src/shared/bootspec.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <stdio.h>
   4 #include <linux/magic.h>
   5
   6 #include "sd-device.h"
   7 #include "sd-id128.h"
   8
   9 #include "alloc-util.h"
  10 #include "blkid-util.h"
  11 #include "bootspec.h"
  12 #include "conf-files.h"
  13 #include "def.h"
  14 #include "device-nodes.h"
  15 #include "dirent-util.h"
  16 #include "efivars.h"
  17 #include "env-file.h"
  18 #include "env-util.h"
  19 #include "fd-util.h"
  20 #include "fileio.h"
  21 #include "parse-util.h"
  22 #include "path-util.h"
  23 #include "pe-header.h"
  24 #include "sort-util.h"
  25 #include "stat-util.h"
  26 #include "string-table.h"
  27 #include "string-util.h"
  28 #include "strv.h"
  29 #include "unaligned.h"
  30 #include "virt.h"
  31
  32 static void boot_entry_free(BootEntry *entry) {
  33         assert(entry);
  34
  35         free(entry->id);
  36         free(entry->path);
  37         free(entry->root);
  38         free(entry->title);
  39         free(entry->show_title);
  40         free(entry->version);
  41         free(entry->machine_id);
  42         free(entry->architecture);
  43         strv_free(entry->options);
  44         free(entry->kernel);
  45         free(entry->efi);
  46         strv_free(entry->initrd);
  47         free(entry->device_tree);
  48 }
  49
  50 static int boot_entry_load(
  51                 const char *root,
  52                 const char *path,
  53                 BootEntry *entry) {
  54
  55         _cleanup_(boot_entry_free) BootEntry tmp = {
  56                 .type = BOOT_ENTRY_CONF,
  57         };
  58
  59         _cleanup_fclose_ FILE *f = NULL;
  60         unsigned line = 1;
  61         char *b, *c;
  62         int r;
  63
  64         assert(root);
  65         assert(path);
  66         assert(entry);
  67
  68         c = endswith_no_case(path, ".conf");
  69         if (!c)
  70                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid loader entry file suffix: %s", path);
  71
  72         b = basename(path);
  73         tmp.id = strndup(b, c - b);
  74         if (!tmp.id)
  75                 return log_oom();
  76
  77         if (!efi_loader_entry_name_valid(tmp.id))
  78                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid loader entry filename: %s", path);
  79
  80         tmp.path = strdup(path);
  81         if (!tmp.path)
  82                 return log_oom();
  83
  84         tmp.root = strdup(root);
  85         if (!tmp.root)
  86                 return log_oom();
  87
  88         f = fopen(path, "re");
  89         if (!f)
  90                 return log_error_errno(errno, "Failed to open \"%s\": %m", path);
  91
  92         for (;;) {
  93                 _cleanup_free_ char *buf = NULL, *field = NULL;
  94                 const char *p;
  95
  96                 r = read_line(f, LONG_LINE_MAX, &buf);
  97                 if (r == 0)
  98                         break;
  99                 if (r == -ENOBUFS)
 100                         return log_error_errno(r, "%s:%u: Line too long", path, line);
 101                 if (r < 0)
 102                         return log_error_errno(r, "%s:%u: Error while reading: %m", path, line);
 103
 104                 line++;
 105
 106                 if (IN_SET(*strstrip(buf), '#', '\0'))
 107                         continue;
 108
 109                 p = buf;
 110                 r = extract_first_word(&p, &field, " \t", 0);
 111                 if (r < 0) {
 112                         log_error_errno(r, "Failed to parse config file %s line %u: %m", path, line);
 113                         continue;
 114                 }
 115                 if (r == 0) {
 116                         log_warning("%s:%u: Bad syntax", path, line);
 117                         continue;
 118                 }
 119
 120                 if (streq(field, "title"))
 121                         r = free_and_strdup(&tmp.title, p);
 122                 else if (streq(field, "version"))
 123                         r = free_and_strdup(&tmp.version, p);
 124                 else if (streq(field, "machine-id"))
 125                         r = free_and_strdup(&tmp.machine_id, p);
 126                 else if (streq(field, "architecture"))
 127                         r = free_and_strdup(&tmp.architecture, p);
 128                 else if (streq(field, "options"))
 129                         r = strv_extend(&tmp.options, p);
 130                 else if (streq(field, "linux"))
 131                         r = free_and_strdup(&tmp.kernel, p);
 132                 else if (streq(field, "efi"))
 133                         r = free_and_strdup(&tmp.efi, p);
 134                 else if (streq(field, "initrd"))
 135                         r = strv_extend(&tmp.initrd, p);
 136                 else if (streq(field, "devicetree"))
 137                         r = free_and_strdup(&tmp.device_tree, p);
 138                 else {
 139                         log_notice("%s:%u: Unknown line \"%s\", ignoring.", path, line, field);
 140                         continue;
 141                 }
 142                 if (r < 0)
 143                         return log_error_errno(r, "%s:%u: Error while reading: %m", path, line);
 144         }
 145
 146         *entry = tmp;
 147         tmp = (BootEntry) {};
 148         return 0;
 149 }
 150
 151 void boot_config_free(BootConfig *config) {
 152         size_t i;
 153
 154         assert(config);
 155
 156         free(config->default_pattern);
 157         free(config->timeout);
 158         free(config->editor);
 159         free(config->auto_entries);
 160         free(config->auto_firmware);
 161
 162         free(config->entry_oneshot);
 163         free(config->entry_default);
 164
 165         for (i = 0; i < config->n_entries; i++)
 166                 boot_entry_free(config->entries + i);
 167         free(config->entries);
 168 }
 169
 170 static int boot_loader_read_conf(const char *path, BootConfig *config) {
 171         _cleanup_fclose_ FILE *f = NULL;
 172         unsigned line = 1;
 173         int r;
 174
 175         assert(path);
 176         assert(config);
 177
 178         f = fopen(path, "re");
 179         if (!f) {
 180                 if (errno == ENOENT)
 181                         return 0;
 182
 183                 return log_error_errno(errno, "Failed to open \"%s\": %m", path);
 184         }
 185
 186         for (;;) {
 187                 _cleanup_free_ char *buf = NULL, *field = NULL;
 188                 const char *p;
 189
 190                 r = read_line(f, LONG_LINE_MAX, &buf);
 191                 if (r == 0)
 192                         break;
 193                 if (r == -ENOBUFS)
 194                         return log_error_errno(r, "%s:%u: Line too long", path, line);
 195                 if (r < 0)
 196                         return log_error_errno(r, "%s:%u: Error while reading: %m", path, line);
 197
 198                 line++;
 199
 200                 if (IN_SET(*strstrip(buf), '#', '\0'))
 201                         continue;
 202
 203                 p = buf;
 204                 r = extract_first_word(&p, &field, " \t", 0);
 205                 if (r < 0) {
 206                         log_error_errno(r, "Failed to parse config file %s line %u: %m", path, line);
 207                         continue;
 208                 }
 209                 if (r == 0) {
 210                         log_warning("%s:%u: Bad syntax", path, line);
 211                         continue;
 212                 }
 213
