sysext: define a default image dissection policy for confext images

diff --git a/man/systemd-sysext.xml b/man/systemd-sysext.xml
index a257fa73bca298032154899cc033016c51849bea..6e164077e2e897444d25a27ad8858ed7126f07aa 100644 (file)
--- a/man/systemd-sysext.xml
+++ b/man/systemd-sysext.xml
@@ -281,11 +281,13 @@
         <listitem><para>Takes an image policy string as argument, as per
         <citerefentry><refentrytitle>systemd.image-policy</refentrytitle><manvolnum>7</manvolnum></citerefentry>. The
         policy is enforced when operating on system extension disk images. If not specified defaults to
-        <literal>root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent</literal>,
-        i.e. only the root and <filename>/usr/</filename> file systems in the image are used. When run in the
-        initrd and operating on a system extension image stored in the <filename>/.extra/sysext/</filename>
-        directory a slightly stricter policy is used by default:
-        <literal>root=signed+absent:usr=signed+absent</literal>, see above for details.</para></listitem>
+        <literal>root=verity+signed+encrypted+unprotected+absent:usr=verity+signed+encrypted+unprotected+absent</literal>
+        for system extensions, i.e. only the root and <filename>/usr/</filename> file systems in the image
+        are used. For configuration extensions defaults to
+        <literal>root=verity+signed+encrypted+unprotected+absent</literal>. When run in the initrd and
+        operating on a system extension image stored in the <filename>/.extra/sysext/</filename> directory a
+        slightly stricter policy is used by default: <literal>root=signed+absent:usr=signed+absent</literal>,
+        see above for details.</para></listitem>
       </varlistentry>
 
       <xi:include href="standard-options.xml" xpointer="no-pager" />

diff --git a/src/shared/image-policy.c b/src/shared/image-policy.c
index 5baeac4c5d8b14e8ebad1f42851c60f36649e9b0..8e27021b6661df0fe12a67f0b72466443fa4b11e 100644 (file)
--- a/src/shared/image-policy.c
+++ b/src/shared/image-policy.c
@@ -641,6 +641,16 @@ const ImagePolicy image_policy_sysext_strict = {
         .default_flags = PARTITION_POLICY_IGNORE,
 };
 
+const ImagePolicy image_policy_confext = {
+        /* For configuraiton extensions, honour root file system, and ignore everything else. After all, we
+         * are only interested in the /etc/ tree anyway, and that's really the only place it can be. */
+        .n_policies = 1,
+        .policies = {
+                { PARTITION_ROOT,     PARTITION_POLICY_VERITY|PARTITION_POLICY_SIGNED|PARTITION_POLICY_ENCRYPTED|PARTITION_POLICY_UNPROTECTED|PARTITION_POLICY_ABSENT },
+        },
+        .default_flags = PARTITION_POLICY_IGNORE,
+};
+
 const ImagePolicy image_policy_container = {
         /* For systemd-nspawn containers we use all partitions, with the exception of swap */
         .n_policies = 8,

diff --git a/src/shared/image-policy.h b/src/shared/image-policy.h
index a5e37642afa0430c551ba6fc019767b4fd049140..848b24c147f01f55a7693270ae8d31faef638fa3 100644 (file)
--- a/src/shared/image-policy.h
+++ b/src/shared/image-policy.h
@@ -59,6 +59,7 @@ extern const ImagePolicy image_policy_deny;
 extern const ImagePolicy image_policy_ignore;
 extern const ImagePolicy image_policy_sysext;        /* No verity required */
 extern const ImagePolicy image_policy_sysext_strict; /* Signed verity required */
+extern const ImagePolicy image_policy_confext;       /* No verity required */
 extern const ImagePolicy image_policy_container;
 extern const ImagePolicy image_policy_service;
 extern const ImagePolicy image_policy_host;

diff --git a/src/sysext/sysext.c b/src/sysext/sysext.c
index 3fc6b910c4e1ff97be9492b25317825a3be8af54..df4092fea9f60f425d52b553e19c933046c1b4bd 100644 (file)
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@@ -63,6 +63,7 @@ static const struct {
         const char *level_env;
         const char *scope_env;
         const char *name_env;
+        const ImagePolicy *default_image_policy;
 } image_class_info[_IMAGE_CLASS_MAX] = {
         [IMAGE_SYSEXT] = {
                 .dot_directory_name = ".systemd-sysext",
@@ -72,6 +73,7 @@ static const struct {
                 .level_env = "SYSEXT_LEVEL",
                 .scope_env = "SYSEXT_SCOPE",
                 .name_env = "SYSTEMD_SYSEXT_HIERARCHIES",
+                .default_image_policy = &image_policy_sysext,
         },
         [IMAGE_CONFEXT] = {
                 .dot_directory_name = ".systemd-confext",
@@ -81,6 +83,7 @@ static const struct {
                 .level_env = "CONFEXT_LEVEL",
                 .scope_env = "CONFEXT_SCOPE",
                 .name_env = "SYSTEMD_CONFEXT_HIERARCHIES",
+                .default_image_policy = &image_policy_confext,
         }
 };
 
@@ -458,7 +461,7 @@ static const ImagePolicy *pick_image_policy(const Image *img) {
         if (in_initrd() && path_startswith(img->path, "/.extra/sysext/"))
                 return &image_policy_sysext_strict;
 
-        return &image_policy_sysext;
+        return image_class_info[img->class].default_image_policy;
 }
 
 static int merge_subprocess(Hashmap *images, const char *workspace) {