From 6df5f80bd374be1b45c52d740e88f0236da922c7 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 8 Mar 2026 14:30:52 +0000 Subject: [PATCH 1/3] machined: reject invalid class types when registering machines Follow-up for fbe550738d03b178bb004a1390e74115e904118a --- src/machine/machine-varlink.c | 3 +++ src/machine/machined-dbus.c | 4 +-- test/units/TEST-13-NSPAWN.unpriv.sh | 40 +++++++++++++++++++++++++++++ 3 files changed, 45 insertions(+), 2 deletions(-) diff --git a/src/machine/machine-varlink.c b/src/machine/machine-varlink.c index 118d8178f4..73edd781b5 100644 --- a/src/machine/machine-varlink.c +++ b/src/machine/machine-varlink.c @@ -155,6 +155,9 @@ int vl_method_register(sd_varlink *link, sd_json_variant *parameters, sd_varlink if (r != 0) return r; + if (!IN_SET(machine->class, MACHINE_CONTAINER, MACHINE_VM)) + return sd_varlink_error_invalid_parameter_name(link, "class"); + if (manager->runtime_scope != RUNTIME_SCOPE_USER) { r = varlink_verify_polkit_async( link, diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c index ab7ca94fd0..87f0c15ee1 100644 --- a/src/machine/machined-dbus.c +++ b/src/machine/machined-dbus.c @@ -433,7 +433,7 @@ static int method_create_or_register_machine( c = _MACHINE_CLASS_INVALID; else { c = machine_class_from_string(class); - if (c < 0) + if (c < 0 || !IN_SET(c, MACHINE_CONTAINER, MACHINE_VM)) return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid machine class parameter"); } @@ -608,7 +608,7 @@ static int method_create_or_register_machine_ex( c = _MACHINE_CLASS_INVALID; else { c = machine_class_from_string(class); - if (c < 0) + if (c < 0 || !IN_SET(c, MACHINE_CONTAINER, MACHINE_VM)) return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid machine class parameter"); } diff --git a/test/units/TEST-13-NSPAWN.unpriv.sh b/test/units/TEST-13-NSPAWN.unpriv.sh index 25867de707..75a9c1aac0 100755 --- a/test/units/TEST-13-NSPAWN.unpriv.sh +++ b/test/units/TEST-13-NSPAWN.unpriv.sh @@ -120,6 +120,46 @@ run0 -u testuser \ /run/systemd/machine/io.systemd.Machine \ io.systemd.Machine.Open \ '{"name":"shouldnotwork3", "mode": "shell", "user":"root","path":"/usr/bin/bash","args":["bash","-c","''touch /shouldnotwork; sleep 20''"]}') +(! varlinkctl \ + call \ + /run/systemd/machine/io.systemd.Machine \ + io.systemd.Machine.Register \ + "{\"name\":\"shouldnotwork4\", \"class\":\"host\", \"leader\": $sleep_pid}") +(! machinectl list | grep shouldnotwork4) +(! run0 -u testuser \ + varlinkctl \ + call \ + /run/systemd/machine/io.systemd.Machine \ + io.systemd.Machine.Register \ + "{\"name\":\"shouldnotwork5\", \"class\":\"host\", \"leader\": $sleep_pid}") +(! machinectl list | grep shouldnotwork5) +(! busctl call \ + org.freedesktop.machine1 \ + /org/freedesktop/machine1 \ + org.freedesktop.machine1.Manager \ + RegisterMachine \ + 'sayssus' \ + shouldnotwork6 \ + 0 \ + "" \ + host \ + 0 \ + "") +(! machinectl list | grep shouldnotwork6) +(! run0 -u testuser \ + busctl call \ + org.freedesktop.machine1 \ + /org/freedesktop/machine1 \ + org.freedesktop.machine1.Manager \ + RegisterMachine \ + 'sayssus' \ + shouldnotwork7 \ + 0 \ + "" \ + host \ + 0 \ + "") +(! machinectl list | grep shouldnotwork7) systemctl --user --machine testuser@ stop sleep.service test ! -f /shouldnotwork From 61bceb1bff4b1f9c126b18dc971ca3e6d8c71c40 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 11 Mar 2026 12:15:26 +0000 Subject: [PATCH 2/3] nspawn: apply BindUser/Ephemeral from settings file only if trusted Originally reported on yeswehack.com as: YWH-PGM9780-116 Follow-up for 2f8930449079403b26c9164b8eeac78d5af2c8df Follow-up for a2f577fca0be79b23f61f033229b64884e7d840a --- src/nspawn/nspawn.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 1b3aa7d1ad..84e94e845a 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -4783,8 +4783,13 @@ static int merge_settings(Settings *settings, const char *path) { } if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 && - settings->ephemeral >= 0) - arg_ephemeral = settings->ephemeral; + settings->ephemeral >= 0) { + + if (!arg_settings_trusted) + log_warning("Ignoring ephemeral setting, file %s is not trusted.", path); + else + arg_ephemeral = settings->ephemeral; + } if ((arg_settings_mask & SETTING_DIRECTORY) == 0 && settings->root) { @@ -4953,8 +4958,13 @@ static int merge_settings(Settings *settings, const char *path) { } if ((arg_settings_mask & SETTING_BIND_USER) == 0 && - !strv_isempty(settings->bind_user)) - strv_free_and_replace(arg_bind_user, settings->bind_user); + !strv_isempty(settings->bind_user)) { + + if (!arg_settings_trusted) + log_warning("Ignoring bind user setting, file %s is not trusted.", path); + else + strv_free_and_replace(arg_bind_user, settings->bind_user); + } if (!FLAGS_SET(arg_settings_mask, SETTING_BIND_USER_SHELL) && settings->bind_user_shell_set) { From 7b85f5498a958e5bb660c703b8f4a71cceed3373 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 11 Mar 2026 13:27:14 +0000 Subject: [PATCH 3/3] nspawn: normalize pivot_root paths Originally reported on yeswehack.com as: YWH-PGM9780-116 Follow-up for b53ede699cdc5233041a22591f18863fb3fe2672 --- src/nspawn/nspawn-mount.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c index 282a29c359..1ee01238f3 100644 --- a/src/nspawn/nspawn-mount.c +++ b/src/nspawn/nspawn-mount.c @@ -1370,7 +1370,9 @@ int pivot_root_parse(char **pivot_root_new, char **pivot_root_old, const char *s if (!path_is_absolute(root_new)) return -EINVAL; - if (root_old && !path_is_absolute(root_old)) + if (!path_is_normalized(root_new)) + return -EINVAL; + if (root_old && (!path_is_absolute(root_old) || !path_is_normalized(root_old))) return -EINVAL; free_and_replace(*pivot_root_new, root_new);