From 21f8e749a18d71f4f28a1fe949244f639fb6f776 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Tue, 23 Apr 2024 22:05:09 +0800 Subject: [PATCH 1/4] mount-setup: use mount_verbose_full where appropriate --- src/shared/mount-setup.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/src/shared/mount-setup.c b/src/shared/mount-setup.c index 56381bc7d8..6511d48a90 100644 --- a/src/shared/mount-setup.c +++ b/src/shared/mount-setup.c @@ -195,10 +195,7 @@ static int mount_one(const MountPoint *p, bool relabel) { p->type, strna(p->options)); - if (FLAGS_SET(p->mode, MNT_FOLLOW_SYMLINK)) - r = mount_follow_verbose(priority, p->what, p->where, p->type, p->flags, p->options); - else - r = mount_nofollow_verbose(priority, p->what, p->where, p->type, p->flags, p->options); + r = mount_verbose_full(priority, p->what, p->where, p->type, p->flags, p->options, FLAGS_SET(p->mode, MNT_FOLLOW_SYMLINK)); if (r < 0) return FLAGS_SET(p->mode, MNT_FATAL) ? r : 0; From 2b28dfe6e632f47a9058d9378fb88a0c99b34a91 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Tue, 23 Apr 2024 21:24:55 +0800 Subject: [PATCH 2/4] core/manager: drop obsolete cgroup taint string Wwe can't boot on systems without cgroup anyway (even cgroup v1 will be gone pretty soon). --- catalog/systemd.catalog.in | 2 -- man/org.freedesktop.systemd1.xml | 8 -------- src/core/manager.c | 9 +++------ 3 files changed, 3 insertions(+), 16 deletions(-) diff --git a/catalog/systemd.catalog.in b/catalog/systemd.catalog.in index 04e90e0b75..87022f40fa 100644 --- a/catalog/systemd.catalog.in +++ b/catalog/systemd.catalog.in @@ -558,8 +558,6 @@ Defined-By: systemd Support: %SUPPORT_URL% The following "tags" are possible: -- "cgroups-missing" — the kernel was compiled without cgroup support or access - to expected interface files is restricted - "var-run-bad" — /var/run is not a symlink to /run - "overflowuid-not-65534" — the kernel user ID used for "unknown" users (with NFS or user namespaces) is not 65534 diff --git a/man/org.freedesktop.systemd1.xml b/man/org.freedesktop.systemd1.xml index 1870ed02bb..3aa1d0de57 100644 --- a/man/org.freedesktop.systemd1.xml +++ b/man/org.freedesktop.systemd1.xml @@ -1668,14 +1668,6 @@ node /org/freedesktop/systemd1 { - - cgroups-missing - - Support for cgroups is unavailable. - - - - cgroupsv1 diff --git a/src/core/manager.c b/src/core/manager.c index 0078f5a33f..856bbd823c 100644 --- a/src/core/manager.c +++ b/src/core/manager.c @@ -4836,22 +4836,19 @@ static int short_uid_range(const char *path) { } char* manager_taint_string(const Manager *m) { + const char *stage[11] = {}; + size_t n = 0; + /* Returns a "taint string", e.g. "local-hwclock:var-run-bad". Only things that are detected at * runtime should be tagged here. For stuff that is known during compilation, emit a warning in the * configuration phase. */ assert(m); - const char* stage[12] = {}; - size_t n = 0; - _cleanup_free_ char *usrbin = NULL; if (readlink_malloc("/bin", &usrbin) < 0 || !PATH_IN_SET(usrbin, "usr/bin", "/usr/bin")) stage[n++] = "unmerged-usr"; - if (access("/proc/cgroups", F_OK) < 0) - stage[n++] = "cgroups-missing"; - if (cg_all_unified() == 0) stage[n++] = "cgroupsv1"; From ea81442892da6bd8c3175bb2571aafb1abf84f79 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Tue, 23 Apr 2024 22:20:57 +0800 Subject: [PATCH 3/4] core/manager: rearrange taint tags --- catalog/systemd.catalog.in | 15 ++++++++++++++- man/org.freedesktop.systemd1.xml | 21 +++++++++------------ src/core/manager.c | 18 +++++++++--------- 3 files changed, 32 insertions(+), 22 deletions(-) diff --git a/catalog/systemd.catalog.in b/catalog/systemd.catalog.in index 87022f40fa..3bf9b6cffb 100644 --- a/catalog/systemd.catalog.in +++ b/catalog/systemd.catalog.in @@ -558,11 +558,24 @@ Defined-By: systemd Support: %SUPPORT_URL% The following "tags" are possible: -- "var-run-bad" — /var/run is not a symlink to /run +- "unmerged-usr" - /bin, /sbin, /lib* are not symlinks to their counterparts + under /usr/ +- "var-run-bad" — /var/run is not a symlink to /run/ +- "cgroupsv1" - the system is using the deprecated cgroup v1 hierarchy +- "local-hwclock" - the local hardware clock (RTC) is configured to be in + local time rather than UTC +- "support-ended" - the system is running past the end of support declared + by the vendor +- "old-kernel" - the system is running a kernel version that is older than + the minimum supported by this version of systemd - "overflowuid-not-65534" — the kernel user ID used for "unknown" users (with NFS or user namespaces) is not 65534 - "overflowgid-not-65534" — the kernel group ID used for "unknown" users (with NFS or user namespaces) is not 65534 +- "short-uid-range" - the UID range assigned to the running systemd instance + covers less than 0…65534 +- "short-gid-range" - the GID range assigned to the running systemd instance + covers less than 0…65534 Current system is tagged as @TAINT@. -- fe6faa94e7774663a0da52717891d8ef diff --git a/man/org.freedesktop.systemd1.xml b/man/org.freedesktop.systemd1.xml index 3aa1d0de57..1c5b7d38f5 100644 --- a/man/org.freedesktop.systemd1.xml +++ b/man/org.freedesktop.systemd1.xml @@ -1665,13 +1665,21 @@ node /org/freedesktop/systemd1 { . + + + var-run-bad + + /run/ does not exist or /var/run is not a + symlink to /run/. + + cgroupsv1 - The system is using the old cgroup hierarchy. + The system is using the deprecated cgroup v1 hierarchy. @@ -1705,15 +1713,6 @@ node /org/freedesktop/systemd1 { - - var-run-bad - - /run/ does not exist or /var/run is not a - symlink to /run/. - - - - overflowuid-not-65534 overflowgid-not-65534 @@ -1732,8 +1731,6 @@ node /org/freedesktop/systemd1 { - - FirmwareTimestamp, FirmwareTimestampMonotonic, diff --git a/src/core/manager.c b/src/core/manager.c index 856bbd823c..35e08e5f77 100644 --- a/src/core/manager.c +++ b/src/core/manager.c @@ -4849,6 +4849,11 @@ char* manager_taint_string(const Manager *m) { if (readlink_malloc("/bin", &usrbin) < 0 || !PATH_IN_SET(usrbin, "usr/bin", "/usr/bin")) stage[n++] = "unmerged-usr"; + _cleanup_free_ char *destination = NULL; + if (readlink_malloc("/var/run", &destination) < 0 || + !PATH_IN_SET(destination, "../run", "/run")) + stage[n++] = "var-run-bad"; + if (cg_all_unified() == 0) stage[n++] = "cgroupsv1"; @@ -4858,10 +4863,10 @@ char* manager_taint_string(const Manager *m) { if (os_release_support_ended(NULL, /* quiet= */ true, NULL) > 0) stage[n++] = "support-ended"; - _cleanup_free_ char *destination = NULL; - if (readlink_malloc("/var/run", &destination) < 0 || - !PATH_IN_SET(destination, "../run", "/run")) - stage[n++] = "var-run-bad"; + struct utsname uts; + assert_se(uname(&uts) >= 