diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml index 2effc434c6..381db9a048 100644 --- a/.github/workflows/mkosi.yml +++ b/.github/workflows/mkosi.yml @@ -105,7 +105,7 @@ jobs: steps: - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 - - uses: systemd/mkosi@3454f7bd4ef0336ec80a117d593baaef0fe53398 + - uses: systemd/mkosi@2a35f9958bc6b82d95d1eac02dc245e9bb068765 # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space # immediately, we remove the files in the background. However, we first move them to a different location diff --git a/mkosi.conf b/mkosi.conf index 980147f760..b76cefe0df 100644 --- a/mkosi.conf +++ b/mkosi.conf @@ -26,12 +26,18 @@ PassEnvironment= [Output] RepartDirectories=mkosi.repart OutputDirectory=build/mkosi.output + +[Build] BuildDirectory=build/mkosi.builddir CacheDirectory=build/mkosi.cache +BuildSourcesEphemeral=yes +Incremental=yes + +# TODO: Remove when TEST-70-TPM doesn't fail in an image with signed PCRs anymore. +[Validation] +SignExpectedPcr=no [Content] -BuildSourcesEphemeral=yes - ExtraTrees= mkosi.crt:/usr/lib/verity.d/mkosi.crt # sysext verification key mkosi.leak-sanitizer-suppressions:/usr/lib/systemd/leak-sanitizer-suppressions @@ -137,11 +143,9 @@ Credentials= tty.serial.hvc0.login.noauth=yes tty.console.agetty.autologin=root tty.console.login.noauth=yes -Incremental=yes RuntimeBuildSources=yes RuntimeScratch=no QemuSmp=2 QemuSwtpm=yes QemuVsock=yes QemuKvm=yes -ToolsTreePackages=virtiofsd diff --git a/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf b/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf index 0a388f3c08..137130e569 100644 --- a/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf +++ b/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf @@ -3,9 +3,6 @@ # libselinux does not work in the slightest with /usr-only images so don't install the packages if we're # building a /usr-only image. -[Match] -Profile=!particle - [Content] Packages= selinux-policy diff --git a/mkosi.conf.d/10-centos/mkosi.conf b/mkosi.conf.d/10-centos/mkosi.conf index dd462efcee..d2178315a2 100644 --- a/mkosi.conf.d/10-centos/mkosi.conf +++ b/mkosi.conf.d/10-centos/mkosi.conf @@ -6,7 +6,7 @@ Distribution=centos [Distribution] Release=10 -[Content] +[Build] Environment= # CentOS doesn't support btrfs so we have to use something else. We'd prefer to use XFS here but it # fails to mount on duplicate filesystem UUIDs which happens when running tests in parallel so we use @@ -16,5 +16,6 @@ Environment= # mkfs.ext4 enabled it by default, so we disable it explicitly. SYSTEMD_REPART_MKFS_OPTIONS_EXT4="-O ^orphan_file" +[Content] Packages= kernel-modules # For squashfs diff --git a/mkosi.conf.d/20-particle/mkosi.conf b/mkosi.conf.d/20-particle/mkosi.conf deleted file mode 100644 index 99dad00f5a..0000000000 --- a/mkosi.conf.d/20-particle/mkosi.conf +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Profile=particle - -[Output] -RepartDirectories= -RepartDirectories=mkosi.repart - -[Validation] -SecureBoot=yes -SignExpectedPcr=yes - -[Host] -RuntimeSize=8G diff --git a/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf b/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf deleted file mode 100644 index 3755278462..0000000000 --- a/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf +++ /dev/null @@ -1,6 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Partition] -Type=swap -SizeMinBytes=100M -SizeMaxBytes=100M diff --git a/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf b/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf