From 5afd344438833535b541beb8065b4ce98fc73d6d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 28 Apr 2026 15:26:47 +0200 Subject: [PATCH] bootctl,mute-console,pcrextend,pcrlock,repart: allow connections from self MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With SD_VARLINK_SERVER_ROOT_ONLY, we refuse all unprivileged operations. This is silly, the user can and should be able to do anything that doesn't require privileges. E.g.: $ SYSTEMD_LOG_LEVEL=debug varlinkctl introspect /usr/lib/systemd/systemd-pcrextend Forking off Varlink child process '/usr/lib/systemd/systemd-pcrextend'. Successfully forked off '(sd-vlexec)' as PID 568993. varlink: Setting state idle-client json-stream: Sending message: {"method":"org.varlink.service.GetInterfaceDescription","parameters":{"interface":"io.systemd.PCRExtend"}} Skipping PR_SET_MM, as we don't have privileges. varlink: Changing state idle-client → calling varlink: Unprivileged client attempted connection, refusing. Failed to run Varlink event loop: Operation not permitted json-stream: Got POLLHUP from socket. varlink: Changing state calling → pending-disconnect varlink: Connection was closed. Failed to issue org.varlink.service.GetInterfaceDescription() varlink call: Connection reset by peer This and similar commands now work, e.g. $ SYSTEMD_LOG_LEVEL=debug varlinkctl call --more ./build/bootctl io.systemd.BootControl.ListBootEntries {} ... Failed to open directory "/efi": No such file or directory File system "/boot" is not a FAT EFI System Partition (ESP) file system. ... Method call failed: Permission denied { "origin" : "linux", "errno" : 13, "errnoName" : "EACCES" } Which is fine — we lack privileges to actually return a useful answer, but the call itself should go through. I didn't touch udevd, which refuses to run if it is not root, and does a lot of privileged setup, so would refuse to start even if the check was removed. --- src/bootctl/bootctl.c | 4 +++- src/mute-console/mute-console.c | 5 +++-- src/pcrextend/pcrextend.c | 4 +++- src/pcrlock/pcrlock.c | 4 +++- src/repart/repart.c | 7 +++---- 5 files changed, 15 insertions(+), 9 deletions(-) diff --git a/src/bootctl/bootctl.c b/src/bootctl/bootctl.c index c627a7dd07..881bdfb60f 100644 --- a/src/bootctl/bootctl.c +++ b/src/bootctl/bootctl.c @@ -817,7 +817,9 @@ static int vl_server(void) { r = varlink_server_new( &varlink_server, - SD_VARLINK_SERVER_ROOT_ONLY|SD_VARLINK_SERVER_ALLOW_FD_PASSING_INPUT, + SD_VARLINK_SERVER_ROOT_ONLY | + SD_VARLINK_SERVER_MYSELF_ONLY | + SD_VARLINK_SERVER_ALLOW_FD_PASSING_INPUT, /* userdata= */ NULL); if (r < 0) return log_error_errno(r, "Failed to allocate Varlink server: %m"); diff --git a/src/mute-console/mute-console.c b/src/mute-console/mute-console.c index d5788de09b..b64c66e14f 100644 --- a/src/mute-console/mute-console.c +++ b/src/mute-console/mute-console.c @@ -308,8 +308,9 @@ static int vl_server(void) { r = varlink_server_new( &varlink_server, - SD_VARLINK_SERVER_ROOT_ONLY| - SD_VARLINK_SERVER_HANDLE_SIGINT| + SD_VARLINK_SERVER_ROOT_ONLY | + SD_VARLINK_SERVER_MYSELF_ONLY | + SD_VARLINK_SERVER_HANDLE_SIGINT | SD_VARLINK_SERVER_HANDLE_SIGTERM, /* userdata= */ NULL); if (r < 0) diff --git a/src/pcrextend/pcrextend.c b/src/pcrextend/pcrextend.c index f452363209..278b3b730c 100644 --- a/src/pcrextend/pcrextend.c +++ b/src/pcrextend/pcrextend.c @@ -427,7 +427,9 @@ static int vl_server(void) { _cleanup_(sd_varlink_server_unrefp) sd_varlink_server *varlink_server = NULL; int r; - r = varlink_server_new(&varlink_server, SD_VARLINK_SERVER_ROOT_ONLY, /* userdata= */ NULL); + r = varlink_server_new(&varlink_server, + SD_VARLINK_SERVER_ROOT_ONLY | SD_VARLINK_SERVER_MYSELF_ONLY, + /* userdata= */ NULL); if (r < 0) return log_error_errno(r, "Failed to allocate Varlink server: %m"); diff --git a/src/pcrlock/pcrlock.c b/src/pcrlock/pcrlock.c index 63af144fe0..4ebe3f995b 100644 --- a/src/pcrlock/pcrlock.c +++ b/src/pcrlock/pcrlock.c @@ -5480,7 +5480,9 @@ static int run(int argc, char *argv[]) { /* Invocation as Varlink service */ - r = varlink_server_new(&varlink_server, SD_VARLINK_SERVER_ROOT_ONLY, NULL); + r = varlink_server_new(&varlink_server, + SD_VARLINK_SERVER_ROOT_ONLY | SD_VARLINK_SERVER_MYSELF_ONLY, + /* userdata= */ NULL); if (r < 0) return log_error_errno(r, "Failed to allocate Varlink server: %m"); diff --git a/src/repart/repart.c b/src/repart/repart.c index ad19f0ab1e..84aaf60b5f 100644 --- a/src/repart/repart.c +++ b/src/repart/repart.c @@ -11094,10 +11094,9 @@ static int vl_server(void) { /* Invocation as Varlink service */ - r = varlink_server_new( - &varlink_server, - SD_VARLINK_SERVER_ROOT_ONLY, - /* userdata= */ NULL); + r = varlink_server_new(&varlink_server, + SD_VARLINK_SERVER_ROOT_ONLY | SD_VARLINK_SERVER_MYSELF_ONLY, + /* userdata= */ NULL); if (r < 0) return log_error_errno(r, "Failed to allocate Varlink server: %m");