loop_write() writes one buffer at the file position. To write at an
offset, callers call pwrite() or pwritev() directly and handle short
writes themselves.
Add pwritev_full(), which writes all iovecs at an offset, retries on
EINTR and short writes, splits batches larger than IOV_MAX, and reports
the number of bytes written, also on failure. Add pwrite_full(), which
does the same for one buffer.
(cherry picked from commit 4d36be491a568180dc6336b91b0c496bb8cb6601)
journal_file_set_offline() sets OFFLINE_SYNCING before it starts the
offline thread. If the first pthread_sigmask() fails, it returns without
starting the thread and leaves the state at OFFLINE_SYNCING. The next
journal_file_set_offline_thread_join() then calls pthread_join() on a
thread that was never created.
Set OFFLINE_JOINED, as the error path of pthread_create() does.
(cherry picked from commit db2b225a30da26d0939f1f6d6c4b524bd2240900)
config_find_entry() matches the case folded patterns from loader.conf and
the LoaderEntry* EFI variables against entry IDs with the case sensitive
efi_fnmatch(), relying on the IDs being lower case already. Type #1
entries fold their ID after the boot counter has been parsed, but Type #2
entries only did so when the file name carried no boot counter, because
boot_entry_parse_tries() rebuilds the ID from the original file name. The
ID of a secondary UKI profile was not folded either, as the profile ID
from the .profile section is appended verbatim.
Hence a UKI like EFI/Linux/Foo+3.efi, or a profile with ID=Profile1,
could never be selected via default, preferred, @saved, bootctl
set-default or systemctl reboot --boot-loader-entry=, while bootctl
(which matches case insensitively) claimed that it was the default.
Fold the ID unconditionally, like Type #1 entries do, and fold the
profile suffix as well. The file names used for renaming the boot
counter keep their case.
Follow-up for 4301ad00ef and
941b91600c.
(cherry picked from commit 1402519771a45745de3f6b7e93d08d7c96d3d65b)
With --size=auto, repart unloads and reloads the partition table after
context_acquire_partition_uuids_and_labels() ran. The reload recreates the
foreign partitions (those without a definition) with a null new UUID and
no new label, so context_mangle_partitions() sees them as changed and hits
assert(!PARTITION_IS_FOREIGN(p)) when adding a partition to an existing
image:
Initializing UUID of existing partition 0.
Setting partition label of existing partition 0.
Assertion '!PARTITION_IS_FOREIGN(p)' failed.
Set the new UUID and label of a foreign partition when it is loaded, so a
reload keeps them.
(cherry picked from commit 4fc4f6bac772ff3749ba7e0bbcd607175694420c)
nss_pack_group_record() left gr_passwd pointing at PASSWORD_SEE_SHADOW,
which is part of the module's read-only .rodata. That breaks callers that
modify the returned group before freeing it, in particular
pam_modutil_cleanup_group(), which zeroes gr_passwd when the PAM handle
is torn down and then segfaults on read-only memory.
Copy the placeholder into the caller-provided buffer, as
nss_pack_user_record() already does.
(cherry picked from commit c7a8e871de3427cf654d9a608dc58663874197bb)
verb_sign() logs argv[0], which is the verb, as the name of the file it
could not hash. Log argv[1], the input file.
(cherry picked from commit 9030bbfc90c646b7c07bbe8d70cfe7ba40b5a25a)
uki_read_pretty_name() only handles a missing .osrel section. Any other
error, for example an .osrel section larger than PE_SECTION_READ_MAX,
passes a NULL buffer to parse_env_data(), and "bootctl kernel-inspect"
aborts:
Assertion 'data' failed at src/basic/env-file.c:429
Return the error instead.
(cherry picked from commit 37717744394b433eb452674f060a4288a8f469bf)
pe_read_section_data() reads VirtualSize bytes starting at
PointerToRawData. When VirtualSize is larger than SizeOfRawData, because
the section ends with zero-initialized data, it returns the start of the
next section, or fails with EBADMSG at the end of the file. Read
MIN(VirtualSize, SizeOfRawData) bytes, like systemd-stub and uki_hash()
do.
