From 0ec1a83eeae18e658a55dca5f8f65ce2391f8ead Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 19 Mar 2025 10:02:16 +0100 Subject: [PATCH 1/4] veritysetup: automatically generate unit name, instead of hardcoding it --- src/veritysetup/veritysetup-generator.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/veritysetup/veritysetup-generator.c b/src/veritysetup/veritysetup-generator.c index 8e35946ca6..520cf097e5 100644 --- a/src/veritysetup/veritysetup-generator.c +++ b/src/veritysetup/veritysetup-generator.c @@ -22,9 +22,6 @@ #include "string-util.h" #include "unit-name.h" -#define SYSTEMD_VERITYSETUP_SERVICE_ROOT "systemd-veritysetup@root.service" -#define SYSTEMD_VERITYSETUP_SERVICE_USR "systemd-veritysetup@usr.service" - static const char *arg_dest = NULL; static bool arg_enabled = true; static bool arg_read_veritytab = true; @@ -49,7 +46,6 @@ STATIC_DESTRUCTOR_REGISTER(arg_usr_options, freep); static int create_special_device( const char *name, - const char *service, const char *roothash, const char *data_what, const char *hash_what, @@ -62,7 +58,6 @@ static int create_special_device( /* Creates a systemd-veritysetup@.service instance for the special kernel cmdline specified root + usr devices. */ assert(name); - assert(service); /* If all three pieces of information are missing, then verity is turned off */ if (!roothash && !data_what && !hash_what) @@ -79,6 +74,11 @@ static int create_special_device( if (!roothash || !data_what || !hash_what) return -EINVAL; + _cleanup_free_ char *service = NULL; + r = unit_name_build("systemd-veritysetup", name, ".service", &service); + if (r < 0) + return log_error_errno(r, "Failed to generate unit name: %m"); + log_debug("Using %s verity data device %s, hash device %s, options %s, and hash %s.", name, data_what, hash_what, options, roothash); u = fstab_node_to_udev_node(data_what); @@ -126,11 +126,11 @@ static int create_special_device( } static int create_root_device(void) { - return create_special_device("root", SYSTEMD_VERITYSETUP_SERVICE_ROOT, arg_root_hash, arg_root_data_what, arg_root_hash_what, arg_root_options); + return create_special_device("root", arg_root_hash, arg_root_data_what, arg_root_hash_what, arg_root_options); } static int create_usr_device(void) { - return create_special_device("usr", SYSTEMD_VERITYSETUP_SERVICE_USR, arg_usr_hash, arg_usr_data_what, arg_usr_hash_what, arg_usr_options); + return create_special_device("usr", arg_usr_hash, arg_usr_data_what, arg_usr_hash_what, arg_usr_options); } static int parse_proc_cmdline_item(const char *key, const char *value, void *data) { From eedd0b9886e105330ecfb174b445413053aa220f Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 19 Mar 2025 10:05:25 +0100 Subject: [PATCH 2/4] veritysetup-generator: exit on first error --- src/veritysetup/veritysetup-generator.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/src/veritysetup/veritysetup-generator.c b/src/veritysetup/veritysetup-generator.c index 520cf097e5..cc489b1b65 100644 --- a/src/veritysetup/veritysetup-generator.c +++ b/src/veritysetup/veritysetup-generator.c @@ -65,14 +65,11 @@ static int create_special_device( /* if one of them is missing however, the data is simply incomplete and this is an error */ if (!roothash) - log_error("Verity information for %s incomplete, root hash unspecified.", name); + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Verity information for %s incomplete, root hash unspecified.", name); if (!data_what) - log_error("Verity information for %s incomplete, data device unspecified.", name); + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Verity information for %s incomplete, data device unspecified.", name); if (!hash_what) - log_error("Verity information for %s incomplete, hash device unspecified.", name); - - if (!roothash || !data_what || !hash_what) - return -EINVAL; + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Verity information for %s incomplete, hash device unspecified.", name); _cleanup_free_ char *service = NULL; r = unit_name_build("systemd-veritysetup", name, ".service", &service); From 64f8df2f31d23b8921ce5d2af517df2433724f65 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 19 Mar 2025 10:05:50 +0100 Subject: [PATCH 3/4] veritysetup-generator: specify source for generator_open_unit_file() --- src/veritysetup/veritysetup-generator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/veritysetup/veritysetup-generator.c b/src/veritysetup/veritysetup-generator.c index cc489b1b65..95f1d52fef 100644 --- a/src/veritysetup/veritysetup-generator.c +++ b/src/veritysetup/veritysetup-generator.c @@ -92,7 +92,7 @@ static int create_special_device( if (r < 0) return log_error_errno(r, "Failed to generate unit name: %m"); - r = generator_open_unit_file(arg_dest, NULL, service, &f); + r = generator_open_unit_file(arg_dest, "/proc/cmdline", service, &f); if (r < 0) return r; From bed546d187d3beba64d488aa917d2530fc038d47 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 19 Mar 2025 10:06:10 +0100 Subject: [PATCH 4/4] veritysetup-generator: repeat format string arguments a bit less --- src/veritysetup/veritysetup-generator.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/veritysetup/veritysetup-generator.c b/src/veritysetup/veritysetup-generator.c index 95f1d52fef..6335775d43 100644 --- a/src/veritysetup/veritysetup-generator.c +++ b/src/veritysetup/veritysetup-generator.c @@ -102,9 +102,8 @@ static int create_special_device( fprintf(f, "Before=veritysetup.target\n" - "BindsTo=%s %s\n" - "After=%s %s\n", - d, e, + "BindsTo=%1$s %2$s\n" + "After=%1$s %2$s\n", d, e); r = generator_write_veritysetup_service_section(f, name, u, v, roothash, options); @@ -222,7 +221,6 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat r = free_and_strdup(&arg_usr_options, value); if (r < 0) return log_oom(); - } return 0;