]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/shared/dissect-image.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #29122 from yuwata/network-allow-multiple-ipv6-null-addresses
[thirdparty/systemd.git] / src / shared / dissect-image.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #if HAVE_VALGRIND_MEMCHECK_H
4 #include <valgrind/memcheck.h>
5 #endif
6
7 #include <linux/dm-ioctl.h>
8 #include <linux/loop.h>
9 #include <sys/file.h>
10 #include <sys/mount.h>
11 #include <sys/prctl.h>
12 #include <sys/wait.h>
13 #include <sysexits.h>
14
15 #if HAVE_OPENSSL
16 #include <openssl/err.h>
17 #include <openssl/pem.h>
18 #include <openssl/x509.h>
19 #endif
20
21 #include "sd-device.h"
22 #include "sd-id128.h"
23
24 #include "architecture.h"
25 #include "ask-password-api.h"
26 #include "blkid-util.h"
27 #include "blockdev-util.h"
28 #include "btrfs-util.h"
29 #include "chase.h"
30 #include "conf-files.h"
31 #include "constants.h"
32 #include "copy.h"
33 #include "cryptsetup-util.h"
34 #include "device-nodes.h"
35 #include "device-util.h"
36 #include "devnum-util.h"
37 #include "discover-image.h"
38 #include "dissect-image.h"
39 #include "dm-util.h"
40 #include "env-file.h"
41 #include "env-util.h"
42 #include "extension-util.h"
43 #include "fd-util.h"
44 #include "fileio.h"
45 #include "fs-util.h"
46 #include "fsck-util.h"
47 #include "gpt.h"
48 #include "hexdecoct.h"
49 #include "hostname-setup.h"
50 #include "id128-util.h"
51 #include "import-util.h"
52 #include "io-util.h"
53 #include "missing_mount.h"
54 #include "mkdir-label.h"
55 #include "mount-util.h"
56 #include "mountpoint-util.h"
57 #include "namespace-util.h"
58 #include "nulstr-util.h"
59 #include "openssl-util.h"
60 #include "os-util.h"
61 #include "path-util.h"
62 #include "process-util.h"
63 #include "raw-clone.h"
64 #include "resize-fs.h"
65 #include "signal-util.h"
66 #include "sparse-endian.h"
67 #include "stat-util.h"
68 #include "stdio-util.h"
69 #include "string-table.h"
70 #include "string-util.h"
71 #include "strv.h"
72 #include "tmpfile-util.h"
73 #include "udev-util.h"
74 #include "user-util.h"
75 #include "xattr-util.h"
76
77 /* how many times to wait for the device nodes to appear */
78 #define N_DEVICE_NODE_LIST_ATTEMPTS 10
79
80 int dissect_fstype_ok(const char *fstype) {
81 const char *e;
82 bool b;
83
84 /* When we automatically mount file systems, be a bit conservative by default what we are willing to
85 * mount, just as an extra safety net to not mount with badly maintained legacy file system
86 * drivers. */
87
88 e = secure_getenv("SYSTEMD_DISSECT_FILE_SYSTEMS");
89 if (e) {
90 _cleanup_strv_free_ char **l = NULL;
91
92 l = strv_split(e, ":");
93 if (!l)
94 return -ENOMEM;
95
96 b = strv_contains(l, fstype);
97 } else
98 b = STR_IN_SET(fstype,
99 "btrfs",
100 "erofs",
101 "ext4",
102 "f2fs",
103 "squashfs",
104 "vfat",
105 "xfs");
106 if (b)
107 return true;
108
109 log_debug("File system type '%s' is not allowed to be mounted as result of automatic dissection.", fstype);
110 return false;
111 }
112
113 int probe_sector_size(int fd, uint32_t *ret) {
114
115 /* Disk images might be for 512B or for 4096 sector sizes, let's try to auto-detect that by searching
116 * for the GPT headers at the relevant byte offsets */
117
118 assert_cc(sizeof(GptHeader) == 92);
119
120 /* We expect a sector size in the range 512…4096. The GPT header is located in the second
121 * sector. Hence it could be at byte 512 at the earliest, and at byte 4096 at the latest. And we must
122 * read with granularity of the largest sector size we care about. Which means 8K. */
123 uint8_t sectors[2 * 4096];
124 uint32_t found = 0;
125 ssize_t n;
126
127 assert(fd >= 0);
128 assert(ret);
129
130 n = pread(fd, sectors, sizeof(sectors), 0);
131 if (n < 0)
132 return -errno;
133 if (n != sizeof(sectors)) /* too short? */
134 goto not_found;
135
136 /* Let's see if we find the GPT partition header with various expected sector sizes */
137 for (uint32_t sz = 512; sz <= 4096; sz <<= 1) {
138 const GptHeader *p;
139
140 assert(sizeof(sectors) >= sz * 2);
141 p = (const GptHeader*) (sectors + sz);
142
143 if (!gpt_header_has_signature(p))
144 continue;
145
146 if (found != 0)
147 return log_debug_errno(SYNTHETIC_ERRNO(ENOTUNIQ),
148 "Detected valid partition table at offsets matching multiple sector sizes, refusing.");
149
150 found = sz;
151 }
152
153 if (found != 0) {
154 log_debug("Determined sector size %" PRIu32 " based on discovered partition table.", found);
155 *ret = found;
156 return 1; /* indicate we *did* find it */
157 }
158
159 not_found:
160 log_debug("Couldn't find any partition table to derive sector size of.");
161 *ret = 512; /* pick the traditional default */
162 return 0; /* indicate we didn't find it */
163 }
164
165 int probe_sector_size_prefer_ioctl(int fd, uint32_t *ret) {
166 struct stat st;
167
168 assert(fd >= 0);
169 assert(ret);
170
171 /* Just like probe_sector_size(), but if we are looking at a block device, will use the already
172 * configured sector size rather than probing by contents */
173
174 if (fstat(fd, &st) < 0)
175 return -errno;
176
177 if (S_ISBLK(st.st_mode))
178 return blockdev_get_sector_size(fd, ret);
179
180 return probe_sector_size(fd, ret);
181 }
182
183 int probe_filesystem_full(
184 int fd,
185 const char *path,
186 uint64_t offset,
187 uint64_t size,
188 char **ret_fstype) {
189
190 /* Try to find device content type and return it in *ret_fstype. If nothing is found,
191 * 0/NULL will be returned. -EUCLEAN will be returned for ambiguous results, and a
192 * different error otherwise. */
193
194 #if HAVE_BLKID
195 _cleanup_(blkid_free_probep) blkid_probe b = NULL;
196 _cleanup_free_ char *path_by_fd = NULL;
197 _cleanup_close_ int fd_close = -EBADF;
198 const char *fstype;
199 int r;
200
201 assert(fd >= 0 || path);
202 assert(ret_fstype);
203
204 if (fd < 0) {
205 fd_close = open(path, O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_NOCTTY);
206 if (fd_close < 0)
207 return -errno;
208
209 fd = fd_close;
210 }
211
212 if (!path) {
213 r = fd_get_path(fd, &path_by_fd);
214 if (r < 0)
215 return r;
216
217 path = path_by_fd;
218 }
219
220 if (size == 0) /* empty size? nothing found! */
221 goto not_found;
222
223 b = blkid_new_probe();
224 if (!b)
225 return -ENOMEM;
226
227 /* The Linux kernel maintains separate block device caches for main ("whole") and partition block
228 * devices, which means making a change to one might not be reflected immediately when reading via
229 * the other. That's massively confusing when mixing accesses to such devices. Let's address this in
230 * a limited way: when probing a file system that is not at the beginning of the block device we
231 * apparently probe a partition via the main block device, and in that case let's first flush the
232 * main block device cache, so that we get the data that the per-partition block device last
233 * sync'ed on.
234 *
235 * This only works under the assumption that any tools that write to the partition block devices
236 * issue an syncfs()/fsync() on the device after making changes. Typically file system formatting
237 * tools that write a superblock onto a partition block device do that, however. */
238 if (offset != 0)
239 if (ioctl(fd, BLKFLSBUF, 0) < 0)
240 log_debug_errno(errno, "Failed to flush block device cache, ignoring: %m");
241
242 errno = 0;
243 r = blkid_probe_set_device(
244 b,
245 fd,
246 offset,
247 size == UINT64_MAX ? 0 : size); /* when blkid sees size=0 it understands "everything". We prefer using UINT64_MAX for that */
248 if (r != 0)
249 return errno_or_else(ENOMEM);
250
251 blkid_probe_enable_superblocks(b, 1);
252 blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
253
254 errno = 0;
255 r = blkid_do_safeprobe(b);
256 if (r == _BLKID_SAFEPROBE_NOT_FOUND)
257 goto not_found;
258 if (r == _BLKID_SAFEPROBE_AMBIGUOUS)
259 return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN),
260 "Results ambiguous for partition %s", path);
261 if (r == _BLKID_SAFEPROBE_ERROR)
262 return log_debug_errno(errno_or_else(EIO), "Failed to probe partition %s: %m", path);
263
264 assert(r == _BLKID_SAFEPROBE_FOUND);
265
266 (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
267
268 if (fstype) {
269 char *t;
270
271 log_debug("Probed fstype '%s' on partition %s.", fstype, path);
272
273 t = strdup(fstype);
274 if (!t)
275 return -ENOMEM;
276
277 *ret_fstype = t;
278 return 1;
279 }
280
281 not_found:
282 log_debug("No type detected on partition %s", path);
283 *ret_fstype = NULL;
284 return 0;
285 #else
286 return -EOPNOTSUPP;
287 #endif
288 }
289
290 #if HAVE_BLKID
291 static int image_policy_may_use(
292 const ImagePolicy *policy,
293 PartitionDesignator designator) {
294
295 PartitionPolicyFlags f;
296
297 /* For each partition we find in the partition table do a first check if it may exist at all given
298 * the policy, or if it shall be ignored. */
299
300 f = image_policy_get_exhaustively(policy, designator);
301 if (f < 0)
302 return f;
303
304 if ((f & _PARTITION_POLICY_USE_MASK) == PARTITION_POLICY_ABSENT)
305 /* only flag set in policy is "absent"? then this partition may not exist at all */
306 return log_debug_errno(
307 SYNTHETIC_ERRNO(ERFKILL),
308 "Partition of designator '%s' exists, but not allowed by policy, refusing.",
309 partition_designator_to_string(designator));
310 if ((f & _PARTITION_POLICY_USE_MASK & ~PARTITION_POLICY_ABSENT) == PARTITION_POLICY_UNUSED) {
311 /* only "unused" or "unused" + "absent" are set? then don't use it */
312 log_debug("Partition of designator '%s' exists, and policy dictates to ignore it, doing so.",
313 partition_designator_to_string(designator));
314 return false; /* ignore! */
315 }
316
317 return true; /* use! */
318 }
319
320 static int image_policy_check_protection(
321 const ImagePolicy *policy,
322 PartitionDesignator designator,
323 PartitionPolicyFlags found_flags) {
324
325 PartitionPolicyFlags policy_flags;
326
327 /* Checks if the flags in the policy for the designated partition overlap the flags of what we found */
328
329 if (found_flags < 0)
330 return found_flags;
331
332 policy_flags = image_policy_get_exhaustively(policy, designator);
333 if (policy_flags < 0)
334 return policy_flags;
335
336 if ((found_flags & policy_flags) == 0) {
337 _cleanup_free_ char *found_flags_string = NULL, *policy_flags_string = NULL;
338
339 (void) partition_policy_flags_to_string(found_flags, /* simplify= */ true, &found_flags_string);
340 (void) partition_policy_flags_to_string(policy_flags, /* simplify= */ true, &policy_flags_string);
341
342 return log_debug_errno(SYNTHETIC_ERRNO(ERFKILL), "Partition %s discovered with policy '%s' but '%s' was required, refusing.",
343 partition_designator_to_string(designator),
344 strnull(found_flags_string), strnull(policy_flags_string));
345 }
346
347 return 0;
348 }
349
350 static int image_policy_check_partition_flags(
351 const ImagePolicy *policy,
352 PartitionDesignator designator,
353 uint64_t gpt_flags) {
354
355 PartitionPolicyFlags policy_flags;
356 bool b;
357
358 /* Checks if the partition flags in the policy match reality */
359
360 policy_flags = image_policy_get_exhaustively(policy, designator);
361 if (policy_flags < 0)
362 return policy_flags;
363
364 b = FLAGS_SET(gpt_flags, SD_GPT_FLAG_READ_ONLY);
365 if ((policy_flags & _PARTITION_POLICY_READ_ONLY_MASK) == (b ? PARTITION_POLICY_READ_ONLY_OFF : PARTITION_POLICY_READ_ONLY_ON))
366 return log_debug_errno(SYNTHETIC_ERRNO(ERFKILL), "Partition %s has 'read-only' flag incorrectly set (must be %s, is %s), refusing.",
367 partition_designator_to_string(designator),
368 one_zero(!b), one_zero(b));
369
370 b = FLAGS_SET(gpt_flags, SD_GPT_FLAG_GROWFS);
371 if ((policy_flags & _PARTITION_POLICY_GROWFS_MASK) == (b ? PARTITION_POLICY_GROWFS_OFF : PARTITION_POLICY_GROWFS_ON))
372 return log_debug_errno(SYNTHETIC_ERRNO(ERFKILL), "Partition %s has 'growfs' flag incorrectly set (must be %s, is %s), refusing.",
373 partition_designator_to_string(designator),
374 one_zero(!b), one_zero(b));
375
376 return 0;
377 }
378
379 static int dissected_image_probe_filesystems(
380 DissectedImage *m,
381 int fd,
382 const ImagePolicy *policy) {
383
384 int r;
385
386 assert(m);
387
388 /* Fill in file system types if we don't know them yet. */
389
390 for (PartitionDesignator i = 0; i < _PARTITION_DESIGNATOR_MAX; i++) {
391 DissectedPartition *p = m->partitions + i;
392 PartitionPolicyFlags found_flags;
393
394 if (!p->found)
395 continue;
396
397 if (!p->fstype) {
398 /* If we have an fd referring to the partition block device, use that. Otherwise go
399 * via the whole block device or backing regular file, and read via offset. */
400 if (p->mount_node_fd >= 0)
401 r = probe_filesystem_full(p->mount_node_fd, p->node, 0, UINT64_MAX, &p->fstype);
402 else
403 r = probe_filesystem_full(fd, p->node, p->offset, p->size, &p->fstype);
404 if (r < 0)
405 return r;
406 }
407
408 if (streq_ptr(p->fstype, "crypto_LUKS")) {
409 m->encrypted = true;
410 found_flags = PARTITION_POLICY_ENCRYPTED; /* found this one, and its definitely encrypted */
411 } else
412 /* found it, but it's definitely not encrypted, hence mask the encrypted flag, but
413 * set all other ways that indicate "present". */
414 found_flags = PARTITION_POLICY_UNPROTECTED|PARTITION_POLICY_VERITY|PARTITION_POLICY_SIGNED;
415
416 if (p->fstype && fstype_is_ro(p->fstype))
417 p->rw = false;
418
419 if (!p->rw)
420 p->growfs = false;
421
422 /* We might have learnt more about the file system now (i.e. whether it is encrypted or not),
423 * hence we need to validate this against policy again, to see if the policy still matches
424 * with this new information. Note that image_policy_check_protection() will check for
425 * overlap between what's allowed in the policy and what we pass as 'found_policy' here. In
426 * the unencrypted case we thus might pass an overly unspecific mask here (i.e. unprotected
427 * OR verity OR signed), but that's fine since the earlier policy check already checked more
428 * specific which of those three cases where OK. Keep in mind that this function here only
429 * looks at specific partitions (and thus can only deduce encryption or not) but not the
430 * overall partition table (and thus cannot deduce verity or not). The earlier dissection
431 * checks already did the relevant checks that look at the whole partition table, and
432 * enforced policy there as needed. */
433 r = image_policy_check_protection(policy, i, found_flags);
434 if (r < 0)
435 return r;
436 }
437
438 return 0;
439 }
440
441 static void check_partition_flags(
442 const char *node,
443 unsigned long long pflags,
444 unsigned long long supported) {
445
446 assert(node);
447
448 /* Mask away all flags supported by this partition's type and the three flags the UEFI spec defines generically */
449 pflags &= ~(supported |
450 SD_GPT_FLAG_REQUIRED_PARTITION |
451 SD_GPT_FLAG_NO_BLOCK_IO_PROTOCOL |
452 SD_GPT_FLAG_LEGACY_BIOS_BOOTABLE);
453
454 if (pflags == 0)
455 return;
456
457 /* If there are other bits set, then log about it, to make things discoverable */
458 for (unsigned i = 0; i < sizeof(pflags) * 8; i++) {
459 unsigned long long bit = 1ULL << i;
460 if (!FLAGS_SET(pflags, bit))
461 continue;
462
463 log_debug("Unexpected partition flag %llu set on %s!", bit, node);
464 }
465 }
466
467 static int dissected_image_new(const char *path, DissectedImage **ret) {
468 _cleanup_(dissected_image_unrefp) DissectedImage *m = NULL;
469 _cleanup_free_ char *name = NULL;
470 int r;
471
472 assert(ret);
473
474 if (path) {
475 _cleanup_free_ char *filename = NULL;
476
477 r = path_extract_filename(path, &filename);
478 if (r < 0)
479 return r;
480
481 r = raw_strip_suffixes(filename, &name);
482 if (r < 0)
483 return r;
484
485 if (!image_name_is_valid(name)) {
486 log_debug("Image name %s is not valid, ignoring.", strna(name));
487 name = mfree(name);
488 }
489 }
490
491 m = new(DissectedImage, 1);
492 if (!m)
493 return -ENOMEM;
494
495 *m = (DissectedImage) {
496 .has_init_system = -1,
497 .image_name = TAKE_PTR(name),
498 };
499
500 for (PartitionDesignator i = 0; i < _PARTITION_DESIGNATOR_MAX; i++)
501 m->partitions[i] = DISSECTED_PARTITION_NULL;
502
503 *ret = TAKE_PTR(m);
504 return 0;
505 }
506 #endif
507
508 static void dissected_partition_done(DissectedPartition *p) {
509 assert(p);
510
511 free(p->fstype);
512 free(p->node);
513 free(p->label);
514 free(p->decrypted_fstype);
515 free(p->decrypted_node);
516 free(p->mount_options);
517 safe_close(p->mount_node_fd);
518
519 *p = DISSECTED_PARTITION_NULL;
520 }
521
522 #if HAVE_BLKID
523 static int make_partition_devname(
524 const char *whole_devname,
525 uint64_t diskseq,
526 int nr,
527 DissectImageFlags flags,
528 char **ret) {
529
530 _cleanup_free_ char *s = NULL;
531 int r;
532
533 assert(whole_devname);
534 assert(nr != 0); /* zero is not a valid partition nr */
535 assert(ret);
536
537 if (!FLAGS_SET(flags, DISSECT_IMAGE_DISKSEQ_DEVNODE) || diskseq == 0) {
538
539 /* Given a whole block device node name (e.g. /dev/sda or /dev/loop7) generate a partition
540 * device name (e.g. /dev/sda7 or /dev/loop7p5). The rule the kernel uses is simple: if whole
541 * block device node name ends in a digit, then suffix a 'p', followed by the partition
542 * number. Otherwise, just suffix the partition number without any 'p'. */
543
544 if (nr < 0) { /* whole disk? */
545 s = strdup(whole_devname);
546 if (!s)
547 return -ENOMEM;
548 } else {
549 size_t l = strlen(whole_devname);
550 if (l < 1) /* underflow check for the subtraction below */
551 return -EINVAL;
552
553 bool need_p = ascii_isdigit(whole_devname[l-1]); /* Last char a digit? */
554
555 if (asprintf(&s, "%s%s%i", whole_devname, need_p ? "p" : "", nr) < 0)
556 return -ENOMEM;
557 }
558 } else {
559 if (nr < 0) /* whole disk? */
560 r = asprintf(&s, "/dev/disk/by-diskseq/%" PRIu64, diskseq);
561 else
562 r = asprintf(&s, "/dev/disk/by-diskseq/%" PRIu64 "-part%i", diskseq, nr);
563 if (r < 0)
564 return -ENOMEM;
565 }
566
567 *ret = TAKE_PTR(s);
568 return 0;
569 }
570
571 static int open_partition(
572 const char *node,
573 bool is_partition,
574 const LoopDevice *loop) {
575
576 _cleanup_(sd_device_unrefp) sd_device *dev = NULL;
577 _cleanup_close_ int fd = -EBADF;
578 dev_t devnum;
579 int r;
580
581 assert(node);
582 assert(loop);
583
584 fd = open(node, O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_NOCTTY);
585 if (fd < 0)
586 return -errno;
587
588 /* Check if the block device is a child of (or equivalent to) the originally provided one. */
589 r = block_device_new_from_fd(fd, is_partition ? BLOCK_DEVICE_LOOKUP_WHOLE_DISK : 0, &dev);
590 if (r < 0)
591 return r;
592
593 r = sd_device_get_devnum(dev, &devnum);
594 if (r < 0)
595 return r;
596
597 if (loop->devno != devnum)
598 return -ENXIO;
599
600 /* Also check diskseq. */
601 if (loop->diskseq != 0) {
602 uint64_t diskseq;
603
604 r = fd_get_diskseq(fd, &diskseq);
605 if (r < 0)
606 return r;
607
608 if (loop->diskseq != diskseq)
609 return -ENXIO;
610 }
611
612 log_debug("Opened %s (fd=%i, whole_block_devnum=" DEVNUM_FORMAT_STR ", diskseq=%" PRIu64 ").",
613 node, fd, DEVNUM_FORMAT_VAL(loop->devno), loop->diskseq);
614 return TAKE_FD(fd);
615 }
616
617 static int compare_arch(Architecture a, Architecture b) {
618 if (a == b)
619 return 0;
620
621 if (a == native_architecture())
622 return 1;
623
624 if (b == native_architecture())
625 return -1;
626
627 #ifdef ARCHITECTURE_SECONDARY
628 if (a == ARCHITECTURE_SECONDARY)
629 return 1;
630
631 if (b == ARCHITECTURE_SECONDARY)
632 return -1;
633 #endif
634
635 return 0;
636 }
637
638 static int dissect_image(
639 DissectedImage *m,
640 int fd,
641 const char *devname,
642 const VeritySettings *verity,
643 const MountOptions *mount_options,
644 const ImagePolicy *policy,
645 DissectImageFlags flags) {
646
647 sd_id128_t root_uuid = SD_ID128_NULL, root_verity_uuid = SD_ID128_NULL;
648 sd_id128_t usr_uuid = SD_ID128_NULL, usr_verity_uuid = SD_ID128_NULL;
649 bool is_gpt, is_mbr, multiple_generic = false,
650 generic_rw = false, /* initialize to appease gcc */
651 generic_growfs = false;
652 _cleanup_(blkid_free_probep) blkid_probe b = NULL;
653 _cleanup_free_ char *generic_node = NULL;
654 sd_id128_t generic_uuid = SD_ID128_NULL;
655 const char *pttype = NULL, *sptuuid = NULL;
656 blkid_partlist pl;
657 int r, generic_nr = -1, n_partitions;
658
659 assert(m);
660 assert(fd >= 0);
661 assert(devname);
662 assert(!verity || verity->designator < 0 || IN_SET(verity->designator, PARTITION_ROOT, PARTITION_USR));
663 assert(!verity || verity->root_hash || verity->root_hash_size == 0);
664 assert(!verity || verity->root_hash_sig || verity->root_hash_sig_size == 0);
665 assert(!verity || (verity->root_hash || !verity->root_hash_sig));
666 assert(!((flags & DISSECT_IMAGE_GPT_ONLY) && (flags & DISSECT_IMAGE_NO_PARTITION_TABLE)));
667 assert(m->sector_size > 0);
668
669 /* Probes a disk image, and returns information about what it found in *ret.
