SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #24703 from yuwata/dissect-image-verity-partition-make-fail

Browse Source 
dissect-image: make verity_partition() actually fail when all attempts of activation failed
This commit is contained in:
Daan De Meyer
2022-09-17 09:57:20 +02:00
committed by GitHub
parent ee3455cf11 9972e6d6ed
commit 9bf36477bf
1 changed files with 29 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/dissect-image.c
+29 -24
View File
@@ -1877,6 +1877,28 @@ static int do_crypt_activate_verity(
CRYPT_ACTIVATE_READONLY);
}
static usec_t verity_timeout(void) {
usec_t t = 100 * USEC_PER_MSEC;
const char *e;
int r;
/* On slower machines, like non-KVM vm, setting up device may take a long time.
* Let's make the timeout configurable. */
e = getenv("SYSTEMD_DISSECT_VERITY_TIMEOUT_SEC");
if (!e)
return t;
r = parse_sec(e, &t);
if (r < 0)
log_debug_errno(r,
"Failed to parse timeout specified in $SYSTEMD_DISSECT_VERITY_TIMEOUT_SEC, "
"using the default timeout (%s).",
FORMAT_TIMESPAN(t, USEC_PER_MSEC));
return t;
}
static int verity_partition(
PartitionDesignator designator,
DissectedPartition *m,
@@ -1985,28 +2007,9 @@ static int verity_partition(
if (r < 0 && !IN_SET(r, -ENODEV, -ENOENT, -EBUSY))
return log_debug_errno(r, "Checking whether existing verity device %s can be reused failed: %m", node);
if (r >= 0) {
usec_t timeout_usec = 100 * USEC_PER_MSEC;
const char *e;
/* On slower machines, like non-KVM vm, setting up device may take a long time.
* Let's make the timeout configurable. */
e = getenv("SYSTEMD_DISSECT_VERITY_TIMEOUT_SEC");
if (e) {
usec_t t;
r = parse_sec(e, &t);
if (r < 0)
log_debug_errno(r,
"Failed to parse timeout specified in $SYSTEMD_DISSECT_VERITY_TIMEOUT_SEC, "
"using the default timeout (%s).",
FORMAT_TIMESPAN(timeout_usec, USEC_PER_MSEC));
else
timeout_usec = t;
}
/* devmapper might say that the device exists, but the devlink might not yet have been
* created. Check and wait for the udev event in that case. */
r = device_wait_for_devlink(node, "block", timeout_usec, NULL);
r = device_wait_for_devlink(node, "block", verity_timeout(), NULL);
/* Fallback to activation with a unique device if it's taking too long */
if (r == -ETIMEDOUT)
break;
@@ -2018,17 +2021,19 @@ static int verity_partition(
}
}
if (r >= 0)
break;
goto success;
/* Device is being opened by another process, but it has not finished yet, yield for 2ms */
(void) usleep(2 * USEC_PER_MSEC);
}
/* An existing verity device was reported by libcryptsetup/libdevmapper, but we can't use it at this time.
* Fall back to activating it with a unique device name. */
if (r < 0 && FLAGS_SET(flags, DISSECT_IMAGE_VERITY_SHARE))
/* All trials failed. Let's try to activate with a unique name. */
if (FLAGS_SET(flags, DISSECT_IMAGE_VERITY_SHARE))
return verity_partition(designator, m, v, verity, flags & ~DISSECT_IMAGE_VERITY_SHARE, d);
return log_debug_errno(SYNTHETIC_ERRNO(EBUSY), "All attempts to activate verity device %s failed.", name);
success:
/* Everything looks good and we'll be able to mount the device, so deferred remove will be re-enabled at that point. */
restore_deferred_remove = mfree(restore_deferred_remove);