(cherry picked from commit f219e7e790ec7b1064b71173ad697f48a5d71830)
Most callers load the PE headers and the section table together, and
only keep the DOS header to pass it to pe_load_sections(). Add a helper
that does both, and use it instead of the private copy in bootspec.c.
(cherry picked from commit 5902fb429f52d75e7b25e6dea4be113e769b2ff8)
ret_parameters (and ret_error_id) returned by sd_varlink_call()/
sd_varlink_callbo() are borrowed from the connection, as documented in
sd-varlink.h, and must not be unreffed by the caller. process_hostname()
declared its reply as _cleanup_(sd_json_variant_unrefp), freeing memory
owned by the Varlink connection and leading to a use-after-free/
double-free (the same bug class and ownership mistake just fixed for
pcrextend_pcr_now()/pcrextend_nvpcr_now() in 76a6dc6d).
(cherry picked from commit c556722826c4892939d2a6239ab00d0a343530a8)
The arg_verb was copying the pointer to the shutdown verb, but that
pointer was being overwritten. When the shutdown scripts run, the forked
child calls rename_process() which overwrites argv, so the scripts got
an empty $1 instead of reboot, poweroff, etc.
Make a copy of the verb with strdup() so it is not affected.
Fixes: #44087
Follow-up for: 4927588993
(cherry picked from commit e6b62f2b3a564fcfb282dc4729eb9a5565e87ba9)
This is strictly speaking an API break, but given this is output only
and the component so new, I think we should just fix this anyway.
Fix: #44088
(cherry picked from commit fd309374687070ea1ef957d35dffe1e43b4a9c73)
Otherwise, if sd_event_add_inotify() is called with NULL for ret,
the event source is disabled and never triggered.
Fixes a bug introduced by e67d738a87.
(cherry picked from commit 0582f7cba907eba6d55b686028d145061c38d0b7)
manager_get_dns_server() may re-read /etc/resolv.conf and replace
m->dns_servers and m->search_domains, but it was passed as an argument
to dns_configuration_json_append() together with those lists, and the
order of evaluation of the arguments is unspecified. gcc with LTO reads
the list heads first, so after a foreign /etc/resolv.conf has changed
the freed lists are walked. Typically the serialization then fails with
EUCLEAN, which makes the SubscribeDNSConfiguration method of
io.systemd.Resolve.Monitor and in turn systemd-networkd-wait-online
--dns fail.
Call manager_get_dns_server() first and store the result in a local
variable.
(cherry picked from commit 04567a3b5e2e29a2252e89be8a3c625c692103d3)
Tests exist to test stuff, hence we should not use plain assert(), but
the ASSERT_XYZ() macros, which are never compiled out and print useful
information on failure.
(cherry picked from commit 13bf80491bcf8ffee2b43cf86b16e3d1394300ef)
gcc 13 on armhf complains with -Wmaybe-uninitialized about family, port
and server_name in bus_message_read_dns_array(), even though they are
always set when bus_message_read_dns_one() returns > 0.
(cherry picked from commit da4052d0037c6bb4981387bb375355f595ab4b1c)
With assert() the comparison is compiled out in NDEBUG builds, leaving
twilio_reply_string unused, which breaks the build with -Werror.
(cherry picked from commit e1577aaed620793fdec39ded861b873e17627f46)
On CI (Azure runners) the accelerated networking PCI VF behind the
Hyper-V vmbus PCI bridge may be hot-unplugged while the test runs,
causing sd_device_new_from_syspath() to fail with ENODEV for a device we
just enumerated:
test_sd_device_one(/sys/devices/LNXSYSTM:00/.../pci7870:00/7870:00:00.0)
Assertion failed: Expected "sd_device_new_from_syspath(&dev, syspath)"
to succeed, but got error: -19/ENODEV
Skip devices whose syspath vanished since enumeration rather than
failing.
