The goal is to be allow the use of those binaries on systemd with older
systemd. The report stuff is generally independent of the running systemd
version.
When built with -Dinstall-tests=true -Dstandalone-binaries=true
-Dbuildtype=release -Db_lto=true, gcc-16.1.1-2.fc44.x86_64, the sizes
are quite reasonable:
$ ls -lG build-lto/*.standalone
-rwxr-xr-x 1 zbyszek 713200 Jul 3 13:16 build-lto/systemd-report.standalone
-rwxr-xr-x 1 zbyszek 662936 Jul 3 13:16 build-lto/systemd-report-basic.standalone
-rwxr-xr-x 1 zbyszek 567424 Jul 3 13:16 build-lto/systemd-report-cgroup.standalone
-rwxr-xr-x 1 zbyszek 592856 Jul 3 13:16 build-lto/systemd-report-files.standalone
-rwxr-xr-x 1 zbyszek 589864 Jul 3 13:16 build-lto/systemd-report-sign-plain.standalone
-rwxr-xr-x 1 zbyszek 548624 Jul 3 13:16 build-lto/systemd-report-sign-tsm.standalone
We have two concepts: a list of files that should be extracted from an
intermediate build artifact to be used in a later build artifact, and for a
given artifact, a list "donors". The first list was called "extract", because
it is passed to the .extract_objects() meson function, and the second was
called "objects", because that is the meson parameter to specify pre-built
objects files (6350d2dbd9). But this naming is
confusing: we don't care about the 'extract' step, this is something internal
to the build machinery. And 'objects' is a very generic term.
Let's use 'export' for the stuff that is "exported" for other binaries to use,
and 'import' to say where to import from. Those terms are symmetrical and the
association between them should be intuitive. (If you think the terms are
actually assymetrical, there are precedents for confusing the import with the
import sources. E.g. in modern English, turkeys are called so because they were
imported from the Americas and guineafowls were imported from Africa via
Türkiye and all that foreign stuff is alike.)
* 45c16dd369 Use uniform format for %rhel conditionals
* 034fa693f2 Print the build status also in %build
* 3cc7e03365 Restore definitions of helper macros
* 2382c910b7 Disable the standalone report yet again
* 2d6fd95c70 Restore explicit requires for Centos Stream 9 and 10
* 521ab0fb09 test: skip the integration test suite on Fedora ELN (for now)
* 453447b79b rpminspect: ignore test-coredump-stacktrace in annocheck
* 9d4edaa576 test: work around a kernel bug in virtio/vsock
* c53b2fb307 test: cap the number of parallel tests
* 9bd26bb71f Fix ntpvendor for ELN
* de7b685908 Disable reqs for dlopen'ed libraries on CentOS
* 4830641844 Move portabled to systemd-container subpackage
* 893fcd9978 Add missing conditionalization and more debugging
* c783e74791 split-files: improve error message
* ee2dff42d6 Add systemd-report-standalone
* 9c87a3f8ad Load libssl.so.4 rather than libssl.so.3
* 714b0799d2 Version 261.1
* 054158500a Update to load openssl-4 rather than openssl-3
* 5a3e750ef8 Version 261
* 4faee7ab7d Version 261~rc4
* 8ff635a921 Rebuilt for openssl 4.0
* 0064f73d97 Rebuilt for openssl 4.0
* 14a9aac87e Use dlopen notes again
* 720fa8259a Do not check ownership of /var/lib/systemd/timesync/ in rpm -V
* 06bd9926f2 Version 261~rc3
* 6ddbd499e8 Drop unused tree build dependency
* bd81a14bfc Version 261~rc2
This commit implements `journalctl -f` like behavior for the
varlink API of journalctl. It is used via:
```
$ varlinkctl call -E \
/run/systemd/io.systemd.JournalAccess \
io.systemd.JournalAccess.GetEntries '{"follow": true, "limit": 10}'
```
This gives the last 10 message and then it keeps the connection
open and output each new log line that matches the set filters.
The code is modeled after `journalctl -f`. It seems there is little
to extract into shared code here so I left it for now.
mdns_maintenance_query() takes a ref on the browser's varlink link but
never installs itself as that link's userdata. dns_query_free() then
unconditionally runs sd_varlink_set_userdata(varlink_request, NULL),
so freeing any maintenance query wipes the browse query's registration
on the shared sb->link slot, disabling the abort paths in
vl_on_disconnect() and dns_service_browser_free(). The maintenance
query also never takes a reference on the DnsServiceBrowser, so a client
disconnect could free the browser while a maintenance query was still
in flight, leaving the per-service schedule_event timer and the raw
service->service_browser back-pointer dangling (use-after-free on the
next timer tick or query completion).
Take a service_browser_request reference instead, matching the browse
query path. dns_query_free() already drops it. The browser now outlives
its in-flight maintenance queries.
