The confext concept is an extension of the existing sysext concept and
allows to extend the host's filesystem or a unit's filesystem with signed
images that add new files to the /etc/ directory using OverlayFS.
The release file that accompanies the confext images needs to be
host compatible to be able to be merged into the host /etc/ directory.
This commit checks for version compatibility between the image file and
the host file.
Adds a new image type called IMAGE_CONFEXT which is similar to IMAGE_SYSEXT but works
for the /etc/ directory instead of /usr/ and /opt/. This commit also adds the ability to
parse the release file that is present with the confext image in /etc/confext-release.d/
directory.
If we don't find a single useful partition table, refusing dissection.
(Except in systemd-dissect, when we are supposed to show DDI
information, in that case allow this to run and show general DDI
information, i.e. size, UUID and name at least)
This allows unprivileged validation of DDIs. Only superficial structure,
i.e. not mounting or so. This becomes particularly handy in the
integration tests, and to validate image policies.
This is to dissect_image_file() what dissect_loop_device_and_warn() is
to dissect_loop_device(), i.e. it dissects the image file and logs an
error string if that fails instead of just returning an error.
- Remove useless serial console configs
- Add CONFIG_SERIAL_8250_PCI so that qemu's virtconsole works properly
- Add CONFIG_DMI and CONFIG_DMI_SYSFS so that SMBIOS credentials work
- Add CONFIG_IKCONFIG and CONFIG_IKCONFIG_PROC so we can read the
current kernel config from /proc/config.gz
- Add CONFIG_IOSCHED_BFQ to get rid of a udev error on boot on Fedora
- Add CONFIG_HW_RANDOM_VIRTIO to get hw rng in qemu
- Add CONFIG_SECURITY_YAMA to get rid of warning from sysctl on boot
- Add CONFIG_VSOCKETS and CONFIG_VIRTIO_VSOCKETS to enable vsock support
This reverts commit be266f49d6b7e3f021e2a07f937d39d1f14a283d.
Turns out we installed this because it's required by the bpf selftests
so let's keep it intact.
We have some missing coverage in the CI, all builds enable these features,
but there are often changes and they cover a lot of code. Do one build
without them to ensure we don't break builds.
Fixes:
- Comment style
- Alignment style
- cleanup macro usage
- incorrect error message[1]
1. Thanks to tempusfugit991@gmail.com for pointing out the error
message mistake.
Signed-off-by: William Roberts <william.c.roberts@intel.com>
None of the existing test files fit very well. test-unit-serialize is
pretty close, but it does special cgroup setup, which we don't need in
this case. I hope we can add more tests in the future for this basic
functionality, so I'm adding a brand new file names after the source file
it's testing.
Move the tests that link to libcore into a separate subgroup.
They are special and it makes sense to keep them together. While
at it, make the list alphabetical.
Also, merge the list additions into one. No idea why it was like that.
If a root directory is specified, and e.g. /var under the root directory
is a symlink to the host's /var, then we wrongly read host's machine ID,
even if O_NOFOLLOW is set.
Let's chase the path with CHASE_NOFOLLOW to refuse such case.
Also, refuse null ID, otherwise we may setup machine ID with NULL.
Previously, when the NULL (all zero) machine ID is configured in the
container, nspawn refused to execute.
Now id128_get_machine() is used, so NULL machine ID is refused with
-ENOMEDIUM, and fallback to specified UUID or randomly generated one.
maanyagoenka
Luca Boccassi
Franck Bui
Lennart Poettering
Yu Watanabe
Daan De Meyer
Ronan Pigott
Zbigniew Jędrzejewski-Szmek
William Roberts
Thomas Blume