systemd-pcrlock requires support for the PolicyAuthorizeNV command,
which is not implemented in the first TPM2 releases. We also strictly
require SHA-256 support. Hence add a tool for checking for both of
these.
This is a tighter version of "systemd-analyze has-tpm2", that checks for
the precise feature that systemd-pcrlock needs, on top of basic TPM2
functionality.
Fixes: #37607
I wanted to see if moving moving out constant string arguments our of
error messages results in smaller binary sizes. Turns out it does, but
the savings are not consistent. Sometimes we get a few kB in a single
binary, sometimes there is no size change.
In multi-seat scenarios, a display manager might need to start multiple
greeter sessions. But systemd allows at most one graphical session per
user. So, display managers now have a range of UIDs to dynamically
allocate users for their greeter sessions.
git grep -l 'Failed to open /'|xargs sed -r -i 's|"Failed to open (/[^ ]+): %m"|"Failed to open %s: %m", "\1"|g'
git grep -l $'Failed to open \'/'|xargs sed -r -i $'s|"Failed to open \'(/[^ ]+)\': %m"|"Failed to open %s: %m", "\\1"|g'
git grep -l "Failed to open /"|xargs sed -r -i $'s|"Failed to open (/[^ ]+), ignoring: %m"|"Failed to open %s, ignoring: %m", "\\1"|g'
+ some manual fixups.
We already do this for partition_min_size(), let's do it for
partition_max_size() as well. This makes sure repart doesn't accidentally
try to grow verity sig partitions to larger sizes than the hardcoded
max size in systemd.
If .attr_set is zero (and .att_clr, .propagation too), then there's no
point in calling mount_setattr().
Fixes: #37062
Note that this optimization is not precisely load-bearing anymore, since
3cc23a2c23 got merged which removes the
only caller of make_fsmount() that might trigger it. But it's worth
fixing generic code anyway, in case it gets used like this later again.
When bootctl is called by an unprivileged user, then previously we got
```
Failed to read "/boot/EFI/systemd": Permission denied
Failed to open '/boot//loader/loader.conf': Permission denied
```
Now, with this patch, we get
```
Failed to read "/boot/EFI/systemd": Permission denied
Failed to open '/boot/loader/loader.conf': Permission denied
```
Two constants are described in the man page, but are not defined by a header.
The third constant is described in the kernel docs. Use explicit values to
show that those are values are defined externally.
Add endpoint for listing boots. Output format mimics `journalctl
--list-boots -o json`, so it's a plain array containing index, boot ID
and timestamps of the first and last entry. Initial implementation
returns boots ordered starting with the current one and doesn't allow
any filtering (i.e. equivalent of --lines argument).
Fixes: #37573
This renames e.g. struct bus_body_part -> BusMessageBodyPart to
follow our usual coding style. Also, several struct and enum
declarations are moved to relevant headers.
Also, this introduces bus-forward.h.
Re-introduce the check dropped by
ec3c5cfac7,
ad446c8ceb.
For some reasons, if we are running on LXC, even if bpf_program_supported()
returned true, but bpf_program_load_kernel() failed:
```
Attaching device control BPF program to cgroup /system.slice/test-bpf-devices-875b406d56ac7bc3.scope/186c411f6e991777 failed: Operation not permitted
src/test/test-bpf-devices.c:31: Assertion failed: Expected "r" to succeed, but got error: Operation not permitted
```
When populating a filesytem with CopyFiles=, we first copy the files to
a temporary directory. Make sure we use the (new) COPY_FS_VERITY flag
when doing that copy so that the `mkfs` that we invoke can see the files
with fs-verity enabled.
Closes#35352
In order to fully support unpriv containers placed in directories owned
by the foreign UID range, below some unpriv user $HOME, we need to away
to actually create these hierarchies in the first place.
Let's add a method call for that. It takes a dir fd, then validates that
its ownership matches the client's identity, and then creates a subdir,
chown()ing it to the foreign UID range. It then returns an fd to the
result.
The result could then be passed to MountDirectory() in order to get a
mount which can then be populated by some code running in a dynamic
userns.
Add an fsverity flag to MkfsFlags and use it to pass the `-O verity`
option when creating an ext4 or f2fs filesystem: they share the same
argument for this.
The only other filesystem that currently supports fs-verity is btrfs and
it doesn't require a flag to be enabled when creating the filesystem.
Nothing uses this yet.
Signed-off-by: Allison Karlitskaya <allison.karlitskaya@redhat.com>
Add a new `MakeFilesystemFlags` enum and use it to replace the existing
`quiet` and `discard` booleans on `make_filesystem()`.
Update the callers. While we're doing that, consolidate some duplicated
logic in systemd-repart.
Signed-off-by: Allison Karlitskaya <allison.karlitskaya@redhat.com>
Change 'flags' to 'fork_flags' in preparation for using 'flags' as an
argument in the next commit.
Signed-off-by: Allison Karlitskaya <allison.karlitskaya@redhat.com>
Add a new member to CopyFlags to request copying of fs-verity status.
If copying of fs-verity is requested then we query the descriptor from
each regular file. If it has one, we use it to setup fs-verity on the
destination, using the same parameters.
Signatures don't seem to be a particularly well-loved (or used) feature
of fs-verity and we don't bother to query them here. Support for that
could be added later, if desired.
This change means that, with the correct combination of flags, we might
end up calling `fsync()` on a read-only file descriptor. This is
permitted by POSIX and supported on Linux.
Nothing uses this yet.
Signed-off-by: Allison Karlitskaya <allison.karlitskaya@redhat.com>
This effectively renames cg_is_empty_recursive() to cg_is_empty().
Note that all existing code calls the former and not the latter,
hence with cgv1 support being dropped it's trivial to consult
cgroup.events directly for populated state everywhere.
Additionally, use more generic cg_get_keyed_attribute() helper
rather than cg_read_event().
I guess the current wording of "Interactive authentication required." is
hard to grok for many users. Let's try to reword this, and say
explicitly:
1. That this is a form of "access denied" error
2. That interactive auth could remedy this
3. But that the client disabled interactive auth
I think these are the three primary elements the error msg needs to
convey. I tried to distill this in a short error string with this.
Fixes: #2081
F2FS returns EINVAL from FS_IOC_SETFLAGS when trying to set
FS_NOCOW_FL. Let's handle this by treating EINVAL as not supported.
While we're at it, make sure we use ERRNO_IS_IOCTL_NOT_SUPPORTED()
across the tree instead of ERRNO_IS_NOT_SUPPORTED() when calling any
of the chattr_xxx() functions.
Fixes#37593
Jelle van der Waa
Lennart Poettering
Yu Watanabe
Zbigniew Jędrzejewski-Szmek
Adrian Vovk
Daan De Meyer
Christian Glombek
Jan Čermák
Mike Yuan
Nick Rosbrook
Ivan Kruglov
Allison Karlitskaya