670 *
671 * Returns -ENOPKG if no suitable partition table or file system could be found.
672 * Returns -EADDRNOTAVAIL if a root hash was specified but no matching root/verity partitions found.
673 * Returns -ENXIO if we couldn't find any partition suitable as root or /usr partition
674 * Returns -ENOTUNIQ if we only found multiple generic partitions and thus don't know what to do with that
675 * Returns -ERFKILL if image doesn't match image policy
676 * Returns -EBADR if verity data was provided externally for an image that has a GPT partition table (i.e. is not just a naked fs)
677 * Returns -EPROTONOSUPPORT if DISSECT_IMAGE_ADD_PARTITION_DEVICES is set but the block device does not have partition logic enabled
678 * Returns -ENOMSG if we didn't find a single usable partition (and DISSECT_IMAGE_REFUSE_EMPTY is set) */
679
680 uint64_t diskseq = m->loop ? m->loop->diskseq : 0;
681
682 if (verity && verity->root_hash) {
683 sd_id128_t fsuuid, vuuid;
684
685 /* If a root hash is supplied, then we use the root partition that has a UUID that match the
686 * first 128-bit of the root hash. And we use the verity partition that has a UUID that match
687 * the final 128-bit. */
688
689 if (verity->root_hash_size < sizeof(sd_id128_t))
690 return -EINVAL;
691
692 memcpy(&fsuuid, verity->root_hash, sizeof(sd_id128_t));
693 memcpy(&vuuid, (const uint8_t*) verity->root_hash + verity->root_hash_size - sizeof(sd_id128_t), sizeof(sd_id128_t));
694
695 if (sd_id128_is_null(fsuuid))
696 return -EINVAL;
697 if (sd_id128_is_null(vuuid))
698 return -EINVAL;
699
700 /* If the verity data declares it's for the /usr partition, then search for that, in all
701 * other cases assume it's for the root partition. */
702 if (verity->designator == PARTITION_USR) {
703 usr_uuid = fsuuid;
704 usr_verity_uuid = vuuid;
705 } else {
706 root_uuid = fsuuid;
707 root_verity_uuid = vuuid;
708 }
709 }
710
711 b = blkid_new_probe();
712 if (!b)
713 return -ENOMEM;
714
715 errno = 0;
716 r = blkid_probe_set_device(b, fd, 0, 0);
717 if (r != 0)
718 return errno_or_else(ENOMEM);
719
720 errno = 0;
721 r = blkid_probe_set_sectorsize(b, m->sector_size);
722 if (r != 0)
723 return errno_or_else(EIO);
724
725 if ((flags & DISSECT_IMAGE_GPT_ONLY) == 0) {
726 /* Look for file system superblocks, unless we only shall look for GPT partition tables */
727 blkid_probe_enable_superblocks(b, 1);
728 blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE|BLKID_SUBLKS_USAGE|BLKID_SUBLKS_UUID);
729 }
730
731 blkid_probe_enable_partitions(b, 1);
732 blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
733
734 errno = 0;
735 r = blkid_do_safeprobe(b);
736 if (r == _BLKID_SAFEPROBE_ERROR)
737 return errno_or_else(EIO);
738 if (IN_SET(r, _BLKID_SAFEPROBE_AMBIGUOUS, _BLKID_SAFEPROBE_NOT_FOUND))
739 return log_debug_errno(SYNTHETIC_ERRNO(ENOPKG), "Failed to identify any partition table.");
740
741 assert(r == _BLKID_SAFEPROBE_FOUND);
742
743 if ((!(flags & DISSECT_IMAGE_GPT_ONLY) &&
744 (flags & DISSECT_IMAGE_GENERIC_ROOT)) ||
745 (flags & DISSECT_IMAGE_NO_PARTITION_TABLE)) {
746 const char *usage = NULL;
747
748 /* If flags permit this, also allow using non-partitioned single-filesystem images */
749
750 (void) blkid_probe_lookup_value(b, "USAGE", &usage, NULL);
751 if (STRPTR_IN_SET(usage, "filesystem", "crypto")) {
752 _cleanup_free_ char *t = NULL, *n = NULL, *o = NULL;
753 const char *fstype = NULL, *options = NULL, *suuid = NULL;
754 _cleanup_close_ int mount_node_fd = -EBADF;
755 sd_id128_t uuid = SD_ID128_NULL;
756 PartitionPolicyFlags found_flags;
757 bool encrypted;
758
759 /* OK, we have found a file system, that's our root partition then. */
760
761 r = image_policy_may_use(policy, PARTITION_ROOT);
762 if (r < 0)
763 return r;
764 if (r == 0) /* policy says ignore this, so we ignore it */
765 return -ENOPKG;
766
767 (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
768 (void) blkid_probe_lookup_value(b, "UUID", &suuid, NULL);
769
770 encrypted = streq_ptr(fstype, "crypto_LUKS");
771
772 if (verity_settings_data_covers(verity, PARTITION_ROOT))
773 found_flags = verity->root_hash_sig ? PARTITION_POLICY_SIGNED : PARTITION_POLICY_VERITY;
774 else
775 found_flags = encrypted ? PARTITION_POLICY_ENCRYPTED : PARTITION_POLICY_UNPROTECTED;
776
777 r = image_policy_check_protection(policy, PARTITION_ROOT, found_flags);
778 if (r < 0)
779 return r;
780
781 r = image_policy_check_partition_flags(policy, PARTITION_ROOT, 0); /* we have no gpt partition flags, hence check against all bits off */
782 if (r < 0)
783 return r;
784
785 if (FLAGS_SET(flags, DISSECT_IMAGE_PIN_PARTITION_DEVICES)) {
786 mount_node_fd = open_partition(devname, /* is_partition = */ false, m->loop);
787 if (mount_node_fd < 0)
788 return mount_node_fd;
789 }
790
791 if (fstype) {
792 t = strdup(fstype);
793 if (!t)
794 return -ENOMEM;
795 }
796
797 if (suuid) {
798 /* blkid will return FAT's serial number as UUID, hence it is quite possible
799 * that parsing this will fail. We'll ignore the ID, since it's just too
800 * short to be useful as tru identifier. */
801 r = sd_id128_from_string(suuid, &uuid);
802 if (r < 0)
803 log_debug_errno(r, "Failed to parse file system UUID '%s', ignoring: %m", suuid);
804 }
805
806 r = make_partition_devname(devname, diskseq, -1, flags, &n);
807 if (r < 0)
808 return r;
809
810 m->single_file_system = true;
811 m->encrypted = encrypted;
812
813 m->has_verity = verity && verity->data_path;
814 m->verity_ready = verity_settings_data_covers(verity, PARTITION_ROOT);
815
816 m->has_verity_sig = false; /* signature not embedded, must be specified */
817 m->verity_sig_ready = m->verity_ready && verity->root_hash_sig;
818
819 m->image_uuid = uuid;
820
821 options = mount_options_from_designator(mount_options, PARTITION_ROOT);
822 if (options) {
823 o = strdup(options);
824 if (!o)
825 return -ENOMEM;
826 }
827
828 m->partitions[PARTITION_ROOT] = (DissectedPartition) {
829 .found = true,
830 .rw = !m->verity_ready && !fstype_is_ro(fstype),
831 .partno = -1,
832 .architecture = _ARCHITECTURE_INVALID,
833 .fstype = TAKE_PTR(t),
834 .node = TAKE_PTR(n),
835 .mount_options = TAKE_PTR(o),
836 .mount_node_fd = TAKE_FD(mount_node_fd),
837 .offset = 0,
838 .size = UINT64_MAX,
839 };
840
841 return 0;
842 }
843 }
844
845 (void) blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
846 if (!pttype)
847 return -ENOPKG;
848
849 is_gpt = streq_ptr(pttype, "gpt");
850 is_mbr = streq_ptr(pttype, "dos");
851
852 if (!is_gpt && ((flags & DISSECT_IMAGE_GPT_ONLY) || !is_mbr))
853 return -ENOPKG;
854
855 /* We support external verity data partitions only if the image has no partition table */
856 if (verity && verity->data_path)
857 return -EBADR;
858
859 if (FLAGS_SET(flags, DISSECT_IMAGE_ADD_PARTITION_DEVICES)) {
860 /* Safety check: refuse block devices that carry a partition table but for which the kernel doesn't
861 * do partition scanning. */
862 r = blockdev_partscan_enabled(fd);
863 if (r < 0)
864 return r;
865 if (r == 0)
866 return -EPROTONOSUPPORT;
867 }
868
869 (void) blkid_probe_lookup_value(b, "PTUUID", &sptuuid, NULL);
870 if (sptuuid) {
871 r = sd_id128_from_string(sptuuid, &m->image_uuid);
872 if (r < 0)
873 log_debug_errno(r, "Failed to parse partition table UUID '%s', ignoring: %m", sptuuid);
874 }
875
876 errno = 0;
877 pl = blkid_probe_get_partitions(b);
878 if (!pl)
879 return errno_or_else(ENOMEM);
880
881 errno = 0;
882 n_partitions = blkid_partlist_numof_partitions(pl);
883 if (n_partitions < 0)
884 return errno_or_else(EIO);
885
886 for (int i = 0; i < n_partitions; i++) {
887 _cleanup_free_ char *node = NULL;
888 unsigned long long pflags;
889 blkid_loff_t start, size;
890 blkid_partition pp;
891 int nr;
892
893 errno = 0;
894 pp = blkid_partlist_get_partition(pl, i);
895 if (!pp)
896 return errno_or_else(EIO);
897
898 pflags = blkid_partition_get_flags(pp);
899
900 errno = 0;
901 nr = blkid_partition_get_partno(pp);
902 if (nr < 0)
903 return errno_or_else(EIO);
904
905 errno = 0;
906 start = blkid_partition_get_start(pp);
907 if (start < 0)
908 return errno_or_else(EIO);
909
910 assert((uint64_t) start < UINT64_MAX/512);
911
912 errno = 0;
913 size = blkid_partition_get_size(pp);
914 if (size < 0)
915 return errno_or_else(EIO);
916
917 assert((uint64_t) size < UINT64_MAX/512);
918
919 /* While probing we need the non-diskseq device node name to access the thing, hence mask off
920 * DISSECT_IMAGE_DISKSEQ_DEVNODE. */
921 r = make_partition_devname(devname, diskseq, nr, flags & ~DISSECT_IMAGE_DISKSEQ_DEVNODE, &node);
922 if (r < 0)
923 return r;
924
925 /* So here's the thing: after the main ("whole") block device popped up it might take a while
926 * before the kernel fully probed the partition table. Waiting for that to finish is icky in
927 * userspace. So here's what we do instead. We issue the BLKPG_ADD_PARTITION ioctl to add the
928 * partition ourselves, racing against the kernel. Good thing is: if this call fails with
929 * EBUSY then the kernel was quicker than us, and that's totally OK, the outcome is good for
930 * us: the device node will exist. If OTOH our call was successful we won the race. Which is
931 * also good as the outcome is the same: the partition block device exists, and we can use
932 * it.
