SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #27229 from poettering/dissect-policy-confext

Browse Source 
dissect: follow-up for image policy merge
This commit is contained in:
Mike Yuan
2023-04-13 00:14:30 +08:00
committed by GitHub
parent 5a9e2dff47 4f25844a4b
commit 7581da99a1
5 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/discover-image.c
+4 -6
View File
@@ -79,12 +79,10 @@ static const char* const image_search_path[_IMAGE_CLASS_MAX] = {
static const char* const image_search_path_initrd[_IMAGE_CLASS_MAX] = {
/* (entries that aren't listed here will get the same search path as for the non initrd-case) */
[IMAGE_SYSEXT] = "/etc/extensions\0" /* only place symlinks here */
"/run/extensions\0" /* and here too */
"/var/lib/extensions\0" /* the main place for images */
"/usr/local/lib/extensions\0"
"/usr/lib/extensions\0"
"/.extra/sysext\0" /* put sysext picked up by systemd-stub last, since not trusted */
[IMAGE_SYSEXT] = "/etc/extensions\0" /* only place symlinks here */
"/run/extensions\0" /* and here too */
"/var/lib/extensions\0" /* the main place for images */
"/.extra/sysext\0" /* put sysext picked up by systemd-stub last, since not trusted */
};
static Image *image_free(Image *i) {
src/shared/image-policy.c
+10
View File
@@ -641,6 +641,16 @@ const ImagePolicy image_policy_sysext_strict = {
.default_flags = PARTITION_POLICY_IGNORE,
};
const ImagePolicy image_policy_confext = {
/* For configuraiton extensions, honour root file system, and ignore everything else. After all, we
* are only interested in the /etc/ tree anyway, and that's really the only place it can be. */
.n_policies = 1,
.policies = {
{ PARTITION_ROOT, PARTITION_POLICY_VERITY|PARTITION_POLICY_SIGNED|PARTITION_POLICY_ENCRYPTED|PARTITION_POLICY_UNPROTECTED|PARTITION_POLICY_ABSENT },
},
.default_flags = PARTITION_POLICY_IGNORE,
};
const ImagePolicy image_policy_container = {
/* For systemd-nspawn containers we use all partitions, with the exception of swap */
.n_policies = 8,
src/shared/image-policy.h
+1
View File
@@ -59,6 +59,7 @@ extern const ImagePolicy image_policy_deny;
extern const ImagePolicy image_policy_ignore;
extern const ImagePolicy image_policy_sysext; /* No verity required */
extern const ImagePolicy image_policy_sysext_strict; /* Signed verity required */
extern const ImagePolicy image_policy_confext; /* No verity required */
extern const ImagePolicy image_policy_container;
extern const ImagePolicy image_policy_service;
extern const ImagePolicy image_policy_host;