From cc76bf01e38f354bc60adc747af83b4ae006a6b7 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Thu, 16 Jul 2020 09:45:22 +0100 Subject: [PATCH 1/4] basic/mkdir: use uid_is_valid instead of manual check --- src/basic/mkdir.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/basic/mkdir.c b/src/basic/mkdir.c index ed5c4546e4..6ebc2b95fd 100644 --- a/src/basic/mkdir.c +++ b/src/basic/mkdir.c @@ -136,7 +136,7 @@ int mkdir_parents_internal(const char *prefix, const char *path, mode_t mode, ui if (prefix && path_startswith(prefix, t)) continue; - if (uid == UID_INVALID && gid == UID_INVALID && flags == 0) { + if (!uid_is_valid(uid) && !gid_is_valid(gid) && flags == 0) { r = _mkdir(t, mode); if (r < 0 && r != -EEXIST) return r; @@ -167,7 +167,7 @@ int mkdir_p_internal(const char *prefix, const char *path, mode_t mode, uid_t ui if (r < 0) return r; - if (uid == UID_INVALID && gid == UID_INVALID && flags == 0) { + if (!uid_is_valid(uid) && !gid_is_valid(gid) && flags == 0) { r = _mkdir(path, mode); if (r < 0 && (r != -EEXIST || is_dir(path, true) <= 0)) return r; From 2094cd49c4d9732f7e6e3f66550f4198967a76b4 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Thu, 16 Jul 2020 09:45:44 +0100 Subject: [PATCH 2/4] shared/os-util: fix comment style to follow guidelines --- src/shared/os-util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/shared/os-util.c b/src/shared/os-util.c index 7cca59d58a..042e77c8c7 100644 --- a/src/shared/os-util.c +++ b/src/shared/os-util.c @@ -130,7 +130,7 @@ int load_os_release_pairs_with_prefix(const char *root, const char *prefix, char STRV_FOREACH_PAIR(p, q, os_release_pairs) { char *line; - // We strictly return only the four main ID fields and ignore the rest + /* We strictly return only the four main ID fields and ignore the rest */ if (!STR_IN_SET(*p, "ID", "VERSION_ID", "BUILD_ID", "VARIANT_ID")) continue; From eafc7d60569064f30663a93463b7c5df5768bac6 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Thu, 16 Jul 2020 09:46:16 +0100 Subject: [PATCH 3/4] nspawn: use access/F_OK instead of stat to check for file existence --- src/nspawn/nspawn-mount.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c index b07a214b61..ea250af0d7 100644 --- a/src/nspawn/nspawn-mount.c +++ b/src/nspawn/nspawn-mount.c @@ -587,7 +587,6 @@ int mount_all(const char *dest, for (k = 0; k < ELEMENTSOF(mount_table); k++) { _cleanup_free_ char *where = NULL, *options = NULL; const char *o; - struct stat source_st; bool fatal = FLAGS_SET(mount_table[k].mount_settings, MOUNT_FATAL); if (in_userns != FLAGS_SET(mount_table[k].mount_settings, MOUNT_IN_USERNS)) @@ -617,7 +616,7 @@ int mount_all(const char *dest, /* Shortcut for optional bind mounts: if the source can't be found skip ahead to avoid creating * empty and unused directories. */ if (!fatal && FLAGS_SET(mount_table[k].mount_settings, MOUNT_MKDIR) && FLAGS_SET(mount_table[k].flags, MS_BIND)) { - r = stat(mount_table[k].what, &source_st); + r = access(mount_table[k].what, F_OK); if (r < 0) { if (errno == ENOENT) continue; From 14f1c47a0cd0c9ad9c30e2354a0fdba26417ccf0 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Thu, 16 Jul 2020 09:47:16 +0100 Subject: [PATCH 4/4] nspawn: mount os-release in two steps to make it read-only The kernel interface requires setting up read-only bind-mounts in two steps, the bind first and then a read-only remount. Fix nspawn-mount, and cover this case in the integration test. Fixes #16484 --- src/nspawn/nspawn-mount.c | 10 +++++++--- test/units/testsuite-13.sh | 2 ++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c index ea250af0d7..4687ac4c18 100644 --- a/src/nspawn/nspawn-mount.c +++ b/src/nspawn/nspawn-mount.c @@ -563,10 +563,14 @@ int mount_all(const char *dest, MOUNT_FATAL|MOUNT_MKDIR }, { "tmpfs", "/run", "tmpfs", "mode=755" TMPFS_LIMITS_RUN, MS_NOSUID|MS_NODEV|MS_STRICTATIME, MOUNT_FATAL|MOUNT_MKDIR }, - { "/usr/lib/os-release", "/run/host/usr/lib/os-release", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, - MOUNT_FATAL|MOUNT_MKDIR|MOUNT_TOUCH }, - { "/etc/os-release", "/run/host/etc/os-release", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, + { "/usr/lib/os-release", "/run/host/usr/lib/os-release", NULL, NULL, MS_BIND, + MOUNT_FATAL|MOUNT_MKDIR|MOUNT_TOUCH }, /* As per kernel interface requirements, bind mount first (creating mount points) and make read-only later */ + { NULL, "/run/host/usr/lib/os-release", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, + 0 }, + { "/etc/os-release", "/run/host/etc/os-release", NULL, NULL, MS_BIND, MOUNT_MKDIR|MOUNT_TOUCH }, + { NULL, "/run/host/etc/os-release", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, + 0 }, #if HAVE_SELINUX { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND, diff --git a/test/units/testsuite-13.sh b/test/units/testsuite-13.sh index dd1c9575c4..0ad75ac8b0 100755 --- a/test/units/testsuite-13.sh +++ b/test/units/testsuite-13.sh @@ -67,6 +67,8 @@ if [ -n "${VERSION_ID:+set}" ] && [ "${VERSION_ID}" != "${container_host_version if [ -n "${BUILD_ID:+set}" ] && [ "${BUILD_ID}" != "${container_host_build_id}" ]; then exit 1; fi if [ -n "${VARIANT_ID:+set}" ] && [ "${VARIANT_ID}" != "${container_host_variant_id}" ]; then exit 1; fi cd /tmp; (cd /run/host/usr/lib; md5sum os-release) | md5sum -c +if echo test >> /run/host/usr/lib/os-release; then exit 1; fi +if echo test >> /run/host/etc/os-release; then exit 1; fi ' systemd-nspawn --register=no -D /testsuite-13.nc-container --bind=/etc/os-release:/tmp/os-release /bin/sh -x -e -c "$_cmd"