933 *
934 * Kernel returns EBUSY if there's already a partition by that number or an overlapping
935 * partition already existent. */
936
937 if (FLAGS_SET(flags, DISSECT_IMAGE_ADD_PARTITION_DEVICES)) {
938 r = block_device_add_partition(fd, node, nr, (uint64_t) start * 512, (uint64_t) size * 512);
939 if (r < 0) {
940 if (r != -EBUSY)
941 return log_debug_errno(r, "BLKPG_ADD_PARTITION failed: %m");
942
943 log_debug_errno(r, "Kernel was quicker than us in adding partition %i.", nr);
944 } else
945 log_debug("We were quicker than kernel in adding partition %i.", nr);
946 }
947
948 if (is_gpt) {
949 const char *fstype = NULL, *label;
950 sd_id128_t type_id, id;
951 GptPartitionType type;
952 bool rw = true, growfs = false;
953
954 r = blkid_partition_get_uuid_id128(pp, &id);
955 if (r < 0) {
956 log_debug_errno(r, "Failed to read partition UUID, ignoring: %m");
957 continue;
958 }
959
960 r = blkid_partition_get_type_id128(pp, &type_id);
961 if (r < 0) {
962 log_debug_errno(r, "Failed to read partition type UUID, ignoring: %m");
963 continue;
964 }
965
966 type = gpt_partition_type_from_uuid(type_id);
967
968 label = blkid_partition_get_name(pp); /* libblkid returns NULL here if empty */
969
970 if (IN_SET(type.designator,
971 PARTITION_HOME,
972 PARTITION_SRV,
973 PARTITION_XBOOTLDR,
974 PARTITION_TMP)) {
975
976 check_partition_flags(node, pflags,
977 SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY | SD_GPT_FLAG_GROWFS);
978
979 if (pflags & SD_GPT_FLAG_NO_AUTO)
980 continue;
981
982 rw = !(pflags & SD_GPT_FLAG_READ_ONLY);
983 growfs = FLAGS_SET(pflags, SD_GPT_FLAG_GROWFS);
984
985 } else if (type.designator == PARTITION_ESP) {
986
987 /* Note that we don't check the SD_GPT_FLAG_NO_AUTO flag for the ESP, as it is
988 * not defined there. We instead check the SD_GPT_FLAG_NO_BLOCK_IO_PROTOCOL, as
989 * recommended by the UEFI spec (See "12.3.3 Number and Location of System
990 * Partitions"). */
991
992 if (pflags & SD_GPT_FLAG_NO_BLOCK_IO_PROTOCOL)
993 continue;
994
995 fstype = "vfat";
996
997 } else if (type.designator == PARTITION_ROOT) {
998
999 check_partition_flags(node, pflags,
1000 SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY | SD_GPT_FLAG_GROWFS);
1001
1002 if (pflags & SD_GPT_FLAG_NO_AUTO)
1003 continue;
1004
1005 /* If a root ID is specified, ignore everything but the root id */
1006 if (!sd_id128_is_null(root_uuid) && !sd_id128_equal(root_uuid, id))
1007 continue;
1008
1009 rw = !(pflags & SD_GPT_FLAG_READ_ONLY);
1010 growfs = FLAGS_SET(pflags, SD_GPT_FLAG_GROWFS);
1011
1012 } else if (type.designator == PARTITION_ROOT_VERITY) {
1013
1014 check_partition_flags(node, pflags,
1015 SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY);
1016
1017 if (pflags & SD_GPT_FLAG_NO_AUTO)
1018 continue;
1019
1020 m->has_verity = true;
1021
1022 /* If no verity configuration is specified, then don't do verity */
1023 if (!verity)
1024 continue;
1025 if (verity->designator >= 0 && verity->designator != PARTITION_ROOT)
1026 continue;
1027
1028 /* If root hash is specified, then ignore everything but the root id */
1029 if (!sd_id128_is_null(root_verity_uuid) && !sd_id128_equal(root_verity_uuid, id))
1030 continue;
1031
1032 fstype = "DM_verity_hash";
1033 rw = false;
1034
1035 } else if (type.designator == PARTITION_ROOT_VERITY_SIG) {
1036
1037 check_partition_flags(node, pflags,
1038 SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY);
1039
1040 if (pflags & SD_GPT_FLAG_NO_AUTO)
1041 continue;
1042
1043 m->has_verity_sig = true;
1044
1045 if (!verity)
1046 continue;
1047 if (verity->designator >= 0 && verity->designator != PARTITION_ROOT)
1048 continue;
1049
1050 fstype = "verity_hash_signature";
1051 rw = false;
1052
1053 } else if (type.designator == PARTITION_USR) {
1054
1055 check_partition_flags(node, pflags,
1056 SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY | SD_GPT_FLAG_GROWFS);
1057
1058 if (pflags & SD_GPT_FLAG_NO_AUTO)
1059 continue;
1060
1061 /* If a usr ID is specified, ignore everything but the usr id */
1062 if (!sd_id128_is_null(usr_uuid) && !sd_id128_equal(usr_uuid, id))
1063 continue;
1064
1065 rw = !(pflags & SD_GPT_FLAG_READ_ONLY);
1066 growfs = FLAGS_SET(pflags, SD_GPT_FLAG_GROWFS);
1067
1068 } else if (type.designator == PARTITION_USR_VERITY) {
1069
1070 check_partition_flags(node, pflags,
1071 SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY);
1072
1073 if (pflags & SD_GPT_FLAG_NO_AUTO)
1074 continue;
1075
1076 m->has_verity = true;
1077
1078 if (!verity)
1079 continue;
1080 if (verity->designator >= 0 && verity->designator != PARTITION_USR)
1081 continue;
1082
1083 /* If usr hash is specified, then ignore everything but the usr id */
1084 if (!sd_id128_is_null(usr_verity_uuid) && !sd_id128_equal(usr_verity_uuid, id))
1085 continue;
1086
1087 fstype = "DM_verity_hash";
1088 rw = false;
1089
1090 } else if (type.designator == PARTITION_USR_VERITY_SIG) {
1091
1092 check_partition_flags(node, pflags,
1093 SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY);
1094
1095 if (pflags & SD_GPT_FLAG_NO_AUTO)
1096 continue;
1097
1098 m->has_verity_sig = true;
1099
1100 if (!verity)
1101 continue;
1102 if (verity->designator >= 0 && verity->designator != PARTITION_USR)
1103 continue;
1104
1105 fstype = "verity_hash_signature";
1106 rw = false;
1107
1108 } else if (type.designator == PARTITION_SWAP) {
1109
1110 check_partition_flags(node, pflags, SD_GPT_FLAG_NO_AUTO);
1111
1112 if (pflags & SD_GPT_FLAG_NO_AUTO)
1113 continue;
1114
1115 /* Note: we don't set fstype = "swap" here, because we still need to probe if
1116 * it might be encrypted (i.e. fstype "crypt_LUKS") or unencrypted
1117 * (i.e. fstype "swap"), and the only way to figure that out is via fstype
1118 * probing. */
1119
1120 /* We don't have a designator for SD_GPT_LINUX_GENERIC so check the UUID instead. */
1121 } else if (sd_id128_equal(type.uuid, SD_GPT_LINUX_GENERIC)) {
1122
1123 check_partition_flags(node, pflags,
1124 SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY | SD_GPT_FLAG_GROWFS);
1125
1126 if (pflags & SD_GPT_FLAG_NO_AUTO)
1127 continue;
1128
1129 if (generic_node)
1130 multiple_generic = true;
1131 else {
1132 generic_nr = nr;
1133 generic_rw = !(pflags & SD_GPT_FLAG_READ_ONLY);
1134 generic_growfs = FLAGS_SET(pflags, SD_GPT_FLAG_GROWFS);
1135 generic_uuid = id;
1136 generic_node = TAKE_PTR(node);
1137 }
1138
1139 } else if (type.designator == PARTITION_VAR) {
1140
1141 check_partition_flags(node, pflags,
1142 SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY | SD_GPT_FLAG_GROWFS);
1143
1144 if (pflags & SD_GPT_FLAG_NO_AUTO)
1145 continue;
1146
1147 if (!FLAGS_SET(flags, DISSECT_IMAGE_RELAX_VAR_CHECK)) {
1148 sd_id128_t var_uuid;
1149
1150 /* For /var we insist that the uuid of the partition matches the
1151 * HMAC-SHA256 of the /var GPT partition type uuid, keyed by machine
1152 * ID. Why? Unlike the other partitions /var is inherently
1153 * installation specific, hence we need to be careful not to mount it
1154 * in the wrong installation. By hashing the partition UUID from
1155 * /etc/machine-id we can securely bind the partition to the
1156 * installation. */
1157
1158 r = sd_id128_get_machine_app_specific(SD_GPT_VAR, &var_uuid);
1159 if (r < 0)
1160 return r;
1161
1162 if (!sd_id128_equal(var_uuid, id)) {
1163 log_debug("Found a /var/ partition, but its UUID didn't match our expectations "
1164 "(found: " SD_ID128_UUID_FORMAT_STR ", expected: " SD_ID128_UUID_FORMAT_STR "), ignoring.",
1165 SD_ID128_FORMAT_VAL(id), SD_ID128_FORMAT_VAL(var_uuid));
1166 continue;
1167 }
1168 }
1169
1170 rw = !(pflags & SD_GPT_FLAG_READ_ONLY);
1171 growfs = FLAGS_SET(pflags, SD_GPT_FLAG_GROWFS);
1172 }
1173
1174 if (type.designator != _PARTITION_DESIGNATOR_INVALID) {
1175 _cleanup_free_ char *t = NULL, *o = NULL, *l = NULL, *n = NULL;
1176 _cleanup_close_ int mount_node_fd = -EBADF;
1177 const char *options = NULL;
1178
1179 r = image_policy_may_use(policy, type.designator);
1180 if (r < 0)
1181 return r;
1182 if (r == 0) {
1183 /* Policy says: ignore; Remember this fact, so that we later can distinguish between "found but ignored" and "not found at all" */
1184
1185 if (!m->partitions[type.designator].found)
1186 m->partitions[type.designator].ignored = true;
1187
1188 continue;
1189 }
1190
1191 if (m->partitions[type.designator].found) {
1192 int c;
1193
1194 /* For most partition types the first one we see wins. Except for the
1195 * rootfs and /usr, where we do a version compare of the label, and
1196 * let the newest version win. This permits a simple A/B versioning
1197 * scheme in OS images. */
1198
1199 c = compare_arch(type.arch, m->partitions[type.designator].architecture);
1200 if (c < 0) /* the arch we already found is better than the one we found now */
1201 continue;
1202 if (c == 0 && /* same arch? then go by version in label */
1203 (!partition_designator_is_versioned(type.designator) ||
1204 strverscmp_improved(label, m->partitions[type.designator].label) <= 0))
1205 continue;
1206
1207 dissected_partition_done(m->partitions + type.designator);
1208 }
1209
1210 if (FLAGS_SET(flags, DISSECT_IMAGE_PIN_PARTITION_DEVICES) &&
1211 type.designator != PARTITION_SWAP) {
1212 mount_node_fd = open_partition(node, /* is_partition = */ true, m->loop);
1213 if (mount_node_fd < 0)
1214 return mount_node_fd;
1215 }
1216
1217 r = make_partition_devname(devname, diskseq, nr, flags, &n);
1218 if (r < 0)
1219 return r;
1220
1221 if (fstype) {
1222 t = strdup(fstype);
1223 if (!t)
1224 return -ENOMEM;
1225 }
1226
1227 if (label) {
1228 l = strdup(label);
1229 if (!l)
1230 return -ENOMEM;
1231 }
1232
1233 options = mount_options_from_designator(mount_options, type.designator);
1234 if (options) {
1235 o = strdup(options);
1236 if (!o)
1237 return -ENOMEM;
1238 }
1239
1240 m->partitions[type.designator] = (DissectedPartition) {
1241 .found = true,
1242 .partno = nr,
1243 .rw = rw,
1244 .growfs = growfs,
1245 .architecture = type.arch,
1246 .node = TAKE_PTR(n),
1247 .fstype = TAKE_PTR(t),
1248 .label = TAKE_PTR(l),
1249 .uuid = id,
1250 .mount_options = TAKE_PTR(o),
1251 .mount_node_fd = TAKE_FD(mount_node_fd),
1252 .offset = (uint64_t) start * 512,
1253 .size = (uint64_t) size * 512,
1254 .gpt_flags = pflags,
1255 };
1256 }
1257
1258 } else if (is_mbr) {
1259
1260 switch (blkid_partition_get_type(pp)) {
1261
1262 case 0x83: /* Linux partition */
1263
1264 if (pflags != 0x80) /* Bootable flag */
1265 continue;
1266
1267 if (generic_node)
1268 multiple_generic = true;
1269 else {
1270 generic_nr = nr;
1271 generic_rw = true;
1272 generic_growfs = false;
1273 generic_node = TAKE_PTR(node);
1274 }
1275
1276 break;
1277
1278 case 0xEA: { /* Boot Loader Spec extended $BOOT partition */
1279 _cleanup_close_ int mount_node_fd = -EBADF;
1280 _cleanup_free_ char *o = NULL, *n = NULL;
1281 sd_id128_t id = SD_ID128_NULL;
1282 const char *options = NULL;
1283
1284 r = image_policy_may_use(policy, PARTITION_XBOOTLDR);
1285 if (r < 0)
1286 return r;
1287 if (r == 0) { /* policy says: ignore */
1288 if (!m->partitions[PARTITION_XBOOTLDR].found)
1289 m->partitions[PARTITION_XBOOTLDR].ignored = true;
1290
1291 continue;
1292 }
1293
1294 /* First one wins */
1295 if (m->partitions[PARTITION_XBOOTLDR].found)
1296 continue;
1297
1298 if (FLAGS_SET(flags, DISSECT_IMAGE_PIN_PARTITION_DEVICES)) {
1299 mount_node_fd = open_partition(node, /* is_partition = */ true, m->loop);
1300 if (mount_node_fd < 0)
1301 return mount_node_fd;
1302 }
1303
1304 (void) blkid_partition_get_uuid_id128(pp, &id);
1305
1306 r = make_partition_devname(devname, diskseq, nr, flags, &n);
1307 if (r < 0)
1308 return r;
1309
1310 options = mount_options_from_designator(mount_options, PARTITION_XBOOTLDR);
1311 if (options) {
1312 o = strdup(options);
1313 if (!o)
1314 return -ENOMEM;
1315 }
1316
1317 m->partitions[PARTITION_XBOOTLDR] = (DissectedPartition) {
1318 .found = true,
1319 .partno = nr,
1320 .rw = true,
1321 .growfs = false,
1322 .architecture = _ARCHITECTURE_INVALID,
1323 .node = TAKE_PTR(n),
1324 .uuid = id,
1325 .mount_options = TAKE_PTR(o),
1326 .mount_node_fd = TAKE_FD(mount_node_fd),
1327 .offset = (uint64_t) start * 512,
1328 .size = (uint64_t) size * 512,
1329 };
1330
1331 break;
1332 }}
1333 }
1334 }
1335
1336 if (!m->partitions[PARTITION_ROOT].found &&
1337 (m->partitions[PARTITION_ROOT_VERITY].found ||
1338 m->partitions[PARTITION_ROOT_VERITY_SIG].found))
1339 return -EADDRNOTAVAIL; /* Verity found but no matching rootfs? Something is off, refuse. */
1340
1341 /* Hmm, we found a signature partition but no Verity data? Something is off. */
1342 if (m->partitions[PARTITION_ROOT_VERITY_SIG].found && !m->partitions[PARTITION_ROOT_VERITY].found)
1343 return -EADDRNOTAVAIL;
1344
1345 if (!m->partitions[PARTITION_USR].found &&
1346 (m->partitions[PARTITION_USR_VERITY].found ||
1347 m->partitions[PARTITION_USR_VERITY_SIG].found))
1348 return -EADDRNOTAVAIL; /* as above */
1349
1350 /* as above */
1351 if (m->partitions[PARTITION_USR_VERITY_SIG].found && !m->partitions[PARTITION_USR_VERITY].found)
1352 return -EADDRNOTAVAIL;
1353
1354 /* If root and /usr are combined then insist that the architecture matches */
1355 if (m->partitions[PARTITION_ROOT].found &&
1356 m->partitions[PARTITION_USR].found &&
1357 (m->partitions[PARTITION_ROOT].architecture >= 0 &&
1358 m->partitions[PARTITION_USR].architecture >= 0 &&
1359 m->partitions[PARTITION_ROOT].architecture != m->partitions[PARTITION_USR].architecture))
1360 return -EADDRNOTAVAIL;
1361
1362 if (!m->partitions[PARTITION_ROOT].found &&
1363 !m->partitions[PARTITION_USR].found &&
1364 (flags & DISSECT_IMAGE_GENERIC_ROOT) &&
1365 (!verity || !verity->root_hash || verity->designator != PARTITION_USR)) {
1366
1367 /* OK, we found nothing usable, then check if there's a single generic partition, and use
1368 * that. If the root hash was set however, then we won't fall back to a generic node, because
1369 * the root hash decides. */
1370
1371 /* If we didn't find a properly marked root partition, but we did find a single suitable
1372 * generic Linux partition, then use this as root partition, if the caller asked for it. */
1373 if (multiple_generic)
1374 return -ENOTUNIQ;
1375
1376 /* If we didn't find a generic node, then we can't fix this up either */
1377 if (generic_node) {
1378 r = image_policy_may_use(policy, PARTITION_ROOT);
1379 if (r < 0)
1380 return r;
1381 if (r == 0)
1382 /* Policy says: ignore; remember that we did */
1383 m->partitions[PARTITION_ROOT].ignored = true;
1384 else {
1385 _cleanup_close_ int mount_node_fd = -EBADF;
1386 _cleanup_free_ char *o = NULL, *n = NULL;
1387 const char *options;
1388
1389 if (FLAGS_SET(flags, DISSECT_IMAGE_PIN_PARTITION_DEVICES)) {
1390 mount_node_fd = open_partition(generic_node, /* is_partition = */ true, m->loop);
1391 if (mount_node_fd < 0)
1392 return mount_node_fd;
1393 }
1394
1395 r = make_partition_devname(devname, diskseq, generic_nr, flags, &n);
1396 if (r < 0)
1397 return r;
1398
1399 options = mount_options_from_designator(mount_options, PARTITION_ROOT);
1400 if (options) {
1401 o = strdup(options);
1402 if (!o)
1403 return -ENOMEM;
1404 }
1405
1406 assert(generic_nr >= 0);
1407 m->partitions[PARTITION_ROOT] = (DissectedPartition) {
1408 .found = true,
1409 .rw = generic_rw,
1410 .growfs = generic_growfs,
1411 .partno = generic_nr,
1412 .architecture = _ARCHITECTURE_INVALID,
1413 .node = TAKE_PTR(n),
1414 .uuid = generic_uuid,
1415 .mount_options = TAKE_PTR(o),
1416 .mount_node_fd = TAKE_FD(mount_node_fd),
1417 .offset = UINT64_MAX,
1418 .size = UINT64_MAX,
1419 };
1420 }
1421 }
1422 }
1423
1424 /* Check if we have a root fs if we are told to do check. /usr alone is fine too, but only if appropriate flag for that is set too */
1425 if (FLAGS_SET(flags, DISSECT_IMAGE_REQUIRE_ROOT) &&
1426 !(m->partitions[PARTITION_ROOT].found || (m->partitions[PARTITION_USR].found && FLAGS_SET(flags, DISSECT_IMAGE_USR_NO_ROOT))))
1427 return -ENXIO;
1428
1429 if (m->partitions[PARTITION_ROOT_VERITY].found) {
1430 /* We only support one verity partition per image, i.e. can't do for both /usr and root fs */
1431 if (m->partitions[PARTITION_USR_VERITY].found)
1432 return -ENOTUNIQ;
1433
1434 /* We don't support verity enabled root with a split out /usr. Neither with nor without
1435 * verity there. (Note that we do support verity-less root with verity-full /usr, though.) */
1436 if (m->partitions[PARTITION_USR].found)
1437 return -EADDRNOTAVAIL;
1438 }
1439
1440 if (verity) {
1441 /* If a verity designator is specified, then insist that the matching partition exists */
1442 if (verity->designator >= 0 && !m->partitions[verity->designator].found)
1443 return -EADDRNOTAVAIL;
1444
1445 bool have_verity_sig_partition =
1446 m->partitions[verity->designator == PARTITION_USR ? PARTITION_USR_VERITY_SIG : PARTITION_ROOT_VERITY_SIG].found;
1447
1448 if (verity->root_hash) {
1449 /* If we have an explicit root hash and found the partitions for it, then we are ready to use
1450 * Verity, set things up for it */
1451
1452 if (verity->designator < 0 || verity->designator == PARTITION_ROOT) {
1453 if (!m->partitions[PARTITION_ROOT_VERITY].found || !m->partitions[PARTITION_ROOT].found)
1454 return -EADDRNOTAVAIL;
1455
1456 /* If we found a verity setup, then the root partition is necessarily read-only. */
1457 m->partitions[PARTITION_ROOT].rw = false;
1458 m->verity_ready = true;
1459
1460 } else {
1461 assert(verity->designator == PARTITION_USR);
1462
1463 if (!m->partitions[PARTITION_USR_VERITY].found || !m->partitions[PARTITION_USR].found)
1464 return -EADDRNOTAVAIL;
1465
1466 m->partitions[PARTITION_USR].rw = false;
1467 m->verity_ready = true;
1468 }
1469
1470 if (m->verity_ready)
1471 m->verity_sig_ready = verity->root_hash_sig || have_verity_sig_partition;
1472
1473 } else if (have_verity_sig_partition) {
1474
1475 /* If we found an embedded signature partition, we are ready, too. */
1476
1477 m->verity_ready = m->verity_sig_ready = true;
1478 m->partitions[verity->designator == PARTITION_USR ? PARTITION_USR : PARTITION_ROOT].rw = false;
1479 }
1480 }
1481
1482 bool any = false;
1483
1484 /* After we discovered all partitions let's see if the verity requirements match the policy. (Note:
1485 * we don't check encryption requirements here, because we haven't probed the file system yet, hence
1486 * don't know if this is encrypted or not) */
1487 for (PartitionDesignator di = 0; di < _PARTITION_DESIGNATOR_MAX; di++) {
1488 PartitionDesignator vi, si;
1489 PartitionPolicyFlags found_flags;
1490
1491 any = any || m->partitions[di].found;
1492
1493 vi = partition_verity_of(di);
1494 si = partition_verity_sig_of(di);
1495
1496 /* Determine the verity protection level for this partition. */
1497 found_flags = m->partitions[di].found ?