Follow-up for 8458b7fb91
link_request_sr_iov_vfs() queued each request with a raw SRIOV* as
userdata and a NULL free_func, so the request did not own the object.
The SRIOV is owned by link->network->sr_iov_by_section, which is freed
by network_free() on reload while the RTM_SETLINK reply may still be in
flight (the floating netlink slot keeps the request alive but does not
keep the userdata alive). A later reply, or the 25s netlink timeout,
then dispatches sr_iov_handler() which reads the freed SRIOV.
Follow-up for cb8453cc51
worker_free() did not clear worker->event->worker, leaving an event
that was still attached to a worker pointing at freed memory once the
worker was gone. manager_free() frees the workers (hashmap_free())
before it walks manager->events to process them, and event_free() then
writes event->worker->event = NULL into the already-freed worker.
Clear the back-pointer in worker_free(), mirroring event_free() which
already clears the worker's pointer. The link used to be torn down by
the event_free(worker->event) call in worker_free(), which was dropped
when events became reference counted.
The Event and Worker definitions move to udev-manager.h (next to
Manager) so the unit test can construct and free a bound worker/event
pair.
Follow-up for cb16d47f30
add_object_vtable_internal() inserts BusVTableMember entries into the
global vtable_methods/vtable_properties sets as it walks the vtable, but
only sets node_vtable.node (which gates the disconnect-time cleanup)
after the loop. A failure mid-loop thus left the already-inserted
members behind, dangling once the slot's interface string and the node's
path were freed, so a later registration reading those keys hit a
use-after-free. Remove this slot's members on the fail path.
The test asserts the failed registration leaves no member behind.
Follow-up for 19befb2d5f
The CAN_HASH branch of bus_match_run() that iterates the array values of
an argNhas= match dispatches a callback per value but, unlike the leaf
and manual-iteration branches, does not re-check bus->match_callbacks_modified
afterwards. A callback that adds or removes a match (freeing the node)
would then have the next hashmap_get(node->compare.children, ...) read
freed memory. Add the same check the sibling branches already have.
Follow-up for 198b158f49
netlink_slot_allocate() links the slot into nl->slots and takes an nl
reference, but sd_netlink_call_async() and netlink_add_match_internal()
hold it in a _cleanup_free_, so an error after allocation frees the slot
with a bare free()
Follow-up for ee38400bba
If dns_resolvers_to_dot_addrs() fails (e.g. OOM) it returns without
assigning *ret_addrs, so the CLEANUP_ARRAY() cleanup would free an
uninitialized dot_servers pointer on the error return.
Follow-up for 3fd6708cde
FORMAT_SUBST_LINKS passes the same 'l' (remaining size) to strpcpy for
each devlink and discards the returned remaining value, so the cursor
advances while the bound stays at the full size, overflowing dest.
Capture the return value.
Follow-up for f6caab8995
Sets store their element in the key slot but use a value destructor
(DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR). On the reject/duplicate path
set_ensure_consume() only checked free_key and otherwise called free().
Follow-up for fcc1d0315d
The tag-match loop emits 6 instructions per tag into a fixed 512-entry
stack array without a bounds check (unlike the subsystem loop below),
so enough tags overflow the stack. Refuse with -E2BIG instead.
Follow-up for b1c097af8d
CoCo firmware is stateless, so Secure Boot keys cannot be enrolled at
runtime: it only enforces Secure Boot with keys baked in at build time,
refusing unsigned images from the first boot. The default exclusion of
the enrolled-keys firmware feature hence keeps unsigned images bootable,
but it also makes firmware discovery fail on distros that only ship
SNP/TDX firmware with pre-enrolled keys (e.g. Fedora's TDVF). Drop the
rejection of --secure-boot=yes with --coco= and instead treat it as an
opt-in to such firmware, by lifting the enrolled-keys exclusion.
While at it, reject --efi-nvram-template= and an explicit
--efi-nvram-state= path with --coco=, which were silently ignored, as
stateless firmware has no NVRAM to instantiate or persist.
Signed-off-by: Paul Meyer <katexochen0@gmail.com>
Carry the firmware descriptor's feature list in OvmfConfig, and verify
that firmware selected via an explicit --firmware= descriptor declares
the amd-sev-snp/intel-tdx feature, is stateless, and is in raw format,
the same constraints automatic discovery already imposes. This replaces
the cached supports_sb boolean with a generic feature lookup.
Signed-off-by: Paul Meyer <katexochen0@gmail.com>
Instead of requiring --firmware= to point at a raw .fd image for
--coco=sev-snp/tdx, pick a suitable firmware automatically from the
QEMU firmware descriptors, requiring the amd-sev-snp/intel-tdx feature.
CoCo firmware is stateless (it carries no NVRAM template), so teach
find_ovmf_config() to select stateless raw-format firmware via new
flags. --firmware= now uniformly takes a firmware descriptor path.