deleted file mode 100644 index 2f92af248f..0000000000 --- a/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf +++ /dev/null @@ -1,6 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Partition] -Type=root -Format=btrfs -SizeMinBytes=1G diff --git a/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf b/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf deleted file mode 100644 index dac79ba4ed..0000000000 --- a/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -C+! /etc - - - - /usr/share/factory/mkosi diff --git a/mkosi.conf.d/20-particle/mkosi.finalize b/mkosi.conf.d/20-particle/mkosi.finalize deleted file mode 100755 index 69f9554864..0000000000 --- a/mkosi.conf.d/20-particle/mkosi.finalize +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/bash -# SPDX-License-Identifier: LGPL-2.1-or-later -set -e - -mkdir -p "$BUILDROOT"/usr/share/factory/mkosi -cp --archive --recursive --no-target-directory --reflink=auto "$BUILDROOT"/etc "$BUILDROOT"/usr/share/factory/mkosi diff --git a/mkosi.conf.d/20-particle/mkosi.postinst.chroot b/mkosi.conf.d/20-particle/mkosi.postinst.chroot deleted file mode 100755 index 95e0552d91..0000000000 --- a/mkosi.conf.d/20-particle/mkosi.postinst.chroot +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/bash -# SPDX-License-Identifier: LGPL-2.1-or-later -set -e - -# sbsign is not available on CentOS Stream -if command -v sbsign &>/dev/null; then - # Ensure that side-loaded PE addons are loaded if signed, and ignored if not - addons_dir=/efi/loader/addons - mkdir -p "$addons_dir" - ukify build --secureboot-private-key mkosi.key --secureboot-certificate mkosi.crt --cmdline this_should_be_here -o "$addons_dir/good.addon.efi" - ukify build --cmdline this_should_not_be_here -o "$addons_dir/bad.addon.efi" -fi diff --git a/mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf b/mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf deleted file mode 100644 index 391543d1e7..0000000000 --- a/mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Partition] -Type=esp -Format=vfat -CopyFiles=/boot:/ -CopyFiles=/efi:/ -SizeMinBytes=1G -SizeMaxBytes=1G diff --git a/mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf b/mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf deleted file mode 100644 index 343761d097..0000000000 --- a/mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Partition] -Type=usr -Format=erofs -CopyFiles=/usr:/ -Verity=data -VerityMatchKey=usr -Minimize=yes diff --git a/mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf b/mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf deleted file mode 100644 index b4d45dd7ef..0000000000 --- a/mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Partition] -Type=usr-verity -Verity=hash -VerityMatchKey=usr -Minimize=yes diff --git a/mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf b/mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf deleted file mode 100644 index 1841d0a6db..0000000000 --- a/mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf +++ /dev/null @@ -1,6 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Partition] -Type=usr-verity-sig -Verity=signature -VerityMatchKey=usr diff --git a/mkosi.conf.d/20-sanitizers.conf b/mkosi.conf.d/20-sanitizers.conf index 62d052360a..ecbb02ba61 100644 --- a/mkosi.conf.d/20-sanitizers.conf +++ b/mkosi.conf.d/20-sanitizers.conf @@ -4,13 +4,15 @@ Environment=SANITIZERS Environment=!SANITIZERS= -[Content] +[Build] # Set verify_asan_link_order=0 to prevent ASAN warnings when building the image and make sure the real ASAN # options are set when booting the image. # Set intercept_tls_get_addr=0 to work around leak sanitizer segmentation fault in test-dlopen-so on CentOS # Stream 9. # TODO: Drop intercept_tls_get_addr=0 when we remove CentOS Stream 9 builds. Environment=ASAN_OPTIONS=verify_asan_link_order=0:intercept_tls_get_addr=0 + +[Content] KernelCommandLine= ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1 systemd.setenv=ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1 @@ -19,5 +21,5 @@ KernelCommandLine= LSAN_OPTIONS=suppressions=/usr/lib/systemd/leak-sanitizer-suppressions systemd.setenv=LSAN_OPTIONS=suppressions=/usr/lib/systemd/leak-sanitizer-suppressions -[Config] +[Include] Include=%D/mkosi.sanitizers diff --git a/mkosi.images/build/mkosi.conf.d/arch/mkosi.conf b/mkosi.images/build/mkosi.conf.d/arch/mkosi.conf index ced3ea4108..fc90285561 100644 --- a/mkosi.images/build/mkosi.conf.d/arch/mkosi.conf +++ b/mkosi.images/build/mkosi.conf.d/arch/mkosi.conf @@ -3,13 +3,14 @@ [Match] Distribution=arch -[Content] +[Build] Environment= GIT_URL=https://gitlab.archlinux.org/archlinux/packaging/packages/systemd.git GIT_BRANCH=main GIT_COMMIT=d5a2dc54dad2bcfefa1032cc95823f1acedfcb4c PKG_SUBDIR=arch +[Content] Packages= base base-devel diff --git a/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.conf b/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.conf index 1efca6d4b2..0f4a79652c 100644 --- a/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.conf +++ b/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.conf @@ -4,13 +4,14 @@ Distribution=|centos Distribution=|fedora -[Content] +[Build] Environment= GIT_URL=https://src.fedoraproject.org/rpms/systemd.git GIT_BRANCH=rawhide GIT_COMMIT=a67221c3f0d0b81b9b5b3230a71d09044342f1a4 PKG_SUBDIR=fedora +[Content] Packages= compiler-rt git-core diff --git a/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf b/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf index 29727d7e22..2351aaa6ce 100644 --- a/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf +++ b/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf @@ -4,7 +4,7 @@ Distribution=|debian Distribution=|ubuntu -[Content] +[Build] Environment= GIT_URL=https://salsa.debian.org/systemd-team/systemd.git GIT_SUBDIR=debian @@ -12,6 +12,7 @@ Environment= GIT_COMMIT=51389fefcabae6d1e28153fed84a5e69a9147b19 PKG_SUBDIR=debian +[Content] Packages= apt erofs-utils diff --git a/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.conf b/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.conf index 0b17435672..a4882df8b1 100644 --- a/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.conf +++ b/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.conf @@ -3,13 +3,14 @@ [Match] Distribution=opensuse -[Content] +[Build] Environment= GIT_URL=https://src.opensuse.org/pool/systemd GIT_BRANCH=factory GIT_COMMIT=612bc16021b28ab99002fa1069f1ec97124397a25c7a207d013213b5cfb86055 PKG_SUBDIR=opensuse +[Content] Packages= diffutils erofs-utils diff --git a/mkosi.images/exitrd/mkosi.conf b/mkosi.images/exitrd/mkosi.conf index 28da8a592b..ea4fc806bf 100644 --- a/mkosi.images/exitrd/mkosi.conf +++ b/mkosi.images/exitrd/mkosi.conf @@ -13,5 +13,5 @@ MakeInitrd=yes Packages= bash -[Config] +[Include] Include=%D/mkosi.sanitizers diff --git a/mkosi.images/initrd/mkosi.conf b/mkosi.images/initrd/mkosi.conf index 3f2c5c77ce..ca28c123af 100644 --- a/mkosi.images/initrd/mkosi.conf +++ b/mkosi.images/initrd/mkosi.conf @@ -1,6 +1,6 @@ # SPDX-License-Identifier: LGPL-2.1-or-later -[Config] +[Include] Include= mkosi-initrd %D/mkosi.sanitizers diff --git a/mkosi.images/minimal-0/mkosi.conf b/mkosi.images/minimal-0/mkosi.conf index 5ef80b8bc7..5d6717f897 100644 --- a/mkosi.images/minimal-0/mkosi.conf +++ b/mkosi.images/minimal-0/mkosi.conf @@ -7,7 +7,9 @@ Dependencies=minimal-base Format=portable SplitArtifacts=yes +[Build] +Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs + [Content] BaseTrees=%O/minimal-base -Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs Bootable=no diff --git a/mkosi.images/minimal-1/mkosi.conf b/mkosi.images/minimal-1/mkosi.conf index 5ef80b8bc7..5d6717f897 100644 --- a/mkosi.images/minimal-1/mkosi.conf +++ b/mkosi.images/minimal-1/mkosi.conf @@ -7,7 +7,9 @@ Dependencies=minimal-base Format=portable SplitArtifacts=yes +[Build] +Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs + [Content] BaseTrees=%O/minimal-base -Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs Bootable=no diff --git a/mkosi.images/minimal-base/mkosi.conf b/mkosi.images/minimal-base/mkosi.conf index d841f9b76b..56040f8b21 100644 --- a/mkosi.images/minimal-base/mkosi.conf +++ b/mkosi.images/minimal-base/mkosi.conf @@ -15,5 +15,5 @@ Packages= grep util-linux -[Config] +[Include] Include=%D/mkosi.sanitizers diff --git a/mkosi.profiles/particle.conf b/mkosi.profiles/particle.conf deleted file mode 100644 index 5f36d58e4d..0000000000 --- a/mkosi.profiles/particle.conf +++ /dev/null @@ -1,2 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later -# This file exists to create the particle profile which is matched on by other configuration files. diff --git a/src/boot/efi/boot.c b/src/boot/efi/boot.c index 213c012e3f..a362f7a93f 100644 --- a/src/boot/efi/boot.c +++ b/src/boot/efi/boot.c @@ -1925,11 +1925,11 @@ static bool is_sd_boot(EFI_FILE *root_dir, const char16_t *loader_path) { /* profile= */ UINT_MAX, /* validate_base= */ 0, &vector); - if (vector.size != sizeof(SD_MAGIC)) + if (vector.memory_size != sizeof(SD_MAGIC)) return false; - err = file_handle_read(handle, vector.file_offset, vector.size, &content, &read); - if (err != EFI_SUCCESS || vector.size != read) + err = file_handle_read(handle, vector.file_offset, vector.file_size, &content, &read); + if (err != EFI_SUCCESS || vector.file_size != read) return false; return memcmp(content, SD_MAGIC, sizeof(SD_MAGIC)) == 0; @@ -2210,7 +2210,7 @@ static void boot_entry_add_type2( err = file_handle_read( handle, sections[SECTION_OSREL].file_offset, - sections[SECTION_OSREL].size, + sections[SECTION_OSREL].file_size, &content, /* ret_size= */ NULL); if (err != EFI_SUCCESS) @@ -2281,7 +2281,7 @@ static void boot_entry_add_type2( err = file_handle_read( handle, sections[SECTION_PROFILE].file_offset, - sections[SECTION_PROFILE].size, + sections[SECTION_PROFILE].file_size, &content, /* ret_size= */ NULL); if (err != EFI_SUCCESS) @@ -2348,7 +2348,7 @@ static void boot_entry_add_type2( err = file_handle_read( handle, sections[SECTION_CMDLINE].file_offset, - sections[SECTION_CMDLINE].size, + sections[SECTION_CMDLINE].file_size, &content, &cmdline_len); if (err == EFI_SUCCESS) { diff --git a/src/boot/efi/pe.c b/src/boot/efi/pe.c index 2f9b058eb6..26dfcd4291 100644 --- a/src/boot/efi/pe.c +++ b/src/boot/efi/pe.c @@ -186,13 +186,13 @@ static void pe_locate_sections( /* Overflow check: ignore sections that are impossibly large, relative to the file * address for the section. */ size_t size_max = SIZE_MAX - j->PointerToRawData; - if ((size_t) j->VirtualSize > size_max) + if ((size_t) j->SizeOfRawData > size_max) continue; /* Overflow check: ignore sections that