1498 (vi >= 0 && m->partitions[vi].found ?
1499 (si >= 0 && m->partitions[si].found ? PARTITION_POLICY_SIGNED : PARTITION_POLICY_VERITY) :
1500 PARTITION_POLICY_ENCRYPTED|PARTITION_POLICY_UNPROTECTED) :
1501 (m->partitions[di].ignored ? PARTITION_POLICY_UNUSED : PARTITION_POLICY_ABSENT);
1502
1503 r = image_policy_check_protection(policy, di, found_flags);
1504 if (r < 0)
1505 return r;
1506
1507 if (m->partitions[di].found) {
1508 r = image_policy_check_partition_flags(policy, di, m->partitions[di].gpt_flags);
1509 if (r < 0)
1510 return r;
1511 }
1512 }
1513
1514 if (!any && !FLAGS_SET(flags, DISSECT_IMAGE_ALLOW_EMPTY))
1515 return -ENOMSG;
1516
1517 r = dissected_image_probe_filesystems(m, fd, policy);
1518 if (r < 0)
1519 return r;
1520
1521 return 0;
1522 }
1523 #endif
1524
1525 int dissect_image_file(
1526 const char *path,
1527 const VeritySettings *verity,
1528 const MountOptions *mount_options,
1529 const ImagePolicy *image_policy,
1530 DissectImageFlags flags,
1531 DissectedImage **ret) {
1532
1533 #if HAVE_BLKID
1534 _cleanup_(dissected_image_unrefp) DissectedImage *m = NULL;
1535 _cleanup_close_ int fd = -EBADF;
1536 int r;
1537
1538 assert(path);
1539
1540 fd = open(path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
1541 if (fd < 0)
1542 return -errno;
1543
1544 r = fd_verify_regular(fd);
1545 if (r < 0)
1546 return r;
1547
1548 r = dissected_image_new(path, &m);
1549 if (r < 0)
1550 return r;
1551
1552 r = probe_sector_size(fd, &m->sector_size);
1553 if (r < 0)
1554 return r;
1555
1556 r = dissect_image(m, fd, path, verity, mount_options, image_policy, flags);
1557 if (r < 0)
1558 return r;
1559
1560 if (ret)
1561 *ret = TAKE_PTR(m);
1562 return 0;
1563 #else
1564 return -EOPNOTSUPP;
1565 #endif
1566 }
1567
1568 int dissect_log_error(int log_level, int r, const char *name, const VeritySettings *verity) {
1569 assert(log_level >= 0 && log_level <= LOG_DEBUG);
1570 assert(name);
1571
1572 switch (r) {
1573
1574 case 0 ... INT_MAX: /* success! */
1575 return r;
1576
1577 case -EOPNOTSUPP:
1578 return log_full_errno(log_level, r, "Dissecting images is not supported, compiled without blkid support.");
1579
1580 case -ENOPKG:
1581 return log_full_errno(log_level, r, "%s: Couldn't identify a suitable partition table or file system.", name);
1582
1583 case -ENOMEDIUM:
1584 return log_full_errno(log_level, r, "%s: The image does not pass os-release/extension-release validation.", name);
1585
1586 case -EADDRNOTAVAIL:
1587 return log_full_errno(log_level, r, "%s: No root partition for specified root hash found.", name);
1588
1589 case -ENOTUNIQ:
1590 return log_full_errno(log_level, r, "%s: Multiple suitable root partitions found in image.", name);
1591
1592 case -ENXIO:
1593 return log_full_errno(log_level, r, "%s: No suitable root partition found in image.", name);
1594
1595 case -EPROTONOSUPPORT:
1596 return log_full_errno(log_level, r, "Device '%s' is a loopback block device with partition scanning turned off, please turn it on.", name);
1597
1598 case -ENOTBLK:
1599 return log_full_errno(log_level, r, "%s: Image is not a block device.", name);
1600
1601 case -EBADR:
1602 return log_full_errno(log_level, r,
1603 "Combining partitioned images (such as '%s') with external Verity data (such as '%s') not supported. "
1604 "(Consider setting $SYSTEMD_DISSECT_VERITY_SIDECAR=0 to disable automatic discovery of external Verity data.)",
1605 name, strna(verity ? verity->data_path : NULL));
1606
1607 case -ERFKILL:
1608 return log_full_errno(log_level, r, "%s: image does not match image policy.", name);
1609
1610 case -ENOMSG:
1611 return log_full_errno(log_level, r, "%s: no suitable partitions found.", name);
1612
1613 default:
1614 return log_full_errno(log_level, r, "%s: cannot dissect image: %m", name);
1615 }
1616 }
1617
1618 int dissect_image_file_and_warn(
1619 const char *path,
1620 const VeritySettings *verity,
1621 const MountOptions *mount_options,
1622 const ImagePolicy *image_policy,
1623 DissectImageFlags flags,
1624 DissectedImage **ret) {
1625
1626 return dissect_log_error(
1627 LOG_ERR,
1628 dissect_image_file(path, verity, mount_options, image_policy, flags, ret),
1629 path,
1630 verity);
1631 }
1632
1633 DissectedImage* dissected_image_unref(DissectedImage *m) {
1634 if (!m)
1635 return NULL;
1636
1637 /* First, clear dissected partitions. */
1638 for (PartitionDesignator i = 0; i < _PARTITION_DESIGNATOR_MAX; i++)
1639 dissected_partition_done(m->partitions + i);
1640
1641 /* Second, free decrypted images. This must be after dissected_partition_done(), as freeing
1642 * DecryptedImage may try to deactivate partitions. */
1643 decrypted_image_unref(m->decrypted_image);
1644
1645 /* Third, unref LoopDevice. This must be called after the above two, as freeing LoopDevice may try to
1646 * remove existing partitions on the loopback block device. */
1647 loop_device_unref(m->loop);
1648
1649 free(m->image_name);
1650 free(m->hostname);
1651 strv_free(m->machine_info);
1652 strv_free(m->os_release);
1653 strv_free(m->initrd_release);
1654 strv_free(m->extension_release);
1655
1656 return mfree(m);
1657 }
1658
1659 static int is_loop_device(const char *path) {
1660 char s[SYS_BLOCK_PATH_MAX("/../loop/")];
1661 struct stat st;
1662
1663 assert(path);
1664
1665 if (stat(path, &st) < 0)
1666 return -errno;
1667
1668 if (!S_ISBLK(st.st_mode))
1669 return -ENOTBLK;
1670
1671 xsprintf_sys_block_path(s, "/loop/", st.st_dev);
1672 if (access(s, F_OK) < 0) {
1673 if (errno != ENOENT)
1674 return -errno;
1675
1676 /* The device itself isn't a loop device, but maybe it's a partition and its parent is? */
1677 xsprintf_sys_block_path(s, "/../loop/", st.st_dev);
1678 if (access(s, F_OK) < 0)
1679 return errno == ENOENT ? false : -errno;
1680 }
1681
1682 return true;
1683 }
1684
1685 static int run_fsck(int node_fd, const char *fstype) {
1686 int r, exit_status;
1687 pid_t pid;
1688
1689 assert(node_fd >= 0);
1690 assert(fstype);
1691
1692 r = fsck_exists_for_fstype(fstype);
1693 if (r < 0) {
1694 log_debug_errno(r, "Couldn't determine whether fsck for %s exists, proceeding anyway.", fstype);
1695 return 0;
1696 }
1697 if (r == 0) {
1698 log_debug("Not checking partition %s, as fsck for %s does not exist.", FORMAT_PROC_FD_PATH(node_fd), fstype);
1699 return 0;
1700 }
1701
1702 r = safe_fork_full(
1703 "(fsck)",
1704 NULL,
1705 &node_fd, 1, /* Leave the node fd open */
1706 FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_REARRANGE_STDIO|FORK_CLOEXEC_OFF,
1707 &pid);
1708 if (r < 0)
1709 return log_debug_errno(r, "Failed to fork off fsck: %m");
1710 if (r == 0) {
1711 /* Child */
1712 execlp("fsck", "fsck", "-aT", FORMAT_PROC_FD_PATH(node_fd), NULL);
1713 log_open();
1714 log_debug_errno(errno, "Failed to execl() fsck: %m");
1715 _exit(FSCK_OPERATIONAL_ERROR);
1716 }
1717
1718 exit_status = wait_for_terminate_and_check("fsck", pid, 0);
1719 if (exit_status < 0)
1720 return log_debug_errno(exit_status, "Failed to fork off fsck: %m");
1721
1722 if ((exit_status & ~FSCK_ERROR_CORRECTED) != FSCK_SUCCESS) {
1723 log_debug("fsck failed with exit status %i.", exit_status);
1724
1725 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
1726 return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN), "File system is corrupted, refusing.");
1727
1728 log_debug("Ignoring fsck error.");
1729 }
1730
1731 return 0;
1732 }
1733
1734 static int fs_grow(const char *node_path, const char *mount_path) {
1735 _cleanup_close_ int mount_fd = -EBADF, node_fd = -EBADF;
1736 uint64_t size, newsize;
1737 int r;
1738
1739 node_fd = open(node_path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
1740 if (node_fd < 0)
1741 return log_debug_errno(errno, "Failed to open node device %s: %m", node_path);
1742
1743 if (ioctl(node_fd, BLKGETSIZE64, &size) != 0)
1744 return log_debug_errno(errno, "Failed to get block device size of %s: %m", node_path);
1745
1746 mount_fd = open(mount_path, O_RDONLY|O_DIRECTORY|O_CLOEXEC);
1747 if (mount_fd < 0)
1748 return log_debug_errno(errno, "Failed to open mountd file system %s: %m", mount_path);
1749
1750 log_debug("Resizing \"%s\" to %"PRIu64" bytes...", mount_path, size);
1751 r = resize_fs(mount_fd, size, &newsize);
1752 if (r < 0)
1753 return log_debug_errno(r, "Failed to resize \"%s\" to %"PRIu64" bytes: %m", mount_path, size);
1754
1755 if (newsize == size)
1756 log_debug("Successfully resized \"%s\" to %s bytes.",
1757 mount_path, FORMAT_BYTES(newsize));
1758 else {
1759 assert(newsize < size);
1760 log_debug("Successfully resized \"%s\" to %s bytes (%"PRIu64" bytes lost due to blocksize).",
1761 mount_path, FORMAT_BYTES(newsize), size - newsize);
1762 }
1763
1764 return 0;
1765 }
1766
1767 int partition_pick_mount_options(
1768 PartitionDesignator d,
1769 const char *fstype,
1770 bool rw,
1771 bool discard,
1772 char **ret_options,
1773 unsigned long *ret_ms_flags) {
1774
1775 _cleanup_free_ char *options = NULL;
1776
1777 assert(ret_options);
1778
1779 /* Selects a baseline of bind mount flags, that should always apply.
1780 *
1781 * Firstly, we set MS_NODEV universally on all mounts, since we don't want to allow device nodes outside of /dev/.
1782 *
1783 * On /var/tmp/ we'll also set MS_NOSUID, same as we set for /tmp/ on the host.
1784 *
1785 * On the ESP and XBOOTLDR partitions we'll also disable symlinks, and execution. These file systems
1786 * are generally untrusted (i.e. not encrypted or authenticated), and typically VFAT hence we should
1787 * be as restrictive as possible, and this shouldn't hurt, since the functionality is not available
1788 * there anyway. */
1789
1790 unsigned long flags = MS_NODEV;
1791
1792 if (!rw)
1793 flags |= MS_RDONLY;
1794
1795 switch (d) {
1796
1797 case PARTITION_ESP:
1798 case PARTITION_XBOOTLDR:
1799 flags |= MS_NOSUID|MS_NOEXEC|ms_nosymfollow_supported();
1800
1801 /* The ESP might contain a pre-boot random seed. Let's make this unaccessible to regular
1802 * userspace. ESP/XBOOTLDR is almost certainly VFAT, hence if we don't know assume it is. */
1803 if (!fstype || fstype_can_umask(fstype))
1804 if (!strextend_with_separator(&options, ",", "umask=0077"))
1805 return -ENOMEM;
1806 break;
1807
1808 case PARTITION_TMP:
1809 flags |= MS_NOSUID;
1810 break;
1811
1812 default:
1813 break;
1814 }
1815
1816 /* So, when you request MS_RDONLY from ext4, then this means nothing. It happily still writes to the
1817 * backing storage. What's worse, the BLKRO[GS]ET flag and (in case of loopback devices)
1818 * LO_FLAGS_READ_ONLY don't mean anything, they affect userspace accesses only, and write accesses
1819 * from the upper file system still get propagated through to the underlying file system,
1820 * unrestricted. To actually get ext4/xfs/btrfs to stop writing to the device we need to specify
1821 * "norecovery" as mount option, in addition to MS_RDONLY. Yes, this sucks, since it means we need to
1822 * carry a per file system table here.
1823 *
1824 * Note that this means that we might not be able to mount corrupted file systems as read-only
1825 * anymore (since in some cases the kernel implementations will refuse mounting when corrupted,
1826 * read-only and "norecovery" is specified). But I think for the case of automatically determined
1827 * mount options for loopback devices this is the right choice, since otherwise using the same
1828 * loopback file twice even in read-only mode, is going to fail badly sooner or later. The use case of
1829 * making reuse of the immutable images "just work" is more relevant to us than having read-only
1830 * access that actually modifies stuff work on such image files. Or to say this differently: if
1831 * people want their file systems to be fixed up they should just open them in writable mode, where
1832 * all these problems don't exist. */
1833 if (!rw && fstype && fstype_can_norecovery(fstype))
1834 if (!strextend_with_separator(&options, ",", "norecovery"))
1835 return -ENOMEM;
1836
1837 if (discard && fstype && fstype_can_discard(fstype))
1838 if (!strextend_with_separator(&options, ",", "discard"))
1839 return -ENOMEM;
1840
1841 if (!ret_ms_flags) /* Fold flags into option string if ret_flags specified as NULL */
1842 if (!strextend_with_separator(&options, ",",
1843 FLAGS_SET(flags, MS_RDONLY) ? "ro" : "rw",
1844 FLAGS_SET(flags, MS_NODEV) ? "nodev" : "dev",
1845 FLAGS_SET(flags, MS_NOSUID) ? "nosuid" : "suid",
1846 FLAGS_SET(flags, MS_NOEXEC) ? "noexec" : "exec",
1847 FLAGS_SET(flags, MS_NOSYMFOLLOW) ? "nosymfollow" : NULL))
1848 /* NB: we suppress 'symfollow' here, since it's the default, and old /bin/mount might not know it */
1849 return -ENOMEM;
1850
1851 if (ret_ms_flags)
1852 *ret_ms_flags = flags;
1853
1854 *ret_options = TAKE_PTR(options);
1855 return 0;
1856 }
1857
1858 static int mount_partition(
1859 PartitionDesignator d,
1860 DissectedPartition *m,
1861 const char *where,
1862 const char *directory,
1863 uid_t uid_shift,
1864 uid_t uid_range,
1865 DissectImageFlags flags) {
1866
1867 _cleanup_free_ char *chased = NULL, *options = NULL;
1868 bool rw, discard, remap_uid_gid = false;
1869 const char *p, *node, *fstype;
1870 unsigned long ms_flags;
1871 int r;
1872
1873 assert(m);
1874 assert(where);
1875
1876 if (m->mount_node_fd < 0)
1877 return 0;
1878
1879 /* Use decrypted node and matching fstype if available, otherwise use the original device */
1880 node = FORMAT_PROC_FD_PATH(m->mount_node_fd);
1881 fstype = dissected_partition_fstype(m);
1882
1883 if (!fstype)
1884 return -EAFNOSUPPORT;
1885
1886 /* We are looking at an encrypted partition? This either means stacked encryption, or the caller
1887 * didn't call dissected_image_decrypt() beforehand. Let's return a recognizable error for this
1888 * case. */
1889 if (streq(fstype, "crypto_LUKS"))
1890 return -EUNATCH;
1891
1892 r = dissect_fstype_ok(fstype);
1893 if (r < 0)
1894 return r;
1895 if (!r)
1896 return -EIDRM; /* Recognizable error */
1897
1898 rw = m->rw && !(flags & DISSECT_IMAGE_MOUNT_READ_ONLY);
1899
1900 discard = ((flags & DISSECT_IMAGE_DISCARD) ||
1901 ((flags & DISSECT_IMAGE_DISCARD_ON_LOOP) && is_loop_device(m->node) > 0));
1902
1903 if (FLAGS_SET(flags, DISSECT_IMAGE_FSCK) && rw) {
1904 r = run_fsck(m->mount_node_fd, fstype);
1905 if (r < 0)
1906 return r;
1907 }
1908
1909 if (directory) {
1910 /* Automatically create missing mount points inside the image, if necessary. */
1911 r = mkdir_p_root(where, directory, uid_shift, (gid_t) uid_shift, 0755, NULL);
1912 if (r < 0 && r != -EROFS)
1913 return r;
1914
1915 r = chase(directory, where, CHASE_PREFIX_ROOT, &chased, NULL);
1916 if (r < 0)
1917 return r;
1918
1919 p = chased;
1920 } else {
1921 /* Create top-level mount if missing – but only if this is asked for. This won't modify the
1922 * image (as the branch above does) but the host hierarchy, and the created directory might
1923 * survive our mount in the host hierarchy hence. */
1924 if (FLAGS_SET(flags, DISSECT_IMAGE_MKDIR)) {
1925 r = mkdir_p(where, 0755);
1926 if (r < 0)
1927 return r;
1928 }
1929
1930 p = where;
1931 }
1932
1933 r = partition_pick_mount_options(d, dissected_partition_fstype(m), rw, discard, &options, &ms_flags);
1934 if (r < 0)
1935 return r;
1936
1937 if (uid_is_valid(uid_shift) && uid_shift != 0) {
1938
1939 if (fstype_can_uid_gid(fstype)) {
1940 _cleanup_free_ char *uid_option = NULL;
1941
1942 if (asprintf(&uid_option, "uid=" UID_FMT ",gid=" GID_FMT, uid_shift, (gid_t) uid_shift) < 0)
1943 return -ENOMEM;
1944
1945 if (!strextend_with_separator(&options, ",", uid_option))
1946 return -ENOMEM;
1947 } else if (FLAGS_SET(flags, DISSECT_IMAGE_MOUNT_IDMAPPED))
1948 remap_uid_gid = true;
1949 }
1950
1951 if (!isempty(m->mount_options))
1952 if (!strextend_with_separator(&options, ",", m->mount_options))
1953 return -ENOMEM;
1954
1955 r = mount_nofollow_verbose(LOG_DEBUG, node, p, fstype, ms_flags, options);
1956 if (r < 0)
1957 return r;
1958
1959 if (rw && m->growfs && FLAGS_SET(flags, DISSECT_IMAGE_GROWFS))
1960 (void) fs_grow(node, p);
1961
1962 if (remap_uid_gid) {
1963 r = remount_idmap(p, uid_shift, uid_range, UID_INVALID, REMOUNT_IDMAPPING_HOST_ROOT);
1964 if (r < 0)
1965 return r;
1966 }
1967
1968 return 1;
1969 }
1970
1971 static int mount_root_tmpfs(const char *where, uid_t uid_shift, DissectImageFlags flags) {
1972 _cleanup_free_ char *options = NULL;
1973 int r;
1974
1975 assert(where);
1976
1977 /* For images that contain /usr/ but no rootfs, let's mount rootfs as tmpfs */
1978
1979 if (FLAGS_SET(flags, DISSECT_IMAGE_MKDIR)) {
1980 r = mkdir_p(where, 0755);
1981 if (r < 0)
1982 return r;
1983 }
1984
1985 if (uid_is_valid(uid_shift)) {
1986 if (asprintf(&options, "uid=" UID_FMT ",gid=" GID_FMT, uid_shift, (gid_t) uid_shift) < 0)
1987 return -ENOMEM;
1988 }
1989
1990 r = mount_nofollow_verbose(LOG_DEBUG, "rootfs", where, "tmpfs", MS_NODEV, options);
1991 if (r < 0)
1992 return r;
1993
1994 return 1;
1995 }
1996
1997 static int mount_point_is_available(const char *where, const char *path, bool missing_ok) {
1998 _cleanup_free_ char *p = NULL;
1999 int r;
2000
2001 /* Check whether <path> is suitable as a mountpoint, i.e. is an empty directory
2002 * or does not exist at all (when missing_ok). */
2003
2004 r = chase(path, where, CHASE_PREFIX_ROOT, &p, NULL);
2005 if (r == -ENOENT)
2006 return missing_ok;
2007 if (r < 0)
2008 return log_debug_errno(r, "Failed to chase \"%s\": %m", path);
2009
2010 r = dir_is_empty(p, /* ignore_hidden_or_backup= */ false);
2011 if (r == -ENOTDIR)
2012 return false;
2013 if (r < 0)
2014 return log_debug_errno(r, "Failed to check directory \"%s\": %m", p);