(cherry picked from commit b43136ffcdbd62b5d11c226df9dd33372cff7823)
These checks stem from a rework from strv to a proper varlink object,
but the whole rework's point was to allow more expressive field types,
hence drop the unnecessary verification of the string type.
(cherry picked from commit fc38a61894bcc772b2bc8d56be9700335cdba181)
The commit bca7d4ab23e90ec8859fbaeadaa5e0ae9e51b398 kept the priority of
the post event source at the default (NORMAL), which is lower than the
device monitor (EVENT_PRIORITY_DEVICE_MONITOR, NORMAL-1). Since a pending
device monitor is always dispatched first, on_post() only runs when the
monitor is not pending, hence the sd_event_source_get_pending() check
added in the previous commit could never be true. Moreover, during a
uevent flood on_post() is starved, and as it is the only caller of
event_queue_start(), idle workers no longer get events assigned.
Let's give the post event source a priority above the device monitor, but
below the worker event sources so that worker completions are observed
before the queue is started.
Also, similar to checking whether the device monitor event source is pending,
when synthesizing change uevents, new uevents may come soon. Do not remove
the queue file and do not kill idle workers in that case.
Follow-up for bca7d4ab23e90ec8859fbaeadaa5e0ae9e51b398.
Fixes#43865.
(cherry picked from commit a0d25767050d76cfbc1f32dcdde3a0c3da5a7423)
The Process lines in systemctl status join argv with spaces, making
multi-word arguments ambiguous and empty arguments invisible.
Use quote_command_line() with SHELL_ESCAPE_EMPTY to retain argument
boundaries. Leave the formatted string NULL for an empty argv vector so
that strna() prints n/a. Cover whitespace, empty arguments and literal
dollar signs in TEST-26-SYSTEMCTL.
Fixes#43938.
(cherry picked from commit a83a0d2fc461091b16a699aeba07a82d71545c71)
Since 748a548e1b ("resolved: set cache-flush bit on mDNS responses"),
every RR of an mDNS zone, except DNS-SD service enumeration PTRs,
carries DNS_ANSWER_CACHE_FLUSH, and dns_packet_append_key() turns it
into the cache-flush bit regardless of the protocol of the packet.
When a lookup via the DNS stub is answered from our own mDNS zone, e.g.
the reverse lookup of one of our link-local addresses, the RR is sent
with class 0x8001. In unicast DNS bit 15 is part of the class value, so
clients see CLASS32769 instead of IN:
$ dig +nocmd +nocookie -x fe80::d1f:2970:a730:5ab8 @127.0.0.53
;; Warning: Message parser reports malformed message packet.
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30061
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;8.b.a.5.0.3.7.a.0.7.9.2.f.1.d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa. IN PTR
;; ANSWER SECTION:
8.b.a.5.0.3.7.a.0.7.9.2.f.1.d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa. 120 CLASS32769 PTR lady-voodoo.local.
;; Query time: 1 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Wed Sep 02 21:40:55 IST 2026
;; MSG SIZE rcvd: 132
The cache-flush bit is defined for mDNS only, hence only set it on mDNS
packets.
See: https://github.com/systemd/systemd/pull/43627
(cherry picked from commit 21159c052bbf28983115d842dbc2597869177d42)
dns_packet_append_key() ORs MDNS_RR_CACHE_FLUSH_OR_QU into the CLASS
field of any RR whose answer item carries DNS_ANSWER_CACHE_FLUSH,
regardless of the packet the RR is appended to.
Since 748a548e1b ("resolved: set cache-flush bit on mDNS responses"),
every RR of an mDNS zone, except DNS-SD service enumeration PTRs,
carries that flag. The Authority Section of mDNS probes (RFC 6762,
section 8.2) is filled from our mDNS zone via dns_zone_lookup(), which
applies the flag to items still in probing state too, hence probes are
sent with class 0x8001 in their Authority Section.
