diff --git a/src/basic/socket-util.h b/src/basic/socket-util.h index 86791608b4..c784125ccb 100644 --- a/src/basic/socket-util.h +++ b/src/basic/socket-util.h @@ -374,6 +374,11 @@ int socket_get_mtu(int fd, int af, size_t *ret); int connect_unix_path(int fd, int dir_fd, const char *path); +static inline bool VSOCK_CID_IS_REGULAR(unsigned cid) { + /* 0, 1, 2, UINT32_MAX are special, refuse those */ + return cid > 2 && cid < UINT32_MAX; +} + int vsock_parse_port(const char *s, unsigned *ret); int vsock_parse_cid(const char *s, unsigned *ret); diff --git a/src/vmspawn/vmspawn-util.c b/src/vmspawn/vmspawn-util.c index b5b5eafae6..6270b7ffae 100644 --- a/src/vmspawn/vmspawn-util.c +++ b/src/vmspawn/vmspawn-util.c @@ -100,7 +100,7 @@ static int firmware_executable(const char *name, JsonVariant *v, JsonDispatchFla {} }; - return json_dispatch(v, table, 0, userdata); + return json_dispatch(v, table, flags, userdata); } static int firmware_nvram_template(const char *name, JsonVariant *v, JsonDispatchFlags flags, void *userdata) { @@ -110,7 +110,7 @@ static int firmware_nvram_template(const char *name, JsonVariant *v, JsonDispatc {} }; - return json_dispatch(v, table, 0, userdata); + return json_dispatch(v, table, flags, userdata); } static int firmware_mapping(const char *name, JsonVariant *v, JsonDispatchFlags flags, void *userdata) { @@ -121,7 +121,7 @@ static int firmware_mapping(const char *name, JsonVariant *v, JsonDispatchFlags {} }; - return json_dispatch(v, table, 0, userdata); + return json_dispatch(v, table, flags, userdata); } int find_ovmf_config(int search_sb, OvmfConfig **ret) { @@ -183,7 +183,7 @@ int find_ovmf_config(int search_sb, OvmfConfig **ret) { if (!fwd) return -ENOMEM; - r = json_dispatch(config_json, table, 0, fwd); + r = json_dispatch(config_json, table, JSON_ALLOW_EXTENSIONS, fwd); if (r == -ENOMEM) return r; if (r < 0) { diff --git a/src/vmspawn/vmspawn.c b/src/vmspawn/vmspawn.c index 4ccda8bae8..b4cc6dddc6 100644 --- a/src/vmspawn/vmspawn.c +++ b/src/vmspawn/vmspawn.c @@ -42,7 +42,7 @@ static char *arg_qemu_smp = NULL; static uint64_t arg_qemu_mem = 2ULL * 1024ULL * 1024ULL * 1024ULL; static int arg_qemu_kvm = -1; static int arg_qemu_vsock = -1; -static uint64_t arg_vsock_cid = UINT64_MAX; +static unsigned arg_vsock_cid = VMADDR_CID_ANY; static bool arg_qemu_gui = false; static int arg_secure_boot = -1; static MachineCredentialContext arg_credentials = {}; @@ -69,11 +69,11 @@ static int help(void) { "%5$sSpawn a command or OS in a virtual machine.%6$s\n\n" " -h --help Show this help\n" " --version Print version string\n" - " --no-pager Do not pipe output into a pager\n\n" - "%3$sImage:%4$s\n" + " --no-pager Do not pipe output into a pager\n" + "\n%3$sImage:%4$s\n" " -i --image=PATH Root file system disk image (or device node) for\n" - " the virtual machine\n\n" - "%3$sHost Configuration:%4$s\n" + " the virtual machine\n" + "\n%3$sHost Configuration:%4$s\n" " --qemu-smp=SMP Configure guest's SMP settings\n" " --qemu-mem=MEM Configure guest's RAM size\n" " --qemu-kvm=BOOL Configure whether to use KVM or not\n" @@ -81,10 +81,10 @@ static int help(void) { " --vsock-cid= Specify the CID to use for the qemu guest's vsock\n" " --qemu-gui Start QEMU in graphical mode\n" " --secure-boot=BOOL Configure whether to search for firmware which\n" - " supports Secure Boot\n\n" - "%3$sSystem Identity:%4$s\n" + " supports Secure Boot\n" + "\n%3$sSystem Identity:%4$s\n" " -M --machine=NAME Set the machine name for the container\n" - "%3$sCredentials:%4$s\n" + "\n%3$sCredentials:%4$s\n" " --set-credential=ID:VALUE\n" " Pass a credential with literal value to container.