From 169764332af0a85e52e01f7b9cb28cc05cee038f Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 31 Aug 2021 10:04:06 +0200 Subject: [PATCH 1/5] homed: add missing capabilities for SMB/CIFS backend In 2020 mount.cifs started to require a bunch for caps to work. let's add them to the capability bounding set. Also, SMB support obviously needs network access, hence open that up. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1962920 --- units/systemd-homed.service.in | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/units/systemd-homed.service.in b/units/systemd-homed.service.in index 0576f84697..f8198c45b7 100644 --- a/units/systemd-homed.service.in +++ b/units/systemd-homed.service.in @@ -16,19 +16,18 @@ After=home.mount [Service] BusName=org.freedesktop.home1 -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE CAP_SETPCAP CAP_DAC_READ_SEARCH DeviceAllow=/dev/loop-control rw DeviceAllow=/dev/mapper/control rw DeviceAllow=block-* rw DeviceAllow=char-hidraw rw ExecStart={{ROOTLIBEXECDIR}}/systemd-homed -IPAddressDeny=any KillMode=mixed LimitNOFILE={{HIGH_RLIMIT_NOFILE}} LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_ALG +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_ALG AF_INET AF_INET6 RestrictNamespaces=mnt RestrictRealtime=yes StateDirectory=systemd/home From 279e060e2549183101ebf94e9739b70ed499c4c1 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 31 Aug 2021 10:46:06 +0200 Subject: [PATCH 2/5] homed: make sure to use right asssesors for GID + access mode Don't reach directly into the UserRecord struct, but use the right assessors, so that the "unspecified" case is covered. --- src/home/homework-cifs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/home/homework-cifs.c b/src/home/homework-cifs.c index 2254eb59cd..cf3c58431a 100644 --- a/src/home/homework-cifs.c +++ b/src/home/homework-cifs.c @@ -58,8 +58,8 @@ int home_prepare_cifs( f = safe_fclose(f); - if (asprintf(&options, "credentials=%s,uid=" UID_FMT ",forceuid,gid=" UID_FMT ",forcegid,file_mode=0%3o,dir_mode=0%3o", - p, h->uid, h->uid, h->access_mode, h->access_mode) < 0) + if (asprintf(&options, "credentials=%s,uid=" UID_FMT ",forceuid,gid=" GID_FMT ",forcegid,file_mode=0%3o,dir_mode=0%3o", + p, h->uid, user_record_gid(h), user_record_access_mode(h), user_record_access_mode(h)) < 0) return log_oom(); r = safe_fork("(mount)", FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR, &mount_pid); From e070b9eac92993422db25c72ebdbdcc1cf424a0f Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 31 Aug 2021 10:47:02 +0200 Subject: [PATCH 3/5] homed: fix log message referring to fsck, when we actually mean mount --- src/home/homework-cifs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/home/homework-cifs.c b/src/home/homework-cifs.c index cf3c58431a..a697f7e5ee 100644 --- a/src/home/homework-cifs.c +++ b/src/home/homework-cifs.c @@ -71,7 +71,7 @@ int home_prepare_cifs( h->cifs_service, "/run/systemd/user-home-mount", "-o", options, NULL); - log_error_errno(errno, "Failed to execute fsck: %m"); + log_error_errno(errno, "Failed to execute mount: %m"); _exit(EXIT_FAILURE); } From 9191142ddfb3ccd2007245c01197d3f42943815c Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 31 Aug 2021 10:47:29 +0200 Subject: [PATCH 4/5] homed: add missing SYNTHETIC_ERRNO() --- src/home/homework-cifs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/home/homework-cifs.c b/src/home/homework-cifs.c index a697f7e5ee..04a4db8a94 100644 --- a/src/home/homework-cifs.c +++ b/src/home/homework-cifs.c @@ -86,7 +86,8 @@ int home_prepare_cifs( } if (!mounted) - return log_error_errno(ENOKEY, "Failed to mount home directory with supplied password."); + return log_error_errno(SYNTHETIC_ERRNO(ENOKEY), + "Failed to mount home directory with supplied password."); setup->root_fd = open("/run/systemd/user-home-mount", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW); } From 67f9bf897c762ecb61872a5e8e0707a97c8ccd3d Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 31 Aug 2021 10:47:40 +0200 Subject: [PATCH 5/5] homed: remove misplaced assert() --- src/home/homework-mount.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/home/homework-mount.c b/src/home/homework-mount.c index 5e737687d1..da4f14e08d 100644 --- a/src/home/homework-mount.c +++ b/src/home/homework-mount.c @@ -69,9 +69,10 @@ int home_move_mount(const char *user_name_and_realm, const char *target) { const char *d; int r; - assert(user_name_and_realm); assert(target); + /* If user_name_and_realm is set, then we'll mount a subdir of the source mount into the host. If + * it's NULL we'll move the mount itself */ if (user_name_and_realm) { subdir = path_join("/run/systemd/user-home-mount/", user_name_and_realm); if (!subdir)