From 9af74e0f59b9af5568d4f594655dd99a3be17ac4 Mon Sep 17 00:00:00 2001 From: Franck Bui Date: Fri, 8 Apr 2022 12:06:27 +0200 Subject: [PATCH 1/5] tmpfiles.d: only 'w+' can have multiple lines for the same path Since d0ea5c5e39dce60efbce6d86534eb9ca253440b0, all lines specifying actions that recreate a file system object (such as 'f+, 'L+', etc ...) on the same path were allowed. This had the bad side effect to break the tmpfiles configuration file sorting for files defining such lines. For example: # cat /etc/tmpfiles.d/a.conf f+ /tmp/file - - - - a.conf # cat /etc/tmpfiles.d/z.conf f+ /tmp/file - - - - z.conf # systemd-tmpfiles --create /etc/tmpfiles.d/{a,z}.conf # cat /tmp/file z.conf Even though "a.conf" sorts lexicographically before "z.conf", the content of /tmp/file was the result of the action defined in "z.conf" This patch restores the old logic - if multiple files specify the same path, the entry in the file with the lexicographically earliest name will be applied. --- src/tmpfiles/tmpfiles.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-) diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c index 023207bc60..f41f086be1 100644 --- a/src/tmpfiles/tmpfiles.c +++ b/src/tmpfiles/tmpfiles.c @@ -2896,6 +2896,26 @@ static int parse_age_by_from_arg(const char *age_by_str, Item *item) { return 0; } +static bool is_duplicated_item(ItemArray *existing, Item *i) { + + assert(existing); + assert(i); + + for (size_t n = 0; n < existing->n_items; n++) { + Item *e = existing->items + n; + + if (item_compatible(e, i)) + continue; + + /* Only multiple 'w+' lines for the same path are allowed. */ + if (e->type != WRITE_FILE || !e->append_or_force || + i->type != WRITE_FILE || !i->append_or_force) + return true; + } + + return false; +} + static int parse_line( const char *fname, unsigned line, @@ -3247,13 +3267,10 @@ static int parse_line( existing = ordered_hashmap_get(h, i.path); if (existing) { - size_t n; - - for (n = 0; n < existing->n_items; n++) { - if (!item_compatible(existing->items + n, &i) && !i.append_or_force) { - log_syntax(NULL, LOG_NOTICE, fname, line, 0, "Duplicate line for path \"%s\", ignoring.", i.path); - return 0; - } + if (is_duplicated_item(existing, &i)) { + log_syntax(NULL, LOG_NOTICE, fname, line, 0, + "Duplicate line for path \"%s\", ignoring.", i.path); + return 0; } } else { existing = new0(ItemArray, 1); From 9f55d48ba50afaad4557710f983d2971e9746582 Mon Sep 17 00:00:00 2001 From: Franck Bui Date: Fri, 8 Apr 2022 08:32:04 +0200 Subject: [PATCH 2/5] test tmpfiles: add a test for 'w+' --- test/units/testsuite-22.03.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/test/units/testsuite-22.03.sh b/test/units/testsuite-22.03.sh index 404e33e2fa..a9df3d6bdd 100755 --- a/test/units/testsuite-22.03.sh +++ b/test/units/testsuite-22.03.sh @@ -186,6 +186,7 @@ test ! -e /tmp/F/daemon/unsafe-symlink/exploit # 'w' # touch /tmp/w/overwritten +touch /tmp/w/appended ### nop if the target does not exist. systemd-tmpfiles --create - < Date: Fri, 8 Apr 2022 09:57:32 +0200 Subject: [PATCH 3/5] test: add test checking tmpfiles conf file precedence --- test/units/testsuite-22.13.sh | 75 +++++++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100755 test/units/testsuite-22.13.sh diff --git a/test/units/testsuite-22.13.sh b/test/units/testsuite-22.13.sh new file mode 100755 index 0000000000..33ef451f2a --- /dev/null +++ b/test/units/testsuite-22.13.sh @@ -0,0 +1,75 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +# +# Tests for configuration directory and file precedences +# +set -eux + +rm -f /{usr/lib,etc}/tmpfiles.d/{L,w}-*.conf +rm -fr /tmp/precedence/{L,w} + +mkdir -p /{usr/lib,etc}/tmpfiles.d +mkdir -p /tmp/precedence/{L,w} + +# +# 'L' +# +ln -s /dev/null /tmp/precedence/L + +# Overwrite the existing symlink +cat >/usr/lib/tmpfiles.d/L-z.conf</etc/tmpfiles.d/L-z.conf</usr/lib/tmpfiles.d/L-a.conf</etc/tmpfiles.d/L-a.conf</usr/lib/tmpfiles.d/w-$i.conf</etc/tmpfiles.d/w-$i.conf</usr/lib/tmpfiles.d/w-b.conf< Date: Mon, 11 Apr 2022 11:00:07 +0200 Subject: [PATCH 4/5] test: adapt install_pam() for openSUSE limits.conf is installed in /usr/etc/security for openSUSE. --- test/test-functions | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/test-functions b/test/test-functions index c734a15ca9..e1d6ed646f 100644 --- a/test/test-functions +++ b/test/test-functions @@ -1846,7 +1846,7 @@ install_pam() { paths+=(/lib*/security) fi - for d in /etc/pam.d /etc/security /usr/{etc,lib}/pam.d; do + for d in /etc/pam.d /{usr/,}etc/security /usr/{etc,lib}/pam.d; do [ -d "$d" ] && paths+=("$d") done From a6aafd6ab6211a4142ebd72bd8c42ddbe2841eaa Mon Sep 17 00:00:00 2001 From: Franck Bui Date: Mon, 11 Apr 2022 11:01:12 +0200 Subject: [PATCH 5/5] tmpfiles: constify item_compatible() parameters --- src/tmpfiles/tmpfiles.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c index f41f086be1..be09d19a9a 100644 --- a/src/tmpfiles/tmpfiles.c +++ b/src/tmpfiles/tmpfiles.c @@ -2657,7 +2657,7 @@ static int item_compare(const Item *a, const Item *b) { return CMP(a->type, b->type); } -static bool item_compatible(Item *a, Item *b) { +static bool item_compatible(const Item *a, const Item *b) { assert(a); assert(b); assert(streq(a->path, b->path)); @@ -2896,13 +2896,13 @@ static int parse_age_by_from_arg(const char *age_by_str, Item *item) { return 0; } -static bool is_duplicated_item(ItemArray *existing, Item *i) { +static bool is_duplicated_item(ItemArray *existing, const Item *i) { assert(existing); assert(i); for (size_t n = 0; n < existing->n_items; n++) { - Item *e = existing->items + n; + const Item *e = existing->items + n; if (item_compatible(e, i)) continue;