UKI/SignInitrdPCRs was added together with --sign-initrd-pcrs, but only
that command-line option is documented. Document the configuration key
and move the entry to the [UKI] section.
Fixes#43863.
(cherry picked from commit 4f8ca5032fd0633c6b5caff4868a375ac91b5b0f)
Since 7eb016d60b ("nsresourced: restore the BPF-LSM policy from the
registry on startup"), the programs are loaded in manager_setup_bpf()
but only attached later in manager_attach_bpf(). Before that, a failed
attach made the whole setup fail, and nsresourced proceeded with the
user namespace interfaces disabled. Now the same failure is fatal, and
nsresourced exits on kernels that can load BPF-LSM programs but not
attach them, such as arm64 before 7.2.
Handle a failed attach like a failed setup again: log it, drop the BPF
state, and continue with the user namespace interfaces disabled.
When a program fails to attach, the programs attached before it stay
attached, because userns_restrict_attach() has already pinned their
links. The programs keep enforcing the policy. Without the ring buffer
reader, nsresourced never reaps dead namespaces from the maps. Remove
the pins created by the failed attach, so that dropping the BPF state
detaches the programs.
test-userns-restrict fails on the same kernels, because it asserts that
the attach succeeds. Skip it instead.
Fixes: #43964
(cherry picked from commit 4446b9bb51c9900f22d7ba50379fa96dcbfb58f2)
It was added as experimental in v255: "this component is experimental and
its public interface is subject to change". This status was never changed
and the meson config still disables vmspawn by default in non-developer
builds. I think this makes sense to keep things this way and remove all
experimental markings at once with an official announcement once we're
sure about the interface.
(cherry picked from commit f2323da4da8c3311b855f505cdddc66400c501ee)
The text implied that the changes may happen randomly at any time.
Obviously, they can only happen after an update, but also we're unlikely
to do that not on a major release boundary. So town down that part of the
message. At the same time, it's important that the change might just
happen. For stable features, we also sometimes implement incompatible
changes, but this is preceded by announcements and lengthy deprecation
periods. So use the phrase "without advance notice".
OTOH, the text implicitly promised future stabilization. This might or
might not happen, so remind the users that it might not.
(cherry picked from commit 96cb6a5c74c8cd64334c48ddcca18e128e9a40ea)
The blurbs were added to be shared, but no sharing was actually
done.
Also, rename "singular"/"plural" to "option"/"options", so that we
can later have "component"/"components" and possibly other
variants.
The text were a bit different in various places, but I don't think
it was a useful distinction.
(cherry picked from commit 69dd30fddf2bbf358e05a632b0ef3383eb46b028)
The output section parser matches a valid prefix and ignores any remaining
characters. For example, '.cmdline:textjunk' is treated as text output,
and '.cmdline:text@' is accepted despite the missing output filename.
Require the complete specification to match the existing grammar, and
test malformed suffixes along with valid text and binary output.
(cherry picked from commit fbb4b64bdb326fac5c19122f88bd9d1feb0350e5)
Commit 905a89a219 raised the priority of
events triggered by the device monitor, so that the queue file would not
be removed while the netlink socket in the device monitor still had a
queued uevent.
However, that causes a problem: when udevd receives a flood of uevents,
sigchld and notification events from the workers are postponed. As a
result, the queued events may not be processed during the flood, and
udevd's memory consumption keeps increasing.
Let's lower the priority of these events again. To avoid removing the
queue file while a uevent is still pending on the netlink socket, check
whether the event source corresponding to the device monitor is pending.
Follow-up for 905a89a219.
Fixes#43865.
(cherry picked from commit bca7d4ab23e90ec8859fbaeadaa5e0ae9e51b398)
If compiling with -Db_pie=true, we should do PIE compilation (position
independent executables), even in the static mode.
The caveat is that people distributions actually override compilation
flags when doing their builds. They'll need to set the static flags
properly if they do such builds.