2015 return r > 0;
2016 }
2017
2018 int dissected_image_mount(
2019 DissectedImage *m,
2020 const char *where,
2021 uid_t uid_shift,
2022 uid_t uid_range,
2023 DissectImageFlags flags) {
2024
2025 int r;
2026
2027 assert(m);
2028 assert(where);
2029
2030 /* Returns:
2031 *
2032 * -ENXIO → No root partition found
2033 * -EMEDIUMTYPE → DISSECT_IMAGE_VALIDATE_OS set but no os-release/extension-release file found
2034 * -EUNATCH → Encrypted partition found for which no dm-crypt was set up yet
2035 * -EUCLEAN → fsck for file system failed
2036 * -EBUSY → File system already mounted/used elsewhere (kernel)
2037 * -EAFNOSUPPORT → File system type not supported or not known
2038 * -EIDRM → File system is not among allowlisted "common" file systems
2039 */
2040
2041 if (!(m->partitions[PARTITION_ROOT].found ||
2042 (m->partitions[PARTITION_USR].found && FLAGS_SET(flags, DISSECT_IMAGE_USR_NO_ROOT))))
2043 return -ENXIO; /* Require a root fs or at least a /usr/ fs (the latter is subject to a flag of its own) */
2044
2045 if ((flags & DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY) == 0) {
2046
2047 /* First mount the root fs. If there's none we use a tmpfs. */
2048 if (m->partitions[PARTITION_ROOT].found)
2049 r = mount_partition(PARTITION_ROOT, m->partitions + PARTITION_ROOT, where, NULL, uid_shift, uid_range, flags);
2050 else
2051 r = mount_root_tmpfs(where, uid_shift, flags);
2052 if (r < 0)
2053 return r;
2054
2055 /* For us mounting root always means mounting /usr as well */
2056 r = mount_partition(PARTITION_USR, m->partitions + PARTITION_USR, where, "/usr", uid_shift, uid_range, flags);
2057 if (r < 0)
2058 return r;
2059
2060 if ((flags & (DISSECT_IMAGE_VALIDATE_OS|DISSECT_IMAGE_VALIDATE_OS_EXT)) != 0) {
2061 /* If either one of the validation flags are set, ensure that the image qualifies
2062 * as one or the other (or both). */
2063 bool ok = false;
2064
2065 if (FLAGS_SET(flags, DISSECT_IMAGE_VALIDATE_OS)) {
2066 r = path_is_os_tree(where);
2067 if (r < 0)
2068 return r;
2069 if (r > 0)
2070 ok = true;
2071 }
2072 if (!ok && FLAGS_SET(flags, DISSECT_IMAGE_VALIDATE_OS_EXT)) {
2073 r = extension_has_forbidden_content(where);
2074 if (r < 0)
2075 return r;
2076 if (r == 0) {
2077 r = path_is_extension_tree(IMAGE_SYSEXT, where, m->image_name, FLAGS_SET(flags, DISSECT_IMAGE_RELAX_EXTENSION_CHECK));
2078 if (r == 0)
2079 r = path_is_extension_tree(IMAGE_CONFEXT, where, m->image_name, FLAGS_SET(flags, DISSECT_IMAGE_RELAX_EXTENSION_CHECK));
2080 if (r < 0)
2081 return r;
2082 if (r > 0)
2083 ok = true;
2084 }
2085 }
2086
2087 if (!ok)
2088 return -ENOMEDIUM;
2089 }
2090 }
2091
2092 if (flags & DISSECT_IMAGE_MOUNT_ROOT_ONLY)
2093 return 0;
2094
2095 r = mount_partition(PARTITION_HOME, m->partitions + PARTITION_HOME, where, "/home", uid_shift, uid_range, flags);
2096 if (r < 0)
2097 return r;
2098
2099 r = mount_partition(PARTITION_SRV, m->partitions + PARTITION_SRV, where, "/srv", uid_shift, uid_range, flags);
2100 if (r < 0)
2101 return r;
2102
2103 r = mount_partition(PARTITION_VAR, m->partitions + PARTITION_VAR, where, "/var", uid_shift, uid_range, flags);
2104 if (r < 0)
2105 return r;
2106
2107 r = mount_partition(PARTITION_TMP, m->partitions + PARTITION_TMP, where, "/var/tmp", uid_shift, uid_range, flags);
2108 if (r < 0)
2109 return r;
2110
2111 int slash_boot_is_available;
2112 r = slash_boot_is_available = mount_point_is_available(where, "/boot", /* missing_ok = */ true);
2113 if (r < 0)
2114 return r;
2115 if (r > 0) {
2116 r = mount_partition(PARTITION_XBOOTLDR, m->partitions + PARTITION_XBOOTLDR, where, "/boot", uid_shift, uid_range, flags);
2117 if (r < 0)
2118 return r;
2119 slash_boot_is_available = !r;
2120 }
2121
2122 if (m->partitions[PARTITION_ESP].found) {
2123 const char *esp_path = NULL;
2124
2125 /* Mount the ESP to /boot/ if it exists and is empty and we didn't already mount the XBOOTLDR
2126 * partition into it. Otherwise, use /efi instead, but only if it exists and is empty. */
2127
2128 if (slash_boot_is_available) {
2129 r = mount_point_is_available(where, "/boot", /* missing_ok = */ false);
2130 if (r < 0)
2131 return r;
2132 if (r > 0)
2133 esp_path = "/boot";
2134 }
2135
2136 if (!esp_path) {
2137 r = mount_point_is_available(where, "/efi", /* missing_ok = */ true);
2138 if (r < 0)
2139 return r;
2140 if (r > 0)
2141 esp_path = "/efi";
2142 }
2143
2144 if (esp_path) {
2145 /* OK, let's mount the ESP now (possibly creating the dir if missing) */
2146 r = mount_partition(PARTITION_ESP, m->partitions + PARTITION_ESP, where, esp_path, uid_shift, uid_range, flags);
2147 if (r < 0)
2148 return r;
2149 }
2150 }
2151
2152 return 0;
2153 }
2154
2155 int dissected_image_mount_and_warn(
2156 DissectedImage *m,
2157 const char *where,
2158 uid_t uid_shift,
2159 uid_t uid_range,
2160 DissectImageFlags flags) {
2161
2162 int r;
2163
2164 assert(m);
2165 assert(where);
2166
2167 r = dissected_image_mount(m, where, uid_shift, uid_range, flags);
2168 if (r == -ENXIO)
2169 return log_error_errno(r, "Not root file system found in image.");
2170 if (r == -EMEDIUMTYPE)
2171 return log_error_errno(r, "No suitable os-release/extension-release file in image found.");
2172 if (r == -EUNATCH)
2173 return log_error_errno(r, "Encrypted file system discovered, but decryption not requested.");
2174 if (r == -EUCLEAN)
2175 return log_error_errno(r, "File system check on image failed.");
2176 if (r == -EBUSY)
2177 return log_error_errno(r, "File system already mounted elsewhere.");
2178 if (r == -EAFNOSUPPORT)
2179 return log_error_errno(r, "File system type not supported or not known.");
2180 if (r == -EIDRM)
2181 return log_error_errno(r, "File system is too uncommon, refused.");
2182 if (r < 0)
2183 return log_error_errno(r, "Failed to mount image: %m");
2184
2185 return r;
2186 }
2187
2188 #if HAVE_LIBCRYPTSETUP
2189 struct DecryptedPartition {
2190 struct crypt_device *device;
2191 char *name;
2192 bool relinquished;
2193 };
2194 #endif
2195
2196 typedef struct DecryptedPartition DecryptedPartition;
2197
2198 struct DecryptedImage {
2199 unsigned n_ref;
2200 DecryptedPartition *decrypted;
2201 size_t n_decrypted;
2202 };
2203
2204 static DecryptedImage* decrypted_image_free(DecryptedImage *d) {
2205 #if HAVE_LIBCRYPTSETUP
2206 int r;
2207
2208 if (!d)
2209 return NULL;
2210
2211 for (size_t i = 0; i < d->n_decrypted; i++) {
2212 DecryptedPartition *p = d->decrypted + i;
2213
2214 if (p->device && p->name && !p->relinquished) {
2215 _cleanup_free_ char *node = NULL;
2216
2217 node = path_join("/dev/mapper", p->name);
2218 if (node) {
2219 r = btrfs_forget_device(node);
2220 if (r < 0 && r != -ENOENT)
2221 log_debug_errno(r, "Failed to forget btrfs device %s, ignoring: %m", node);
2222 } else
2223 log_oom_debug();
2224
2225 /* Let's deactivate lazily, as the dm volume may be already/still used by other processes. */
2226 r = sym_crypt_deactivate_by_name(p->device, p->name, CRYPT_DEACTIVATE_DEFERRED);
2227 if (r < 0)
2228 log_debug_errno(r, "Failed to deactivate encrypted partition %s", p->name);
2229 }
2230
2231 if (p->device)
2232 sym_crypt_free(p->device);
2233 free(p->name);
2234 }
2235
2236 free(d->decrypted);
2237 free(d);
2238 #endif
2239 return NULL;
2240 }
2241
2242 DEFINE_TRIVIAL_REF_UNREF_FUNC(DecryptedImage, decrypted_image, decrypted_image_free);
2243
2244 #if HAVE_LIBCRYPTSETUP
2245 static int decrypted_image_new(DecryptedImage **ret) {
2246 _cleanup_(decrypted_image_unrefp) DecryptedImage *d = NULL;
2247
2248 assert(ret);
2249
2250 d = new(DecryptedImage, 1);
2251 if (!d)
2252 return -ENOMEM;
2253
2254 *d = (DecryptedImage) {
2255 .n_ref = 1,
2256 };
2257
2258 *ret = TAKE_PTR(d);
2259 return 0;
2260 }
2261
2262 static int make_dm_name_and_node(const void *original_node, const char *suffix, char **ret_name, char **ret_node) {
2263 _cleanup_free_ char *name = NULL, *node = NULL;
2264 const char *base;
2265
2266 assert(original_node);
2267 assert(suffix);
2268 assert(ret_name);
2269 assert(ret_node);
2270
2271 base = strrchr(original_node, '/');
2272 if (!base)
2273 base = original_node;
2274 else
2275 base++;
2276 if (isempty(base))
2277 return -EINVAL;
2278
2279 name = strjoin(base, suffix);
2280 if (!name)
2281 return -ENOMEM;
2282 if (!filename_is_valid(name))
2283 return -EINVAL;
2284
2285 node = path_join(sym_crypt_get_dir(), name);
2286 if (!node)
2287 return -ENOMEM;
2288
2289 *ret_name = TAKE_PTR(name);
2290 *ret_node = TAKE_PTR(node);
2291
2292 return 0;
2293 }
2294
2295 static int decrypt_partition(
2296 DissectedPartition *m,
2297 const char *passphrase,
2298 DissectImageFlags flags,
2299 DecryptedImage *d) {
2300
2301 _cleanup_free_ char *node = NULL, *name = NULL;
2302 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
2303 _cleanup_close_ int fd = -EBADF;
2304 int r;
2305
2306 assert(m);
2307 assert(d);
2308
2309 if (!m->found || !m->node || !m->fstype)
2310 return 0;
2311
2312 if (!streq(m->fstype, "crypto_LUKS"))
2313 return 0;
2314
2315 if (!passphrase)
2316 return -ENOKEY;
2317
2318 r = dlopen_cryptsetup();
2319 if (r < 0)
2320 return r;
2321
2322 r = make_dm_name_and_node(m->node, "-decrypted", &name, &node);
2323 if (r < 0)
2324 return r;
2325
2326 if (!GREEDY_REALLOC0(d->decrypted, d->n_decrypted + 1))
2327 return -ENOMEM;
2328
2329 r = sym_crypt_init(&cd, m->node);
2330 if (r < 0)
2331 return log_debug_errno(r, "Failed to initialize dm-crypt: %m");
2332
2333 cryptsetup_enable_logging(cd);
2334
2335 r = sym_crypt_load(cd, CRYPT_LUKS, NULL);
2336 if (r < 0)
2337 return log_debug_errno(r, "Failed to load LUKS metadata: %m");
2338
2339 r = sym_crypt_activate_by_passphrase(cd, name, CRYPT_ANY_SLOT, passphrase, strlen(passphrase),
2340 ((flags & DISSECT_IMAGE_DEVICE_READ_ONLY) ? CRYPT_ACTIVATE_READONLY : 0) |
2341 ((flags & DISSECT_IMAGE_DISCARD_ON_CRYPTO) ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0));
2342 if (r < 0) {
2343 log_debug_errno(r, "Failed to activate LUKS device: %m");
2344 return r == -EPERM ? -EKEYREJECTED : r;
2345 }
2346
2347 fd = open(node, O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_NOCTTY);
2348 if (fd < 0)
2349 return log_debug_errno(errno, "Failed to open %s: %m", node);
2350
2351 d->decrypted[d->n_decrypted++] = (DecryptedPartition) {
2352 .name = TAKE_PTR(name),
2353 .device = TAKE_PTR(cd),
2354 };
2355
2356 m->decrypted_node = TAKE_PTR(node);
2357 close_and_replace(m->mount_node_fd, fd);
2358
2359 return 0;
2360 }
2361
2362 static int verity_can_reuse(
2363 const VeritySettings *verity,
2364 const char *name,
2365 struct crypt_device **ret_cd) {
2366
2367 /* If the same volume was already open, check that the root hashes match, and reuse it if they do */
2368 _cleanup_free_ char *root_hash_existing = NULL;
2369 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
2370 struct crypt_params_verity crypt_params = {};
2371 size_t root_hash_existing_size;
2372 int r;
2373
2374 assert(verity);
2375 assert(name);
2376 assert(ret_cd);
2377
2378 r = sym_crypt_init_by_name(&cd, name);
2379 if (r < 0)
2380 return log_debug_errno(r, "Error opening verity device, crypt_init_by_name failed: %m");
2381
2382 cryptsetup_enable_logging(cd);
2383
2384 r = sym_crypt_get_verity_info(cd, &crypt_params);
2385 if (r < 0)
2386 return log_debug_errno(r, "Error opening verity device, crypt_get_verity_info failed: %m");
2387
2388 root_hash_existing_size = verity->root_hash_size;
2389 root_hash_existing = malloc0(root_hash_existing_size);
2390 if (!root_hash_existing)
2391 return -ENOMEM;
2392
2393 r = sym_crypt_volume_key_get(cd, CRYPT_ANY_SLOT, root_hash_existing, &root_hash_existing_size, NULL, 0);
2394 if (r < 0)
2395 return log_debug_errno(r, "Error opening verity device, crypt_volume_key_get failed: %m");
2396 if (verity->root_hash_size != root_hash_existing_size ||
2397 memcmp(root_hash_existing, verity->root_hash, verity->root_hash_size) != 0)
2398 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Error opening verity device, it already exists but root hashes are different.");
2399
2400 #if HAVE_CRYPT_ACTIVATE_BY_SIGNED_KEY
2401 /* Ensure that, if signatures are supported, we only reuse the device if the previous mount used the
2402 * same settings, so that a previous unsigned mount will not be reused if the user asks to use
2403 * signing for the new one, and vice versa. */
2404 if (!!verity->root_hash_sig != !!(crypt_params.flags & CRYPT_VERITY_ROOT_HASH_SIGNATURE))
2405 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Error opening verity device, it already exists but signature settings are not the same.");
2406 #endif
2407
2408 *ret_cd = TAKE_PTR(cd);
2409 return 0;
2410 }
2411
2412 static char* dm_deferred_remove_clean(char *name) {
2413 if (!name)
2414 return NULL;
2415
2416 (void) sym_crypt_deactivate_by_name(NULL, name, CRYPT_DEACTIVATE_DEFERRED);
2417 return mfree(name);
2418 }
2419 DEFINE_TRIVIAL_CLEANUP_FUNC(char *, dm_deferred_remove_clean);
2420
2421 static int validate_signature_userspace(const VeritySettings *verity) {
2422 #if HAVE_OPENSSL
2423 _cleanup_(sk_X509_free_allp) STACK_OF(X509) *sk = NULL;
2424 _cleanup_strv_free_ char **certs = NULL;
2425 _cleanup_(PKCS7_freep) PKCS7 *p7 = NULL;
2426 _cleanup_free_ char *s = NULL;
2427 _cleanup_(BIO_freep) BIO *bio = NULL; /* 'bio' must be freed first, 's' second, hence keep this order
2428 * of declaration in place, please */
2429 const unsigned char *d;
2430 int r;
2431
2432 assert(verity);
2433 assert(verity->root_hash);
2434 assert(verity->root_hash_sig);
2435
2436 /* Because installing a signature certificate into the kernel chain is so messy, let's optionally do
2437 * userspace validation. */
2438
2439 r = conf_files_list_nulstr(&certs, ".crt", NULL, CONF_FILES_REGULAR|CONF_FILES_FILTER_MASKED, CONF_PATHS_NULSTR("verity.d"));
2440 if (r < 0)
2441 return log_debug_errno(r, "Failed to enumerate certificates: %m");
2442 if (strv_isempty(certs)) {
2443 log_debug("No userspace dm-verity certificates found.");
2444 return 0;
2445 }
2446
2447 d = verity->root_hash_sig;
2448 p7 = d2i_PKCS7(NULL, &d, (long) verity->root_hash_sig_size);
2449 if (!p7)
2450 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to parse PKCS7 DER signature data.");
2451
2452 s = hexmem(verity->root_hash, verity->root_hash_size);
2453 if (!s)
2454 return log_oom_debug();
2455
2456 bio = BIO_new_mem_buf(s, strlen(s));
2457 if (!bio)
2458 return log_oom_debug();
2459
2460 sk = sk_X509_new_null();
2461 if (!sk)
2462 return log_oom_debug();
2463
2464 STRV_FOREACH(i, certs) {
2465 _cleanup_(X509_freep) X509 *c = NULL;
2466 _cleanup_fclose_ FILE *f = NULL;
2467
2468 f = fopen(*i, "re");
2469 if (!f) {
2470 log_debug_errno(errno, "Failed to open '%s', ignoring: %m", *i);
2471 continue;
2472 }
2473
2474 c = PEM_read_X509(f, NULL, NULL, NULL);
2475 if (!c) {
2476 log_debug("Failed to load X509 certificate '%s', ignoring.", *i);
2477 continue;
2478 }
2479
2480 if (sk_X509_push(sk, c) == 0)
2481 return log_oom_debug();
2482
2483 TAKE_PTR(c);
2484 }
2485
2486 r = PKCS7_verify(p7, sk, NULL, bio, NULL, PKCS7_NOINTERN|PKCS7_NOVERIFY);
2487 if (r)
2488 log_debug("Userspace PKCS#7 validation succeeded.");
2489 else
2490 log_debug("Userspace PKCS#7 validation failed: %s", ERR_error_string(ERR_get_error(), NULL));
2491
2492 return r;
2493 #else
2494 log_debug("Not doing client-side validation of dm-verity root hash signatures, OpenSSL support disabled.");
2495 return 0;
2496 #endif
2497 }
2498
2499 static int do_crypt_activate_verity(
2500 struct crypt_device *cd,
2501 const char *name,
2502 const VeritySettings *verity) {
2503
2504 bool check_signature;
2505 int r;
2506
2507 assert(cd);
2508 assert(name);
2509 assert(verity);
2510
2511 if (verity->root_hash_sig) {
2512 r = getenv_bool_secure("SYSTEMD_DISSECT_VERITY_SIGNATURE");
2513 if (r < 0 && r != -ENXIO)
2514 log_debug_errno(r, "Failed to parse $SYSTEMD_DISSECT_VERITY_SIGNATURE");
2515
2516 check_signature = r != 0;
2517 } else
2518 check_signature = false;
2519
2520 if (check_signature) {
2521
2522 #if HAVE_CRYPT_ACTIVATE_BY_SIGNED_KEY
2523 /* First, if we have support for signed keys in the kernel, then try that first. */
2524 r = sym_crypt_activate_by_signed_key(
2525 cd,
2526 name,
2527 verity->root_hash,
2528 verity->root_hash_size,
2529 verity->root_hash_sig,
2530 verity->root_hash_sig_size,
2531 CRYPT_ACTIVATE_READONLY);
2532 if (r >= 0)
2533 return r;
2534
2535 log_debug("Validation of dm-verity signature failed via the kernel, trying userspace validation instead.");
2536 #else
2537 log_debug("Activation of verity device with signature requested, but not supported via the kernel by %s due to missing crypt_activate_by_signed_key(), trying userspace validation instead.",
2538 program_invocation_short_name);
2539 #endif
2540
2541 /* So this didn't work via the kernel, then let's try userspace validation instead. If that
2542 * works we'll try to activate without telling the kernel the signature. */
2543
2544 r = validate_signature_userspace(verity);
2545 if (r < 0)
2546 return r;
2547 if (r == 0)
2548 return log_debug_errno(SYNTHETIC_ERRNO(ENOKEY),
2549 "Activation of signed Verity volume worked neither via the kernel nor in userspace, can't activate.");
2550 }
2551
2552 return sym_crypt_activate_by_volume_key(
2553 cd,
2554 name,
2555 verity->root_hash,
2556 verity->root_hash_size,
2557 CRYPT_ACTIVATE_READONLY);
2558 }
2559
2560 static usec_t verity_timeout(void) {
2561 usec_t t = 100 * USEC_PER_MSEC;
2562 const char *e;
2563 int r;
2564
2565 /* On slower machines, like non-KVM vm, setting up device may take a long time.