 214                 if (streq(field, "default"))
 215                         r = free_and_strdup(&config->default_pattern, p);
 216                 else if (streq(field, "timeout"))
 217                         r = free_and_strdup(&config->timeout, p);
 218                 else if (streq(field, "editor"))
 219                         r = free_and_strdup(&config->editor, p);
 220                 else if (streq(field, "auto-entries"))
 221                         r = free_and_strdup(&config->auto_entries, p);
 222                 else if (streq(field, "auto-firmware"))
 223                         r = free_and_strdup(&config->auto_firmware, p);
 224                 else if (streq(field, "console-mode"))
 225                         r = free_and_strdup(&config->console_mode, p);
 226                 else {
 227                         log_notice("%s:%u: Unknown line \"%s\", ignoring.", path, line, field);
 228                         continue;
 229                 }
 230                 if (r < 0)
 231                         return log_error_errno(r, "%s:%u: Error while reading: %m", path, line);
 232         }
 233
 234         return 1;
 235 }
 236
 237 static int boot_entry_compare(const BootEntry *a, const BootEntry *b) {
 238         return str_verscmp(a->id, b->id);
 239 }
 240
 241 static int boot_entries_find(
 242                 const char *root,
 243                 const char *dir,
 244                 BootEntry **entries,
 245                 size_t *n_entries) {
 246
 247         _cleanup_strv_free_ char **files = NULL;
 248         size_t n_allocated = *n_entries;
 249         char **f;
 250         int r;
 251
 252         assert(root);
 253         assert(dir);
 254         assert(entries);
 255         assert(n_entries);
 256
 257         r = conf_files_list(&files, ".conf", NULL, 0, dir, NULL);
 258         if (r < 0)
 259                 return log_error_errno(r, "Failed to list files in \"%s\": %m", dir);
 260
 261         STRV_FOREACH(f, files) {
 262                 if (!GREEDY_REALLOC0(*entries, n_allocated, *n_entries + 1))
 263                         return log_oom();
 264
 265                 r = boot_entry_load(root, *f, *entries + *n_entries);
 266                 if (r < 0)
 267                         continue;
 268
 269                 (*n_entries) ++;
 270         }
 271
 272         return 0;
 273 }
 274
 275 static int boot_entry_load_unified(
 276                 const char *root,
 277                 const char *path,
 278                 const char *osrelease,
 279                 const char *cmdline,
 280                 BootEntry *ret) {
 281
 282         _cleanup_free_ char *os_pretty_name = NULL, *os_id = NULL, *version_id = NULL, *build_id = NULL;
 283         _cleanup_(boot_entry_free) BootEntry tmp = {
 284                 .type = BOOT_ENTRY_UNIFIED,
 285         };
 286         _cleanup_fclose_ FILE *f = NULL;
 287         const char *k;
 288         int r;
 289
 290         assert(root);
 291         assert(path);
 292         assert(osrelease);
 293
 294         k = path_startswith(path, root);
 295         if (!k)
 296                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Path is not below root: %s", path);
 297
 298         f = fmemopen((void*) osrelease, strlen(osrelease), "r");
 299         if (!f)
 300                 return log_error_errno(errno, "Failed to open os-release buffer: %m");
 301
 302         r = parse_env_file(f, "os-release",
 303                            "PRETTY_NAME", &os_pretty_name,
 304                            "ID", &os_id,
 305                            "VERSION_ID", &version_id,
 306                            "BUILD_ID", &build_id);
 307         if (r < 0)
 308                 return log_error_errno(r, "Failed to parse os-release data from unified kernel image %s: %m", path);
 309
 310         if (!os_pretty_name || !os_id || !(version_id || build_id))
 311                 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Missing fields in os-release data from unified kernel image %s, refusing.", path);
 312
 313         tmp.id = strjoin(os_id, "-", version_id ?: build_id);
 314         if (!tmp.id)
 315                 return log_oom();
 316
 317         if (!efi_loader_entry_name_valid(tmp.id))
 318                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid loader entry: %s", tmp.id);
 319
 320         tmp.path = strdup(path);
 321         if (!tmp.path)
 322                 return log_oom();
 323
 324         tmp.root = strdup(root);
 325         if (!tmp.root)
 326                 return log_oom();
 327
 328         tmp.kernel = strdup(skip_leading_chars(k, "/"));
 329         if (!tmp.kernel)
 330                 return log_oom();
 331
 332         tmp.options = strv_new(skip_leading_chars(cmdline, WHITESPACE));
 333         if (!tmp.options)
 334                 return log_oom();
 335
 336         delete_trailing_chars(tmp.options[0], WHITESPACE);
 337
 338         tmp.title = TAKE_PTR(os_pretty_name);
 339
 340         *ret = tmp;
 341         tmp = (BootEntry) {};
 342         return 0;
 343 }
 344
 345 /* Maximum PE section we are willing to load (Note that sections we are not interested in may be larger, but
 346  * the ones we do care about and we are willing to load into memory have this size limit.) */
 347 #define PE_SECTION_SIZE_MAX (4U*1024U*1024U)
 348
 349 static int find_sections(
 350                 int fd,
 351                 char **ret_osrelease,
 352                 char **ret_cmdline) {
 353
 354         _cleanup_free_ struct PeSectionHeader *sections = NULL;
 355         _cleanup_free_ char *osrelease = NULL, *cmdline = NULL;
 356         size_t i, n_sections;
 357         struct DosFileHeader dos;
 358         struct PeHeader pe;
 359         uint64_t start;
 360         ssize_t n;
 361
 362         n = pread(fd, &dos, sizeof(dos), 0);
 363         if (n < 0)
 364                 return log_error_errno(errno, "Failed read DOS header: %m");
 365         if (n != sizeof(dos))
 366                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading DOS header, refusing.");
 367
 368         if (dos.Magic[0] != 'M' || dos.Magic[1] != 'Z')
 369                 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "DOS executable magic missing, refusing.");
 370
 371         start = unaligned_read_le32(&dos.ExeHeader);
 372         n = pread(fd, &pe, sizeof(pe), start);
 373         if (n < 0)
 374                 return log_error_errno(errno, "Failed to read PE header: %m");
 375         if (n != sizeof(pe))
 376                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading PE header, refusing.");
 377
 378         if (pe.Magic[0] != 'P' || pe.Magic[1] != 'E' || pe.Magic[2] != 0 || pe.Magic[3] != 0)
 379                 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "PE executable magic missing, refusing.");
 380
 381         n_sections = unaligned_read_le16(&pe.FileHeader.NumberOfSections);
 382         if (n_sections > 96)
 383                 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "PE header has too many sections, refusing.");
 384
 385         sections = new(struct PeSectionHeader, n_sections);
 386         if (!sections)
 387                 return log_oom();
 388
 389         n = pread(fd, sections,
 390                   n_sections * sizeof(struct PeSectionHeader),
 391                   start + sizeof(pe) + unaligned_read_le16(&pe.FileHeader.SizeOfOptionalHeader));
 392         if (n < 0)
 393                 return log_error_errno(errno, "Failed to read section data: %m");
 394         if ((size_t) n != n_sections * sizeof(struct PeSectionHeader))