(cherry picked from commit 8b289a8c4d9e2f69a2c10d109c1c19f353005047)
null_or_empty_path_with_root() passes a path that already includes the root
to chase_and_stat() with CHASE_PREFIX_ROOT, so the root is added twice. It
also only recognizes /dev/null when the path itself is /dev/null. Below a
root, a symlink to an empty file therefore fails with ENOENT. A symlink to
/dev/null fails the same way when the image has no /dev/null. Resolve the
symlink inside the root without requiring the target to exist, and stat the
target through the O_PATH fd that chase() returns.
chase() accepts ret_fd together with CHASE_NONEXISTENT and sets the fd to
-EBADF when the target is missing. Its comment says that ret_fd cannot be
combined with CHASE_NONEXISTENT. Fix the comment.
(cherry picked from commit f2b0c29597466bdcc800dcfa8da4c8192fb9e824)
The invalid-boolean error contains a literal f-string prefix and
placeholder, hiding the value that failed to parse. Format the message
to include the rejected value.
(cherry picked from commit aeef38045e74dc585088a64c601166f989705d75)
... as some of the fields like `pcr_mask` field of `struct
tpm2_credential_header` that are passed to this function are 64-bit.
(cherry picked from commit de827820240d56a142aea7a2b012121a8869282d)
... in `attr_subst_subdir()`.
`strnpcpy_full()` returns space left in the buffer. Its return value
should be directly used instead of being subtracted from buffer size.
(cherry picked from commit d5b4357f8f1829608b3a5b641bb97e480a45a2c3)
... in `write_membership()` function.
Log the actual error message returned from `chase_and_open()`.
(cherry picked from commit 513e4b9947c619e2ecfe79c0e81d6461dc65480c)
The metric list is built with conf_files_list_strv(), but each metric's
value is then looked up again by walking report_files_dirs[] by hand,
and the two disagreed whenever an earlier directory had an entry that is
not a regular file:
- conf_files_list_strv() skipped such an entry and listed the one from
a later directory, so the metric was advertised by Describe();
- file_metric_generate() only moved on to the next directory on
-ENOENT, so it hit the non-regular entry, logged a warning and
produced nothing.
The practical case is masking a vendor-supplied entry with a symlink to
/dev/null: the metric kept being described, was never listed, and every
scrape logged "Failed to open ..., skipping: File descriptor in bad
state".
Honour masks in the enumeration via CONF_FILES_FILTER_MASKED_BY_SYMLINK,
as other conf dirs do, and make the lookup skip non-regular entries the
same way the enumeration does. Document the masking in the man page and
cover both cases in TEST-74-AUX-UTILS.report.
(cherry picked from commit 08be8677539642f45c6127085283cf08b6a410b7)
It doesn't make sense to taint a system if these fails don't exist.
A missing /usr/sbin for example doesn't indicate an unmerged-bin.
Indeed, if you have no /usr/sbin but only a /usr/bin you have a
perfectly merged bin.
(cherry picked from commit 419cf189d05e0903a233d13db444586cfb2aaf16)
vmspawn never used `aio=io_uring` for disks, even when QEMU supports it.
Commit 1a7b6fd9dd added a blockdev probe node named `__io_uring_probe`.
QEMU rejects that name ("Invalid node-name"), as node names have to
start with a letter. The probe then reported io_uring as unsupported.
Use a valid name, following the "vmspawn-" prefix of the other node names.
Check the multi-drive test's debug log for rejected node names to catch
this and similar issues in the future.
Signed-off-by: Martin Pitt <martin@amutable.com>
(cherry picked from commit 9c582182e1ae1e38b7ec2dca29bb279cae83e69b)
The lookup paths are root prefixed in this function, so we need to
pass in the root prefixed path as well to make sure path_is_generator()
does the right thing.
(cherry picked from commit fd6984e2d67fccf54ecf29a3d311e2486423cb98)
unit_file_preset() and unit_file_preset_all() zero-initialized their
install contexts, so their scope was always RUNTIME_SCOPE_SYSTEM. In
the global scope, specifiers in [Install] were then resolved as if for
the system: %U became 0 and a unit got enabled into
target-0.target.wants/. Set the scope the caller asked for, so that
this fails with -EUNATCH instead.
Covered by a new test that presets a unit using %U in the global
scope, with both functions.