2566 * Let's make the timeout configurable. */
2567
2568 e = getenv("SYSTEMD_DISSECT_VERITY_TIMEOUT_SEC");
2569 if (!e)
2570 return t;
2571
2572 r = parse_sec(e, &t);
2573 if (r < 0)
2574 log_debug_errno(r,
2575 "Failed to parse timeout specified in $SYSTEMD_DISSECT_VERITY_TIMEOUT_SEC, "
2576 "using the default timeout (%s).",
2577 FORMAT_TIMESPAN(t, USEC_PER_MSEC));
2578
2579 return t;
2580 }
2581
2582 static int verity_partition(
2583 PartitionDesignator designator,
2584 DissectedPartition *m,
2585 DissectedPartition *v,
2586 const VeritySettings *verity,
2587 DissectImageFlags flags,
2588 DecryptedImage *d) {
2589
2590 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
2591 _cleanup_(dm_deferred_remove_cleanp) char *restore_deferred_remove = NULL;
2592 _cleanup_free_ char *node = NULL, *name = NULL;
2593 _cleanup_close_ int mount_node_fd = -EBADF;
2594 int r;
2595
2596 assert(m);
2597 assert(v || (verity && verity->data_path));
2598
2599 if (!verity || !verity->root_hash)
2600 return 0;
2601 if (!((verity->designator < 0 && designator == PARTITION_ROOT) ||
2602 (verity->designator == designator)))
2603 return 0;
2604
2605 if (!m->found || !m->node || !m->fstype)
2606 return 0;
2607 if (!verity->data_path) {
2608 if (!v->found || !v->node || !v->fstype)
2609 return 0;
2610
2611 if (!streq(v->fstype, "DM_verity_hash"))
2612 return 0;
2613 }
2614
2615 r = dlopen_cryptsetup();
2616 if (r < 0)
2617 return r;
2618
2619 if (FLAGS_SET(flags, DISSECT_IMAGE_VERITY_SHARE)) {
2620 /* Use the roothash, which is unique per volume, as the device node name, so that it can be reused */
2621 _cleanup_free_ char *root_hash_encoded = NULL;
2622
2623 root_hash_encoded = hexmem(verity->root_hash, verity->root_hash_size);
2624 if (!root_hash_encoded)
2625 return -ENOMEM;
2626
2627 r = make_dm_name_and_node(root_hash_encoded, "-verity", &name, &node);
2628 } else
2629 r = make_dm_name_and_node(m->node, "-verity", &name, &node);
2630 if (r < 0)
2631 return r;
2632
2633 r = sym_crypt_init(&cd, verity->data_path ?: v->node);
2634 if (r < 0)
2635 return r;
2636
2637 cryptsetup_enable_logging(cd);
2638
2639 r = sym_crypt_load(cd, CRYPT_VERITY, NULL);
2640 if (r < 0)
2641 return r;
2642
2643 r = sym_crypt_set_data_device(cd, m->node);
2644 if (r < 0)
2645 return r;
2646
2647 if (!GREEDY_REALLOC0(d->decrypted, d->n_decrypted + 1))
2648 return -ENOMEM;
2649
2650 /* If activating fails because the device already exists, check the metadata and reuse it if it matches.
2651 * In case of ENODEV/ENOENT, which can happen if another process is activating at the exact same time,
2652 * retry a few times before giving up. */
2653 for (unsigned i = 0; i < N_DEVICE_NODE_LIST_ATTEMPTS; i++) {
2654 _cleanup_(sym_crypt_freep) struct crypt_device *existing_cd = NULL;
2655 _cleanup_close_ int fd = -EBADF;
2656
2657 /* First, check if the device already exists. */
2658 fd = open(node, O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_NOCTTY);
2659 if (fd < 0 && !ERRNO_IS_DEVICE_ABSENT(errno))
2660 return log_debug_errno(errno, "Failed to open verity device %s: %m", node);
2661 if (fd >= 0)
2662 goto check; /* The device already exists. Let's check it. */
2663
2664 /* The symlink to the device node does not exist yet. Assume not activated, and let's activate it. */
2665 r = do_crypt_activate_verity(cd, name, verity);
2666 if (r >= 0)
2667 goto try_open; /* The device is activated. Let's open it. */
2668 /* libdevmapper can return EINVAL when the device is already in the activation stage.
2669 * There's no way to distinguish this situation from a genuine error due to invalid
2670 * parameters, so immediately fall back to activating the device with a unique name.
2671 * Improvements in libcrypsetup can ensure this never happens:
2672 * https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests/96 */
2673 if (r == -EINVAL && FLAGS_SET(flags, DISSECT_IMAGE_VERITY_SHARE))
2674 break;
2675 if (r == -ENODEV) /* Volume is being opened but not ready, crypt_init_by_name would fail, try to open again */
2676 goto try_again;
2677 if (!IN_SET(r,
2678 -EEXIST, /* Volume has already been opened and ready to be used. */
2679 -EBUSY /* Volume is being opened but not ready, crypt_init_by_name() can fetch details. */))
2680 return log_debug_errno(r, "Failed to activate verity device %s: %m", node);
2681
2682 check:
2683 if (!restore_deferred_remove){
2684 /* To avoid races, disable automatic removal on umount while setting up the new device. Restore it on failure. */
2685 r = dm_deferred_remove_cancel(name);
2686 /* -EBUSY and -ENXIO: the device has already been removed or being removed. We cannot
2687 * use the device, try to open again. See target_message() in drivers/md/dm-ioctl.c
2688 * and dm_cancel_deferred_remove() in drivers/md/dm.c */
2689 if (IN_SET(r, -EBUSY, -ENXIO))
2690 goto try_again;
2691 if (r < 0)
2692 return log_debug_errno(r, "Failed to disable automated deferred removal for verity device %s: %m", node);
2693
2694 restore_deferred_remove = strdup(name);
2695 if (!restore_deferred_remove)
2696 return log_oom_debug();
2697 }
2698
2699 r = verity_can_reuse(verity, name, &existing_cd);
2700 /* Same as above, -EINVAL can randomly happen when it actually means -EEXIST */
2701 if (r == -EINVAL && FLAGS_SET(flags, DISSECT_IMAGE_VERITY_SHARE))
2702 break;
2703 if (IN_SET(r,
2704 -ENOENT, /* Removed?? */
2705 -EBUSY, /* Volume is being opened but not ready, crypt_init_by_name() can fetch details. */
2706 -ENODEV /* Volume is being opened but not ready, crypt_init_by_name() would fail, try to open again. */ ))
2707 goto try_again;
2708 if (r < 0)
2709 return log_debug_errno(r, "Failed to check if existing verity device %s can be reused: %m", node);
2710
2711 if (fd < 0) {
2712 /* devmapper might say that the device exists, but the devlink might not yet have been
2713 * created. Check and wait for the udev event in that case. */
2714 r = device_wait_for_devlink(node, "block", verity_timeout(), NULL);
2715 /* Fallback to activation with a unique device if it's taking too long */
2716 if (r == -ETIMEDOUT && FLAGS_SET(flags, DISSECT_IMAGE_VERITY_SHARE))
2717 break;
2718 if (r < 0)
2719 return log_debug_errno(r, "Failed to wait device node symlink %s: %m", node);
2720 }
2721
2722 try_open:
2723 if (fd < 0) {
2724 /* Now, the device is activated and devlink is created. Let's open it. */
2725 fd = open(node, O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_NOCTTY);
2726 if (fd < 0) {
2727 if (!ERRNO_IS_DEVICE_ABSENT(errno))
2728 return log_debug_errno(errno, "Failed to open verity device %s: %m", node);
2729
2730 /* The device has already been removed?? */
2731 goto try_again;
2732 }
2733 }
2734
2735 mount_node_fd = TAKE_FD(fd);
2736 if (existing_cd)
2737 crypt_free_and_replace(cd, existing_cd);
2738
2739 goto success;
2740
2741 try_again:
2742 /* Device is being removed by another process. Let's wait for a while. */
2743 (void) usleep_safe(2 * USEC_PER_MSEC);
2744 }
2745
2746 /* All trials failed or a conflicting verity device exists. Let's try to activate with a unique name. */
2747 if (FLAGS_SET(flags, DISSECT_IMAGE_VERITY_SHARE)) {
2748 /* Before trying to activate with unique name, we need to free crypt_device object.
2749 * Otherwise, we get error from libcryptsetup like the following:
2750 * ------
2751 * systemd[1234]: Cannot use device /dev/loop5 which is in use (already mapped or mounted).
2752 * ------
2753 */
2754 sym_crypt_free(cd);
2755 cd = NULL;
2756 return verity_partition(designator, m, v, verity, flags & ~DISSECT_IMAGE_VERITY_SHARE, d);
2757 }
2758
2759 return log_debug_errno(SYNTHETIC_ERRNO(EBUSY), "All attempts to activate verity device %s failed.", name);
2760
2761 success:
2762 /* Everything looks good and we'll be able to mount the device, so deferred remove will be re-enabled at that point. */
2763 restore_deferred_remove = mfree(restore_deferred_remove);
2764
2765 d->decrypted[d->n_decrypted++] = (DecryptedPartition) {
2766 .name = TAKE_PTR(name),
2767 .device = TAKE_PTR(cd),
2768 };
2769
2770 m->decrypted_node = TAKE_PTR(node);
2771 close_and_replace(m->mount_node_fd, mount_node_fd);
2772
2773 return 0;
2774 }
2775 #endif
2776
2777 int dissected_image_decrypt(
2778 DissectedImage *m,
2779 const char *passphrase,
2780 const VeritySettings *verity,
2781 DissectImageFlags flags) {
2782
2783 #if HAVE_LIBCRYPTSETUP
2784 _cleanup_(decrypted_image_unrefp) DecryptedImage *d = NULL;
2785 int r;
2786 #endif
2787
2788 assert(m);
2789 assert(!verity || verity->root_hash || verity->root_hash_size == 0);
2790
2791 /* Returns:
2792 *
2793 * = 0 → There was nothing to decrypt
2794 * > 0 → Decrypted successfully
2795 * -ENOKEY → There's something to decrypt but no key was supplied
2796 * -EKEYREJECTED → Passed key was not correct
2797 */
2798
2799 if (verity && verity->root_hash && verity->root_hash_size < sizeof(sd_id128_t))
2800 return -EINVAL;
2801
2802 if (!m->encrypted && !m->verity_ready)
2803 return 0;
2804
2805 #if HAVE_LIBCRYPTSETUP
2806 r = decrypted_image_new(&d);
2807 if (r < 0)
2808 return r;
2809
2810 for (PartitionDesignator i = 0; i < _PARTITION_DESIGNATOR_MAX; i++) {
2811 DissectedPartition *p = m->partitions + i;
2812 PartitionDesignator k;
2813
2814 if (!p->found)
2815 continue;
2816
2817 r = decrypt_partition(p, passphrase, flags, d);
2818 if (r < 0)
2819 return r;
2820
2821 k = partition_verity_of(i);
2822 if (k >= 0) {
2823 r = verity_partition(i, p, m->partitions + k, verity, flags | DISSECT_IMAGE_VERITY_SHARE, d);
2824 if (r < 0)
2825 return r;
2826 }
2827
2828 if (!p->decrypted_fstype && p->mount_node_fd >= 0 && p->decrypted_node) {
2829 r = probe_filesystem_full(p->mount_node_fd, p->decrypted_node, 0, UINT64_MAX, &p->decrypted_fstype);
2830 if (r < 0 && r != -EUCLEAN)
2831 return r;
2832 }
2833 }
2834
2835 m->decrypted_image = TAKE_PTR(d);
2836
2837 return 1;
2838 #else
2839 return -EOPNOTSUPP;
2840 #endif
2841 }
2842
2843 int dissected_image_decrypt_interactively(
2844 DissectedImage *m,
2845 const char *passphrase,
2846 const VeritySettings *verity,
2847 DissectImageFlags flags) {
2848
2849 _cleanup_strv_free_erase_ char **z = NULL;
2850 int n = 3, r;
2851
2852 if (passphrase)
2853 n--;
2854
2855 for (;;) {
2856 r = dissected_image_decrypt(m, passphrase, verity, flags);
2857 if (r >= 0)
2858 return r;
2859 if (r == -EKEYREJECTED)
2860 log_error_errno(r, "Incorrect passphrase, try again!");
2861 else if (r != -ENOKEY)
2862 return log_error_errno(r, "Failed to decrypt image: %m");
2863
2864 if (--n < 0)
2865 return log_error_errno(SYNTHETIC_ERRNO(EKEYREJECTED),
2866 "Too many retries.");
2867
2868 z = strv_free(z);
2869
2870 r = ask_password_auto("Please enter image passphrase:", NULL, "dissect", "dissect", "dissect.passphrase", USEC_INFINITY, 0, &z);
2871 if (r < 0)
2872 return log_error_errno(r, "Failed to query for passphrase: %m");
2873
2874 passphrase = z[0];
2875 }
2876 }
2877
2878 static int decrypted_image_relinquish(DecryptedImage *d) {
2879 assert(d);
2880
2881 /* Turns on automatic removal after the last use ended for all DM devices of this image, and sets a
2882 * boolean so that we don't clean it up ourselves either anymore */
2883
2884 #if HAVE_LIBCRYPTSETUP
2885 int r;
2886
2887 for (size_t i = 0; i < d->n_decrypted; i++) {
2888 DecryptedPartition *p = d->decrypted + i;
2889
2890 if (p->relinquished)
2891 continue;
2892
2893 r = sym_crypt_deactivate_by_name(NULL, p->name, CRYPT_DEACTIVATE_DEFERRED);
2894 if (r < 0)
2895 return log_debug_errno(r, "Failed to mark %s for auto-removal: %m", p->name);
2896
2897 p->relinquished = true;
2898 }
2899 #endif
2900
2901 return 0;
2902 }
2903
2904 int dissected_image_relinquish(DissectedImage *m) {
2905 int r;
2906
2907 assert(m);
2908
2909 if (m->decrypted_image) {
2910 r = decrypted_image_relinquish(m->decrypted_image);
2911 if (r < 0)
2912 return r;
2913 }
2914
2915 if (m->loop)
2916 loop_device_relinquish(m->loop);
2917
2918 return 0;
2919 }
2920
2921 static char *build_auxiliary_path(const char *image, const char *suffix) {
2922 const char *e;
2923 char *n;
2924
2925 assert(image);
2926 assert(suffix);
2927
2928 e = endswith(image, ".raw");
2929 if (!e)
2930 return strjoin(e, suffix);
2931
2932 n = new(char, e - image + strlen(suffix) + 1);
2933 if (!n)
2934 return NULL;
2935
2936 strcpy(mempcpy(n, image, e - image), suffix);
2937 return n;
2938 }
2939
2940 void verity_settings_done(VeritySettings *v) {
2941 assert(v);
2942
2943 v->root_hash = mfree(v->root_hash);