 395                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading sections, refusing.");
 396
 397         for (i = 0; i < n_sections; i++) {
 398                 _cleanup_free_ char *k = NULL;
 399                 uint32_t offset, size;
 400                 char **b;
 401
 402                 if (strneq((char*) sections[i].Name, ".osrel", sizeof(sections[i].Name)))
 403                         b = &osrelease;
 404                 else if (strneq((char*) sections[i].Name, ".cmdline", sizeof(sections[i].Name)))
 405                         b = &cmdline;
 406                 else
 407                         continue;
 408
 409                 if (*b)
 410                         return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Duplicate section %s, refusing.", sections[i].Name);
 411
 412                 offset = unaligned_read_le32(&sections[i].PointerToRawData);
 413                 size = unaligned_read_le32(&sections[i].VirtualSize);
 414
 415                 if (size > PE_SECTION_SIZE_MAX)
 416                         return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Section %s too large, refusing.", sections[i].Name);
 417
 418                 k = new(char, size+1);
 419                 if (!k)
 420                         return log_oom();
 421
 422                 n = pread(fd, k, size, offset);
 423                 if (n < 0)
 424                         return log_error_errno(errno, "Failed to read section payload: %m");
 425                 if (n != size)
 426                         return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading section payload, refusing:");
 427
 428                 /* Allow one trailing NUL byte, but nothing more. */
 429                 if (size > 0 && memchr(k, 0, size - 1))
 430                         return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Section contains embedded NUL byte: %m");
 431
 432                 k[size] = 0;
 433                 *b = TAKE_PTR(k);
 434         }
 435
 436         if (!osrelease)
 437                 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Image lacks .osrel section, refusing.");
 438
 439         if (ret_osrelease)
 440                 *ret_osrelease = TAKE_PTR(osrelease);
 441         if (ret_cmdline)
 442                 *ret_cmdline = TAKE_PTR(cmdline);
 443
 444         return 0;
 445 }
 446
 447 static int boot_entries_find_unified(
 448                 const char *root,
 449                 const char *dir,
 450                 BootEntry **entries,
 451                 size_t *n_entries) {
 452
 453         _cleanup_(closedirp) DIR *d = NULL;
 454         size_t n_allocated = *n_entries;
 455         struct dirent *de;
 456         int r;
 457
 458         assert(root);
 459         assert(dir);
 460         assert(entries);
 461         assert(n_entries);
 462
 463         d = opendir(dir);
 464         if (!d) {
 465                 if (errno == ENOENT)
 466                         return 0;
 467
 468                 return log_error_errno(errno, "Failed to open %s: %m", dir);
 469         }
 470
 471         FOREACH_DIRENT(de, d, return log_error_errno(errno, "Failed to read %s: %m", dir)) {
 472                 _cleanup_free_ char *j = NULL, *osrelease = NULL, *cmdline = NULL;
 473                 _cleanup_close_ int fd = -1;
 474
 475                 if (!dirent_is_file(de))
 476                         continue;
 477
 478                 if (!endswith_no_case(de->d_name, ".efi"))
 479                         continue;
 480
 481                 if (!GREEDY_REALLOC0(*entries, n_allocated, *n_entries + 1))
 482                         return log_oom();
 483
 484                 fd = openat(dirfd(d), de->d_name, O_RDONLY|O_CLOEXEC|O_NONBLOCK);
 485                 if (fd < 0) {
 486                         log_warning_errno(errno, "Failed to open %s/%s, ignoring: %m", dir, de->d_name);
 487                         continue;
 488                 }
 489
 490                 r = fd_verify_regular(fd);
 491                 if (r < 0) {
 492                         log_warning_errno(r, "File %s/%s is not regular, ignoring: %m", dir, de->d_name);
 493                         continue;
 494                 }
 495
 496                 r = find_sections(fd, &osrelease, &cmdline);
 497                 if (r < 0)
 498                         continue;
 499
 500                 j = path_join(dir, de->d_name);
 501                 if (!j)
 502                         return log_oom();
 503
 504                 r = boot_entry_load_unified(root, j, osrelease, cmdline, *entries + *n_entries);
 505                 if (r < 0)
 506                         continue;
 507
 508                 (*n_entries) ++;
 509         }
 510
 511         return 0;
 512 }
 513
 514 static bool find_nonunique(BootEntry *entries, size_t n_entries, bool *arr) {
 515         size_t i, j;
 516         bool non_unique = false;
 517
 518         assert(entries || n_entries == 0);
 519         assert(arr || n_entries == 0);
 520
 521         for (i = 0; i < n_entries; i++)
 522                 arr[i] = false;
 523
 524         for (i = 0; i < n_entries; i++)
 525                 for (j = 0; j < n_entries; j++)
 526                         if (i != j && streq(boot_entry_title(entries + i),
 527                                             boot_entry_title(entries + j)))
 528                                 non_unique = arr[i] = arr[j] = true;
 529
 530         return non_unique;
 531 }
 532
 533 static int boot_entries_uniquify(BootEntry *entries, size_t n_entries) {
 534         char *s;
 535         size_t i;
 536         int r;
 537         bool arr[n_entries];
 538
 539         assert(entries || n_entries == 0);
 540
 541         /* Find _all_ non-unique titles */
 542         if (!find_nonunique(entries, n_entries, arr))
 543                 return 0;
 544
 545         /* Add version to non-unique titles */
 546         for (i = 0; i < n_entries; i++)
 547                 if (arr[i] && entries[i].version) {
 548                         r = asprintf(&s, "%s (%s)", boot_entry_title(entries + i), entries[i].version);
 549                         if (r < 0)
 550                                 return -ENOMEM;
 551
 552                         free_and_replace(entries[i].show_title, s);
 553                 }
 554
 555         if (!find_nonunique(entries, n_entries, arr))
 556                 return 0;
 557
 558         /* Add machine-id to non-unique titles */
 559         for (i = 0; i < n_entries; i++)
 560                 if (arr[i] && entries[i].machine_id) {
 561                         r = asprintf(&s, "%s (%s)", boot_entry_title(entries + i), entries[i].machine_id);
 562                         if (r < 0)
 563                                 return -ENOMEM;
 564
 565                         free_and_replace(entries[i].show_title, s);
 566                 }
 567
 568         if (!find_nonunique(entries, n_entries, arr))
 569                 return 0;
 570
 571         /* Add file name to non-unique titles */
 572         for (i = 0; i < n_entries; i++)
 573                 if (arr[i]) {
 574                         r = asprintf(&s, "%s (%s)", boot_entry_title(entries + i), entries[i].id);
 575                         if (r < 0)
 576                                 return -ENOMEM;
 577
 578                         free_and_replace(entries[i].show_title, s);
 579                 }
 580
 581         return 0;
 582 }
 583
 584 static int boot_entries_select_default(const BootConfig *config) {
 585         int i;
 586
 587         assert(config);