\n" " --load-credential=ID:PATH\n" @@ -198,20 +198,21 @@ static int parse_argv(int argc, char *argv[]) { return log_error_errno(r, "Failed to parse --qemu-vsock=%s: %m", optarg); break; - case ARG_VSOCK_CID: { - unsigned cid; + case ARG_VSOCK_CID: if (isempty(optarg)) - cid = VMADDR_CID_ANY; + arg_vsock_cid = VMADDR_CID_ANY; else { - r = safe_atou_bounded(optarg, 3, UINT_MAX - 1, &cid); - if (r == -ERANGE) - return log_error_errno(r, "Invalid value for --vsock-cid=: %m"); + unsigned cid; + + r = vsock_parse_cid(optarg, &cid); if (r < 0) - return log_error_errno(r, "Failed to parse --vsock-cid=%s: %m", optarg); + return log_error_errno(r, "Failed to parse --vsock-cid: %s", optarg); + if (!VSOCK_CID_IS_REGULAR(cid)) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Specified CID is not regular, refusing: %u", cid); + + arg_vsock_cid = cid; } - arg_vsock_cid = (uint64_t)cid; break; - } case ARG_QEMU_GUI: arg_qemu_gui = true; @@ -499,8 +500,7 @@ static int run_virtual_machine(void) { unsigned child_cid = VMADDR_CID_ANY; _cleanup_close_ int child_vsock_fd = -EBADF; if (use_vsock) { - if (arg_vsock_cid < UINT_MAX) - child_cid = (unsigned)arg_vsock_cid; + child_cid = arg_vsock_cid; r = vsock_fix_child_cid(&child_cid, arg_machine, &child_vsock_fd); if (r < 0) @@ -675,7 +675,6 @@ static int run_virtual_machine(void) { _exit(EXIT_FAILURE); } - int exit_status = INT_MAX; if (use_vsock) { r = setup_notify_parent(event, vsock_fd, &exit_status, ¬ify_event_source); @@ -684,10 +683,10 @@ static int run_virtual_machine(void) { } /* shutdown qemu when we are shutdown */ - (void) sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(child_pid)); - (void) sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(child_pid)); + (void) sd_event_add_signal(event, NULL, SIGINT | SD_EVENT_SIGNAL_PROCMASK, on_orderly_shutdown, PID_TO_PTR(child_pid)); + (void) sd_event_add_signal(event, NULL, SIGTERM | SD_EVENT_SIGNAL_PROCMASK, on_orderly_shutdown, PID_TO_PTR(child_pid)); - (void) sd_event_add_signal(event, NULL, SIGRTMIN+18, sigrtmin18_handler, NULL); + (void) sd_event_add_signal(event, NULL, (SIGRTMIN+18) | SD_EVENT_SIGNAL_PROCMASK, sigrtmin18_handler, NULL); /* Exit when the child exits */ (void) sd_event_add_child(event, NULL, child_pid, WEXITED, on_child_exit, NULL); @@ -713,7 +712,7 @@ static int determine_names(void) { int r; if (!arg_image) - return log_error_errno(SYNTHETIC_ERRNO(-EINVAL), "Missing required argument -i/--image=, quitting"); + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing required argument -i/--image=, quitting"); if (!arg_machine) { char *e; @@ -748,7 +747,7 @@ static int run(int argc, char *argv[]) { if (r < 0) return r; - assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGTERM, SIGINT, SIGRTMIN+18, -1) >= 0); + assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, -1) >= 0); return run_virtual_machine(); }