SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #27806 from DaanDeMeyer/fix-mkosi-check

Browse Source 
mkosi: Use proper check to detect whether we're in a VM
This commit is contained in:
Daan De Meyer
2023-05-31 15:26:05 +02:00
committed by GitHub
parent 2533fdd0fb df4835c897
commit edabe6fc11
8 changed files with 95 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/kmod-setup.c
+33 -9
View File
@@ -107,6 +107,27 @@ static bool has_virtio_console(void) {
return r > 0;
}
static bool has_virtio_vsock(void) {
int r;
/* Directory traversal might be slow, hence let's do a cheap check first if it's even worth it */
if (detect_vm() == VIRTUALIZATION_NONE)
return false;
r = recurse_dir_at(
AT_FDCWD,
"/sys/devices/pci0000:00",
/* statx_mask= */ 0,
/* n_depth_max= */ 3,
RECURSE_DIR_ENSURE_TYPE,
match_modalias_recurse_dir_cb,
STRV_MAKE("virtio:d00000013v"));
if (r < 0)
log_debug_errno(r, "Failed to determine whether host has virtio-vsock device, ignoring: %m");
return r > 0;
}
static bool in_qemu(void) {
return IN_SET(detect_vm(), VIRTUALIZATION_KVM, VIRTUALIZATION_QEMU);
}
@@ -124,35 +145,38 @@ int kmod_setup(void) {
} kmod_table[] = {
/* This one we need to load explicitly, since auto-loading on use doesn't work
* before udev created the ghost device nodes, and we need it earlier than that. */
{ "autofs4", "/sys/class/misc/autofs", true, false, NULL },
{ "autofs4", "/sys/class/misc/autofs", true, false, NULL },
/* This one we need to load explicitly, since auto-loading of IPv6 is not done when
* we try to configure ::1 on the loopback device. */
{ "ipv6", "/sys/module/ipv6", false, true, NULL },
{ "ipv6", "/sys/module/ipv6", false, true, NULL },
/* This should never be a module */
{ "unix", "/proc/net/unix", true, true, NULL },
{ "unix", "/proc/net/unix", true, true, NULL },
#if HAVE_LIBIPTC
/* netfilter is needed by networkd, nspawn among others, and cannot be autoloaded */
{ "ip_tables", "/proc/net/ip_tables_names", false, false, NULL },
{ "ip_tables", "/proc/net/ip_tables_names", false, false, NULL },
#endif
/* virtio_rng would be loaded by udev later, but real entropy might be needed very early */
{ "virtio_rng", NULL, false, false, has_virtio_rng },
{ "virtio_rng", NULL, false, false, has_virtio_rng },
/* we want early logging to hvc consoles if possible, and make sure systemd-getty-generator
* can rely on all consoles being probed already.*/
{ "virtio_console", NULL, false, false, has_virtio_console },
{ "virtio_console", NULL, false, false, has_virtio_console },
/* Make sure we can send sd-notify messages over vsock as early as possible. */
{ "vmw_vsock_virtio_transport", NULL, false, false, has_virtio_vsock },
/* qemu_fw_cfg would be loaded by udev later, but we want to import credentials from it super early */
{ "qemu_fw_cfg", "/sys/firmware/qemu_fw_cfg", false, false, in_qemu },
{ "qemu_fw_cfg", "/sys/firmware/qemu_fw_cfg", false, false, in_qemu },
/* dmi-sysfs is needed to import credentials from it super early */
{ "dmi-sysfs", "/sys/firmware/dmi/entries", false, false, NULL },
{ "dmi-sysfs", "/sys/firmware/dmi/entries", false, false, NULL },
#if HAVE_TPM2
/* Make sure the tpm subsystem is available which ConditionSecurity=tpm2 depends on. */
{ "tpm", "/sys/class/tpmrm", false, false, efi_has_tpm2 },
{ "tpm", "/sys/class/tpmrm", false, false, efi_has_tpm2 },
#endif
};
_cleanup_(kmod_unrefp) struct kmod_ctx *ctx = NULL;
src/libsystemd/sd-daemon/sd-daemon.c
+33 -40
View File
@@ -450,13 +450,11 @@ static int vsock_bind_privileged_port(int fd) {
return r;
}
_public_ int sd_pid_notify_with_fds(
static int pid_notify_with_fds_internal(
pid_t pid,
int unset_environment,
const char *state,
const int *fds,