 588         assert(config->entries || config->n_entries == 0);
 589
 590         if (config->n_entries == 0) {
 591                 log_debug("Found no default boot entry :(");
 592                 return -1; /* -1 means "no default" */
 593         }
 594
 595         if (config->entry_oneshot)
 596                 for (i = config->n_entries - 1; i >= 0; i--)
 597                         if (streq(config->entry_oneshot, config->entries[i].id)) {
 598                                 log_debug("Found default: id \"%s\" is matched by LoaderEntryOneShot",
 599                                           config->entries[i].id);
 600                                 return i;
 601                         }
 602
 603         if (config->entry_default)
 604                 for (i = config->n_entries - 1; i >= 0; i--)
 605                         if (streq(config->entry_default, config->entries[i].id)) {
 606                                 log_debug("Found default: id \"%s\" is matched by LoaderEntryDefault",
 607                                           config->entries[i].id);
 608                                 return i;
 609                         }
 610
 611         if (config->default_pattern)
 612                 for (i = config->n_entries - 1; i >= 0; i--)
 613                         if (fnmatch(config->default_pattern, config->entries[i].id, FNM_CASEFOLD) == 0) {
 614                                 log_debug("Found default: id \"%s\" is matched by pattern \"%s\"",
 615                                           config->entries[i].id, config->default_pattern);
 616                                 return i;
 617                         }
 618
 619         log_debug("Found default: last entry \"%s\"", config->entries[config->n_entries - 1].id);
 620         return config->n_entries - 1;
 621 }
 622
 623 int boot_entries_load_config(
 624                 const char *esp_path,
 625                 const char *xbootldr_path,
 626                 BootConfig *config) {
 627
 628         const char *p;
 629         int r;
 630
 631         assert(config);
 632
 633         if (esp_path) {
 634                 p = strjoina(esp_path, "/loader/loader.conf");
 635                 r = boot_loader_read_conf(p, config);
 636                 if (r < 0)
 637                         return r;
 638
 639                 p = strjoina(esp_path, "/loader/entries");
 640                 r = boot_entries_find(esp_path, p, &config->entries, &config->n_entries);
 641                 if (r < 0)
 642                         return r;
 643
 644                 p = strjoina(esp_path, "/EFI/Linux/");
 645                 r = boot_entries_find_unified(esp_path, p, &config->entries, &config->n_entries);
 646                 if (r < 0)
 647                         return r;
 648         }
 649
 650         if (xbootldr_path) {
 651                 p = strjoina(xbootldr_path, "/loader/entries");
 652                 r = boot_entries_find(xbootldr_path, p, &config->entries, &config->n_entries);
 653                 if (r < 0)
 654                         return r;
 655
 656                 p = strjoina(xbootldr_path, "/EFI/Linux/");
 657                 r = boot_entries_find_unified(xbootldr_path, p, &config->entries, &config->n_entries);
 658                 if (r < 0)
 659                         return r;
 660         }
 661
 662         typesafe_qsort(config->entries, config->n_entries, boot_entry_compare);
 663
 664         r = boot_entries_uniquify(config->entries, config->n_entries);
 665         if (r < 0)
 666                 return log_error_errno(r, "Failed to uniquify boot entries: %m");
 667
 668         if (is_efi_boot()) {
 669                 r = efi_get_variable_string(EFI_VENDOR_LOADER, "LoaderEntryOneShot", &config->entry_oneshot);
 670                 if (r < 0 && !IN_SET(r, -ENOENT, -ENODATA)) {
 671                         log_warning_errno(r, "Failed to read EFI variable \"LoaderEntryOneShot\": %m");
 672                         if (r == -ENOMEM)
 673                                 return r;
 674                 }
 675
 676                 r = efi_get_variable_string(EFI_VENDOR_LOADER, "LoaderEntryDefault", &config->entry_default);
 677                 if (r < 0 && !IN_SET(r, -ENOENT, -ENODATA)) {
 678                         log_warning_errno(r, "Failed to read EFI variable \"LoaderEntryDefault\": %m");
 679                         if (r == -ENOMEM)
 680                                 return r;
 681                 }
 682         }
 683
 684         config->default_entry = boot_entries_select_default(config);
 685         return 0;
 686 }
 687
 688 int boot_entries_load_config_auto(
 689                 const char *override_esp_path,
 690                 const char *override_xbootldr_path,
 691                 BootConfig *config) {
 692
 693         _cleanup_free_ char *esp_where = NULL, *xbootldr_where = NULL;
 694         int r;
 695
 696         assert(config);
 697
 698         /* This function is similar to boot_entries_load_config(), however we automatically search for the
 699          * ESP and the XBOOTLDR partition unless it is explicitly specified. Also, if the user did not pass
 700          * an ESP or XBOOTLDR path directly, let's see if /run/boot-loader-entries/ exists. If so, let's
 701          * read data from there, as if it was an ESP (i.e. loading both entries and loader.conf data from
 702          * it). This allows other boot loaders to pass boot loader entry information to our tools if they
 703          * want to. */
 704
 705         if (!override_esp_path && !override_xbootldr_path) {
 706                 if (access("/run/boot-loader-entries/", F_OK) >= 0)
 707                         return boot_entries_load_config("/run/boot-loader-entries/", NULL, config);
 708
 709                 if (errno != ENOENT)
 710                         return log_error_errno(errno,
 711                                                "Failed to determine whether /run/boot-loader-entries/ exists: %m");
 712         }
 713
 714         r = find_esp_and_warn(override_esp_path, false, &esp_where, NULL, NULL, NULL, NULL);
 715         if (r == -ENOKEY) /* find_esp_and_warn() doesn't warn about this case */
 716                 return log_error_errno(r, "Cannot find the ESP partition mount point.");
 717         if (r < 0) /* But it logs about all these cases, hence don't log here again */
 718                 return r;
 719
 720         r = find_xbootldr_and_warn(override_xbootldr_path, false, &xbootldr_where, NULL);
 721         if (r < 0 && r != -ENOKEY)
 722                 return r; /* It's fine if the XBOOTLDR partition doesn't exist, hence we ignore ENOKEY here */
 723
 724         return boot_entries_load_config(esp_where, xbootldr_where, config);
 725 }
 726
 727 int boot_entries_augment_from_loader(BootConfig *config, bool only_auto) {
 728
 729         static const char * const title_table[] = {
 730                 /* Pretty names for a few well-known automatically discovered entries. */
 731                 "auto-osx",                      "macOS",
 732                 "auto-windows",                  "Windows Boot Manager",
 733                 "auto-efi-shell",                "EFI Shell",
 734                 "auto-efi-default",              "EFI Default Loader",
 735                 "auto-reboot-to-firmware-setup", "Reboot Into Firmware Interface",
 736         };
 737
 738         _cleanup_free_ char **found_by_loader = NULL;
 739         size_t n_allocated;
 740         char **i;
 741         int r;
 742
 743         assert(config);
 744
