_error) { sd_event *e = ASSERT_PTR(userdata); @@ -316,7 +315,7 @@ static int pin_capsule_socket(const char *capsule, const char *suffix, uid_t *re if (!p) return -ENOMEM; - /* We enter territory owned by the user, hence let's be paranoid about symlinks and ownership */ + /* We enter territory owned by the user, hence let's be paranoid about symlinks */ r = chase(p, /* root= */ NULL, CHASE_SAFE|CHASE_PROHIBIT_SYMLINKS, /* ret_path= */ NULL, &inode_fd); if (r < 0) return r; @@ -324,10 +323,6 @@ static int pin_capsule_socket(const char *capsule, const char *suffix, uid_t *re if (fstat(inode_fd, &st) < 0) return negative_errno(); - /* Paranoid safety check */ - if (uid_is_system(st.st_uid) || gid_is_system(st.st_gid)) - return -EPERM; - *ret_uid = st.st_uid; *ret_gid = st.st_gid; diff --git a/src/shared/install.c b/src/shared/install.c index 4c68821562..d3e5a1fb5a 100644 --- a/src/shared/install.c +++ b/src/shared/install.c @@ -37,12 +37,6 @@ #define UNIT_FILE_FOLLOW_SYMLINK_MAX 64 -typedef enum SearchFlags { - SEARCH_LOAD = 1 << 0, - SEARCH_FOLLOW_CONFIG_SYMLINKS = 1 << 1, - SEARCH_DROPIN = 1 << 2, -} SearchFlags; - typedef struct { RuntimeScope scope; OrderedHashmap *will_process; @@ -1563,7 +1557,7 @@ static int unit_file_search( assert(info->name); - if (unit_name_is_valid(info->name, UNIT_NAME_INSTANCE)) { + if (!FLAGS_SET(flags, SEARCH_IGNORE_TEMPLATE) && unit_name_is_valid(info->name, UNIT_NAME_INSTANCE)) { r = unit_name_template(info->name, &template); if (r < 0) return r; @@ -3242,7 +3236,7 @@ int unit_file_get_state( int unit_file_exists_full( RuntimeScope scope, const LookupPaths *lp, - bool follow, + SearchFlags flags, const char *name, char **ret_path) { @@ -3262,7 +3256,7 @@ int unit_file_exists_full( &c, lp, name, - follow ? SEARCH_FOLLOW_CONFIG_SYMLINKS : 0, + flags, ret_path ? &info : NULL, /* changes= */ NULL, /* n_changes= */ NULL); diff --git a/src/shared/install.h b/src/shared/install.h index 98d5a41d3e..ad5803e321 100644 --- a/src/shared/install.h +++ b/src/shared/install.h @@ -39,6 +39,13 @@ typedef enum UnitFileFlags { _UNIT_FILE_FLAGS_MASK_PUBLIC = UNIT_FILE_RUNTIME|UNIT_FILE_PORTABLE|UNIT_FILE_FORCE, } UnitFileFlags; +typedef enum SearchFlags { + SEARCH_LOAD = 1 << 0, + SEARCH_FOLLOW_CONFIG_SYMLINKS = 1 << 1, + SEARCH_DROPIN = 1 << 2, + SEARCH_IGNORE_TEMPLATE = 1 << 3, /* Don't look up the template if the instance does not exist. */ +} SearchFlags; + /* type can be either one of the INSTALL_CHANGE_SYMLINK, INSTALL_CHANGE_UNLINK, … listed above, or a negative * errno value. * @@ -184,12 +191,12 @@ int unit_file_get_state(RuntimeScope scope, const char *root_dir, const char *fi int unit_file_exists_full( RuntimeScope scope, const LookupPaths *lp, - bool follow, + SearchFlags flags, const char *name, char **ret_path); static inline int unit_file_exists(RuntimeScope scope, const LookupPaths *lp, const char *name) { - return unit_file_exists_full(scope, lp, false, name, NULL); + return unit_file_exists_full(scope, lp, 0, name, NULL); } int unit_file_get_list(RuntimeScope scope, const char *root_dir, char * const *states, char * const *patterns, Hashmap **ret); diff --git a/src/ssh-generator/ssh-generator.c b/src/ssh-generator/ssh-generator.c index e596d36933..3923710b5c 100644 --- a/src/ssh-generator/ssh-generator.c +++ b/src/ssh-generator/ssh-generator.c @@ -474,7 +474,7 @@ static int run(const char *dest, const char *dest_early, const char *dest_late) _cleanup_free_ char *found_sshd_template_unit = NULL; r = unit_file_exists_full(RUNTIME_SCOPE_SYSTEM, &lp, - /* follow = */ true, + SEARCH_FOLLOW_CONFIG_SYMLINKS, "sshd@.service", &found_sshd_template_unit); if (r < 0)