unsigned n_fds) {
SocketAddress address;
struct iovec iovec;
struct msghdr msghdr = {
@@ -470,15 +468,11 @@ _public_ int sd_pid_notify_with_fds(
bool send_ucred;
int r;
if (!state) {
r = -EINVAL;
goto finish;
}
if (!state)
return -EINVAL;
if (n_fds > 0 && !fds) {
r = -EINVAL;
goto finish;
}
if (n_fds > 0 && !fds)
return -EINVAL;
e = getenv("NOTIFY_SOCKET");
if (!e)
@@ -489,46 +483,38 @@ _public_ int sd_pid_notify_with_fds(
if (r == -EPROTO)
r = socket_address_parse_vsock(&address, e);
if (r < 0)
goto finish;
return r;
msghdr.msg_namelen = address.size;
/* If we didn't get an address (which is a normal pattern when specifying VSOCK tuples) error out,
* we always require a specific CID. */
if (address.sockaddr.vm.svm_family == AF_VSOCK && address.sockaddr.vm.svm_cid == VMADDR_CID_ANY) {
r = -EINVAL;
goto finish;
}
if (address.sockaddr.vm.svm_family == AF_VSOCK && address.sockaddr.vm.svm_cid == VMADDR_CID_ANY)
return -EINVAL;
/* At the time of writing QEMU does not yet support AF_VSOCK + SOCK_DGRAM and returns
* ENODEV. Fallback to SOCK_SEQPACKET in that case. */
fd = socket(address.sockaddr.sa.sa_family, SOCK_DGRAM|SOCK_CLOEXEC, 0);
if (fd < 0) {
if (!(ERRNO_IS_NOT_SUPPORTED(errno) || errno == ENODEV) || address.sockaddr.sa.sa_family != AF_VSOCK) {
r = -errno;
goto finish;
}
if (!(ERRNO_IS_NOT_SUPPORTED(errno) || errno == ENODEV) || address.sockaddr.sa.sa_family != AF_VSOCK)
return log_debug_errno(errno, "Failed to open datagram notify socket to '%s': %m", e);
fd = socket(address.sockaddr.sa.sa_family, SOCK_SEQPACKET|SOCK_CLOEXEC, 0);
if (fd < 0) {
r = -errno;
goto finish;
}
if (fd < 0)
return log_debug_errno(errno, "Failed to open sequential packet socket to '%s': %m", e);
r = vsock_bind_privileged_port(fd);
if (r < 0 && !ERRNO_IS_PRIVILEGE(r))
goto finish;
return log_debug_errno(r, "Failed to bind socket to privileged port: %m");
if (connect(fd, &address.sockaddr.sa, address.size) < 0) {
r = -errno;
goto finish;
}
if (connect(fd, &address.sockaddr.sa, address.size) < 0)
return log_debug_errno(errno, "Failed to connect socket to '%s': %m", e);
msghdr.msg_name = NULL;
msghdr.msg_namelen = 0;
} else if (address.sockaddr.sa.sa_family == AF_VSOCK) {
r = vsock_bind_privileged_port(fd);
if (r < 0 && !ERRNO_IS_PRIVILEGE(r))
goto finish;
return log_debug_errno(r, "Failed to bind socket to privileged port: %m");
}
(void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
@@ -575,10 +561,8 @@ _public_ int sd_pid_notify_with_fds(
}
/* First try with fake ucred data, as requested */
if (sendmsg(fd, &msghdr, MSG_NOSIGNAL) >= 0) {
r = 1;
goto finish;
}
if (sendmsg(fd, &msghdr, MSG_NOSIGNAL) >= 0)
return 1;
/* If that failed, try with our own ucred instead */
if (send_ucred) {
@@ -586,15 +570,24 @@ _public_ int sd_pid_notify_with_fds(
if (msghdr.msg_controllen == 0)
msghdr.msg_control = NULL;
if (sendmsg(fd, &msghdr, MSG_NOSIGNAL) >= 0) {
r = 1;
goto finish;
}
if (sendmsg(fd, &msghdr, MSG_NOSIGNAL) >= 0)
return 1;
}
r = -errno;
return log_debug_errno(errno, "Failed to send notify message to '%s': %m", e);
}
_public_ int sd_pid_notify_with_fds(
pid_t pid,
int unset_environment,
const char *state,
const int *fds,
unsigned n_fds) {
int r;
r = pid_notify_with_fds_internal(pid, state, fds, n_fds);
finish:
if (unset_environment)
assert_se(unsetenv("NOTIFY_SOCKET") == 0);
src/oom/test-oomd-util.c
+1 -1
View File
@@ -204,7 +204,7 @@ static void test_oomd_update_cgroup_contexts_between_hashmaps(void) {
}
static void test_oomd_system_context_acquire(void) {
_cleanup_(unlink_tempfilep) char path[] = "/oomdgetsysctxtestXXXXXX";
_cleanup_(unlink_tempfilep) char path[] = "/tmp/oomdgetsysctxtestXXXXXX";
_cleanup_close_ int fd = -EBADF;
OomdSystemContext ctx;