RFC 6762, section 10.2, scopes the cache-flush bit to announcements and
responses. Peers ignore it for probe tiebreaking, so this is not an
interoperability issue, but there is no reason to set it there.
Only set the bit when the packet is a response. mDNS responses,
announcements and goodbye packets are all built by
dns_scope_make_reply_packet(), which sets QR before appending any RR, so
they keep the bit. The Known-Answer list of queries is unaffected, as it
is appended without flags already.
See: https://github.com/systemd/systemd/pull/43627
(cherry picked from commit 1c57b40fc1451b1f518e6168dbd28bf1e5fa2b4d)
The current implementation
FWHEADERMAGIC = 'feeddead'
magic = bytes.fromhex(FWHEADERMAGIC)
struct.pack('<p', magic)
returns a single null byte b'\x00', which is not equal to 0xfeeddead in any
endianness.
(cherry picked from commit fe689d2d7946593001bb3d0e32d51d694af5d50d)
Messages on the private bus have no sender. As it is now, when a job is
canceled through it, as "systemctl cancel" does when run as root, we
pass a NULL name to sd_bus_track_contains(), which fails an
assert_return(). In developer builds, that makes PID 1 abort. Otherwise
it's only logged at debug level, and we consult polkit, as we should.
Let's only check whether the sender owns the job for messages on the API
bus. That's the only bus bus_job_track_sender() tracks senders on, so
jobs enqueued through the private bus aren't tracked anyway.
(cherry picked from commit bfeac4c30e1a818cda14c8d1b347d500a9dfe4e3)
cgroup_context_apply() attaches the BPF programs again whenever the
cgroup is realised again, for example, if someone does set-property or
daemon-relaod.
As it is now, their installers overwrite the links of the previous
installation without freeing them, so the previous programs stay
attached until the cgroup is removed, and keep enforcing whatever
settings they were loaded with.
For example, a unit with SocketBindDeny=any that is allowed to bind to a
port with "systemctl set-property foo.service SocketBindAllow=tcp:1234"
still cannot do so once its cgroup is realised again, as the previous
program keeps denying it. Whoops!
To fix this let's free the previous links once the new ones are
attached.
(cherry picked from commit 2f11fb19b7292339632e9b396fcab12729cde1ff)
Splitting on either a comma or whitespace produces empty items when
whitespace is adjacent to a comma. This rejects valid phase lists and leaves
empty entries in PCR bank lists.
Consume whitespace around commas and accept a single trailing comma in
both lists. Reject leading commas, empty entries between commas and
repeated trailing commas. Treat an empty PCR bank list as no banks.
Update the existing configuration test to cover whitespace around commas
and a trailing comma in both settings.
(cherry picked from commit 44cf775de15c1853c28fd2610f49014855ba09ec)
For consistency with ssh-issue output, do not log about the CID if it is
not a usable destination.
(cherry picked from commit 0d59bcb6944d1f34e8eca9208af198f5357e8535)
Even if the vsock driver allows using this as a wildcard to listen over
vsock, it still cannot be used as a destination CID from the host (and
is rejected by systemd-ssh-proxy). Show a more generic message in this
case instead.
Use VSOCK_CID_IS_REGULAR() to exclude other similar cases too.
Follow-up for 85afe8e82d.
Fixes: https://github.com/systemd/systemd/issues/43364
(cherry picked from commit affcccd4d07180b82d918c0c5f0601d1dec80946)
Since f90efd2d13 the result of the
access() check for loader/random-seed is stored in 'r', which is what
verb_status() returns. A missing seed file then makes 'bootctl status'
exit with 1 without logging anything, even though it's only reported as
"Exists: no". Use 'k' for the check, like the other informational
probes in this function.
(cherry picked from commit 05808e11b9399e6c2149f1f524b3282545ba7569)
With an empty profile we get:
$ portablectl attach -p "" foo
Unit profile name not valid:
It's not clear what is the profile. Let's quote it so it's clear also
for empty profile names.