are impossibly large, given the virtual * address for the section */ size_max = SIZE_MAX - j->VirtualAddress; - if (j->VirtualSize > size_max) + if ((size_t) j->VirtualSize > size_max) continue; /* 2nd overflow check: ignore sections that are impossibly large also taking the @@ -208,9 +208,15 @@ static void pe_locate_sections( /* At this time, the sizes and offsets have been validated. Store them away */ sections[i] = (PeSectionVector) { - .size = j->VirtualSize, - .file_offset = j->PointerToRawData, + .memory_size = j->VirtualSize, .memory_offset = j->VirtualAddress, + /* VirtualSize can be bigger than SizeOfRawData when the section requires + * uninitialized data. It can also be smaller than SizeOfRawData when there's + * no need for uninitialized data as SizeOfRawData is aligned to + * FileAlignment and VirtualSize isn't. The actual data that's read from disk + * is the minimum of these two fields. */ + .file_size = MIN(j->SizeOfRawData, j->VirtualSize), + .file_offset = j->PointerToRawData, }; /* First matching section wins, ignore the rest */ @@ -235,7 +241,7 @@ static uint32_t get_compatibility_entry_address(const DosFileHeader *dos, const PTR_TO_SIZE(dos), &vector); - if (vector.size == 0) /* not found */ + if (vector.memory_size == 0) /* not found */ return 0; typedef struct { @@ -245,7 +251,7 @@ static uint32_t get_compatibility_entry_address(const DosFileHeader *dos, const uint32_t entry_point; } _packed_ LinuxPeCompat1; - size_t addr = vector.memory_offset, size = vector.size; + size_t addr = vector.memory_offset, size = vector.memory_size; while (size >= sizeof(LinuxPeCompat1) && addr % alignof(LinuxPeCompat1) == 0) { const LinuxPeCompat1 *compat = (const LinuxPeCompat1 *) ((const uint8_t *) dos + addr); diff --git a/src/boot/efi/pe.h b/src/boot/efi/pe.h index b9838579cf..56312b15b3 100644 --- a/src/boot/efi/pe.h +++ b/src/boot/efi/pe.h @@ -20,13 +20,14 @@ typedef struct PeSectionHeader { /* This is a subset of the full PE section header structure, with validated values, and without * the noise. */ typedef struct PeSectionVector { - size_t size; + size_t memory_size; /* Size of the section in memory (corresponds to VirtualSize field) */ size_t memory_offset; /* Offset in memory, relative to base address */ + uint64_t file_size; /* Amount of bytes of the section read from disk (possibly aligned to FileAlignment in case VirtualSize > SizeOfRawData). */ uint64_t file_offset; /* Offset on disk, relative to beginning of file */ } PeSectionVector; static inline bool PE_SECTION_VECTOR_IS_SET(const PeSectionVector *v) { - return v && v->size != 0; + return v && v->memory_size != 0; } EFI_STATUS pe_section_table_from_base( diff --git a/src/boot/efi/stub.c b/src/boot/efi/stub.c index d3cc809efb..4df993c5d0 100644 --- a/src/boot/efi/stub.c +++ b/src/boot/efi/stub.c @@ -58,7 +58,7 @@ static char16_t* pe_section_to_str16( if (!PE_SECTION_VECTOR_IS_SET(section)) return NULL; - return xstrn8_to_16((const char *) loaded_image->ImageBase + section->memory_offset, section->size); + return xstrn8_to_16((const char *) loaded_image->ImageBase + section->memory_offset, section->memory_size); } static char *pe_section_to_str8( @@ -71,7 +71,7 @@ static char *pe_section_to_str8( if (!PE_SECTION_VECTOR_IS_SET(section)) return NULL; - return xstrndup8((const char *)loaded_image->ImageBase + section->memory_offset, section->size); + return xstrndup8((const char *)loaded_image->ImageBase + section->memory_offset, section->memory_size); } static void combine_measured_flag(int *value, int measured) { @@ -634,7 +634,7 @@ static EFI_STATUS load_addons( if (uname && PE_SECTION_VECTOR_IS_SET(sections + UNIFIED_SECTION_UNAME) && !strneq8(uname, (const char *)loaded_addon->ImageBase + sections[UNIFIED_SECTION_UNAME].memory_offset, - sections[UNIFIED_SECTION_UNAME].size)) { + sections[UNIFIED_SECTION_UNAME].memory_size)) { log_error(".uname mismatch between %ls and UKI, ignoring", items[i]); continue; } @@ -653,8 +653,8 @@ static EFI_STATUS load_addons( (*devicetree_addons)[(*n_devicetree_addons)++] = (NamedAddon) { .blob = { - .iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_DTB].memory_offset, sections[UNIFIED_SECTION_DTB].size), - .iov_len = sections[UNIFIED_SECTION_DTB].size, + .iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_DTB].memory_offset, sections[UNIFIED_SECTION_DTB].memory_size), + .iov_len = sections[UNIFIED_SECTION_DTB].memory_size, }, .filename = xstrdup16(items[i]), }; @@ -666,8 +666,8 @@ static EFI_STATUS load_addons( (*n_initrd_addons + 1) * sizeof(NamedAddon)); (*initrd_addons)[(*n_initrd_addons)++] = (NamedAddon) { .blob = { - .iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_INITRD].memory_offset, sections[UNIFIED_SECTION_INITRD].size), - .iov_len = sections[UNIFIED_SECTION_INITRD].size, + .iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_INITRD].memory_offset, sections[UNIFIED_SECTION_INITRD].memory_size), + .iov_len = sections[UNIFIED_SECTION_INITRD].memory_size, }, .filename = xstrdup16(items[i]), }; @@ -679,8 +679,8 @@ static EFI_STATUS load_addons( (*n_ucode_addons + 1) * sizeof(NamedAddon)); (*ucode_addons)[(*n_ucode_addons)++] = (NamedAddon) { .blob = { - .iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_UCODE].memory_offset, sections[UNIFIED_SECTION_UCODE].size), - .iov_len = sections[UNIFIED_SECTION_UCODE].size, + .iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_UCODE].memory_offset, sections[UNIFIED_SECTION_UCODE].memory_size), + .iov_len = sections[UNIFIED_SECTION_UCODE].memory_size, }, .filename = xstrdup16(items[i]), }; @@ -748,7 +748,7 @@ static void measure_sections( (void) tpm_log_ipl_event_ascii( TPM2_PCR_KERNEL_BOOT, POINTER_TO_PHYSICAL_ADDRESS(loaded_image->ImageBase) + sections[section].memory_offset, - sections[section].size, + sections[section].memory_size, unified_sections[section], &m); combine_measured_flag(sections_measured, m); @@ -905,7 +905,7 @@ static void generate_embedded_initrds( (void) pack_cpio_literal( (const uint8_t*) loaded_image->ImageBase + sections[t->section].memory_offset, - sections[t->section].size, + sections[t->section].memory_size, ".extra", t->filename, /* dir_mode= */ 0555, @@ -929,12 +929,12 @@ static void lookup_embedded_initrds( if (PE_SECTION_VECTOR_IS_SET(sections + UNIFIED_SECTION_INITRD)) initrds[INITRD_BASE] = IOVEC_MAKE( (const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_INITRD].memory_offset, - sections[UNIFIED_SECTION_INITRD].size); + sections[UNIFIED_SECTION_INITRD].memory_size); if (PE_SECTION_VECTOR_IS_SET(sections + UNIFIED_SECTION_UCODE)) initrds[INITRD_UCODE] = IOVEC_MAKE( (const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_UCODE].memory_offset, - sections[UNIFIED_SECTION_UCODE].size); + sections[UNIFIED_SECTION_UCODE].memory_size); } static void export_pcr_variables( @@ -973,7 +973,7 @@ static void install_embedded_devicetree( err = devicetree_install_from_memory( dt_state, (const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_DTB].memory_offset, - sections[UNIFIED_SECTION_DTB].size); + sections[UNIFIED_SECTION_DTB].memory_size); if (err != EFI_SUCCESS) log_error_status(err, "Error