2944 v->root_hash_size = 0;
2945
2946 v->root_hash_sig = mfree(v->root_hash_sig);
2947 v->root_hash_sig_size = 0;
2948
2949 v->data_path = mfree(v->data_path);
2950 }
2951
2952 int verity_settings_load(
2953 VeritySettings *verity,
2954 const char *image,
2955 const char *root_hash_path,
2956 const char *root_hash_sig_path) {
2957
2958 _cleanup_free_ void *root_hash = NULL, *root_hash_sig = NULL;
2959 size_t root_hash_size = 0, root_hash_sig_size = 0;
2960 _cleanup_free_ char *verity_data_path = NULL;
2961 PartitionDesignator designator;
2962 int r;
2963
2964 assert(verity);
2965 assert(image);
2966 assert(verity->designator < 0 || IN_SET(verity->designator, PARTITION_ROOT, PARTITION_USR));
2967
2968 /* If we are asked to load the root hash for a device node, exit early */
2969 if (is_device_path(image))
2970 return 0;
2971
2972 r = getenv_bool_secure("SYSTEMD_DISSECT_VERITY_SIDECAR");
2973 if (r < 0 && r != -ENXIO)
2974 log_debug_errno(r, "Failed to parse $SYSTEMD_DISSECT_VERITY_SIDECAR, ignoring: %m");
2975 if (r == 0)
2976 return 0;
2977
2978 designator = verity->designator;
2979
2980 /* We only fill in what isn't already filled in */
2981
2982 if (!verity->root_hash) {
2983 _cleanup_free_ char *text = NULL;
2984
2985 if (root_hash_path) {
2986 /* If explicitly specified it takes precedence */
2987 r = read_one_line_file(root_hash_path, &text);
2988 if (r < 0)
2989 return r;
2990
2991 if (designator < 0)
2992 designator = PARTITION_ROOT;
2993 } else {
2994 /* Otherwise look for xattr and separate file, and first for the data for root and if
2995 * that doesn't exist for /usr */
2996
2997 if (designator < 0 || designator == PARTITION_ROOT) {
2998 r = getxattr_malloc(image, "user.verity.roothash", &text);
2999 if (r < 0) {
3000 _cleanup_free_ char *p = NULL;
3001
3002 if (r != -ENOENT && !ERRNO_IS_XATTR_ABSENT(r))
3003 return r;
3004
3005 p = build_auxiliary_path(image, ".roothash");
3006 if (!p)
3007 return -ENOMEM;
3008
3009 r = read_one_line_file(p, &text);
3010 if (r < 0 && r != -ENOENT)
3011 return r;
3012 }
3013
3014 if (text)
3015 designator = PARTITION_ROOT;
3016 }
3017
3018 if (!text && (designator < 0 || designator == PARTITION_USR)) {
3019 /* So in the "roothash" xattr/file name above the "root" of course primarily
3020 * refers to the root of the Verity Merkle tree. But coincidentally it also
3021 * is the hash for the *root* file system, i.e. the "root" neatly refers to
3022 * two distinct concepts called "root". Taking benefit of this happy
3023 * coincidence we call the file with the root hash for the /usr/ file system
3024 * `usrhash`, because `usrroothash` or `rootusrhash` would just be too
3025 * confusing. We thus drop the reference to the root of the Merkle tree, and
3026 * just indicate which file system it's about. */
3027 r = getxattr_malloc(image, "user.verity.usrhash", &text);
3028 if (r < 0) {
3029 _cleanup_free_ char *p = NULL;
3030
3031 if (r != -ENOENT && !ERRNO_IS_XATTR_ABSENT(r))
3032 return r;
3033
3034 p = build_auxiliary_path(image, ".usrhash");
3035 if (!p)
3036 return -ENOMEM;
3037
3038 r = read_one_line_file(p, &text);
3039 if (r < 0 && r != -ENOENT)
3040 return r;
3041 }
3042
3043 if (text)
3044 designator = PARTITION_USR;
3045 }
3046 }
3047
3048 if (text) {
3049 r = unhexmem(text, strlen(text), &root_hash, &root_hash_size);
3050 if (r < 0)
3051 return r;
3052 if (root_hash_size < sizeof(sd_id128_t))
3053 return -EINVAL;
3054 }
3055 }
3056
3057 if ((root_hash || verity->root_hash) && !verity->root_hash_sig) {
3058 if (root_hash_sig_path) {
3059 r = read_full_file(root_hash_sig_path, (char**) &root_hash_sig, &root_hash_sig_size);
3060 if (r < 0 && r != -ENOENT)
3061 return r;
3062
3063 if (designator < 0)
3064 designator = PARTITION_ROOT;
3065 } else {
3066 if (designator < 0 || designator == PARTITION_ROOT) {
3067 _cleanup_free_ char *p = NULL;
3068
3069 /* Follow naming convention recommended by the relevant RFC:
3070 * https://tools.ietf.org/html/rfc5751#section-3.2.1 */
3071 p = build_auxiliary_path(image, ".roothash.p7s");
3072 if (!p)
3073 return -ENOMEM;
3074
3075 r = read_full_file(p, (char**) &root_hash_sig, &root_hash_sig_size);
3076 if (r < 0 && r != -ENOENT)
3077 return r;
3078 if (r >= 0)
3079 designator = PARTITION_ROOT;
3080 }
3081
3082 if (!root_hash_sig && (designator < 0 || designator == PARTITION_USR)) {
3083 _cleanup_free_ char *p = NULL;
3084
3085 p = build_auxiliary_path(image, ".usrhash.p7s");
3086 if (!p)
3087 return -ENOMEM;
3088
3089 r = read_full_file(p, (char**) &root_hash_sig, &root_hash_sig_size);
3090 if (r < 0 && r != -ENOENT)
3091 return r;
3092 if (r >= 0)
3093 designator = PARTITION_USR;
3094 }
3095 }
3096
3097 if (root_hash_sig && root_hash_sig_size == 0) /* refuse empty size signatures */
3098 return -EINVAL;
3099 }
3100
3101 if (!verity->data_path) {
3102 _cleanup_free_ char *p = NULL;
3103
3104 p = build_auxiliary_path(image, ".verity");
3105 if (!p)
3106 return -ENOMEM;
3107
3108 if (access(p, F_OK) < 0) {
3109 if (errno != ENOENT)
3110 return -errno;
3111 } else
3112 verity_data_path = TAKE_PTR(p);
3113 }
3114
3115 if (root_hash) {
3116 verity->root_hash = TAKE_PTR(root_hash);
3117 verity->root_hash_size = root_hash_size;
3118 }
3119
3120 if (root_hash_sig) {
3121 verity->root_hash_sig = TAKE_PTR(root_hash_sig);
3122 verity->root_hash_sig_size = root_hash_sig_size;
3123 }
3124
3125 if (verity_data_path)
3126 verity->data_path = TAKE_PTR(verity_data_path);
3127
3128 if (verity->designator < 0)
3129 verity->designator = designator;
3130
3131 return 1;
3132 }
3133
3134 int dissected_image_load_verity_sig_partition(
3135 DissectedImage *m,
3136 int fd,
3137 VeritySettings *verity) {
3138
3139 _cleanup_free_ void *root_hash = NULL, *root_hash_sig = NULL;
3140 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
3141 size_t root_hash_size, root_hash_sig_size;
3142 _cleanup_free_ char *buf = NULL;
3143 PartitionDesignator d;
3144 DissectedPartition *p;
3145 JsonVariant *rh, *sig;
3146 ssize_t n;
3147 char *e;
3148 int r;
3149
3150 assert(m);
3151 assert(fd >= 0);
3152 assert(verity);
3153
3154 if (verity->root_hash && verity->root_hash_sig) /* Already loaded? */
3155 return 0;
3156
3157 r = getenv_bool_secure("SYSTEMD_DISSECT_VERITY_EMBEDDED");
3158 if (r < 0 && r != -ENXIO)
3159 log_debug_errno(r, "Failed to parse $SYSTEMD_DISSECT_VERITY_EMBEDDED, ignoring: %m");
3160 if (r == 0)
3161 return 0;
3162
3163 d = partition_verity_sig_of(verity->designator < 0 ? PARTITION_ROOT : verity->designator);
3164 assert(d >= 0);
3165
3166 p = m->partitions + d;
3167 if (!p->found)
3168 return 0;
3169 if (p->offset == UINT64_MAX || p->size == UINT64_MAX)
3170 return -EINVAL;
3171
3172 if (p->size > 4*1024*1024) /* Signature data cannot possible be larger than 4M, refuse that */
3173 return log_debug_errno(SYNTHETIC_ERRNO(EFBIG), "Verity signature partition is larger than 4M, refusing.");
3174
3175 buf = new(char, p->size+1);
3176 if (!buf)
3177 return -ENOMEM;
3178
3179 n = pread(fd, buf, p->size, p->offset);
3180 if (n < 0)
3181 return -ENOMEM;
3182 if ((uint64_t) n != p->size)
3183 return -EIO;
3184
3185 e = memchr(buf, 0, p->size);
3186 if (e) {
3187 /* If we found a NUL byte then the rest of the data must be NUL too */
3188 if (!memeqzero(e, p->size - (e - buf)))
3189 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Signature data contains embedded NUL byte.");
3190 } else
3191 buf[p->size] = 0;
3192
3193 r = json_parse(buf, 0, &v, NULL, NULL);
3194 if (r < 0)
3195 return log_debug_errno(r, "Failed to parse signature JSON data: %m");
3196
3197 rh = json_variant_by_key(v, "rootHash");
3198 if (!rh)
3199 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Signature JSON object lacks 'rootHash' field.");
3200 if (!json_variant_is_string(rh))
3201 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "'rootHash' field of signature JSON object is not a string.");
3202
3203 r = unhexmem(json_variant_string(rh), SIZE_MAX, &root_hash, &root_hash_size);
3204 if (r < 0)
3205 return log_debug_errno(r, "Failed to parse root hash field: %m");
3206
3207 /* Check if specified root hash matches if it is specified */
3208 if (verity->root_hash &&
3209 memcmp_nn(verity->root_hash, verity->root_hash_size, root_hash, root_hash_size) != 0) {
3210 _cleanup_free_ char *a = NULL, *b = NULL;
3211
3212 a = hexmem(root_hash, root_hash_size);
3213 b = hexmem(verity->root_hash, verity->root_hash_size);
3214
3215 return log_debug_errno(r, "Root hash in signature JSON data (%s) doesn't match configured hash (%s).", strna(a), strna(b));
3216 }
3217
3218 sig = json_variant_by_key(v, "signature");
3219 if (!sig)
3220 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Signature JSON object lacks 'signature' field.");
3221 if (!json_variant_is_string(sig))
3222 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "'signature' field of signature JSON object is not a string.");
3223
3224 r = unbase64mem(json_variant_string(sig), SIZE_MAX, &root_hash_sig, &root_hash_sig_size);
3225 if (r < 0)
3226 return log_debug_errno(r, "Failed to parse signature field: %m");
3227
3228 free_and_replace(verity->root_hash, root_hash);
3229 verity->root_hash_size = root_hash_size;
3230
3231 free_and_replace(verity->root_hash_sig, root_hash_sig);
3232 verity->root_hash_sig_size = root_hash_sig_size;
3233
3234 return 1;
3235 }
3236
3237 int dissected_image_acquire_metadata(DissectedImage *m, DissectImageFlags extra_flags) {
3238
3239 enum {
3240 META_HOSTNAME,
3241 META_MACHINE_ID,
3242 META_MACHINE_INFO,
3243 META_OS_RELEASE,
3244 META_INITRD_RELEASE,
3245 META_EXTENSION_RELEASE,
3246 META_HAS_INIT_SYSTEM,
3247 _META_MAX,
3248 };
3249
3250 static const char *const paths[_META_MAX] = {
3251 [META_HOSTNAME] = "/etc/hostname\0",
3252 [META_MACHINE_ID] = "/etc/machine-id\0",
3253 [META_MACHINE_INFO] = "/etc/machine-info\0",
3254 [META_OS_RELEASE] = ("/etc/os-release\0"
3255 "/usr/lib/os-release\0"),
3256 [META_INITRD_RELEASE] = ("/etc/initrd-release\0"
3257 "/usr/lib/initrd-release\0"),
3258 [META_EXTENSION_RELEASE] = "extension-release\0", /* Used only for logging. */
3259 [META_HAS_INIT_SYSTEM] = "has-init-system\0", /* ditto */
3260 };
3261
3262 _cleanup_strv_free_ char **machine_info = NULL, **os_release = NULL, **initrd_release = NULL, **extension_release = NULL;
3263 _cleanup_close_pair_ int error_pipe[2] = PIPE_EBADF;
3264 _cleanup_(rmdir_and_freep) char *t = NULL;
3265 _cleanup_(sigkill_waitp) pid_t child = 0;
3266 sd_id128_t machine_id = SD_ID128_NULL;
3267 _cleanup_free_ char *hostname = NULL;
3268 unsigned n_meta_initialized = 0;
3269 int fds[2 * _META_MAX], r, v;
3270 int has_init_system = -1;
3271 ssize_t n;
3272 ImageClass image_class = IMAGE_SYSEXT;
3273
3274 BLOCK_SIGNALS(SIGCHLD);
3275
3276 assert(m);
3277 assert(image_class);
3278
3279 for (; n_meta_initialized < _META_MAX; n_meta_initialized ++) {
3280 if (!paths[n_meta_initialized]) {
3281 fds[2*n_meta_initialized] = fds[2*n_meta_initialized+1] = -EBADF;
3282 continue;
3283 }
3284
3285 if (pipe2(fds + 2*n_meta_initialized, O_CLOEXEC) < 0) {
3286 r = -errno;
3287 goto finish;
3288 }
3289 }
3290
3291 r = mkdtemp_malloc("/tmp/dissect-XXXXXX", &t);
3292 if (r < 0)
3293 goto finish;
3294
3295 if (pipe2(error_pipe, O_CLOEXEC) < 0) {
3296 r = -errno;
3297 goto finish;
3298 }
3299
3300 r = safe_fork("(sd-dissect)", FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_NEW_MOUNTNS|FORK_MOUNTNS_SLAVE, &child);
3301 if (r < 0)
3302 goto finish;
3303 if (r == 0) {
3304 /* Child in a new mount namespace */
3305 error_pipe[0] = safe_close(error_pipe[0]);
3306
3307 r = dissected_image_mount(
3308 m,
3309 t,
3310 UID_INVALID,
3311 UID_INVALID,
3312 extra_flags |
3313 DISSECT_IMAGE_READ_ONLY |
3314 DISSECT_IMAGE_MOUNT_ROOT_ONLY |
3315 DISSECT_IMAGE_USR_NO_ROOT);
3316 if (r < 0) {
3317 log_debug_errno(r, "Failed to mount dissected image: %m");
3318 goto inner_fail;
3319 }
3320
3321 for (unsigned k = 0; k < _META_MAX; k++) {
3322 _cleanup_close_ int fd = -ENOENT;
3323
3324 if (!paths[k])
3325 continue;
3326
3327 fds[2*k] = safe_close(fds[2*k]);
3328
3329 switch (k) {
3330
3331 case META_EXTENSION_RELEASE: {
3332 /* As per the os-release spec, if the image is an extension it will have a file
3333 * named after the image name in extension-release.d/ - we use the image name
3334 * and try to resolve it with the extension-release helpers, as sometimes
3335 * the image names are mangled on deployment and do not match anymore.