(cherry picked from commit 0a4491ef3fce30d31a35c95031c8026a0235e0a2)
%u, %U, %g and %G have nothing to resolve to in the global scope, and
failed with -EINVAL. Install code already treats -EUNATCH as "cannot
resolve specifiers": it is listed in ERRNO_IS_NEG_UNIT_ISSUE() and
install_change_dump_error() turns it into a proper message. With
-EINVAL, "systemctl --global enable" of a unit using these specifiers
only reported "Invalid argument".
Return -EUNATCH instead, like the machine-id and os-release
specifiers already do when their source is missing. Only the install
code uses these specifiers in the global scope.
(cherry picked from commit 03ce9bcff23d07751dc6911c7963e3bde9e780c2)
The log line reported the file name of the masked dependency symlink, except
that entry is not assigned and is NULL at that point.
(cherry picked from commit 6e6114dd6cafb8d7c9585cf1d4ee58866db42d99)
The ordering matters at unit startup and when we refresh on updates.
For now, just add a test for the update refresh ordering.
(cherry picked from commit 3bebfc9d85144ffe375ae076a2ba5cf58ade4284)
The extension refresh on update did sysext first and then confext but
the units until the previous commit didn't have any ordering. Since it
makes sense to first merge configuration and then the service that might
be influenced by that configuration, this ordering was chosen for the
unit startup path.
Align the update refresh order with the unit startup order.
(cherry picked from commit 2d5e73a485f892059e12d95ef69964bd40d04457)
Up to now there was no clear ordering of confext and sysext units.
Normally, configuration should be able to influence the behavior of
services (config files or unit drop-ins), so it makes sense to order
confext before sysext. The mounting from the initrd for the final system
makes this less important together with the fact that live merges/
refreshes can encode unit restarts now. Yet I think it's better to know
what gets merged first and if wanted one can avoid encoding restarts if
one doesn't care about later live content changes. Where it matters more
for me is consistent behavior for the refresh check during boot for
non-verity images because they get compared by file handle and mount ID
which means whether the overlay was set up or not determines the
identity and decides if we do a refresh or not and this should not
vary by boot merely due to timing or other dependencies impacting the
ordering. (Note that one extension type shipping another extension type
is not the reason for the ordering and these cycles should be avoided
because they never free the mounts and backing loop devices.)
(cherry picked from commit 7197b862b2a132ea044fed59d914d5eb3e8ae9dd)
The hash tables are only ever set up in newly created journal files, in
space that was just allocated via posix_fallocate() and hence reads as
zeroes anyway, so zeroing the items explicitly is unnecessary.
It is also harmful: the sequential write faults of the memzero() make the
kernel's mmap readahead instantiate the table in ever larger folios, up to
the size of the readahead window, on file systems that support large folios
in the page cache (e.g. XFS, and ext4 since kernel 6.16). And since write
faults on shared file mappings dirty the whole folio, each later update of
a single 16 byte hash bucket then has the whole folio written back. Without
the explicit zeroing, the table's pages are only faulted in when buckets
are first accessed, in random order, and hence mostly as order-0 folios.
Measured on Linux 6.18 with a new journal file (SystemMaxFileSize=50M),
appending 15 syslog-like entries with 23 fields each per second for 120s,
while writing back the file's dirty pages every second, as happens on
machines under page cache pressure, where reclaim keeps waking up the
flusher threads. Bytes written to the (loop) device, median and range of
4-5 runs:
before after
ext4 182.8M (178.4M-185.7M) 41.2M (31.6M-41.9M)
xfs 172.7M (161.0M-182.4M) 40.1M (39.7M-44.9M)
This also avoids writing out the whole data hash table once for every new
journal file, i.e. ~2.8% of the maximum file size.
Related: #40262
(cherry picked from commit 6db7cf38d40e8fe6a11392d2f0cc044ed5acf812)
Before this change it took some effort to find out why NvPCR related
functions would fail. Specifically, missing NvPCR defintions would let
the `systemd-pcrlogin@` services fail with the following log message:
```
Could not extend NvPCR: No such file or directory
```
There are two annoyances with this: even with log level debug there was
no indication of what is missing, and then there is (at least) one other
reason for the same error to be logged, which is the absence of the PCR
pubkey. The latter can be discovered by setting log level debug for the
affected service.