(cherry picked from commit 6c8b21d30db4f4d5a0cdce9f2dc6a99b9b47e7c7)
Before this commit, if you attach a portable service using a profile
that doesn't exist, it just doesn't add the profile dropin and no
warning nor anything is shown:
$ portablectl attach -p nonexistent xxx
(Matching unit files with prefix 'xxx'.)
Created directory /etc/systemd/system.attached.
Created directory /etc/systemd/system.attached/xxx-capsule.service.d.
Written /etc/systemd/system.attached/xxx-capsule.service.d/20-portable.conf.
Copied /etc/systemd/system.attached/xxx-capsule.service.
Created symlink /etc/portables/xxx.raw → /var/lib/portables/xxx.raw.
$ ls /etc/systemd/system.attached/xxx-capsule.service.d/
20-portable.conf
The 10-profile.conf is not added.
If no profile is attached, the /run bind mount is not added and then lot
of things inside fail in ways that don't make sense.
This patch just makes portable_attach() and reattach check the profile
exists. If it doesn't exist, it shows this error now:
# portablectl -p doesntexists reattach xxx
(Matching unit files with prefix 'xxx'.)
ReattachImage failed: Profile 'doesntexists' does not exist, refusing. (Available profiles are: default, nonetwork, strict, trusted)
In reattach we do it early, before detach, so we don't detach and then
fail to attach it and leave the service detached.
An empty profile name is rejected too by the call to
filename_is_valid(). portablectl already rejects empty profile names.
Please note that we don't change install_profile_dropin(), as that skips
non-existing profiles because that is done at the unit type level and
it's okay if it doesn't exist for some unit types. For example,
/usr/lib/systemd/portable/profile/trusted/ ships a service.conf, but not
timer.conf, socket.conf, etc.
(cherry picked from commit 5642eb3d848300f7225dff25fdd82940e55101c9)
find_portable_profile() returns a negative errno and does not set errno,
so the two log messages reported a stale or unrelated errno value.
(cherry picked from commit 8da05abc9a8c21af85542b0d4d1d5f48a47f738e)
This adds an extended version of mkosi's terminal_is_dumb that checks that both
stdout and stderr are connected to a TTY and also checks that the TERM
environment variable is not set to dumb. Additionally this adds support for the
NO_COLOR variable.
(cherry picked from commit 2c46b11b319e42acb113f659098fad8eeac51b69)
The "flush out all rules" step writes to /proc/sys/fs/binfmt_misc/status and
explicitly ignores failure, but it assigns the result to the same r that
RET_GATHER() consumes below. RET_GATHER() keeps the first error it is given,
so a failed flush is still returned from run() and systemd-binfmt exits 1 even
when every rule in binfmt.d was registered successfully.
Reset r after the ignored flush so it cannot be gathered.
Tested on WSL2 (kernel 6.18.40.1-microsoft-standard-WSL2), systemd 261, where
/proc/sys/fs/binfmt_misc/status is a read-only tmpfs. Before this, the binary
registered /etc/binfmt.d/nixos.conf successfully and then exited 1; after, it
exits 0. /proc/sys/fs/binfmt_misc/WSLInterop stays enabled in both cases.
Fixes#44035.
(cherry picked from commit 8fc6b2141b113f63427a766aa800539437138d6c)
Since 7eb016d60b ("nsresourced: restore the BPF-LSM policy from the
registry on startup"), the programs are loaded in manager_setup_bpf()
but only attached later in manager_attach_bpf(). Before that, a failed
attach made the whole setup fail, and nsresourced proceeded with the
user namespace interfaces disabled. Now the same failure is fatal, and
nsresourced exits on kernels that can load BPF-LSM programs but not
attach them, such as arm64 before 7.2.
Handle a failed attach like a failed setup again: log it, drop the BPF
state, and continue with the user namespace interfaces disabled.
