SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dissect-image: port mount_image_privately_interactively() to use /run/systemd/mount-rootfs/ too

Browse Source 
Let's use the same common directory as the unit logic uses.

This means we have less to clean up, and opens the door to eventually
allow unprivileged operation of the
mount_image_privately_interactively() logic.
This commit is contained in:
Lennart Poettering
2023-05-16 09:26:17 +02:00
parent be79c23569
commit a4b3e94236
12 changed files with 43 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/analyze/analyze.c
+3 -3
View File
@@ -599,7 +599,7 @@ static int parse_argv(int argc, char *argv[]) {
static int run(int argc, char *argv[]) {
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *unlink_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
static const Verb verbs[] = {
{ "help", VERB_ANY, VERB_ANY, 0, help },
@@ -660,13 +660,13 @@ static int run(int argc, char *argv[]) {
DISSECT_IMAGE_GENERIC_ROOT |
DISSECT_IMAGE_RELAX_VAR_CHECK |
DISSECT_IMAGE_READ_ONLY,
&unlink_dir,
&mounted_dir,
/* ret_dir_fd= */ NULL,
&loop_device);
if (r < 0)
return r;
arg_root = strdup(unlink_dir);
arg_root = strdup(mounted_dir);
if (!arg_root)
return log_oom();
}
src/boot/bootctl.c
+3 -3
View File
@@ -445,7 +445,7 @@ static int bootctl_main(int argc, char *argv[]) {
static int run(int argc, char *argv[]) {
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *unlink_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
int r;
log_setup();
@@ -493,13 +493,13 @@ static int run(int argc, char *argv[]) {
arg_image_policy,
DISSECT_IMAGE_GENERIC_ROOT |
DISSECT_IMAGE_RELAX_VAR_CHECK,
&unlink_dir,
&mounted_dir,
/* ret_dir_fd= */ NULL,
&loop_device);
if (r < 0)
return r;
arg_root = strdup(unlink_dir);
arg_root = strdup(mounted_dir);
if (!arg_root)
return log_oom();
}
src/coredump/coredumpctl.c
+1 -1
View File
@@ -1350,7 +1350,7 @@ static int coredumpctl_main(int argc, char *argv[]) {
static int run(int argc, char *argv[]) {
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *mounted_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
int r, units_active;
setlocale(LC_ALL, "");
src/firstboot/firstboot.c
+3 -3
View File
@@ -1506,7 +1506,7 @@ static int parse_argv(int argc, char *argv[]) {
static int run(int argc, char *argv[]) {
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *unlink_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
_cleanup_close_ int rfd = -EBADF;
int r;
@@ -1546,13 +1546,13 @@ static int run(int argc, char *argv[]) {
DISSECT_IMAGE_RELAX_VAR_CHECK |
DISSECT_IMAGE_FSCK |
DISSECT_IMAGE_GROWFS,
&unlink_dir,
&mounted_dir,
&rfd,
&loop_device);
if (r < 0)
return r;
arg_root = strdup(unlink_dir);
arg_root = strdup(mounted_dir);
if (!arg_root)
return log_oom();
} else {
src/journal/journalctl.c
+3 -3
View File
@@ -2112,7 +2112,7 @@ static int wait_for_change(sd_journal *j, int poll_fd) {
static int run(int argc, char *argv[]) {
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *unlink_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
bool previous_boot_id_valid = false, first_line = true, ellipsized = false, need_seek = false, since_seeked = false;
bool use_cursor = false, after_cursor = false;
_cleanup_(sd_journal_closep) sd_journal *j = NULL;
@@ -2143,13 +2143,13 @@ static int run(int argc, char *argv[]) {
DISSECT_IMAGE_VALIDATE_OS |
DISSECT_IMAGE_RELAX_VAR_CHECK |
(arg_action == ACTION_UPDATE_CATALOG ? DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS : DISSECT_IMAGE_READ_ONLY),
&unlink_dir,
&mounted_dir,
/* ret_dir_fd= */ NULL,
&loop_device);
if (r < 0)
return r;
arg_root = strdup(unlink_dir);
arg_root = strdup(mounted_dir);
if (!arg_root)
return log_oom();
}
src/machine-id-setup/machine-id-setup-main.c
+3 -3
View File
@@ -136,7 +136,7 @@ static int parse_argv(int argc, char *argv[]) {
static int run(int argc, char *argv[]) {
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *unlink_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
int r;
log_parse_environment();
@@ -157,13 +157,13 @@ static int run(int argc, char *argv[]) {
DISSECT_IMAGE_RELAX_VAR_CHECK |
DISSECT_IMAGE_FSCK |
DISSECT_IMAGE_GROWFS,
&unlink_dir,
&mounted_dir,
/* ret_dir_fd= */ NULL,
&loop_device);
if (r < 0)
return r;
arg_root = strdup(unlink_dir);
arg_root = strdup(mounted_dir);
if (!arg_root)
return log_oom();
}
src/partition/repart.c
+1 -1
View File
@@ -6669,7 +6669,7 @@ static int determine_auto_size(Context *c) {
static int run(int argc, char *argv[]) {
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *mounted_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
