When we load a user record we retain a reference to the original JSON.
Thus the loaded objects might live at least as long as our user record
object, hence we better make sure we set the 'sensitive' flag for the
'secret' section if it's not marked like that yet.
This is paranoia only: we already should be setting this flag properly
earlier, when acquiring the json variant in the first place. But it's
better to be safe than sorry.
This could mean that we hit EOF, or it could mean that somebody punched
a hole concurrently where we are currently looking. Let's figure this
out by simply trying to copy a single byte, which will give us a
definitive answer.
Fixes: #35569
Now that we have recognizable errors, let's print clear error messages
when we try to unlock a TPM slot. And in case of the token plugin
propagate this as ENOANO so that libcryptsetup recognizes this as bad
PIN. (ENOANO is documented as the error to return in that case)
Fixes: #32260
When we create the policy session the previously passed PIN will be
checked. This means we'll see PIN errors here, in case the PIN is wrong
or if DA lockout mode has been triggered.
Recognize these two errors, and bubble up recognizable errors.
The check existed for musl. Let's remove it, as we explicitly request glibc.
While removing the check, this also drops generic_mallinfo, introduces
a tiny converter from struct mallinfo to struct mallinfo2 if mallinfo2()
does not exist, and renames mallinfo-util.h to malloc.h.
With this change, we can drop many ifdefs and casts in .c files.
Let's make more use of label_ops_pre()/label_ops_post(), and replace
write_env_file_label() by a flag to write_env_file().
This simplifies and normalizes the code.
This also makes one relevant change: it sets the new
WRITE_ENV_FILE_LABEL flag in firstboot.c when we write locale.conf,
where we previously did not (but should have). This should address one
detail of #37857.
More porting work to label_ops_pre()/label_ops_post()
This also enables labelling of the /etc/localtime symlink in
systemd-firstboot, which should address one small facet of #37857
This controls the new SO_PASSRIGHTS socket option in kernel v6.16.
Note that I intentionally choose a different naming scheme than
Pass*=, since all other Pass*= options controls whether some extra
bits are attached to the message, while this one's about denying
file descriptor transfer and it feels more explicit this way.
And diverging from underlying socket option name is precedented
by Timestamping=. But happy to change it to just say PassRights=
if people disagree.
The pkcs7_new() function currently uses the hash algorithm from the X509
certificate's signature, but the content signature may use a different hash
algorithm. This adds a parameter to allow specifying what hash algorithm the
content signature generation used.
_PATH_WTMPX is a kind of internal definition in glibc, and
WTMPX_FILE should be an exposed definition. Both are same,
let's use WTMPX_FILE.
Note, for utmp, we use UTMPX_FILE, rather than _PATH_UTMPX.
Let's use consistent macros.
Necessary for crypto_random_bytes(), which is used in the branch that
HAVE_CRYPT_GENSALT_RA is false. Unfortunately, our CIs tested only the
other branch.
This introduce bus_error_is_connection(), and use it where applicable.
Then, this makes connection errors in acquiring invocation ID by
systemd-run handled gracefully, like we already do other places.
Fixes#37675.
And rework partition_designator_is_verity_sig() to be based on
partition_verity_sig_to_data(), so that we don't have to maintain two
lists of verity sig partition types.
While the `port_vlan_id` field was already present in the
`sd_lldp_neighbor`, it wasn't currently parsed from the LLDP packet.
Added support for that as well as a small parsing test.
Closes#28354.
This is more explicit and ensures that even in testing environments we
operate the same way.
As side effect it also avoids the mess around SELinux blocking access to
cgroupfs.
Fixes: #35723
Since 8065d02e26 ("copy: Fix error handling in fd_copy_directory()")
we immediately abort recursive copy operations on ENOSPC. Let's also
abort on the common case of filesystems not supporting fs-verity: if
it's unsupported for one file, it's unlikely to work for the 1000s that
follow it.
We do this by mapping the two fs-verity "not supported" errors (ENOTTY,
EOPNOTSUPP) to ESOCKTNOSUPPORT as a special "fs-verity not supported
here" error. When we see that error at the top level we exit
immediately.
This prevents us from having to see the same error message literally
thousands of time when using fsverity=copy with systemd-repart on a
filesystem which lacks the proper support.
Adjust the test-copy test case to expect the new errno. Previously this
test case would output multiple failure lines per `copy_tree_at()`
invocation (for the failing cases) but now it only outputs one.
Both ENOEXEC and ESRCH is a kind of error that indicate successful
lookup. ENOEXEC means the server found an entry but it does not
pass filter. ESRCH means the server could not find an entry.
Hence, ENOEXEC should have more information, and should be propagated to
the caller.
Lennart Poettering
Yu Watanabe
Luca Boccassi
Mike Yuan
Dan Streetman
Antonio Alvarez Feijoo
Daan De Meyer
A. Wilcox
Lorenzo Arena
Ivan Kruglov
Allison Karlitskaya