Signed-off-by: Paul Meyer <katexochen0@gmail.com>
The mic-mute key on the Logitech K950 keyboard (046D:B388, Bluetooth)
emits BTN_0 (scancode 0x100e1) instead of a usable key, so it does
nothing under GNOME/KDE. Map it to KEY_MICMUTE, its intended function.
Scancode determined with evtest on the device.
Let's not manually create comments, but use the usual
varlink_idl_format_comment() function which does line break handling
properly.
This polishes the output for very narrow outputs, since we'll line break
these synthetic comments too.
For some reason claude refuses to review
https://github.com/systemd/systemd/pull/42651.
Let's see if we can make it work by splitting up the big PR into smaller
ones. So here's the first one with 5 commits that should be relatively
easy to review and get merged early.
verify_pe() only checked SizeOfOptionalHeader against a SIZE_MAX wrap (a
clause that, given SizeOfOptionalHeader is a uint16_t, can never reject
anything) and never read NumberOfRvaAndSizes. But pe_kernel_info(),
pe_kernel_check_nx_compat() and pe_kernel_check_no_relocation() then read
SizeOfImage, AddressOfEntryPoint, DllCharacteristics and the base
relocation data directory entry from the optional header.
Require SizeOfOptionalHeader to be large enough to contain everything down
to the base relocation data directory entry, and require the image to
declare that many data directory entries.
Follow-up for bacc2ed0d5
linux_exec() patches the stub's own EFI_LOADED_IMAGE_PROTOCOL to point
at the loaded inner kernel, and restores the saved original only after
the entry point returns. The initrd_register() failure path returns
without restoring, leaving the firmware's protocol pointing to freed
data.
Follow-up for f405165065
linux_exec() marks code sections RO+X for W^X and reverts them to RW+NX
in a loop just before returning, because EDK2 requires freed buffers to
be writable and non-executable or FreePages() crashes. Not every error
path is currently covered. Switch to a _cleanup_ helper so that every
return path is covered.
Follow-up for 56d19b633d
pe_locate_sections_internal() stores each matching section's VirtualSize
and VirtualAddress into PeSectionVector.memory_size/memory_offset with
only SIZE_MAX overflow guards, never checking them against the image's
SizeOfImage.
Wire up the image's SizeOfImage down to pe_locate_sections_internal()
and skip any section whose in-memory section does not fit within it.
Follow-up for fb974ac485
The inner-kernel section loader checks VirtualAddress + SizeOfRawData
against kernel_size_in_memory (for the memcpy), but the memzero right
after it clears up to VirtualAddress + VirtualSize, and VirtualSize is
only constrained to be >= SizeOfRawData.
Reject a VirtualAddress + VirtualSize that overflows or exceeds
kernel_size_in_memory, mirroring the existing SizeOfRawData checks.
Follow-up for cab9c7b5a4
pe_kernel_info() returned AddressOfEntryPoint (and the .compat section
entry_point) straight from the PE header with no check against
SizeOfImage. Since cab9c7b5a4 the stub calls the inner kernel directly
as ImageBase + entry_point, and only EFI_SIZE_TO_PAGES(SizeOfImage) pages
are allocated for it.
Follow-up for cab9c7b5a4
de0da85d41 switched the unquote check to strchr8(QUOTES, value[0]),
which is not equivalent to the old explicit comparison for an empty
value: strchr8(), like strchr(3), returns a pointer to the haystack's
terminating NUL when the needle is '\0', so strchr8(QUOTES, '\0') is
non-NULL. For a line whose separator is the last byte (e.g. "ID=") the
split leaves value[0] == '\0' and line[linelen - 1] == '\0' too, so both
conjuncts hold and value++ steps one byte past the value's terminator.
Follow-up for de0da85d41
When a variable exists but is empty, the initial size-query
GetVariable() in efivar_get_raw_full() returns EFI_SUCCESS instead of
EFI_BUFFER_TOO_SMALL: the zero-length payload already "fits" the
zero-length query buffer. The helper returns success, but does not
initialize the return parameters.
Handle a couple of corner cases by checking the return size.
Follow-up for a409607489
device_path_next_node() advances by the current node's Length field,
which per the EFI device path protocol includes the 4-byte node header;
a well-formed node is therefore at least sizeof(EFI_DEVICE_PATH) bytes
long. A malformed node with Length < sizeof(EFI_DEVICE_PATH), in
particular Length == 0, makes the helper return its input pointer
unchanged.
Advance by at least sizeof(EFI_DEVICE_PATH).
Follow-up for 5080a60a71
Zbigniew Jędrzejewski-Szmek
Matthew Schwartz
Michael Vogt
Lennart Poettering
Luca Boccassi
Paul Meyer
Nicholas Lim
Matthias P. Walther
Jesse Guo
Léane GRASSER
Michal Čihař