 745         /* Let's add the entries discovered by the boot loader to the end of our list, unless they are
 746          * already included there. */
 747
 748         r = efi_loader_get_entries(&found_by_loader);
 749         if (IN_SET(r, -ENOENT, -EOPNOTSUPP))
 750                 return log_debug_errno(r, "Boot loader reported no entries.");
 751         if (r < 0)
 752                 return log_error_errno(r, "Failed to determine entries reported by boot loader: %m");
 753
 754         n_allocated = config->n_entries;
 755
 756         STRV_FOREACH(i, found_by_loader) {
 757                 _cleanup_free_ char *c = NULL, *t = NULL;
 758                 char **a, **b;
 759
 760                 if (boot_config_has_entry(config, *i))
 761                         continue;
 762
 763                 if (only_auto && !startswith(*i, "auto-"))
 764                         continue;
 765
 766                 c = strdup(*i);
 767                 if (!c)
 768                         return log_oom();
 769
 770                 STRV_FOREACH_PAIR(a, b, (char**) title_table)
 771                         if (streq(*a, *i)) {
 772                                 t = strdup(*b);
 773                                 if (!t)
 774                                         return log_oom();
 775                                 break;
 776                         }
 777
 778                 if (!GREEDY_REALLOC0(config->entries, n_allocated, config->n_entries + 1))
 779                         return log_oom();
 780
 781                 config->entries[config->n_entries++] = (BootEntry) {
 782                         .type = BOOT_ENTRY_LOADER,
 783                         .id = TAKE_PTR(c),
 784                         .title = TAKE_PTR(t),
 785                 };
 786         }
 787
 788         return 0;
 789 }
 790
 791 /********************************************************************************/
 792
 793 static int verify_esp_blkid(
 794                 dev_t devid,
 795                 bool searching,
 796                 uint32_t *ret_part,
 797                 uint64_t *ret_pstart,
 798                 uint64_t *ret_psize,
 799                 sd_id128_t *ret_uuid) {
 800
 801         sd_id128_t uuid = SD_ID128_NULL;
 802         uint64_t pstart = 0, psize = 0;
 803         uint32_t part = 0;
 804
 805 #if HAVE_BLKID
 806         _cleanup_(blkid_free_probep) blkid_probe b = NULL;
 807         _cleanup_free_ char *node = NULL;
 808         const char *v;
 809         int r;
 810
 811         r = device_path_make_major_minor(S_IFBLK, devid, &node);
 812         if (r < 0)
 813                 return log_error_errno(r, "Failed to format major/minor device path: %m");
 814
 815         errno = 0;
 816         b = blkid_new_probe_from_filename(node);
 817         if (!b)
 818                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(ENOMEM), "Failed to open file system \"%s\": %m", node);
 819
 820         blkid_probe_enable_superblocks(b, 1);
 821         blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
 822         blkid_probe_enable_partitions(b, 1);
 823         blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
 824
 825         errno = 0;
 826         r = blkid_do_safeprobe(b);
 827         if (r == -2)
 828                 return log_error_errno(SYNTHETIC_ERRNO(ENODEV), "File system \"%s\" is ambiguous.", node);
 829         else if (r == 1)
 830                 return log_error_errno(SYNTHETIC_ERRNO(ENODEV), "File system \"%s\" does not contain a label.", node);
 831         else if (r != 0)
 832                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe file system \"%s\": %m", node);
 833
 834         errno = 0;
 835         r = blkid_probe_lookup_value(b, "TYPE", &v, NULL);
 836         if (r != 0)
 837                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe file system type of \"%s\": %m", node);
 838         if (!streq(v, "vfat"))
 839                 return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
 840                                       SYNTHETIC_ERRNO(searching ? EADDRNOTAVAIL : ENODEV),
 841                                       "File system \"%s\" is not FAT.", node);
 842
 843         errno = 0;
 844         r = blkid_probe_lookup_value(b, "PART_ENTRY_SCHEME", &v, NULL);
 845         if (r != 0)
 846                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe partition scheme of \"%s\": %m", node);
 847         if (!streq(v, "gpt"))
 848                 return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
 849                                       SYNTHETIC_ERRNO(searching ? EADDRNOTAVAIL : ENODEV),
 850                                       "File system \"%s\" is not on a GPT partition table.", node);
 851
 852         errno = 0;
 853         r = blkid_probe_lookup_value(b, "PART_ENTRY_TYPE", &v, NULL);
 854         if (r != 0)
 855                 return log_error_errno(errno ?: EIO, "Failed to probe partition type UUID of \"%s\": %m", node);
 856         if (!streq(v, "c12a7328-f81f-11d2-ba4b-00a0c93ec93b"))
 857                 return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
 858                                        SYNTHETIC_ERRNO(searching ? EADDRNOTAVAIL : ENODEV),
 859                                        "File system \"%s\" has wrong type for an EFI System Partition (ESP).", node);
 860
 861         errno = 0;
 862         r = blkid_probe_lookup_value(b, "PART_ENTRY_UUID", &v, NULL);
 863         if (r != 0)
 864                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe partition entry UUID of \"%s\": %m", node);
 865         r = sd_id128_from_string(v, &uuid);
 866         if (r < 0)
 867                 return log_error_errno(r, "Partition \"%s\" has invalid UUID \"%s\".", node, v);
 868
 869         errno = 0;
 870         r = blkid_probe_lookup_value(b, "PART_ENTRY_NUMBER", &v, NULL);
 871         if (r != 0)
 872                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe partition number of \"%s\": m", node);
 873         r = safe_atou32(v, &part);
 874         if (r < 0)
 875                 return log_error_errno(r, "Failed to parse PART_ENTRY_NUMBER field.");
 876
 877         errno = 0;
 878         r = blkid_probe_lookup_value(b, "PART_ENTRY_OFFSET", &v, NULL);
 879         if (r != 0)
 880                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe partition offset of \"%s\": %m", node);
 881         r = safe_atou64(v, &pstart);
 882         if (r < 0)
 883                 return log_error_errno(r, "Failed to parse PART_ENTRY_OFFSET field.");
 884
 885         errno = 0;
 886         r = blkid_probe_lookup_value(b, "PART_ENTRY_SIZE", &v, NULL);
 887         if (r != 0)
 888                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe partition size of \"%s\": %m", node);
 889         r = safe_atou64(v, &psize);
 890         if (r < 0)
 891                 return log_error_errno(r, "Failed to parse PART_ENTRY_SIZE field.");
 892 #endif
 893
 894         if (ret_part)
 895                 *ret_part = part;
 896         if (ret_pstart)
 897                 *ret_pstart = pstart;
 898         if (ret_psize)
 899                 *ret_psize = psize;
 900         if (ret_uuid)
 901                 *ret_uuid = uuid;
 902
 903         return 0;
 904 }
 905
 906 static int verify_esp_udev(
 907                 dev_t devid,
 908                 bool searching,
 909                 uint32_t *ret_part,
 910                 uint64_t *ret_pstart,
 911                 uint64_t *ret_psize,
 912                 sd_id128_t *ret_uuid) {
 913