(cherry picked from commit b43fed88efe34889a49a7710a92141849dc4906d)
cgroupfs has a single shared global superblock but
programs running in managed user namespaces still
need to be able to write it to make cgroup delegation
work. d381a0d9d5 broke
this by insisting the user namespace owns the
superblock. Let's fix this by excluding cgroupfs from
this check.
(cherry picked from commit 889bc48f101a7cbb56cb4be202e85e1f6d933151)
The para for libcryptsetup duplicated the text three paras down.
The news for 259 used the phrase "$library support is now implemented via
dlopen()", which is a copy-pasta from an earlier paragraph which talked
about "Linux audit support" and "PAM support". We support PAM, but we
don't "support" libpam, we use it.
(cherry picked from commit 2b24baf2070d01ea8d48651c5052b82dc4c9ece0)
libgcrypt is used only by test-fsprg. We do not add dlopen notes for
unit tests, so the library may not be installed on the system. If systemd
is built with HAVE_GCRYPT but libgcrypt is not installed, the test fails.
There is no need to install libgcrypt solely for test-dlopen-so, so drop
the test case.
(cherry picked from commit 764b9a724925c4167e91fd36311e38aee8c6871a)
The limit is checked before the new connection is added to the set, so
with --connections-max=N and N connections open "set_size() > N" is
false and an additional connection is admitted. Use ">=" to refuse new
connections once the limit is reached.
(cherry picked from commit 9b51efd69fade39b0315251d02d1c9eab929891c)
Each proxied connection uses eight file descriptors: the accepted and the
outgoing socket, a duplicate of each, and a pipe for each direction. With
the default soft RLIMIT_NOFILE of 1024, setting up forwarding fails with
"Too many open files" at about 127 concurrent connections, well before
the default --connections-max=256, and the connection is closed right
after being accepted.
socket-proxyd's I/O is sd-event based and handles fds above 1023, so it
does not need the select()-compatible soft limit. Call
rlimit_nofile_bump(-1) at startup to raise RLIMIT_NOFILE as far as
permitted, like udevd does.
(cherry picked from commit 98752540be47778e253cbafe51c7ccdd30f4995e)
I stumbled over this with the very first image I tried:
> sudo systemd-pull oci --system quay.io/toolbx/arch-toolbox:latest
That failed with a label "user.overlay.origin" with a value of NULL and size 0.
This one-line change allows value == NULL if size == 0 when setting xattrs.
(cherry picked from commit 885fe07ee37cff7316680b5088d11081e01813b1)
When using `systemd.image_filter=usr=250` a `/usr` was selected based on
its label but the corresponding verity partitions were *not* selected
based on their (potential labels).
This leads to mismatched verity partitions and `dm-verity` failure when
using `image_filter` without also explicitly passing matching
`usr-verity` and `usr-verity-sig`.
Signed-off-by: Simon de Vlieger <cmdr@supakeen.com>
(cherry picked from commit b5326670faac3064bcfa01ae3c1d57565d387bfb)
The integration tests are started with the absolute path of the test
unit as $0, so run_subtests() derives absolute paths for the subtests
and the summary prints them in full. Show just the script name, the
directory is the same for every entry and only adds noise.
Signed-off-by: Paul Meyer <katexochen0@gmail.com>
(cherry picked from commit 0d1ae05a7f)
terminal_fix_size() queries the terminal for its dimensions with CSI 18
and DSR. On a virtual console that is pointless: the kernel renders the
screen itself, so TIOCGWINSZ is already authoritative.
It is also slow. PID 1 queries /dev/console from console_setup(), and
writes there go through redirected_tty_write(), so while plymouth holds a
TIOCCONS redirect the query never reaches the VT and no reply is ever
generated. Each query then waits out CONSOLE_ANSI_SEQUENCE_TIMEOUT_USEC.
