SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #32438 from YHNdnzj/taint-cleanup

Browse Source 
core/manager: clean up taint strings
This commit is contained in:
Yu Watanabe
2024-04-24 11:44:06 +09:00
committed by GitHub
parent 5e1124b510 844863c61e
commit 956709a28f
4 changed files with 45 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
catalog/systemd.catalog.in
+15 -3
View File
@@ -558,13 +558,25 @@ Defined-By: systemd
Support: %SUPPORT_URL%
The following "tags" are possible:
- "cgroups-missing" — the kernel was compiled without cgroup support or access
to expected interface files is restricted
- "var-run-bad" — /var/run is not a symlink to /run
- "unmerged-usr" - /bin, /sbin, /lib* are not symlinks to their counterparts
under /usr/
- "unmerged-bin" - /usr/sbin is not a symlink to /usr/bin/
- "var-run-bad" — /var/run is not a symlink to /run/
- "cgroupsv1" - the system is using the deprecated cgroup v1 hierarchy
- "local-hwclock" - the local hardware clock (RTC) is configured to be in
local time rather than UTC
- "support-ended" - the system is running past the end of support declared
by the vendor
- "old-kernel" - the system is running a kernel version that is older than
the minimum supported by this version of systemd
- "overflowuid-not-65534" — the kernel user ID used for "unknown" users (with
NFS or user namespaces) is not 65534
- "overflowgid-not-65534" — the kernel group ID used for "unknown" users (with
NFS or user namespaces) is not 65534
- "short-uid-range" - the UID range assigned to the running systemd instance
covers less than 0…65534
- "short-gid-range" - the GID range assigned to the running systemd instance
covers less than 0…65534
Current system is tagged as @TAINT@.
-- fe6faa94e7774663a0da52717891d8ef
man/org.freedesktop.systemd1.xml
+13 -15
View File
@@ -1665,13 +1665,22 @@ node /org/freedesktop/systemd1 {
</ulink>.</para>
<xi:include href="version-info.xml" xpointer="v252"/></listitem>
</varlistentry>
<varlistentry>
<term><literal>cgroups-missing</literal></term>
<term><literal>unmerged-bin</literal></term>
<listitem><para>Support for cgroups is unavailable.</para>
<listitem><para><filename>/usr/sbin</filename> is not a symlink to <filename>/usr/bin/</filename>.
</para>
<xi:include href="version-info.xml" xpointer="v256"/></listitem>
</varlistentry>
<varlistentry>
<term><literal>var-run-bad</literal></term>
<listitem><para><filename>/run/</filename> does not exist or <filename>/var/run</filename> is not a
symlink to <filename>/run/</filename>.</para>
<xi:include href="version-info.xml" xpointer="v252"/></listitem>
</varlistentry>
@@ -1679,7 +1688,7 @@ node /org/freedesktop/systemd1 {
<varlistentry>
<term><literal>cgroupsv1</literal></term>
<listitem><para>The system is using the old cgroup hierarchy.</para>
<listitem><para>The system is using the deprecated cgroup v1 hierarchy.</para>
<xi:include href="version-info.xml" xpointer="v252"/></listitem>
</varlistentry>
@@ -1713,15 +1722,6 @@ node /org/freedesktop/systemd1 {
<xi:include href="version-info.xml" xpointer="v252"/></listitem>
</varlistentry>
<varlistentry>
<term><literal>var-run-bad</literal></term>
<listitem><para><filename>/run/</filename> does not exist or <filename>/var/run</filename> is not a
symlink to <filename>/run/</filename>.</para>