When a program fails to attach, the programs attached before it stay
attached, because userns_restrict_attach() has already pinned their
links. The programs keep enforcing the policy. Without the ring buffer
reader, nsresourced never reaps dead namespaces from the maps. Remove
the pins created by the failed attach, so that dropping the BPF state
detaches the programs.
test-userns-restrict fails on the same kernels, because it asserts that
the attach succeeds. Skip it instead.
Fixes: #43964
(cherry picked from commit 4446b9bb51c9900f22d7ba50379fa96dcbfb58f2)
The output section parser matches a valid prefix and ignores any remaining
characters. For example, '.cmdline:textjunk' is treated as text output,
and '.cmdline:text@' is accepted despite the missing output filename.
Require the complete specification to match the existing grammar, and
test malformed suffixes along with valid text and binary output.
(cherry picked from commit fbb4b64bdb326fac5c19122f88bd9d1feb0350e5)
Commit 905a89a219 raised the priority of
events triggered by the device monitor, so that the queue file would not
be removed while the netlink socket in the device monitor still had a
queued uevent.
However, that causes a problem: when udevd receives a flood of uevents,
sigchld and notification events from the workers are postponed. As a
result, the queued events may not be processed during the flood, and
udevd's memory consumption keeps increasing.
Let's lower the priority of these events again. To avoid removing the
queue file while a uevent is still pending on the netlink socket, check
whether the event source corresponding to the device monitor is pending.
Follow-up for 905a89a219.
Fixes#43865.
(cherry picked from commit bca7d4ab23e90ec8859fbaeadaa5e0ae9e51b398)
If compiling with -Db_pie=true, we should do PIE compilation (position
independent executables), even in the static mode.
The caveat is that people distributions actually override compilation
flags when doing their builds. They'll need to set the static flags
properly if they do such builds.
(cherry picked from commit 8b289a8c4d9e2f69a2c10d109c1c19f353005047)
null_or_empty_path_with_root() passes a path that already includes the root
to chase_and_stat() with CHASE_PREFIX_ROOT, so the root is added twice. It
also only recognizes /dev/null when the path itself is /dev/null. Below a
root, a symlink to an empty file therefore fails with ENOENT. A symlink to
/dev/null fails the same way when the image has no /dev/null. Resolve the
symlink inside the root without requiring the target to exist, and stat the
target through the O_PATH fd that chase() returns.
chase() accepts ret_fd together with CHASE_NONEXISTENT and sets the fd to
-EBADF when the target is missing. Its comment says that ret_fd cannot be
combined with CHASE_NONEXISTENT. Fix the comment.
(cherry picked from commit f2b0c29597466bdcc800dcfa8da4c8192fb9e824)
The invalid-boolean error contains a literal f-string prefix and
placeholder, hiding the value that failed to parse. Format the message
to include the rejected value.
(cherry picked from commit aeef38045e74dc585088a64c601166f989705d75)
... as some of the fields like `pcr_mask` field of `struct
tpm2_credential_header` that are passed to this function are 64-bit.
(cherry picked from commit de827820240d56a142aea7a2b012121a8869282d)
... in `attr_subst_subdir()`.
`strnpcpy_full()` returns space left in the buffer. Its return value
should be directly used instead of being subtracted from buffer size.
(cherry picked from commit d5b4357f8f1829608b3a5b641bb97e480a45a2c3)
... in `write_membership()` function.
Log the actual error message returned from `chase_and_open()`.
(cherry picked from commit 513e4b9947c619e2ecfe79c0e81d6461dc65480c)
Daan De Meyer
Florian Franzen
Josh Hoffer
Reilly Brogan
Yu Watanabe
venkatchalla06
abdurrafay3
Lennart Poettering
Egor Ignatov
Jonghyun An
Bertrand Jacquin
Jörg Behrmann
Chris Down
Nick Rosbrook
Dustin Kirkland
Rodrigo Campos
Ilya Naidanov
Daan De Meyer
Zbigniew Jędrzejewski-Szmek
Siteshwar Vashisht