Previously the write failed immediately with EAGAIN — the kernel forces
O_NONBLOCK on /dev/console — so the query was abandoned at no cost; since
ba10d789a8 it is retried until the timeout instead. On a Steam Deck
booting with console=tty1 and plymouth the two queries cost 667ms, about a
quarter of userspace boot time, and no log level shows it because main()
runs console_setup() between log_close() and log_open().
So skip the query on a virtual console and keep the dimensions the kernel
gave us, reporting success rather than an error: declining to ask is not a
failure, and the "dimensions already match" path below returns 0 for the
same reason.
Note this also skips the query on a /dev/ttyN that would have answered,
and does not help a serial console behind a TIOCCONS redirect.
Fixes: ba10d789a8
Fixes: d91a184509
(cherry picked from commit 4ca7ac0275)
The existing limit for the reports was a global METRICS_MAX cap.
However on systems with a verbose socket or with many sockets
that is easily hit and because sockets are contacted in parallel
random parts of the following report generators are skipped.
It seems better to instead make the limit per-source so that one
that is overly verbose cannot starve the others. Because we already
have METRICS_LINKS_MAX this does not add a global limit - we could add
one but it would have the same problem as METRICS_MAX before, some
report would be cut that might be important (or we need to be explicit
about ordering but even then its problematic if we have two
"important" ones and one is buggy and generates too much data).
Note that this keeps the METRICS_PER_SOURCE_MAX at 4096 because
io.systemd.Manager reports a lot, on my idle test VM already
~3k.
We also now report any issue with the metric instead of just the
first one in verb_metrics.
(cherry picked from commit 1cf66d1c67)
This renames BLOCKDEV_LIST_IGNORE_ZRAM to BLOCKDEV_LIST_IGNORE_RAMDISK,
and make it ignores both /dev/ramX and /dev/zramX.
Note, linux-stable by Alpine/postmarketOS has CONFIG_BLK_DEV_RAM=y,
hence the kernel creates /dev/ramX by default. Without this change,
the test case added by 236e7d8a4c fails,
as io.systemd.Repart.ListCandidateDevices varlink method lists the
ramdisks.
(cherry picked from commit 77c51f4e97)
An AF_UNIX stream receive can combine a message without file descriptors
with a following SCM_RIGHTS-bearing message. This associates the received
descriptors with the earlier message even when the sender uses separate
sendmsg() calls.
Use the existing boundary-limited read path whenever FD input is enabled
on stream sockets, not only for protocol upgrades. Include the buffered
delimiter suffix in the peek search so a split CRLF delimiter cannot
over-read into the next message either.
Record the input socket type when attaching the descriptors so the new
FD-triggered limit does not truncate packet sockets. Explicit bounded
reads retain their existing semantics.
Add regressions for a oneway request followed by an FD-bearing request,
a continued reply followed by an FD-bearing terminal reply, a split CRLF
delimiter followed by an FD-bearing message, and batched messages on
SOCK_SEQPACKET and SOCK_DGRAM.
Fixes#43823
(cherry picked from commit 3fe57d03a3)
Previously in CI:
../src/test/fsprg.c:18:1: error: included header gcrypt-util.h is not used directly [misc-include-cleaner,-warnings-as-errors]
18 | #include "gcrypt-util.h"
| ^~~~~~~~~~~~~~~~~~~~~~~~
19 | #include "memory-util.h"
../src/test/fsprg.c:19:1: error: included header memory-util.h is not used directly [misc-include-cleaner,-warnings-as-errors]
19 | #include "memory-util.h"
| ^~~~~~~~~~~~~~~~~~~~~~~~
20 |
2 warnings treated as errors
(cherry picked from commit 1f286f971e)
Jonghyun An
Daan De Meyer
Daan De Meyer
Zbigniew Jędrzejewski-Szmek
Yu Watanabe
cksrb63
Siteshwar Vashisht
Armaan Sandhu
flixman
nikstur
Martin Pitt
Kai Lüke
WilliButz
iacopo
SecretLUL
Kamil Monicz
Tobias Hunger
Simon de Vlieger
Fredrik Hugosson
Paul Meyer
Robert Beckett
Michael Vogt
Totoro