<xi:include href="version-info.xml" xpointer="v252"/></listitem>
</varlistentry>
<varlistentry>
<term><literal>overflowuid-not-65534</literal></term>
<term><literal>overflowgid-not-65534</literal></term>
@@ -1740,8 +1740,6 @@ node /org/freedesktop/systemd1 {
<xi:include href="version-info.xml" xpointer="v252"/></listitem>
</varlistentry>
<!-- mtab-not-symlink was removed in b492ce8a22d4527c1372b2d3fbd580627d70c917 -->
</variablelist>
<para><varname>FirmwareTimestamp</varname>, <varname>FirmwareTimestampMonotonic</varname>,
src/core/manager.c
+16 -15
View File
@@ -4836,21 +4836,27 @@ static int short_uid_range(const char *path) {
}
char* manager_taint_string(const Manager *m) {
const char *stage[12] = {};
size_t n = 0;
/* Returns a "taint string", e.g. "local-hwclock:var-run-bad". Only things that are detected at
* runtime should be tagged here. For stuff that is known during compilation, emit a warning in the
* configuration phase. */
assert(m);
const char* stage[12] = {};
size_t n = 0;
_cleanup_free_ char *bin = NULL, *usr_sbin = NULL, *var_run = NULL;
_cleanup_free_ char *usrbin = NULL;
if (readlink_malloc("/bin", &usrbin) < 0 || !PATH_IN_SET(usrbin, "usr/bin", "/usr/bin"))
if (readlink_malloc("/bin", &bin) < 0 || !PATH_IN_SET(bin, "usr/bin", "/usr/bin"))
stage[n++] = "unmerged-usr";
if (access("/proc/cgroups", F_OK) < 0)
stage[n++] = "cgroups-missing";
/* Note that the check is different from default_PATH(), as we want to taint on uncanonical symlinks
* too. */
if (readlink_malloc("/usr/sbin", &usr_sbin) < 0 || !PATH_IN_SET(usr_sbin, "bin", "/usr/bin"))
stage[n++] = "unmerged-bin";
if (readlink_malloc("/var/run", &var_run) < 0 || !PATH_IN_SET(var_run, "../run", "/run"))
stage[n++] = "var-run-bad";
if (cg_all_unified() == 0)
stage[n++] = "cgroupsv1";
@@ -4861,10 +4867,10 @@ char* manager_taint_string(const Manager *m) {
if (os_release_support_ended(NULL, /* quiet= */ true, NULL) > 0)
stage[n++] = "support-ended";
_cleanup_free_ char *destination = NULL;
if (readlink_malloc("/var/run", &destination) < 0 ||
!PATH_IN_SET(destination, "../run", "/run"))
stage[n++] = "var-run-bad";
struct utsname uts;
assert_se(uname(&uts) >= 0);
if (strverscmp_improved(uts.release, KERNEL_BASELINE_VERSION) < 0)
stage[n++] = "old-kernel";
_cleanup_free_ char *overflowuid = NULL, *overflowgid = NULL;
if (read_one_line_file("/proc/sys/kernel/overflowuid", &overflowuid) >= 0 &&
@@ -4874,11 +4880,6 @@ char* manager_taint_string(const Manager *m) {
!streq(overflowgid, "65534"))
stage[n++] = "overflowgid-not-65534";
struct utsname uts;
assert_se(uname(&uts) >= 0);
if (strverscmp_improved(uts.release, KERNEL_BASELINE_VERSION) < 0)
stage[n++] = "old-kernel";
if (short_uid_range("/proc/self/uid_map") > 0)
stage[n++] = "short-uid-range";
if (short_uid_range("/proc/self/gid_map") > 0)
src/shared/mount-setup.c
+1 -4
View File
@@ -195,10 +195,7 @@ static int mount_one(const MountPoint *p, bool relabel) {
p->type,
strna(p->options));
if (FLAGS_SET(p->mode, MNT_FOLLOW_SYMLINK))
r = mount_follow_verbose(priority, p->what, p->where, p->type, p->flags, p->options);
else
r = mount_nofollow_verbose(priority, p->what, p->where, p->type, p->flags, p->options);
r = mount_verbose_full(priority, p->what, p->where, p->type, p->flags, p->options, FLAGS_SET(p->mode, MNT_FOLLOW_SYMLINK));
if (r < 0)
return FLAGS_SET(p->mode, MNT_FATAL) ? r : 0;