 914         _cleanup_(sd_device_unrefp) sd_device *d = NULL;
 915         _cleanup_free_ char *node = NULL;
 916         sd_id128_t uuid = SD_ID128_NULL;
 917         uint64_t pstart = 0, psize = 0;
 918         uint32_t part = 0;
 919         const char *v;
 920         int r;
 921
 922         r = device_path_make_major_minor(S_IFBLK, devid, &node);
 923         if (r < 0)
 924                 return log_error_errno(r, "Failed to format major/minor device path: %m");
 925
 926         r = sd_device_new_from_devnum(&d, 'b', devid);
 927         if (r < 0)
 928                 return log_error_errno(r, "Failed to get device from device number: %m");
 929
 930         r = sd_device_get_property_value(d, "ID_FS_TYPE", &v);
 931         if (r < 0)
 932                 return log_error_errno(r, "Failed to get device property: %m");
 933         if (!streq(v, "vfat"))
 934                 return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
 935                                       SYNTHETIC_ERRNO(searching ? EADDRNOTAVAIL : ENODEV),
 936                                       "File system \"%s\" is not FAT.", node );
 937
 938         r = sd_device_get_property_value(d, "ID_PART_ENTRY_SCHEME", &v);
 939         if (r < 0)
 940                 return log_error_errno(r, "Failed to get device property: %m");
 941         if (!streq(v, "gpt"))
 942                 return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
 943                                       SYNTHETIC_ERRNO(searching ? EADDRNOTAVAIL : ENODEV),
 944                                       "File system \"%s\" is not on a GPT partition table.", node);
 945
 946         r = sd_device_get_property_value(d, "ID_PART_ENTRY_TYPE", &v);
 947         if (r < 0)
 948                 return log_error_errno(r, "Failed to get device property: %m");
 949         if (!streq(v, "c12a7328-f81f-11d2-ba4b-00a0c93ec93b"))
 950                 return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
 951                                        SYNTHETIC_ERRNO(searching ? EADDRNOTAVAIL : ENODEV),
 952                                        "File system \"%s\" has wrong type for an EFI System Partition (ESP).", node);
 953
 954         r = sd_device_get_property_value(d, "ID_PART_ENTRY_UUID", &v);
 955         if (r < 0)
 956                 return log_error_errno(r, "Failed to get device property: %m");
 957         r = sd_id128_from_string(v, &uuid);
 958         if (r < 0)
 959                 return log_error_errno(r, "Partition \"%s\" has invalid UUID \"%s\".", node, v);
 960
 961         r = sd_device_get_property_value(d, "ID_PART_ENTRY_NUMBER", &v);
 962         if (r < 0)
 963                 return log_error_errno(r, "Failed to get device property: %m");
 964         r = safe_atou32(v, &part);
 965         if (r < 0)
 966                 return log_error_errno(r, "Failed to parse PART_ENTRY_NUMBER field.");
 967
 968         r = sd_device_get_property_value(d, "ID_PART_ENTRY_OFFSET", &v);
 969         if (r < 0)
 970                 return log_error_errno(r, "Failed to get device property: %m");
 971         r = safe_atou64(v, &pstart);
 972         if (r < 0)
 973                 return log_error_errno(r, "Failed to parse PART_ENTRY_OFFSET field.");
 974
 975         r = sd_device_get_property_value(d, "ID_PART_ENTRY_SIZE", &v);
 976         if (r < 0)
 977                 return log_error_errno(r, "Failed to get device property: %m");
 978         r = safe_atou64(v, &psize);
 979         if (r < 0)
 980                 return log_error_errno(r, "Failed to parse PART_ENTRY_SIZE field.");
 981
 982         if (ret_part)
 983                 *ret_part = part;
 984         if (ret_pstart)
 985                 *ret_pstart = pstart;
 986         if (ret_psize)
 987                 *ret_psize = psize;
 988         if (ret_uuid)
 989                 *ret_uuid = uuid;
 990
 991         return 0;
 992 }
 993
 994 static int verify_fsroot_dir(
 995                 const char *path,
 996                 bool searching,
 997                 bool unprivileged_mode,
 998                 dev_t *ret_dev) {
 999
1000         struct stat st, st2;
1001         const char *t2, *trigger;
1002         int r;
1003
1004         assert(path);
1005         assert(ret_dev);
1006
1007         /* So, the ESP and XBOOTLDR partition are commonly located on an autofs mount. stat() on the
1008          * directory won't trigger it, if it is not mounted yet. Let's hence explicitly trigger it here,
1009          * before stat()ing */
1010         trigger = strjoina(path, "/trigger"); /* Filename doesn't matter... */
1011         (void) access(trigger, F_OK);
1012
1013         if (stat(path, &st) < 0)
1014                 return log_full_errno((searching && errno == ENOENT) ||
1015                                       (unprivileged_mode && errno == EACCES) ? LOG_DEBUG : LOG_ERR, errno,
1016                                       "Failed to determine block device node of \"%s\": %m", path);
1017
1018         if (major(st.st_dev) == 0)
1019                 return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
1020                                       SYNTHETIC_ERRNO(searching ? EADDRNOTAVAIL : ENODEV),
1021                                       "Block device node of \"%s\" is invalid.", path);
1022
1023         t2 = strjoina(path, "/..");
1024         if (stat(t2, &st2) < 0) {
1025                 if (errno != EACCES)
1026                         r = -errno;
1027                 else {
1028                         _cleanup_free_ char *parent = NULL;
1029
1030                         /* If going via ".." didn't work due to EACCESS, then let's determine the parent path
1031                          * directly instead. It's not as good, due to symlinks and such, but we can't do
1032                          * anything better here. */
1033
1034                         parent = dirname_malloc(path);
1035                         if (!parent)
1036                                 return log_oom();
1037
1038                         if (stat(parent, &st2) < 0)
1039                                 r = -errno;
1040                         else
1041                                 r = 0;
1042                 }
1043
1044                 if (r < 0)
1045                         return log_full_errno(unprivileged_mode && r == -EACCES ? LOG_DEBUG : LOG_ERR, r,
1046                                               "Failed to determine block device node of parent of \"%s\": %m", path);
1047         }
1048
1049         if (st.st_dev == st2.st_dev)
1050                 return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
1051                                       SYNTHETIC_ERRNO(searching ? EADDRNOTAVAIL : ENODEV),
1052                                       "Directory \"%s\" is not the root of the file system.", path);
1053
1054         if (ret_dev)
1055                 *ret_dev = st.st_dev;
1056
1057         return 0;
1058 }
1059
1060 static int verify_esp(
1061                 const char *p,
1062                 bool searching,
1063                 bool unprivileged_mode,
1064                 uint32_t *ret_part,
1065                 uint64_t *ret_pstart,
1066                 uint64_t *ret_psize,
1067                 sd_id128_t *ret_uuid) {
1068
1069         bool relax_checks;
1070         dev_t devid;
1071         int r;
1072
1073         assert(p);
1074
1075         /* This logs about all errors, except:
1076          *
1077          *  -ENOENT        → if 'searching' is set, and the dir doesn't exist
1078          *  -EADDRNOTAVAIL → if 'searching' is set, and the dir doesn't look like an ESP
