SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: fix checking for extension-releases for ExtensionImages/Directories

Browse Source 
The parsing is done after the image has been opened, not before, as it
cannot be done on an block device. Also fix returning on any error for
ExtensionDirectories, not just ENOENT.

Follow-up for 55ea4ef096
This commit is contained in:
Luca Boccassi
2023-10-12 12:17:58 +01:00
committed by Luca Boccassi
parent 97046f2fc0
commit 5897469a08
4 changed files with 18 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/namespace.c
+13 -19
View File
@@ -1269,9 +1269,8 @@ static int mount_image(
const ImagePolicy *image_policy) {
_cleanup_free_ char *host_os_release_id = NULL, *host_os_release_version_id = NULL,
*host_os_release_level = NULL, *extension_name = NULL;
_cleanup_strv_free_ char **extension_release = NULL;
ImageClass class = IMAGE_SYSEXT;
*host_os_release_sysext_level = NULL, *host_os_release_confext_level = NULL,
*extension_name = NULL;
int r;
assert(m);
@@ -1281,20 +1280,12 @@ static int mount_image(
return log_debug_errno(r, "Failed to extract extension name from %s: %m", mount_entry_source(m));
if (m->mode == EXTENSION_IMAGES) {
r = load_extension_release_pairs(mount_entry_source(m), IMAGE_SYSEXT, extension_name, /* relax_extension_release_check= */ false, &extension_release);
if (r == -ENOENT) {
r = load_extension_release_pairs(mount_entry_source(m), IMAGE_CONFEXT, extension_name, /* relax_extension_release_check= */ false, &extension_release);
if (r >= 0)
class = IMAGE_CONFEXT;
}
if (r == -ENOENT)
return r;
r = parse_os_release(
empty_to_root(root_directory),
"ID", &host_os_release_id,
"VERSION_ID", &host_os_release_version_id,
image_class_info[class].level_env, &host_os_release_level,
image_class_info[IMAGE_SYSEXT].level_env, &host_os_release_sysext_level,
image_class_info[IMAGE_CONFEXT].level_env, &host_os_release_confext_level,
NULL);
if (r < 0)
return log_debug_errno(r, "Failed to acquire 'os-release' data of OS tree '%s': %m", empty_to_root(root_directory));
@@ -1310,20 +1301,23 @@ static int mount_image(
image_policy,
host_os_release_id,
host_os_release_version_id,
host_os_release_level,
host_os_release_sysext_level,
host_os_release_confext_level,
/* required_sysext_scope= */ NULL,
/* ret_image= */ NULL);
if (r == -ENOENT && m->ignore)
return 0;
if (r == -ESTALE && host_os_release_id)
return log_error_errno(r,
"Failed to mount image %s, extension-release metadata does not match the lower layer's: ID=%s%s%s%s%s",
"Failed to mount image %s, extension-release metadata does not match the lower layer's: ID=%s%s%s%s%s%s%s",
mount_entry_source(m),
host_os_release_id,
host_os_release_version_id ? " VERSION_ID=" : "",
strempty(host_os_release_version_id),
host_os_release_level ? image_class_info[class].level_env_print : "",
strempty(host_os_release_level));
host_os_release_sysext_level ? image_class_info[IMAGE_SYSEXT].level_env_print : "",
strempty(host_os_release_sysext_level),
host_os_release_confext_level ? image_class_info[IMAGE_CONFEXT].level_env_print : "",
strempty(host_os_release_confext_level));
if (r < 0)
return log_debug_errno(r, "Failed to mount image %s on %s: %m", mount_entry_source(m), mount_entry_path(m));
@@ -1465,8 +1459,8 @@ static int apply_one_mount(
if (r >= 0)
class = IMAGE_CONFEXT;
}
if (r == -ENOENT)
return r;
if (r < 0)
return log_debug_errno(r, "Failed to acquire 'extension-release' data of extension tree %s: %m", mount_entry_source(m));
r = parse_os_release(
empty_to_root(root_directory),
src/shared/dissect-image.c
+2 -1
View File
@@ -3912,6 +3912,7 @@ int verity_dissect_and_mount(
const char *required_host_os_release_id,
const char *required_host_os_release_version_id,
const char *required_host_os_release_sysext_level,
const char *required_host_os_release_confext_level,
const char *required_sysext_scope,
DissectedImage **ret_image) {
@@ -4029,7 +4030,7 @@ int verity_dissect_and_mount(
dissected_image->image_name,
required_host_os_release_id,
required_host_os_release_version_id,
required_host_os_release_sysext_level,
class == IMAGE_SYSEXT ? required_host_os_release_sysext_level : required_host_os_release_confext_level,
required_sysext_scope,
extension_release,
class);
src/shared/dissect-image.h
+1 -1
View File
@@ -194,7 +194,7 @@ bool dissected_image_verity_sig_ready(const DissectedImage *image, PartitionDesi
int mount_image_privately_interactively(const char *path, const ImagePolicy *image_policy, DissectImageFlags flags, char **ret_directory, int *ret_dir_fd, LoopDevice **ret_loop_device);
int verity_dissect_and_mount(int src_fd, const char *src, const char *dest, const MountOptions *options, const ImagePolicy *image_policy, const char *required_host_os_release_id, const char *required_host_os_release_version_id, const char *required_host_os_release_sysext_level, const char *required_sysext_scope, DissectedImage **ret_image);
int verity_dissect_and_mount(int src_fd, const char *src, const char *dest, const MountOptions *options, const ImagePolicy *image_policy, const char *required_host_os_release_id, const char *required_host_os_release_version_id, const char *required_host_os_release_sysext_level, const char *required_host_os_release_confext_level, const char *required_sysext_scope, DissectedImage **ret_image);
int dissect_fstype_ok(const char *fstype);
src/shared/mount-util.c
+2
View File
@@ -884,6 +884,7 @@ static int mount_in_namespace_legacy(
/* required_host_os_release_id= */ NULL,
/* required_host_os_release_version_id= */ NULL,
/* required_host_os_release_sysext_level= */ NULL,
/* required_host_os_release_confext_level= */ NULL,
/* required_sysext_scope= */ NULL,
/* ret_image= */ NULL);
else
@@ -1102,6 +1103,7 @@ static int mount_in_namespace(
/* required_host_os_release_id= */ NULL,
/* required_host_os_release_version_id= */ NULL,
/* required_host_os_release_sysext_level= */ NULL,
/* required_host_os_release_confext_level= */ NULL,
/* required_sysext_scope= */ NULL,
&img);
if (r < 0)