From 8953917d00e9dfbc5ad07b653852f6f17a047028 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Mon, 8 Apr 2024 20:09:54 +0800 Subject: [PATCH 1/6] labeler: add mountfsd and nsresource --- .github/labeler.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/labeler.yml b/.github/labeler.yml index 86a31776f4..e8952dc82a 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -76,12 +76,18 @@ meson: mkosi: - changed-files: - any-glob-to-any-file: ['.mkosi/*', 'mkosi.build'] +mountfsd: + - changed-files: + - any-glob-to-any-file: ['src/mountfsd/*'] network: - changed-files: - any-glob-to-any-file: ['src/libsystemd-network/**/*', 'src/network/**/*'] nspawn: - changed-files: - any-glob-to-any-file: '**/*nspawn*' +nsresource: + - changed-files: + - any-glob-to-any-file: '**/*nsresource*' portable: - changed-files: - any-glob-to-any-file: 'src/portable/**/*' From 0aec92a5cc3b928cc2a8808d3cc6bd29de4f72e7 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Mon, 8 Apr 2024 19:48:01 +0800 Subject: [PATCH 2/6] uid-range: use FOREACH_ARRAY at one more place --- src/basic/uid-range.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/basic/uid-range.c b/src/basic/uid-range.c index 4fc79c07c2..1f2e76aaa1 100644 --- a/src/basic/uid-range.c +++ b/src/basic/uid-range.c @@ -173,9 +173,9 @@ bool uid_range_covers(const UIDRange *range, uid_t start, uid_t nr) { if (!range) return false; - for (size_t i = 0; i < range->n_entries; i++) - if (start >= range->entries[i].start && - start + nr <= range->entries[i].start + range->entries[i].nr) + FOREACH_ARRAY(i, range->entries, range->n_entries) + if (start >= i->start && + start + nr <= i->start + i->nr) return true; return false; From 7fe28d83860c7f8b50a8fcb3b2c50e3945f3cb41 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Mon, 8 Apr 2024 19:38:29 +0800 Subject: [PATCH 3/6] uid-range: place 'ret' param at last --- src/basic/uid-range.c | 6 +++--- src/basic/uid-range.h | 2 +- src/core/manager.c | 2 +- src/libsystemd/sd-device/device-monitor.c | 2 +- src/nsresourced/nsresourcework.c | 2 +- src/test/test-uid-range.c | 4 ++-- src/userdb/userdbctl.c | 4 ++-- 7 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/basic/uid-range.c b/src/basic/uid-range.c index 1f2e76aaa1..a7658811ec 100644 --- a/src/basic/uid-range.c +++ b/src/basic/uid-range.c @@ -205,7 +205,7 @@ int uid_map_read_one(FILE *f, uid_t *ret_base, uid_t *ret_shift, uid_t *ret_rang return 0; } -int uid_range_load_userns(UIDRange **ret, const char *path, UIDRangeUsernsMode mode) { +int uid_range_load_userns(const char *path, UIDRangeUsernsMode mode, UIDRange **ret) { _cleanup_(uid_range_freep) UIDRange *range = NULL; _cleanup_fclose_ FILE *f = NULL; int r; @@ -216,9 +216,9 @@ int uid_range_load_userns(UIDRange **ret, const char *path, UIDRangeUsernsMode m * * To simplify things this will modify the passed array in case of later failure. */ - assert(ret); assert(mode >= 0); assert(mode < _UID_RANGE_USERNS_MODE_MAX); + assert(ret); if (!path) path = IN_SET(mode, UID_RANGE_USERNS_INSIDE, UID_RANGE_USERNS_OUTSIDE) ? "/proc/self/uid_map" : "/proc/self/gid_map"; @@ -318,7 +318,7 @@ int uid_range_load_userns_by_fd(int userns_fd, UIDRangeUsernsMode mode, UIDRange pid, IN_SET(mode, UID_RANGE_USERNS_INSIDE, UID_RANGE_USERNS_OUTSIDE) ? "uid_map" : "gid_map"); - return uid_range_load_userns(ret, p, mode); + return uid_range_load_userns(p, mode, ret); } bool uid_range_overlaps(const UIDRange *range, uid_t start, uid_t nr) { diff --git a/src/basic/uid-range.h b/src/basic/uid-range.h index 48dfebbf02..1f687b2713 100644 --- a/src/basic/uid-range.h +++ b/src/basic/uid-range.h @@ -72,7 +72,7 @@ typedef enum UIDRangeUsernsMode { _UID_RANGE_USERNS_MODE_INVALID = -EINVAL, } UIDRangeUsernsMode; -int uid_range_load_userns(UIDRange **ret, const char *path, UIDRangeUsernsMode mode); +int uid_range_load_userns(const char *path, UIDRangeUsernsMode mode, UIDRange **ret); int uid_range_load_userns_by_fd(int userns_fd, UIDRangeUsernsMode mode, UIDRange **ret); bool uid_range_overlaps(const UIDRange *range, uid_t start, uid_t nr); diff --git a/src/core/manager.c b/src/core/manager.c index b333be9afd..fe7dc19672 100644 --- a/src/core/manager.c +++ b/src/core/manager.c @@ -4805,7 +4805,7 @@ static int short_uid_range(const char *path) { /* Taint systemd if we the UID range assigned to this environment doesn't at least cover 0…65534, * i.e. from root to nobody. */ - r = uid_range_load_userns(&p, path, UID_RANGE_USERNS_INSIDE); + r = uid_range_load_userns(path, UID_RANGE_USERNS_INSIDE, &p); if (ERRNO_IS_NEG_NOT_SUPPORTED(r)) return false; if (r < 0) diff --git a/src/libsystemd/sd-device/device-monitor.c b/src/libsystemd/sd-device/device-monitor.c index 408cd17581..a7ef03abac 100644 --- a/src/libsystemd/sd-device/device-monitor.c +++ b/src/libsystemd/sd-device/device-monitor.c @@ -473,7 +473,7 @@ static bool check_sender_uid(sd_device_monitor *m, uid_t uid) { return true; if (!m->mapped_userns_uid_range) { - r = uid_range_load_userns(&m->mapped_userns_uid_range, NULL, UID_RANGE_USERNS_INSIDE); + r = uid_range_load_userns(/* path = */ NULL, UID_RANGE_USERNS_INSIDE, &m->mapped_userns_uid_range); if (r < 0) log_monitor_errno(m, r, "Failed to load UID ranges mapped to the current user namespace, ignoring: %m"); } diff --git a/src/nsresourced/nsresourcework.c b/src/nsresourced/nsresourcework.c index 9e68249ea8..6bd2fed06f 100644 --- a/src/nsresourced/nsresourcework.c +++ b/src/nsresourced/nsresourcework.c @@ -453,7 +453,7 @@ static int allocate_now( assert_not_reached(); } - r = uid_range_load_userns(&valid_range, /* path= */ NULL, UID_RANGE_USERNS_INSIDE); + r = uid_range_load_userns(/* path= */ NULL, UID_RANGE_USERNS_INSIDE, &valid_range); if (r < 0) return r; diff --git a/src/test/test-uid-range.c b/src/test/test-uid-range.c index c31fb30e7e..6041d08490 100644 --- a/src/test/test-uid-range.c +++ b/src/test/test-uid-range.c @@ -123,7 +123,7 @@ TEST(load_userns) { _cleanup_fclose_ FILE *f = NULL; int r; - r = uid_range_load_userns(&p, NULL, UID_RANGE_USERNS_INSIDE); + r = uid_range_load_userns(NULL, UID_RANGE_USERNS_INSIDE, &p); if (ERRNO_IS_NEG_NOT_SUPPORTED(r)) return; @@ -146,7 +146,7 @@ TEST(load_userns) { p = uid_range_free(p); - assert_se(uid_range_load_userns(&p, fn, UID_RANGE_USERNS_INSIDE) >= 0); + assert_se(uid_range_load_userns(fn, UID_RANGE_USERNS_INSIDE, &p) >= 0); assert_se(uid_range_contains(p, 0)); assert_se(uid_range_contains(p, 19)); diff --git a/src/userdb/userdbctl.c b/src/userdb/userdbctl.c index c16e44d6b6..f98acce29e 100644 --- a/src/userdb/userdbctl.c +++ b/src/userdb/userdbctl.c @@ -428,7 +428,7 @@ static int display_user(int argc, char *argv[], void *userdata) { _cleanup_(uid_range_freep) UIDRange *uid_range = NULL; int boundary_lines, uid_map_lines; - r = uid_range_load_userns(&uid_range, "/proc/self/uid_map", UID_RANGE_USERNS_INSIDE); + r = uid_range_load_userns(/* path = */ NULL, UID_RANGE_USERNS_INSIDE, &uid_range); if (r < 0) log_debug_errno(r, "Failed to load /proc/self/uid_map, ignoring: %m"); @@ -731,7 +731,7 @@ static int display_group(int argc, char *argv[], void *userdata) { _cleanup_(uid_range_freep) UIDRange *gid_range = NULL; int boundary_lines, gid_map_lines; - r = uid_range_load_userns(&gid_range, "/proc/self/gid_map", UID_RANGE_USERNS_INSIDE); + r = uid_range_load_userns(/* path = */ NULL, GID_RANGE_USERNS_INSIDE, &gid_range); if (r < 0) log_debug_errno(r, "Failed to load /proc/self/gid_map, ignoring: %m"); From f48b487ddbf6cfc40f7154e06a560ec1bb9ad512 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Mon, 8 Apr 2024 20:19:57 +0800 Subject: [PATCH 4/6] userdbctl: avoid NULL pointer deref Error from uid_range_load_userns is ignored, so 'p' could be NULL. --- src/userdb/userdbctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/userdb/userdbctl.c b/src/userdb/userdbctl.c index f98acce29e..761f172682 100644 --- a/src/userdb/userdbctl.c +++ b/src/userdb/userdbctl.c @@ -310,6 +310,9 @@ static int table_add_uid_map( assert(table); assert(add_unavailable); + if (!p) + return 0; + for (size_t i = 0; p && i < p->n_entries; i++) { UIDRangeEntry *x = p->entries + i; From fc759fdf35b5e3d9313c383d0b44af0ef53fcbe6 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Mon, 8 Apr 2024 20:24:02 +0800 Subject: [PATCH 5/6] userdbctl: use FOREACH_ARRAY more --- src/userdb/userdbctl.c | 44 ++++++++++++++++++++---------------------- 1 file changed, 21 insertions(+), 23 deletions(-) diff --git a/src/userdb/userdbctl.c b/src/userdb/userdbctl.c index 761f172682..835cea9c00 100644 --- a/src/userdb/userdbctl.c +++ b/src/userdb/userdbctl.c @@ -174,19 +174,19 @@ static int table_add_uid_boundaries(Table *table, const UIDRange *p) { assert(table); - for (size_t i = 0; i < ELEMENTSOF(uid_range_table); i++) { + FOREACH_ARRAY(i, uid_range_table, ELEMENTSOF(uid_range_table)) { _cleanup_free_ char *name = NULL, *comment = NULL; - if (!uid_range_covers(p, uid_range_table[i].first, uid_range_table[i].last - uid_range_table[i].first + 1)) + if (!uid_range_covers(p, i->first, i->last - i->first + 1)) continue; name = strjoin(special_glyph(SPECIAL_GLYPH_ARROW_DOWN), - " begin ", uid_range_table[i].name, " users ", + " begin ", i->name, " users ", special_glyph(SPECIAL_GLYPH_ARROW_DOWN)); if (!name) return log_oom(); - comment = strjoin("First ", uid_range_table[i].name, " user"); + comment = strjoin("First ", i->name, " user"); if (!comment) return log_oom(); @@ -195,9 +195,9 @@ static int table_add_uid_boundaries(Table *table, const UIDRange *p) { TABLE_STRING, special_glyph(SPECIAL_GLYPH_TREE_TOP), TABLE_STRING, name, TABLE_SET_COLOR, ansi_grey(), - TABLE_STRING, user_disposition_to_string(uid_range_table[i].disposition), + TABLE_STRING, user_disposition_to_string(i->disposition), TABLE_SET_COLOR, ansi_grey(), - TABLE_UID, uid_range_table[i].first, + TABLE_UID, i->first, TABLE_SET_COLOR, ansi_grey(), TABLE_EMPTY, TABLE_STRING, comment, @@ -210,13 +210,13 @@ static int table_add_uid_boundaries(Table *table, const UIDRange *p) { free(name); name = strjoin(special_glyph(SPECIAL_GLYPH_ARROW_UP), - " end ", uid_range_table[i].name, " users ", + " end ", i->name, " users ", special_glyph(SPECIAL_GLYPH_ARROW_UP)); if (!name) return log_oom(); free(comment); - comment = strjoin("Last ", uid_range_table[i].name, " user"); + comment = strjoin("Last ", i->name, " user"); if (!comment) return log_oom(); @@ -225,9 +225,9 @@ static int table_add_uid_boundaries(Table *table, const UIDRange *p) { TABLE_STRING, special_glyph(SPECIAL_GLYPH_TREE_RIGHT), TABLE_STRING, name, TABLE_SET_COLOR, ansi_grey(), - TABLE_STRING, user_disposition_to_string(uid_range_table[i].disposition), + TABLE_STRING, user_disposition_to_string(i->disposition), TABLE_SET_COLOR, ansi_grey(), - TABLE_UID, uid_range_table[i].last, + TABLE_UID, i->last, TABLE_SET_COLOR, ansi_grey(), TABLE_EMPTY, TABLE_STRING, comment, @@ -313,9 +313,7 @@ static int table_add_uid_map( if (!p) return 0; - for (size_t i = 0; p && i < p->n_entries; i++) { - UIDRangeEntry *x = p->entries + i; - + FOREACH_ARRAY(x, p->entries, p->n_entries) { if (focus < x->start) { r = add_unavailable(table, focus, x->start-1); if (r < 0) @@ -534,19 +532,19 @@ static int table_add_gid_boundaries(Table *table, const UIDRange *p) { assert(table); - for (size_t i = 0; i < ELEMENTSOF(uid_range_table); i++) { + FOREACH_ARRAY(i, uid_range_table, ELEMENTSOF(uid_range_table)) { _cleanup_free_ char *name = NULL, *comment = NULL; - if (!uid_range_covers(p, uid_range_table[i].first, uid_range_table[i].last)) + if (!uid_range_covers(p, i->first, i->last)) continue; name = strjoin(special_glyph(SPECIAL_GLYPH_ARROW_DOWN), - " begin ", uid_range_table[i].name, " groups ", + " begin ", i->name, " groups ", special_glyph(SPECIAL_GLYPH_ARROW_DOWN)); if (!name) return log_oom(); - comment = strjoin("First ", uid_range_table[i].name, " group"); + comment = strjoin("First ", i->name, " group"); if (!comment) return log_oom(); @@ -555,9 +553,9 @@ static int table_add_gid_boundaries(Table *table, const UIDRange *p) { TABLE_STRING, special_glyph(SPECIAL_GLYPH_TREE_TOP), TABLE_STRING, name, TABLE_SET_COLOR, ansi_grey(), - TABLE_STRING, user_disposition_to_string(uid_range_table[i].disposition), + TABLE_STRING, user_disposition_to_string(i->disposition), TABLE_SET_COLOR, ansi_grey(), - TABLE_GID, uid_range_table[i].first, + TABLE_GID, i->first, TABLE_SET_COLOR, ansi_grey(), TABLE_STRING, comment, TABLE_SET_COLOR, ansi_grey(), @@ -567,13 +565,13 @@ static int table_add_gid_boundaries(Table *table, const UIDRange *p) { free(name); name = strjoin(special_glyph(SPECIAL_GLYPH_ARROW_UP), - " end ", uid_range_table[i].name, " groups ", + " end ", i->name, " groups ", special_glyph(SPECIAL_GLYPH_ARROW_UP)); if (!name) return log_oom(); free(comment); - comment = strjoin("Last ", uid_range_table[i].name, " group"); + comment = strjoin("Last ", i->name, " group"); if (!comment) return log_oom(); @@ -582,9 +580,9 @@ static int table_add_gid_boundaries(Table *table, const UIDRange *p) { TABLE_STRING, special_glyph(SPECIAL_GLYPH_TREE_RIGHT), TABLE_STRING, name, TABLE_SET_COLOR, ansi_grey(), - TABLE_STRING, user_disposition_to_string(uid_range_table[i].disposition), + TABLE_STRING, user_disposition_to_string(i->disposition), TABLE_SET_COLOR, ansi_grey(), - TABLE_GID, uid_range_table[i].last, + TABLE_GID, i->last, TABLE_SET_COLOR, ansi_grey(), TABLE_STRING, comment, TABLE_SET_COLOR, ansi_grey(), From 8ef347de677218b4aa4b80bceff40a5740f4dc4b Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Mon, 8 Apr 2024 20:24:23 +0800 Subject: [PATCH 6/6] userdbctl: correct uid_range_covers check The third param should be the number of uids. --- src/userdb/userdbctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/userdb/userdbctl.c b/src/userdb/userdbctl.c index 835cea9c00..918b4d772f 100644 --- a/src/userdb/userdbctl.c +++ b/src/userdb/userdbctl.c @@ -535,7 +535,7 @@ static int table_add_gid_boundaries(Table *table, const UIDRange *p) { FOREACH_ARRAY(i, uid_range_table, ELEMENTSOF(uid_range_table)) { _cleanup_free_ char *name = NULL, *comment = NULL; - if (!uid_range_covers(p, i->first, i->last)) + if (!uid_range_covers(p, i->first, i->last - i->first + 1)) continue; name = strjoin(special_glyph(SPECIAL_GLYPH_ARROW_DOWN),