1079          *  -EACESS        → if 'unprivileged_mode' is set, and we have trouble acessing the thing
1080          */
1081
1082         relax_checks = getenv_bool("SYSTEMD_RELAX_ESP_CHECKS") > 0;
1083
1084         /* Non-root user can only check the status, so if an error occured in the following, it does not cause any
1085          * issues. Let's also, silence the error messages. */
1086
1087         if (!relax_checks) {
1088                 struct statfs sfs;
1089
1090                 if (statfs(p, &sfs) < 0)
1091                         /* If we are searching for the mount point, don't generate a log message if we can't find the path */
1092                         return log_full_errno((searching && errno == ENOENT) ||
1093                                               (unprivileged_mode && errno == EACCES) ? LOG_DEBUG : LOG_ERR, errno,
1094                                               "Failed to check file system type of \"%s\": %m", p);
1095
1096                 if (!F_TYPE_EQUAL(sfs.f_type, MSDOS_SUPER_MAGIC))
1097                         return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
1098                                               SYNTHETIC_ERRNO(searching ? EADDRNOTAVAIL : ENODEV),
1099                                               "File system \"%s\" is not a FAT EFI System Partition (ESP) file system.", p);
1100         }
1101
1102         r = verify_fsroot_dir(p, searching, unprivileged_mode, &devid);
1103         if (r < 0)
1104                 return r;
1105
1106         /* In a container we don't have access to block devices, skip this part of the verification, we trust
1107          * the container manager set everything up correctly on its own. */
1108         if (detect_container() > 0 || relax_checks)
1109                 goto finish;
1110
1111         /* If we are unprivileged we ask udev for the metadata about the partition. If we are privileged we
1112          * use blkid instead. Why? Because this code is called from 'bootctl' which is pretty much an
1113          * emergency recovery tool that should also work when udev isn't up (i.e. from the emergency shell),
1114          * however blkid can't work if we have no privileges to access block devices directly, which is why
1115          * we use udev in that case. */
1116         if (unprivileged_mode)
1117                 return verify_esp_udev(devid, searching, ret_part, ret_pstart, ret_psize, ret_uuid);
1118         else
1119                 return verify_esp_blkid(devid, searching, ret_part, ret_pstart, ret_psize, ret_uuid);
1120
1121 finish:
1122         if (ret_part)
1123                 *ret_part = 0;
1124         if (ret_pstart)
1125                 *ret_pstart = 0;
1126         if (ret_psize)
1127                 *ret_psize = 0;
1128         if (ret_uuid)
1129                 *ret_uuid = SD_ID128_NULL;
1130
1131         return 0;
1132 }
1133
1134 int find_esp_and_warn(
1135                 const char *path,
1136                 bool unprivileged_mode,
1137                 char **ret_path,
1138                 uint32_t *ret_part,
1139                 uint64_t *ret_pstart,
1140                 uint64_t *ret_psize,
1141                 sd_id128_t *ret_uuid) {
1142
1143         int r;
1144
1145         /* This logs about all errors except:
1146          *
1147          *    -ENOKEY → when we can't find the partition
1148          *   -EACCESS → when unprivileged_mode is true, and we can't access something
1149          */
1150
1151         if (path) {
1152                 r = verify_esp(path, false, unprivileged_mode, ret_part, ret_pstart, ret_psize, ret_uuid);
1153                 if (r < 0)
1154                         return r;
1155
1156                 goto found;
1157         }
1158
1159         path = getenv("SYSTEMD_ESP_PATH");
1160         if (path) {
1161                 if (!path_is_valid(path) || !path_is_absolute(path))
1162                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1163                                                "$SYSTEMD_ESP_PATH does not refer to absolute path, refusing to use it: %s",
1164                                                path);
1165
1166                 /* Note: when the user explicitly configured things with an env var we won't validate the mount
1167                  * point. After all we want this to be useful for testing. */
1168                 goto found;
1169         }
1170
1171         FOREACH_STRING(path, "/efi", "/boot", "/boot/efi") {
1172
1173                 r = verify_esp(path, true, unprivileged_mode, ret_part, ret_pstart, ret_psize, ret_uuid);
1174                 if (r >= 0)
1175                         goto found;
1176                 if (!IN_SET(r, -ENOENT, -EADDRNOTAVAIL)) /* This one is not it */
1177                         return r;
1178         }
1179
1180         /* No logging here */
1181         return -ENOKEY;
1182
1183 found:
1184         if (ret_path) {
1185                 char *c;
1186
1187                 c = strdup(path);
1188                 if (!c)
1189                         return log_oom();
1190
1191                 *ret_path = c;
1192         }
1193
1194         return 0;
1195 }
1196
1197 static int verify_xbootldr_blkid(
1198                 dev_t devid,
1199                 bool searching,
1200                 sd_id128_t *ret_uuid) {
1201
1202         sd_id128_t uuid = SD_ID128_NULL;
1203
1204 #if HAVE_BLKID
1205         _cleanup_(blkid_free_probep) blkid_probe b = NULL;
1206         _cleanup_free_ char *node = NULL;
1207         const char *v;
1208         int r;
1209
1210         r = device_path_make_major_minor(S_IFBLK, devid, &node);
1211         if (r < 0)
1212                 return log_error_errno(r, "Failed to format major/minor device path: %m");
1213         errno = 0;
1214         b = blkid_new_probe_from_filename(node);
1215         if (!b)
1216                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(ENOMEM), "Failed to open file system \"%s\": %m", node);
1217
1218         blkid_probe_enable_partitions(b, 1);
1219         blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
1220
1221         errno = 0;
1222         r = blkid_do_safeprobe(b);
1223         if (r == -2)
1224                 return log_error_errno(SYNTHETIC_ERRNO(ENODEV), "File system \"%s\" is ambiguous.", node);
1225         else if (r == 1)
1226                 return log_error_errno(SYNTHETIC_ERRNO(ENODEV), "File system \"%s\" does not contain a label.", node);
1227         else if (r != 0)
1228                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe file system \"%s\": %m", node);
1229
1230         errno = 0;
1231         r = blkid_probe_lookup_value(b, "PART_ENTRY_SCHEME", &v, NULL);
1232         if (r != 0)
1233                 return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe partition scheme of \"%s\": %m", node);
1234         if (streq(v, "gpt")) {
1235
1236                 errno = 0;
1237                 r = blkid_probe_lookup_value(b, "PART_ENTRY_TYPE", &v, NULL);
1238                 if (r != 0)
1239                         return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe partition type UUID of \"%s\": %m", node);
1240                 if (!streq(v, "bc13c2ff-59e6-4262-a352-b275fd6f7172"))
1241                         return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
1242                                               searching ? SYNTHETIC_ERRNO(EADDRNOTAVAIL) : SYNTHETIC_ERRNO(ENODEV),
1243                                               "File system \"%s\" has wrong type for extended boot loader partition.", node);
1244
