From e392c868d28c52e0ad5494b69dedae1e20e70fcd Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Fri, 26 Apr 2024 13:46:45 +0200 Subject: [PATCH 1/3] mkosi: Set CleanPackageMetadata=yes for minimal-base We don't want to install any more packages in derived images so let's not store repository metadata in the image to make it smaller. --- mkosi.images/minimal-base/mkosi.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/mkosi.images/minimal-base/mkosi.conf b/mkosi.images/minimal-base/mkosi.conf index afc70b87a0..477db6150f 100644 --- a/mkosi.images/minimal-base/mkosi.conf +++ b/mkosi.images/minimal-base/mkosi.conf @@ -7,6 +7,7 @@ Format=directory Bootable=no @Locale=C.UTF-8 WithDocs=no +CleanPackageMetadata=yes BuildSources= Packages= From dcbf0be1b7c70537a932377d553d356366642b7f Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Fri, 26 Apr 2024 13:51:49 +0200 Subject: [PATCH 2/3] TEST-50-DISSECT: Don't log image contents to console These can contain quite a few files, so let's not write every single file and directory straight to the console to speed things up. --- test/units/testsuite-50.dissect.sh | 4 ++-- test/units/testsuite-50.mountnfsd.sh | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/test/units/testsuite-50.dissect.sh b/test/units/testsuite-50.dissect.sh index de69b72ef1..991346fd6e 100755 --- a/test/units/testsuite-50.dissect.sh +++ b/test/units/testsuite-50.dissect.sh @@ -670,8 +670,8 @@ systemctl stop test-root-ephemeral timeout 10 bash -c 'until test -z "$(ls -A /var/lib/systemd/ephemeral-trees)"; do sleep .5; done' test ! -f /tmp/img/abc -systemd-dissect --mtree /tmp/img -systemd-dissect --list /tmp/img +systemd-dissect --mtree /tmp/img >/dev/null +systemd-dissect --list /tmp/img >/dev/null read -r SHA256SUM1 _ < <(systemd-dissect --copy-from /tmp/img etc/os-release | sha256sum) test "$SHA256SUM1" != "" diff --git a/test/units/testsuite-50.mountnfsd.sh b/test/units/testsuite-50.mountnfsd.sh index 59974e41e6..7fd55980f9 100755 --- a/test/units/testsuite-50.mountnfsd.sh +++ b/test/units/testsuite-50.mountnfsd.sh @@ -45,7 +45,7 @@ SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs \ systemd-dissect --rmdir --umount /tmp/unpriv/mount systemd-dissect --image-policy='root=unprotected:=absent+unused' /var/tmp/unpriv.raw -systemd-dissect --image-policy='root=unprotected:=absent+unused' --mtree /var/tmp/unpriv.raw | tee /tmp/unpriv.raw.mtree +systemd-dissect --image-policy='root=unprotected:=absent+unused' --mtree /var/tmp/unpriv.raw >/tmp/unpriv.raw.mtree # Run unpriv, should fail due to lack of privs (! runas testuser systemd-dissect /var/tmp/unpriv.raw) @@ -65,7 +65,7 @@ cp /tmp/test-50-unpriv-cert.crt /run/verity.d # Now run unpriv again, should be OK now. runas testuser systemd-dissect /var/tmp/unpriv.raw -runas testuser systemd-dissect --mtree /var/tmp/unpriv.raw | tee /tmp/unpriv2.raw.mtree +runas testuser systemd-dissect --mtree /var/tmp/unpriv.raw >/tmp/unpriv2.raw.mtree # Check that unpriv and priv run yielded same results cmp /tmp/unpriv.raw.mtree /tmp/unpriv2.raw.mtree From 13b67b61b3b4a5356f5d1b29b51137b8e336aa55 Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Fri, 26 Apr 2024 15:02:56 +0200 Subject: [PATCH 3/3] sd-daemon: Replace SO_LINGER with shutdown() + recv() Let's shutdown the write end and wait for EOF from the other side before continuing to make sure that the receiver has received all data we sent on the socket. --- src/libsystemd/sd-daemon/sd-daemon.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/src/libsystemd/sd-daemon/sd-daemon.c b/src/libsystemd/sd-daemon/sd-daemon.c index 20065a6a36..58626463a8 100644 --- a/src/libsystemd/sd-daemon/sd-daemon.c +++ b/src/libsystemd/sd-daemon/sd-daemon.c @@ -513,16 +513,6 @@ static int pid_notify_with_fds_internal( } if (address.sockaddr.sa.sa_family == AF_VSOCK) { - /* If we shut down a virtual machine the kernel might not flush the buffers of the vsock - * socket before shutting down. Set SO_LINGER so that we wait until the buffers are flushed - * when the socket is closed. */ - struct linger l = { - .l_onoff = true, - .l_linger = 10, - }; - if (setsockopt(fd, SOL_SOCKET, SO_LINGER, &l, sizeof(l)) < 0) - log_debug_errno(errno, "Failed to set SO_LINGER on vsock notify socket, ignoring: %m"); - r = vsock_bind_privileged_port(fd); if (r < 0 && !ERRNO_IS_PRIVILEGE(r)) return log_debug_errno(r, "Failed to bind socket to privileged port: %m"); @@ -604,6 +594,19 @@ static int pid_notify_with_fds_internal( } } while (!iovec_increment(msghdr.msg_iov, msghdr.msg_iovlen, n)); + if (address.sockaddr.sa.sa_family == AF_VSOCK && IN_SET(type, SOCK_STREAM, SOCK_SEQPACKET)) { + /* For AF_VSOCK, we need to close the socket to signal the end of the message. */ + if (shutdown(fd, SHUT_WR) < 0) + return log_error_errno(errno, "Failed to shutdown notify socket: %m"); + + char buf[1]; + n = recv(fd, buf, sizeof(buf), MSG_NOSIGNAL); + if (n > 0) + return log_error_errno(errno, "Unexpectedly received data on notify socket: %m"); + if (n < 0) + return log_error_errno(errno, "Failed to wait for EOF on notify socket: %m"); + } + return 1; }