_cleanup_(context_freep) Context* context = NULL;
bool node_is_our_loop = false;
int r;
src/shared/dissect-image.c
+18 -14
View File
@@ -3667,8 +3667,7 @@ int mount_image_privately_interactively(
_cleanup_(verity_settings_done) VeritySettings verity = VERITY_SETTINGS_DEFAULT;
_cleanup_(loop_device_unrefp) LoopDevice *d = NULL;
_cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
_cleanup_(rmdir_and_freep) char *created_dir = NULL;
_cleanup_free_ char *temp = NULL;
_cleanup_free_ char *dir = NULL;
int r;
/* Mounts an OS image at a temporary place, inside a newly created mount namespace of our own. This
@@ -3676,7 +3675,6 @@ int mount_image_privately_interactively(
* easily. */
assert(image);
assert(ret_directory);
assert(ret_loop_device);
/* We intend to mount this right-away, hence add the partitions if needed and pin them. */
@@ -3687,10 +3685,6 @@ int mount_image_privately_interactively(
if (r < 0)
return log_error_errno(r, "Failed to load root hash data: %m");
r = tempfn_random_child(NULL, program_invocation_short_name, &temp);
if (r < 0)
return log_error_errno(r, "Failed to generate temporary mount directory: %m");
r = loop_device_make_by_path(
image,
FLAGS_SET(flags, DISSECT_IMAGE_DEVICE_READ_ONLY) ? O_RDONLY : O_RDWR,
@@ -3723,13 +3717,16 @@ int mount_image_privately_interactively(
if (r < 0)
return log_error_errno(r, "Failed to detach mount namespace: %m");
r = mkdir_p(temp, 0700);
r = mkdir_p("/run/systemd/mount-rootfs", 0555);
if (r < 0)
return log_error_errno(r, "Failed to create mount point: %m");
created_dir = TAKE_PTR(temp);
r = dissected_image_mount_and_warn(dissected_image, created_dir, UID_INVALID, UID_INVALID, flags);
r = dissected_image_mount_and_warn(
dissected_image,
"/run/systemd/mount-rootfs",
/* uid_shift= */ UID_INVALID,
/* uid_range= */ UID_INVALID,
flags);
if (r < 0)
return r;
@@ -3741,19 +3738,26 @@ int mount_image_privately_interactively(
if (r < 0)
return log_error_errno(r, "Failed to relinquish DM and loopback block devices: %m");
if (ret_directory) {
dir = strdup("/run/systemd/mount-rootfs");
if (!dir)
return log_oom();
}
if (ret_dir_fd) {
_cleanup_close_ int dir_fd = -EBADF;
dir_fd = open(created_dir, O_CLOEXEC|O_DIRECTORY);
dir_fd = open("/run/systemd/mount-rootfs", O_CLOEXEC|O_DIRECTORY);
if (dir_fd < 0)
return log_error_errno(errno, "Failed to open mount point directory: %m");
*ret_dir_fd = TAKE_FD(dir_fd);
}
*ret_directory = TAKE_PTR(created_dir);
*ret_loop_device = TAKE_PTR(d);
if (ret_directory)
*ret_directory = TAKE_PTR(dir);
*ret_loop_device = TAKE_PTR(d);
return 0;
}
src/systemctl/systemctl.c
+1 -1
View File
@@ -1224,7 +1224,7 @@ static int systemctl_main(int argc, char *argv[]) {
static int run(int argc, char *argv[]) {
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *mounted_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
int r;
setlocale(LC_ALL, "");
src/sysupdate/sysupdate.c
+1 -1
View File
@@ -861,7 +861,7 @@ static int process_image(
LoopDevice **ret_loop_device) {
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *mounted_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
int r;
assert(ret_mounted_dir);
src/sysusers/sysusers.c
+3 -3
View File
@@ -2157,7 +2157,7 @@ static int read_credential_lines(void) {
static int run(int argc, char *argv[]) {
#ifndef STANDALONE
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *unlink_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
#endif
_cleanup_close_ int lock = -EBADF;
Item *i;
@@ -2191,13 +2191,13 @@ static int run(int argc, char *argv[]) {
DISSECT_IMAGE_RELAX_VAR_CHECK |
DISSECT_IMAGE_FSCK |
DISSECT_IMAGE_GROWFS,
&unlink_dir,
&mounted_dir,
/* ret_dir_fd= */ NULL,
&loop_device);
if (r < 0)
return r;
arg_root = strdup(unlink_dir);
arg_root = strdup(mounted_dir);
if (!arg_root)
return log_oom();
}
src/tmpfiles/tmpfiles.c
+3 -3
View File
@@ -4223,7 +4223,7 @@ DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(item_array_hash_ops, char, string_
static int run(int argc, char *argv[]) {
#ifndef STANDALONE
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_rmdir_and_freep) char *unlink_dir = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
#endif
_cleanup_strv_free_ char **config_dirs = NULL;
bool invalid_config = false;
@@ -4314,13 +4314,13 @@ static int run(int argc, char *argv[]) {
DISSECT_IMAGE_RELAX_VAR_CHECK |
DISSECT_IMAGE_FSCK |
DISSECT_IMAGE_GROWFS,
&unlink_dir,
&mounted_dir,
/* ret_dir_fd= */ NULL,
&loop_device);
if (r < 0)
return r;
arg_root = strdup(unlink_dir);
arg_root = strdup(mounted_dir);
if (!arg_root)
return log_oom();
}