0); + if (strverscmp_improved(uts.release, KERNEL_BASELINE_VERSION) < 0) + stage[n++] = "old-kernel"; _cleanup_free_ char *overflowuid = NULL, *overflowgid = NULL; if (read_one_line_file("/proc/sys/kernel/overflowuid", &overflowuid) >= 0 && @@ -4871,11 +4876,6 @@ char* manager_taint_string(const Manager *m) { !streq(overflowgid, "65534")) stage[n++] = "overflowgid-not-65534"; - struct utsname uts; - assert_se(uname(&uts) >= 0); - if (strverscmp_improved(uts.release, KERNEL_BASELINE_VERSION) < 0) - stage[n++] = "old-kernel"; - if (short_uid_range("/proc/self/uid_map") > 0) stage[n++] = "short-uid-range"; if (short_uid_range("/proc/self/gid_map") > 0) From 844863c61e7b501097da84a1e4d1e4a6aa6d9f0d Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Tue, 23 Apr 2024 22:33:10 +0800 Subject: [PATCH 4/4] core/manager: add unmerged-bin taint --- catalog/systemd.catalog.in | 1 + man/org.freedesktop.systemd1.xml | 9 +++++++++ src/core/manager.c | 16 ++++++++++------ 3 files changed, 20 insertions(+), 6 deletions(-) diff --git a/catalog/systemd.catalog.in b/catalog/systemd.catalog.in index 3bf9b6cffb..f0fc62dd85 100644 --- a/catalog/systemd.catalog.in +++ b/catalog/systemd.catalog.in @@ -560,6 +560,7 @@ Support: %SUPPORT_URL% The following "tags" are possible: - "unmerged-usr" - /bin, /sbin, /lib* are not symlinks to their counterparts under /usr/ +- "unmerged-bin" - /usr/sbin is not a symlink to /usr/bin/ - "var-run-bad" — /var/run is not a symlink to /run/ - "cgroupsv1" - the system is using the deprecated cgroup v1 hierarchy - "local-hwclock" - the local hardware clock (RTC) is configured to be in diff --git a/man/org.freedesktop.systemd1.xml b/man/org.freedesktop.systemd1.xml index 1c5b7d38f5..749e6e3653 100644 --- a/man/org.freedesktop.systemd1.xml +++ b/man/org.freedesktop.systemd1.xml @@ -1667,6 +1667,15 @@ node /org/freedesktop/systemd1 { + + unmerged-bin + + /usr/sbin is not a symlink to /usr/bin/. + + + + + var-run-bad diff --git a/src/core/manager.c b/src/core/manager.c index 35e08e5f77..ebaf33bc5f 100644 --- a/src/core/manager.c +++ b/src/core/manager.c @@ -4836,7 +4836,7 @@ static int short_uid_range(const char *path) { } char* manager_taint_string(const Manager *m) { - const char *stage[11] = {}; + const char *stage[12] = {}; size_t n = 0; /* Returns a "taint string", e.g. "local-hwclock:var-run-bad". Only things that are detected at @@ -4845,13 +4845,17 @@ char* manager_taint_string(const Manager *m) { assert(m); - _cleanup_free_ char *usrbin = NULL; - if (readlink_malloc("/bin", &usrbin) < 0 || !PATH_IN_SET(usrbin, "usr/bin", "/usr/bin")) + _cleanup_free_ char *bin = NULL, *usr_sbin = NULL, *var_run = NULL; + + if (readlink_malloc("/bin", &bin) < 0 || !PATH_IN_SET(bin, "usr/bin", "/usr/bin")) stage[n++] = "unmerged-usr"; - _cleanup_free_ char *destination = NULL; - if (readlink_malloc("/var/run", &destination) < 0 || - !PATH_IN_SET(destination, "../run", "/run")) + /* Note that the check is different from default_PATH(), as we want to taint on uncanonical symlinks + * too. */ + if (readlink_malloc("/usr/sbin", &usr_sbin) < 0 || !PATH_IN_SET(usr_sbin, "bin", "/usr/bin")) + stage[n++] = "unmerged-bin"; + + if (readlink_malloc("/var/run", &var_run) < 0 || !PATH_IN_SET(var_run, "../run", "/run")) stage[n++] = "var-run-bad"; if (cg_all_unified() == 0)