loading embedded devicetree, ignoring: %m"); } @@ -1047,7 +1047,7 @@ static void display_splash( if (!PE_SECTION_VECTOR_IS_SET(sections + UNIFIED_SECTION_SPLASH)) return; - graphics_splash((const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_SPLASH].memory_offset, sections[UNIFIED_SECTION_SPLASH].size); + graphics_splash((const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_SPLASH].memory_offset, sections[UNIFIED_SECTION_SPLASH].memory_size); } static EFI_STATUS find_sections( @@ -1250,7 +1250,7 @@ static EFI_STATUS run(EFI_HANDLE image) { struct iovec kernel = IOVEC_MAKE( (const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_LINUX].memory_offset, - sections[UNIFIED_SECTION_LINUX].size); + sections[UNIFIED_SECTION_LINUX].memory_size); err = linux_exec(image, cmdline, &kernel, &final_initrd); graphics_mode(false); diff --git a/src/shared/efi-loader.c b/src/shared/efi-loader.c index 74144af95a..ae0b2b1fdc 100644 --- a/src/shared/efi-loader.c +++ b/src/shared/efi-loader.c @@ -364,5 +364,5 @@ bool efi_loader_entry_name_valid(const char *s) { if (!filename_is_valid(s)) /* Make sure entry names fit in filenames */ return false; - return in_charset(s, ALPHANUMERICAL "+-_."); + return in_charset(s, ALPHANUMERICAL "+-_.@"); } diff --git a/src/ukify/ukify.py b/src/ukify/ukify.py index 93ad78b01d..2344282795 100755 --- a/src/ukify/ukify.py +++ b/src/ukify/ukify.py @@ -1052,7 +1052,7 @@ def make_uki(opts: argparse.Namespace) -> None: Section.create(n, section.get_data(length=section.Misc_VirtualSize), measure=True) ) - call_systemd_measure(uki, opts=opts, profile_start=prev_len + 1) + call_systemd_measure(uki, opts=opts, profile_start=prev_len) # UKI creation @@ -1801,6 +1801,13 @@ def create_parser() -> argparse.ArgumentParser: return p +def resolve_at_path(value: Optional[str]) -> str: + if value and value.startswith('@'): + return Path(value[1:]) + + return value + + def finalize_options(opts: argparse.Namespace) -> None: # Figure out which syntax is being used, one of: # ukify verb --arg --arg --arg @@ -1835,17 +1842,17 @@ def finalize_options(opts: argparse.Namespace) -> None: if n_phase_path_groups is not None and n_phase_path_groups != n_pcr_priv: raise ValueError('--phases= specifications must match --pcr-private-key=') - if opts.cmdline and opts.cmdline.startswith('@'): - opts.cmdline = Path(opts.cmdline[1:]) - elif opts.cmdline: + opts.cmdline = resolve_at_path(opts.cmdline) + + if isinstance(opts.cmdline, str): # Drop whitespace from the command line. If we're reading from a file, # we copy the contents verbatim. But configuration specified on the command line # or in the config file may contain additional whitespace that has no meaning. opts.cmdline = ' '.join(opts.cmdline.split()) - if opts.os_release and opts.os_release.startswith('@'): - opts.os_release = Path(opts.os_release[1:]) - elif not opts.os_release and opts.linux: + opts.os_release = resolve_at_path(opts.os_release) + + if not opts.os_release and opts.linux: p = Path('/etc/os-release') if not p.exists(): p = Path('/usr/lib/os-release') @@ -1891,6 +1898,8 @@ def finalize_options(opts: argparse.Namespace) -> None: '--sign-kernel requires either --secureboot-private-key= and --secureboot-certificate= (for sbsign) or --secureboot-certificate-name= (for pesign) to be specified' # noqa: E501 ) + opts.profile = resolve_at_path(opts.profile) + if opts.join_profiles and not opts.profile: # If any additional profiles are added, we need a base profile as well so add one if # one wasn't explicitly provided