3336 * Unlike other paths this is not fixed, and the image name
3337 * can be mangled on deployment, so by calling into the helper
3338 * we allow a fallback that matches on the first extension-release
3339 * file found in the directory, if one named after the image cannot
3340 * be found first. */
3341 ImageClass class = IMAGE_SYSEXT;
3342 r = open_extension_release(t, IMAGE_SYSEXT, m->image_name, /* relax_extension_release_check= */ false, NULL, &fd);
3343 if (r == -ENOENT) {
3344 r = open_extension_release(t, IMAGE_CONFEXT, m->image_name, /* relax_extension_release_check= */ false, NULL, &fd);
3345 if (r >= 0)
3346 class = IMAGE_CONFEXT;
3347 }
3348 if (r < 0)
3349 fd = r;
3350 else {
3351 r = loop_write(fds[2*k+1], &class, sizeof(class));
3352 if (r < 0)
3353 goto inner_fail; /* Propagate the error to the parent */
3354 }
3355
3356 break;
3357 }
3358
3359 case META_HAS_INIT_SYSTEM: {
3360 bool found = false;
3361
3362 FOREACH_STRING(init,
3363 "/usr/lib/systemd/systemd", /* systemd on /usr merged system */
3364 "/lib/systemd/systemd", /* systemd on /usr non-merged systems */
3365 "/sbin/init") { /* traditional path the Linux kernel invokes */
3366
3367 r = chase(init, t, CHASE_PREFIX_ROOT, NULL, NULL);
3368 if (r < 0) {
3369 if (r != -ENOENT)
3370 log_debug_errno(r, "Failed to resolve %s, ignoring: %m", init);
3371 } else {
3372 found = true;
3373 break;
3374 }
3375 }
3376
3377 r = loop_write(fds[2*k+1], &found, sizeof(found));
3378 if (r < 0)
3379 goto inner_fail;
3380
3381 continue;
3382 }
3383
3384 default:
3385 NULSTR_FOREACH(p, paths[k]) {
3386 fd = chase_and_open(p, t, CHASE_PREFIX_ROOT, O_RDONLY|O_CLOEXEC|O_NOCTTY, NULL);
3387 if (fd >= 0)
3388 break;
3389 }
3390 }
3391
3392 if (fd < 0) {
3393 log_debug_errno(fd, "Failed to read %s file of image, ignoring: %m", paths[k]);
3394 fds[2*k+1] = safe_close(fds[2*k+1]);
3395 continue;
3396 }
3397
3398 r = copy_bytes(fd, fds[2*k+1], UINT64_MAX, 0);
3399 if (r < 0)
3400 goto inner_fail;
3401
3402 fds[2*k+1] = safe_close(fds[2*k+1]);
3403 }
3404
3405 _exit(EXIT_SUCCESS);
3406
3407 inner_fail:
3408 /* Let parent know the error */
3409 (void) write(error_pipe[1], &r, sizeof(r));
3410 _exit(EXIT_FAILURE);
3411 }
3412
3413 error_pipe[1] = safe_close(error_pipe[1]);
3414
3415 for (unsigned k = 0; k < _META_MAX; k++) {
3416 _cleanup_fclose_ FILE *f = NULL;
3417
3418 if (!paths[k])
3419 continue;
3420
3421 fds[2*k+1] = safe_close(fds[2*k+1]);
3422
3423 f = take_fdopen(&fds[2*k], "r");
3424 if (!f) {
3425 r = -errno;
3426 goto finish;
3427 }
3428
3429 switch (k) {
3430
3431 case META_HOSTNAME:
3432 r = read_etc_hostname_stream(f, &hostname);
3433 if (r < 0)
3434 log_debug_errno(r, "Failed to read /etc/hostname of image: %m");
3435
3436 break;
3437
3438 case META_MACHINE_ID: {
3439 _cleanup_free_ char *line = NULL;
3440
3441 r = read_line(f, LONG_LINE_MAX, &line);
3442 if (r < 0)
3443 log_debug_errno(r, "Failed to read /etc/machine-id of image: %m");
3444 else if (r == 33) {
3445 r = sd_id128_from_string(line, &machine_id);
3446 if (r < 0)
3447 log_debug_errno(r, "Image contains invalid /etc/machine-id: %s", line);
3448 } else if (r == 0)
3449 log_debug("/etc/machine-id file of image is empty.");
3450 else if (streq(line, "uninitialized"))
3451 log_debug("/etc/machine-id file of image is uninitialized (likely aborted first boot).");
3452 else
3453 log_debug("/etc/machine-id file of image has unexpected length %i.", r);
3454
3455 break;
3456 }
3457
3458 case META_MACHINE_INFO:
3459 r = load_env_file_pairs(f, "machine-info", &machine_info);
3460 if (r < 0)
3461 log_debug_errno(r, "Failed to read /etc/machine-info of image: %m");
3462
3463 break;
3464
3465 case META_OS_RELEASE:
3466 r = load_env_file_pairs(f, "os-release", &os_release);
3467 if (r < 0)
3468 log_debug_errno(r, "Failed to read OS release file of image: %m");
3469
3470 break;
3471
3472 case META_INITRD_RELEASE:
3473 r = load_env_file_pairs(f, "initrd-release", &initrd_release);
3474 if (r < 0)
3475 log_debug_errno(r, "Failed to read initrd release file of image: %m");
3476
3477 break;
3478
3479 case META_EXTENSION_RELEASE: {
3480 ImageClass cl = IMAGE_SYSEXT;
3481 size_t nr;
3482
3483 errno = 0;
3484 nr = fread(&cl, 1, sizeof(cl), f);
3485 if (nr != sizeof(cl))
3486 log_debug_errno(errno_or_else(EIO), "Failed to read class of extension image: %m");
3487 else {
3488 image_class = cl;
3489 r = load_env_file_pairs(f, "extension-release", &extension_release);
3490 if (r < 0)
3491 log_debug_errno(r, "Failed to read extension release file of image: %m");
3492 }
3493
3494 break;
3495 }
3496
3497 case META_HAS_INIT_SYSTEM: {
3498 bool b = false;
3499 size_t nr;
3500
3501 errno = 0;
3502 nr = fread(&b, 1, sizeof(b), f);
3503 if (nr != sizeof(b))
3504 log_debug_errno(errno_or_else(EIO), "Failed to read has-init-system boolean: %m");
3505 else
3506 has_init_system = b;
3507
3508 break;
3509 }}
3510 }
3511
3512 r = wait_for_terminate_and_check("(sd-dissect)", child, 0);
3513 child = 0;
3514 if (r < 0)
3515 return r;
3516
3517 n = read(error_pipe[0], &v, sizeof(v));
3518 if (n < 0)
3519 return -errno;
3520 if (n == sizeof(v))
3521 return v; /* propagate error sent to us from child */
3522 if (n != 0)
3523 return -EIO;
3524
3525 if (r != EXIT_SUCCESS)
3526 return -EPROTO;
3527
3528 free_and_replace(m->hostname, hostname);
3529 m->machine_id = machine_id;
3530 strv_free_and_replace(m->machine_info, machine_info);
3531 strv_free_and_replace(m->os_release, os_release);
3532 strv_free_and_replace(m->initrd_release, initrd_release);
3533 strv_free_and_replace(m->extension_release, extension_release);
3534 m->has_init_system = has_init_system;
3535 m->image_class = image_class;
3536
3537 finish:
3538 for (unsigned k = 0; k < n_meta_initialized; k++)
3539 safe_close_pair(fds + 2*k);
3540
3541 return r;
3542 }
3543
3544 Architecture dissected_image_architecture(DissectedImage *img) {
3545 assert(img);
3546
3547 if (img->partitions[PARTITION_ROOT].found &&
3548 img->partitions[PARTITION_ROOT].architecture >= 0)
3549 return img->partitions[PARTITION_ROOT].architecture;
3550
3551 if (img->partitions[PARTITION_USR].found &&
3552 img->partitions[PARTITION_USR].architecture >= 0)
3553 return img->partitions[PARTITION_USR].architecture;
3554
3555 return _ARCHITECTURE_INVALID;
3556 }
3557
3558 int dissect_loop_device(
3559 LoopDevice *loop,
3560 const VeritySettings *verity,
3561 const MountOptions *mount_options,
3562 const ImagePolicy *image_policy,
3563 DissectImageFlags flags,
3564 DissectedImage **ret) {
3565
3566 #if HAVE_BLKID
3567 _cleanup_(dissected_image_unrefp) DissectedImage *m = NULL;
3568 int r;
3569
3570 assert(loop);
3571
3572 r = dissected_image_new(loop->backing_file ?: loop->node, &m);
3573 if (r < 0)
3574 return r;
3575
3576 m->loop = loop_device_ref(loop);
3577 m->sector_size = m->loop->sector_size;
3578
3579 r = dissect_image(m, loop->fd, loop->node, verity, mount_options, image_policy, flags);
3580 if (r < 0)
3581 return r;
3582
3583 if (ret)
3584 *ret = TAKE_PTR(m);
3585
3586 return 0;
3587 #else
3588 return -EOPNOTSUPP;
3589 #endif
3590 }
3591
3592 int dissect_loop_device_and_warn(
3593 LoopDevice *loop,
3594 const VeritySettings *verity,
3595 const MountOptions *mount_options,
3596 const ImagePolicy *image_policy,
3597 DissectImageFlags flags,
3598 DissectedImage **ret) {
3599
3600 assert(loop);
3601
3602 return dissect_log_error(
3603 LOG_ERR,
3604 dissect_loop_device(loop, verity, mount_options, image_policy, flags, ret),
3605 loop->backing_file ?: loop->node,
3606 verity);
3607
3608 }
3609
3610 bool dissected_image_verity_candidate(const DissectedImage *image, PartitionDesignator partition_designator) {
3611 assert(image);
3612
3613 /* Checks if this partition could theoretically do Verity. For non-partitioned images this only works
3614 * if there's an external verity file supplied, for which we can consult .has_verity. For partitioned
3615 * images we only check the partition type.
3616 *
3617 * This call is used to decide whether to suppress or show a verity column in tabular output of the
3618 * image. */
3619
3620 if (image->single_file_system)
3621 return partition_designator == PARTITION_ROOT && image->has_verity;
3622
3623 return partition_verity_of(partition_designator) >= 0;
3624 }
3625
3626 bool dissected_image_verity_ready(const DissectedImage *image, PartitionDesignator partition_designator) {
3627 PartitionDesignator k;
3628
3629 assert(image);
3630
3631 /* Checks if this partition has verity data available that we can activate. For non-partitioned this
3632 * works for the root partition, for others only if the associated verity partition was found. */
3633
3634 if (!image->verity_ready)
3635 return false;
3636
3637 if (image->single_file_system)
3638 return partition_designator == PARTITION_ROOT;
3639
3640 k = partition_verity_of(partition_designator);
3641 return k >= 0 && image->partitions[k].found;
3642 }
3643
3644 bool dissected_image_verity_sig_ready(const DissectedImage *image, PartitionDesignator partition_designator) {
3645 PartitionDesignator k;
3646
3647 assert(image);
3648
3649 /* Checks if this partition has verity signature data available that we can use. */
3650
3651 if (!image->verity_sig_ready)
3652 return false;
3653
3654 if (image->single_file_system)
3655 return partition_designator == PARTITION_ROOT;
3656
3657 k = partition_verity_sig_of(partition_designator);
3658 return k >= 0 && image->partitions[k].found;
3659 }
3660
3661 MountOptions* mount_options_free_all(MountOptions *options) {
3662 MountOptions *m;
3663
3664 while ((m = LIST_POP(mount_options, options))) {
3665 free(m->options);
3666 free(m);
3667 }
3668
3669 return NULL;
3670 }
3671
3672 const char* mount_options_from_designator(const MountOptions *options, PartitionDesignator designator) {
3673 LIST_FOREACH(mount_options, m, options)
3674 if (designator == m->partition_designator && !isempty(m->options))
3675 return m->options;
3676
3677 return NULL;
3678 }
3679
3680 int mount_image_privately_interactively(
3681 const char *image,
3682 const ImagePolicy *image_policy,
3683 DissectImageFlags flags,
3684 char **ret_directory,
3685 int *ret_dir_fd,
3686 LoopDevice **ret_loop_device) {
3687
3688 _cleanup_(verity_settings_done) VeritySettings verity = VERITY_SETTINGS_DEFAULT;
3689 _cleanup_(loop_device_unrefp) LoopDevice *d = NULL;
3690 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
3691 _cleanup_free_ char *dir = NULL;
3692 int r;
3693
3694 /* Mounts an OS image at a temporary place, inside a newly created mount namespace of our own. This
3695 * is used by tools such as systemd-tmpfiles or systemd-firstboot to operate on some disk image
3696 * easily. */
3697
3698 assert(image);
3699 assert(ret_loop_device);
3700
3701 /* We intend to mount this right-away, hence add the partitions if needed and pin them. */
3702 flags |= DISSECT_IMAGE_ADD_PARTITION_DEVICES |
3703 DISSECT_IMAGE_PIN_PARTITION_DEVICES;
3704
3705 r = verity_settings_load(&verity, image, NULL, NULL);
3706 if (r < 0)
3707 return log_error_errno(r, "Failed to load root hash data: %m");
3708
3709 r = loop_device_make_by_path(
3710 image,
3711 FLAGS_SET(flags, DISSECT_IMAGE_DEVICE_READ_ONLY) ? O_RDONLY : O_RDWR,
3712 /* sector_size= */ UINT32_MAX,
3713 FLAGS_SET(flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
3714 LOCK_SH,
3715 &d);
3716 if (r < 0)
3717 return log_error_errno(r, "Failed to set up loopback device for %s: %m", image);
3718
3719 r = dissect_loop_device_and_warn(
3720 d,
3721 &verity,
3722 /* mount_options= */ NULL,
3723 image_policy,
3724 flags,
3725 &dissected_image);
3726 if (r < 0)
3727 return r;
3728
3729 r = dissected_image_load_verity_sig_partition(dissected_image, d->fd, &verity);
3730 if (r < 0)
3731 return r;
3732
3733 r = dissected_image_decrypt_interactively(dissected_image, NULL, &verity, flags);
3734 if (r < 0)
3735 return r;
3736
3737 r = detach_mount_namespace();
3738 if (r < 0)
3739 return log_error_errno(r, "Failed to detach mount namespace: %m");
3740
3741 r = mkdir_p("/run/systemd/mount-rootfs", 0555);
3742 if (r < 0)
3743 return log_error_errno(r, "Failed to create mount point: %m");
3744
3745 r = dissected_image_mount_and_warn(
3746 dissected_image,
3747 "/run/systemd/mount-rootfs",
3748 /* uid_shift= */ UID_INVALID,
3749 /* uid_range= */ UID_INVALID,
3750 flags);
3751 if (r < 0)
3752 return r;
3753
3754 r = loop_device_flock(d, LOCK_UN);
3755 if (r < 0)
3756 return r;
3757
3758 r = dissected_image_relinquish(dissected_image);
3759 if (r < 0)
3760 return log_error_errno(r, "Failed to relinquish DM and loopback block devices: %m");
3761
3762 if (ret_directory) {
3763 dir = strdup("/run/systemd/mount-rootfs");
3764 if (!dir)
3765 return log_oom();
3766 }
3767
3768 if (ret_dir_fd) {
3769 _cleanup_close_ int dir_fd = -EBADF;
3770
3771 dir_fd = open("/run/systemd/mount-rootfs", O_CLOEXEC|O_DIRECTORY);
3772 if (dir_fd < 0)
3773 return log_error_errno(errno, "Failed to open mount point directory: %m");
3774
3775 *ret_dir_fd = TAKE_FD(dir_fd);
3776 }
3777
3778 if (ret_directory)
3779 *ret_directory = TAKE_PTR(dir);
3780
3781 *ret_loop_device = TAKE_PTR(d);
3782 return 0;
3783 }
3784
3785 static bool mount_options_relax_extension_release_checks(const MountOptions *options) {
3786 if (!options)
3787 return false;
3788
3789 return string_contains_word(mount_options_from_designator(options, PARTITION_ROOT), ",", "x-systemd.relax-extension-release-check") ||
3790 string_contains_word(mount_options_from_designator(options, PARTITION_USR), ",", "x-systemd.relax-extension-release-check") ||
3791 string_contains_word(options->options, ",", "x-systemd.relax-extension-release-check");
3792 }
3793
3794 int verity_dissect_and_mount(
3795 int src_fd,
3796 const char *src,
3797 const char *dest,
3798 const MountOptions *options,
3799 const ImagePolicy *image_policy,
3800 const char *required_host_os_release_id,
3801 const char *required_host_os_release_version_id,
3802 const char *required_host_os_release_sysext_level,
3803 const char *required_sysext_scope) {
3804
3805 _cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
3806 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
3807 _cleanup_(verity_settings_done) VeritySettings verity = VERITY_SETTINGS_DEFAULT;
3808 DissectImageFlags dissect_image_flags;
3809 bool relax_extension_release_check;
3810 int r;
3811
3812 assert(src);
3813 assert(dest);
3814
3815 relax_extension_release_check = mount_options_relax_extension_release_checks(options);
3816
3817 /* We might get an FD for the image, but we use the original path to look for the dm-verity files */
3818 r = verity_settings_load(&verity, src, NULL, NULL);
3819 if (r < 0)
3820 return log_debug_errno(r, "Failed to load root hash: %m");
3821
3822 dissect_image_flags = (verity.data_path ? DISSECT_IMAGE_NO_PARTITION_TABLE : 0) |
3823 (relax_extension_release_check ? DISSECT_IMAGE_RELAX_EXTENSION_CHECK : 0) |
3824 DISSECT_IMAGE_ADD_PARTITION_DEVICES |
3825 DISSECT_IMAGE_PIN_PARTITION_DEVICES;
3826
3827 /* Note that we don't use loop_device_make here, as the FD is most likely O_PATH which would not be
3828 * accepted by LOOP_CONFIGURE, so just let loop_device_make_by_path reopen it as a regular FD. */
3829 r = loop_device_make_by_path(
3830 src_fd >= 0 ? FORMAT_PROC_FD_PATH(src_fd) : src,
3831 /* open_flags= */ -1,
3832 /* sector_size= */ UINT32_MAX,
3833 verity.data_path ? 0 : LO_FLAGS_PARTSCAN,
3834 LOCK_SH,
3835 &loop_device);
3836 if (r < 0)
3837 return log_debug_errno(r, "Failed to create loop device for image: %m");
3838
3839 r = dissect_loop_device(
3840 loop_device,
3841 &verity,
3842 options,
3843 image_policy,
3844 dissect_image_flags,
3845 &dissected_image);
3846 /* No partition table? Might be a single-filesystem image, try again */
3847 if (!verity.data_path && r == -ENOPKG)
3848 r = dissect_loop_device(
3849 loop_device,
3850 &verity,
3851 options,
3852 image_policy,
3853 dissect_image_flags | DISSECT_IMAGE_NO_PARTITION_TABLE,
3854 &dissected_image);
3855 if (r < 0)
3856 return log_debug_errno(r, "Failed to dissect image: %m");
3857
3858 r = dissected_image_load_verity_sig_partition(dissected_image, loop_device->fd, &verity);
3859 if (r < 0)
3860 return r;
3861
3862 r = dissected_image_decrypt(
3863 dissected_image,
3864 NULL,
3865 &verity,
3866 dissect_image_flags);
3867 if (r < 0)
3868 return log_debug_errno(r, "Failed to decrypt dissected image: %m");
3869
3870 r = mkdir_p_label(dest, 0755);
3871 if (r < 0)
3872 return log_debug_errno(r, "Failed to create destination directory %s: %m", dest);
3873 r = umount_recursive(dest, 0);
3874 if (r < 0)
3875 return log_debug_errno(r, "Failed to umount under destination directory %s: %m", dest);
3876
3877 r = dissected_image_mount(dissected_image, dest, UID_INVALID, UID_INVALID, dissect_image_flags);
3878 if (r < 0)
3879 return log_debug_errno(r, "Failed to mount image: %m");
3880
3881 r = loop_device_flock(loop_device, LOCK_UN);
3882 if (r < 0)
3883 return log_debug_errno(r, "Failed to unlock loopback device: %m");
3884
3885 /* If we got os-release values from the caller, then we need to match them with the image's
3886 * extension-release.d/ content. Return -EINVAL if there's any mismatch.
3887 * First, check the distro ID. If that matches, then check the new SYSEXT_LEVEL value if
3888 * available, or else fallback to VERSION_ID. If neither is present (eg: rolling release),
3889 * then a simple match on the ID will be performed. */
3890 if (required_host_os_release_id) {
3891 _cleanup_strv_free_ char **extension_release = NULL;
3892 ImageClass class = IMAGE_SYSEXT;
3893
3894 assert(!isempty(required_host_os_release_id));
3895
3896 r = load_extension_release_pairs(dest, IMAGE_SYSEXT, dissected_image->image_name, relax_extension_release_check, &extension_release);
3897 if (r == -ENOENT) {
3898 r = load_extension_release_pairs(dest, IMAGE_CONFEXT, dissected_image->image_name, relax_extension_release_check, &extension_release);
3899 if (r >= 0)
3900 class = IMAGE_CONFEXT;
3901 }
3902 if (r < 0)
3903 return log_debug_errno(r, "Failed to parse image %s extension-release metadata: %m", dissected_image->image_name);
3904
3905 r = extension_release_validate(
3906 dissected_image->image_name,
3907 required_host_os_release_id,
3908 required_host_os_release_version_id,
3909 required_host_os_release_sysext_level,
3910 required_sysext_scope,
3911 extension_release,
3912 class);
3913 if (r == 0)
3914 return log_debug_errno(SYNTHETIC_ERRNO(ESTALE), "Image %s extension-release metadata does not match the root's", dissected_image->image_name);
3915 if (r < 0)
3916 return log_debug_errno(r, "Failed to compare image %s extension-release metadata with the root's os-release: %m", dissected_image->image_name);
3917 }
3918
3919 r = dissected_image_relinquish(dissected_image);
3920 if (r < 0)
3921 return log_debug_errno(r, "Failed to relinquish dissected image: %m");
3922
3923 return 0;
3924 }
Unnamed repository; edit this file 'description' to name the repository.