Kai Lueke
5c6bb28999
So far systemd-sysext with --root= specified didn't follow extension symlinks (such as the "current" symlinks managed by systemd-sysupdate). The main use case is running systemd-sysext --root=/sysroot for setting up the overlay mounts already from the initrd. Resolve symlinks correctly but don't defend against later symlink races that would access a path outside of the given root. Malicous live modifications are not a realistic threat model and anyway for that one would need to rework how the image entry is passed over up to the point when the loop device is set up. This change here does not introduce this weakness nor does it expose it more than before. Thus, make it explicit that setting up the extensions for a given --root= implies a certain trust into this given root tree that it does not try do race conditions with symlinks to trick systemd-sysext to mount a file outside --root=. Without a strict --image-policy= set we would anyway mount filesystems right away which is another attack vector but, again, the main use case is to do this for the final system which is trusted at this stage.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS