SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sd-journal: allow to read sealed journal files when sealing is not supported

Browse Source
This commit is contained in:
Yu Watanabe
2026-06-28 00:00:11 +09:00
parent 24c4729198
commit 2e077b57a7
4 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsystemd/sd-journal/journal-authenticate-internal.c
+4
View File
@@ -12,6 +12,10 @@ void journal_auth_set_ops(const JournalAuthOps *ops) {
auth_ops = ops;
}
bool journal_auth_supported(void) {
return !!auth_ops;
}
void journal_file_auth_done(JournalFile *f) {
assert(f);
src/libsystemd/sd-journal/journal-authenticate-internal.h
+1
View File
@@ -21,6 +21,7 @@ typedef struct JournalAuthOps {
} JournalAuthOps;
void journal_auth_set_ops(const JournalAuthOps *ops);
bool journal_auth_supported(void);
void journal_file_auth_done(JournalFile *f);
int journal_file_auth_load(JournalFile *f);
src/libsystemd/sd-journal/journal-def.h
+2 -1
View File
@@ -210,7 +210,8 @@ enum {
HEADER_COMPATIBLE_TAIL_ENTRY_BOOT_ID |
HEADER_COMPATIBLE_SEALED_CONTINUOUS,
HEADER_COMPATIBLE_SUPPORTED = (HAVE_GCRYPT ? HEADER_COMPATIBLE_SEALED | HEADER_COMPATIBLE_SEALED_CONTINUOUS : 0) |
HEADER_COMPATIBLE_SUPPORTED = HEADER_COMPATIBLE_SEALED |
HEADER_COMPATIBLE_SEALED_CONTINUOUS |
HEADER_COMPATIBLE_TAIL_ENTRY_BOOT_ID,
};
src/libsystemd/sd-journal/journal-file.c
+7 -2
View File
@@ -457,14 +457,19 @@ static int journal_file_refresh_header(JournalFile *f) {
}
static bool warn_wrong_flags(const JournalFile *f, bool compatible) {
const uint32_t any = compatible ? HEADER_COMPATIBLE_ANY : HEADER_INCOMPATIBLE_ANY,
supported = compatible ? HEADER_COMPATIBLE_SUPPORTED : HEADER_INCOMPATIBLE_SUPPORTED;
const uint32_t any = compatible ? HEADER_COMPATIBLE_ANY : HEADER_INCOMPATIBLE_ANY;
uint32_t supported = compatible ? HEADER_COMPATIBLE_SUPPORTED : HEADER_INCOMPATIBLE_SUPPORTED;
const char *type = compatible ? "compatible" : "incompatible";
uint32_t flags;
assert(f);
assert(f->header);
/* When sealing is not supported, refuse to write to an already sealed journal file, but still allow
* reading sealed journal files. */
if (compatible && journal_file_writable(f) && !journal_auth_supported())
supported &= ~(HEADER_COMPATIBLE_SEALED | HEADER_COMPATIBLE_SEALED_CONTINUOUS);
flags = le32toh(compatible ? f->header->compatible_flags : f->header->incompatible_flags);
if (flags & ~supported) {