SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dissect: support mount options when going through mountfsd, requiring privileges via polkit (#39394)

Browse Source 
RootImageOptions=/ExtensionImages=/MountImages= all support custom
mount options, but mountfsd does not support it. Add varlink
parameters to allow callers to specify mount options so that
those directives can work as expected. Require additional privs via
polkit.
This commit is contained in:
Luca Boccassi
2026-01-16 14:55:02 +00:00
committed by GitHub
parent 502d6f4bc9 3a8759e5d4
commit 3e2a5dc2e1
11 changed files with 199 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/units/TEST-50-DISSECT.mountfsd.sh
+37
View File
@@ -91,6 +91,43 @@ if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then
--property ExtensionImagePolicy=root=verity+signed+absent:usr=verity+signed+absent \
bash -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\"")
mv /tmp/app0.roothash.p7s.bak /tmp/app0.roothash.p7s
# Mount options should not be allowed without elevated privileges
(! systemd-run -M testuser@ --user --pipe --wait \
--property RootImage="$MINIMAL_IMAGE.gpt" \
--property RootImageOptions="root:ro,noatime,nosuid home:ro,dev nosuid,dev" \
--property RootImageOptions="home:ro,dev nosuid,dev,%%foo" \
true)
(! systemd-run -M testuser@ --user --pipe --wait \
--property RootImage="$MINIMAL_IMAGE.raw" \
--property ExtensionImages=/tmp/app0.raw \
--property MountImages=/tmp/app0.raw:/var/tmp:noatime,nosuid \
true)
mkdir -p /etc/polkit-1/rules.d
cat >/etc/polkit-1/rules.d/mountoptions.rules <<'EOF'
polkit.addRule(function(action, subject) {
if (action.id == "io.systemd.mount-file-system.mount-untrusted-image-privately" &&
action.lookup("mount_options") == "root:nosuid") {
return polkit.Result.YES;
}
});
EOF
systemctl try-reload-or-restart polkit.service
systemd-run -M testuser@ --user --pipe --wait \
--property RootImage="$MINIMAL_IMAGE.gpt" \
--property RootImageOptions="root:nosuid" \
sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && mount | grep -F squashfs | grep -q -F nosuid"
systemd-run -M testuser@ --user --pipe --wait \
--property RootImage="$MINIMAL_IMAGE.raw" \
--property ExtensionImages=/tmp/app0.raw \
--property MountImages=/tmp/app0.raw:/var/tmp:nosuid \
sh -c "test -e \"/dev/mapper/${MINIMAL_IMAGE_ROOTHASH}-verity\" && test -e \"/dev/mapper/$(</tmp/app0.roothash)-verity\" && mount | grep -F /var/tmp | grep -q -F nosuid"
rm -f /etc/polkit-1/rules.d/mountoptions.rules
systemctl try-reload-or-restart polkit.service
fi
# Bare squashfs without any verity or signature also should be rejected, even if we ask to trust it
test/units/TEST-50-DISSECT.sh
+1
View File
@@ -25,6 +25,7 @@ at_exit() {
done < <(find "${IMAGE_DIR}" -mindepth 1 -maxdepth 1 -type d)
rm -rf "$IMAGE_DIR"
rm -rf /etc/polkit-1/rules.d/mountoptions.rules
rm -f /etc/polkit-1/rules.d/sysext-unpriv.rules