A description of SD_BUS_VTABLE_CAPABILITY is added, and the discussion
on SD_BUS_VTABLE_UNPRIVILEGED in expanded. I think it would be nice
to add longer description of how access is checked (maybe in sd-bus(3)),
but I'm leaving that for later. I think the text that was added here
describes everything, even if tersely.
Fixes#21882.
The data type off_t can be 64 on 32 bit systems if they have large
file support. Since mmap expects a size_t with 32 bits as second
argument truncation could occur. At worst these huge files could
lead to mmaps smaller than the previous check for small files.
This in turn shouldn't have a lot of impact because mmap allocates
at page size boundaries. This also made the PAGE_ALIGN call in
open_mmap unneeded. In fact it was neither in sync with other mmap
calls nor with its own munmap counterpart in error path.
If such large files are encountered, which is very unlikely in these
code paths, treat them with the same error as if they are too small.
The approach to use '''…'''.split() instead of a list of strings was initially
used when converting from automake because it allowed identical blocks of lines
to be used for both, making the conversion easier.
But over the years we have been using normal lists more and more, especially
when there were just a few filenames listed. This converts the rest.
No functional change.
Quite often we compare uuids/id128 formatted as strings with specific
values. So far we usually used streq() for that. let's add a new
explicit helper for this in id128_equal_string() that compares a string
with an sd_id128_t and is more robust than a simple string comparison.
Moreover, we can mroe easily reuse the various defines we have for
specific UUIDs, for example those from gpt.h.
We expose various other forms of UUID helpers already, i.e.
SD_ID128_UUID_FORMAT_STR and SD_ID128_MAKE_UUID_STR(), and we parse
UUIDs, hence add a high-level helper for formatting UUIDs too.
This doesn't add any new code, it just moves some helpers
id128-util.[ch] → sd-id128.[ch], to make them public.
device nodes with 0 dev_t are not real (and for that reason such inodes
are used as whiteouts in overlayfs, for example), hence refuse them
early. It seems wrong going to sysfs for something we know can't exist
anyway.
If we're going upwards in the journal file during entry iteration and we
can't reach the current entry due to corruption, start iterating upwards
from the last reachable entry array. This is equivalent to skipping
all entries in the array that can't be reached anymore.
Fixes#22431
8d801e35cb didn't take into account
upwards iteration of entry items when we're working on a corrupted
journal file. Instead of moving to the previous entry array, we'd
always move to the next array, regardless of the iteration direction.
To fix this, we introduce bump_entry_array() that moves to the next
or previous entry array depending on the given direction. Since the
entry array chains are singly linked lists, we have to start iterating
from the front to find the previous array. We only reach this logic
if we're working on a corrupted journal file so being slow here shouldn't
matter too much.
This partially undoes the effect of
ab6e257b3e.
Originally, we always used the mmap logic to determine the current end
of the file. ab6e257b3e changed this so
that we always used pread().
With this change we'll use pread() from the synchronization thread and
mmap otherwise.
This fixes a bunch of issues:
pread() returns ssize_t, and returns errors in 'errno', handle that
correctly.
More importantly: it might incompletely read data in case we hit
EOF. Check for that, and handle it.
Finally, rename the function to journal_file_read_object_header(), since
it really doesn't read full objects, but only their headers.
Follow-up for: 117e21121e
These checks don't achieve anything of value. Assuming they were added to
check for corruption, they don't actually achieve this goal since other parts
of the data object can still get corrupted and we wouldn't notice unless we'd
recalculate the hash every time.
In theory, we could use the entry item hash to avoid a random access lookup
for the data object hash in the journal file in the future to speed up searching,
but for finding all entry objects containing a specific data objects, we already
have entry arrays per data object to get fast access to this information.
This means that duplicating the hashes in the entry item doesn't result in any
added value. In this commit, we remove the checks so that in future commits we
can remove the hashes from the journal file format in the new compact mode.
Previously, for each entry in a data object's entry array, we'd check
if one of that entry's entry items referred to the data object.
Instead, when verifying the main entry array, let's check if for each
entry item found by iterating the main entry array, the corresponding
data object's entry array refers to that entry.
This enables us to re-use more code from journal-file and turns out to
be roughly 10s faster when verifying my 4G laptop journal.
When verifying data objects, we still check if every entry in the data
object's entry array also exists in the main entry array so that we ensure
we're not missing any entries when iterating the main entry array.
Let's always try to link all entry items even if linking one fails
due to not being able to allocate a new entry array. Other entry
items might still be successfully linked if the entry array of the
corresponding data object isn't full yet.
Let's make sure we only move to objects when it's required. If "ret"
is NULL, the caller isn't interested in the actual object and the
function being called shouldn't move to it unless it has to
inspect/modify the object itself.
This reduces the number of calls to journal_file_move_to_object() which are heavy.
All call sites have easy access to the data object so this change doesn't end up
complicating things.
We currently use both offsetof(Object, ...) and offsetof(DataObject, ...).
This makes it harder to grep for usages as we have to make sure we grep for
both usages. Let's unify these all to use offsetof(Object, ...) to make it
easier to grep for usages.
With LTO, the compiler might think that the variable is uninitialized
(from NetworkManager's fork, with gcc-11.2.1-1.fc35):
src/libnm-systemd-core/src/libsystemd/sd-event/sd-event.c: In function 'sd_event_add_inotify':
src/libnm-systemd-core/src/libsystemd/sd-event/sd-event.c:2120: error: 's' may be used uninitialized in this function [-Werror=maybe-uninitialized]
2120 | *ret = s;
|
src/libnm-systemd-core/src/libsystemd/sd-event/sd-event.c:2102: note: 's' was declared here
2102 | sd_event_source *s;
|
lto1: all warnings being treated as errors
In particular, that would happen for codepaths where event_add_inotify_fd_internal()
returns `-errno`, and the compiler cannot be sure that the returned value will
be negative. Technically, the compiler is right, but we rely on libc functions
to set errno correctly, so this only happens in code paths, where something
bad already happend.
While LTO is prone to such false warnings, we are largely able to build systemd
without warnings. So it is feasible and we should make the effort of working
around warnings as they appear.
Zbigniew Jędrzejewski-Szmek
Tobias Stoeckmann
Yu Watanabe
Lennart Poettering
Luca Boccassi
Daan De Meyer
Thomas Haller
Jan Janssen