Assorted journal/portable hardening fixes flagged by kres (#42915)

src/journal/journald-native.c

@@ -319,7 +319,10 @@ void manager_process_native_message(
         assert(buffer || buffer_size == 0);
 
         if (ucred && pid_is_valid(ucred->pid)) {
-                r = client_context_get(m, ucred->pid, ucred, label, /* unit_id= */ NULL, &context);
+                /* Pin the sender's context for the whole dispatch below, as processing an entry may look up
+                 * further contexts (e.g. for an OBJECT_PID=), which can flush already reaped entries from
+                 * the cache */
+                r = client_context_acquire(m, ucred->pid, ucred, label, /* unit_id= */ NULL, &context);
                 if (r < 0)
                         log_ratelimit_warning_errno(r, JOURNAL_LOG_RATELIMIT,
                                                     "Failed to retrieve credentials for PID " PID_FMT ", ignoring: %m",
@@ -331,6 +334,8 @@ void manager_process_native_message(
                                          (const uint8_t*) buffer + (buffer_size - remaining), &remaining,
                                          context, ucred, tv, label);
         } while (r == 0);
+
+        client_context_release(m, context);
 }
 
 static size_t entry_size_max_by_ucred(Manager *m, const struct ucred *ucred, const char *label) {

src/journal/journald-syslog.c

@@ -534,6 +534,8 @@ int manager_open_syslog_socket(Manager *m, const char *syslog_socket) {
         if (r < 0)
                 return log_error_errno(r, "Failed to enable SO_TIMESTAMP: %m");
 
+        m->syslog_event_source = sd_event_source_disable_unref(m->syslog_event_source);
+
         r = sd_event_add_io(m->event, &m->syslog_event_source, m->syslog_fd, EPOLLIN, manager_process_datagram, m);
         if (r < 0)
                 return log_error_errno(r, "Failed to add syslog sevrer fd to event loop: %m");

src/journal/test-journald-syslog.c

@@ -1,9 +1,16 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "sd-event.h"
+
 #include "alloc-util.h"
+#include "fd-util.h"
+#include "journald-manager.h"
 #include "journald-syslog.h"
+#include "path-util.h"
+#include "rm-rf.h"
 #include "syslog-util.h"
 #include "tests.h"
+#include "tmpfile-util.h"
 
 static void test_syslog_parse_identifier_one(
                 const char *str,
@@ -71,4 +78,32 @@ TEST(syslog_parse_priority) {
         test_syslog_parse_priority_one("<111>", true, 111, 1);
 }
 
+TEST(syslog_socket_replaces_existing_event_source) {
+        _cleanup_(rm_rf_physical_and_freep) char *tmpdir = NULL;
+        _cleanup_(sd_event_source_unrefp) sd_event_source *old_source = NULL;
+        _cleanup_(sd_event_unrefp) sd_event *event = NULL;
+        _cleanup_free_ char *syslog_socket = NULL;
+        Manager m = {
+                .syslog_fd = -EBADF,
+        };
+
+        ASSERT_OK(sd_event_new(&event));
+        m.event = event;
+
+        ASSERT_OK(mkdtemp_malloc("/tmp/test-journald-syslog-XXXXXX", &tmpdir));
+        syslog_socket = path_join(tmpdir, "dev-log");
+        ASSERT_NOT_NULL(syslog_socket);
+
+        ASSERT_OK(manager_open_syslog_socket(&m, syslog_socket));
+        old_source = sd_event_source_ref(m.syslog_event_source);
+        ASSERT_NOT_NULL(old_source);
+
+        ASSERT_OK(manager_open_syslog_socket(&m, syslog_socket));
+        ASSERT_OK_ZERO(sd_event_source_get_enabled(old_source, /* ret= */ NULL));
+        ASSERT_TRUE(m.syslog_event_source != old_source);
+
+        m.syslog_event_source = sd_event_source_unref(m.syslog_event_source);
+        m.syslog_fd = safe_close(m.syslog_fd);
+}
+
 DEFINE_TEST_MAIN(LOG_INFO);

src/portable/portable.c

@@ -2164,7 +2164,7 @@ int portable_attach(
         return 0;
 }
 
-static bool marker_matches_images(const char *marker, const char *name_or_path, char **extension_image_paths, bool match_all) {
+static int marker_matches_images(const char *marker, const char *name_or_path, char **extension_image_paths, bool match_all) {
         _cleanup_strv_free_ char **root_and_extensions = NULL;
         int r;
 
@@ -2190,7 +2190,7 @@ static bool marker_matches_images(const char *marker, const char *name_or_path,
         /* Ensure the number of images passed matches the number of images listed in the marker */
         while (!isempty(marker))
                 STRV_FOREACH(image_name_or_path, root_and_extensions) {
-                        _cleanup_free_ char *image = NULL, *base_image = NULL, *base_image_name_or_path = NULL;
+                        _cleanup_free_ char *image = NULL, *base_image = NULL, *base_image_name_or_path = NULL, *base_picked_image = NULL;
                         _cleanup_(pick_result_done) PickResult result = PICK_RESULT_NULL;
 
                         r = extract_first_word(&marker, &image, ":", EXTRACT_UNQUOTE|EXTRACT_RETAIN_ESCAPE);
@@ -2211,19 +2211,21 @@ static bool marker_matches_images(const char *marker, const char *name_or_path,
                                       ELEMENTSOF(pick_filter_image_any),
                                       PICK_ARCHITECTURE|PICK_TRIES|PICK_RESOLVE,
                                       &result);
-                        if (r < 0)
+                        if (r < 0 && r != -ENOENT)
                                 return r;
-                        if (!result.path)
-                                return log_debug_errno(
-                                                SYNTHETIC_ERRNO(ENOENT),
-                                                "No matching entry in .v/ directory %s found.",
-                                                *image_name_or_path);
 
-                        r = path_extract_image_name(result.path, &base_image_name_or_path);
+                        r = path_extract_image_name(*image_name_or_path, &base_image_name_or_path);
                         if (r < 0)
-                                return log_debug_errno(r, "Failed to extract image name from %s, ignoring: %m", result.path);
+                                return log_debug_errno(r, "Failed to extract image name from %s, ignoring: %m", *image_name_or_path);
 
-                        if (!streq(base_image, base_image_name_or_path)) {
+                        if (!streq(base_image, base_image_name_or_path) && result.path) {
+                                r = path_extract_image_name(result.path, &base_picked_image);
+                                if (r < 0)
+                                        return log_debug_errno(r, "Failed to extract image name from %s, ignoring: %m", result.path);
+                        }
+
+                        if (!streq(base_image, base_image_name_or_path) &&
+                            !streq_ptr(base_image, base_picked_image)) {
                                 if (match_all)
                                         return false;
                         } else if (!match_all)