1245                 errno = 0;
1246                 r = blkid_probe_lookup_value(b, "PART_ENTRY_UUID", &v, NULL);
1247                 if (r != 0)
1248                         return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe partition entry UUID of \"%s\": %m", node);
1249                 r = sd_id128_from_string(v, &uuid);
1250                 if (r < 0)
1251                         return log_error_errno(r, "Partition \"%s\" has invalid UUID \"%s\".", node, v);
1252
1253         } else if (streq(v, "dos")) {
1254
1255                 errno = 0;
1256                 r = blkid_probe_lookup_value(b, "PART_ENTRY_TYPE", &v, NULL);
1257                 if (r != 0)
1258                         return log_error_errno(errno ?: SYNTHETIC_ERRNO(EIO), "Failed to probe partition type UUID of \"%s\": %m", node);
1259                 if (!streq(v, "0xea"))
1260                         return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
1261                                               searching ? SYNTHETIC_ERRNO(EADDRNOTAVAIL) : SYNTHETIC_ERRNO(ENODEV),
1262                                               "File system \"%s\" has wrong type for extended boot loader partition.", node);
1263
1264         } else
1265                 return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
1266                                       searching ? SYNTHETIC_ERRNO(EADDRNOTAVAIL) : SYNTHETIC_ERRNO(ENODEV),
1267                                       "File system \"%s\" is not on a GPT or DOS partition table.", node);
1268 #endif
1269
1270         if (ret_uuid)
1271                 *ret_uuid = uuid;
1272
1273         return 0;
1274 }
1275
1276 static int verify_xbootldr_udev(
1277                 dev_t devid,
1278                 bool searching,
1279                 sd_id128_t *ret_uuid) {
1280
1281         _cleanup_(sd_device_unrefp) sd_device *d = NULL;
1282         _cleanup_free_ char *node = NULL;
1283         sd_id128_t uuid = SD_ID128_NULL;
1284         const char *v;
1285         int r;
1286
1287         r = device_path_make_major_minor(S_IFBLK, devid, &node);
1288         if (r < 0)
1289                 return log_error_errno(r, "Failed to format major/minor device path: %m");
1290
1291         r = sd_device_new_from_devnum(&d, 'b', devid);
1292         if (r < 0)
1293                 return log_error_errno(r, "Failed to get device from device number: %m");
1294
1295         r = sd_device_get_property_value(d, "ID_PART_ENTRY_SCHEME", &v);
1296         if (r < 0)
1297                 return log_error_errno(r, "Failed to get device property: %m");
1298
1299         if (streq(v, "gpt")) {
1300
1301                 r = sd_device_get_property_value(d, "ID_PART_ENTRY_TYPE", &v);
1302                 if (r < 0)
1303                         return log_error_errno(r, "Failed to get device property: %m");
1304                 if (!streq(v, "bc13c2ff-59e6-4262-a352-b275fd6f7172"))
1305                         return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
1306                                               searching ? SYNTHETIC_ERRNO(EADDRNOTAVAIL) : SYNTHETIC_ERRNO(ENODEV),
1307                                               "File system \"%s\" has wrong type for extended boot loader partition.", node);
1308
1309                 r = sd_device_get_property_value(d, "ID_PART_ENTRY_UUID", &v);
1310                 if (r < 0)
1311                         return log_error_errno(r, "Failed to get device property: %m");
1312                 r = sd_id128_from_string(v, &uuid);
1313                 if (r < 0)
1314                         return log_error_errno(r, "Partition \"%s\" has invalid UUID \"%s\".", node, v);
1315
1316         } else if (streq(v, "dos")) {
1317
1318                 r = sd_device_get_property_value(d, "ID_PART_ENTRY_TYPE", &v);
1319                 if (r < 0)
1320                         return log_error_errno(r, "Failed to get device property: %m");
1321                 if (!streq(v, "0xea"))
1322                         return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
1323                                               searching ? SYNTHETIC_ERRNO(EADDRNOTAVAIL) : SYNTHETIC_ERRNO(ENODEV),
1324                                               "File system \"%s\" has wrong type for extended boot loader partition.", node);
1325         } else
1326                 return log_full_errno(searching ? LOG_DEBUG : LOG_ERR,
1327                                       searching ? SYNTHETIC_ERRNO(EADDRNOTAVAIL) : SYNTHETIC_ERRNO(ENODEV),
1328                                       "File system \"%s\" is not on a GPT or DOS partition table.", node);
1329
1330         if (ret_uuid)
1331                 *ret_uuid = uuid;
1332
1333         return 0;
1334 }
1335
1336 static int verify_xbootldr(
1337                 const char *p,
1338                 bool searching,
1339                 bool unprivileged_mode,
1340                 sd_id128_t *ret_uuid) {
1341
1342         bool relax_checks;
1343         dev_t devid;
1344         int r;
1345
1346         assert(p);
1347
1348         relax_checks = getenv_bool("SYSTEMD_RELAX_XBOOTLDR_CHECKS") > 0;
1349
1350         r = verify_fsroot_dir(p, searching, unprivileged_mode, &devid);
1351         if (r < 0)
1352                 return r;
1353
1354         if (detect_container() > 0 || relax_checks)
1355                 goto finish;
1356
1357         if (unprivileged_mode)
1358                 return verify_xbootldr_udev(devid, searching, ret_uuid);
1359         else
1360                 return verify_xbootldr_blkid(devid, searching, ret_uuid);
1361
1362 finish:
1363         if (ret_uuid)
1364                 *ret_uuid = SD_ID128_NULL;
1365
1366         return 0;
1367 }
1368
1369 int find_xbootldr_and_warn(
1370                 const char *path,
1371                 bool unprivileged_mode,
1372                 char **ret_path,
1373                 sd_id128_t *ret_uuid) {
1374
1375         int r;
1376
1377         /* Similar to find_esp_and_warn(), but finds the XBOOTLDR partition. Returns the same errors. */
1378
1379         if (path) {
1380                 r = verify_xbootldr(path, false, unprivileged_mode, ret_uuid);
1381                 if (r < 0)
1382                         return r;
1383
1384                 goto found;
1385         }
1386
1387         path = getenv("SYSTEMD_XBOOTLDR_PATH");
1388         if (path) {
1389                 if (!path_is_valid(path) || !path_is_absolute(path))
1390                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1391                                                "$SYSTEMD_XBOOTLDR_PATH does not refer to absolute path, refusing to use it: %s",
1392                                                path);
1393
1394                 goto found;
1395         }
1396
1397         r = verify_xbootldr("/boot", true, unprivileged_mode, ret_uuid);
1398         if (r >= 0) {
1399                 path = "/boot";
1400                 goto found;
1401         }
1402         if (!IN_SET(r, -ENOENT, -EADDRNOTAVAIL)) /* This one is not it */
1403                 return r;
1404
1405         return -ENOKEY;
1406
1407 found:
1408         if (ret_path) {
1409                 char *c;
1410
1411                 c = strdup(path);
1412                 if (!c)
1413                         return log_oom();
1414
1415                 *ret_path = c;
1416         }
1417
1418         return 0;
1419 }
1420
1421 static const char* const boot_entry_type_table[_BOOT_ENTRY_MAX] = {
1422         [BOOT_ENTRY_CONF] = "conf",
1423         [BOOT_ENTRY_UNIFIED] = "unified",
1424         [BOOT_ENTRY_LOADER] = "loader",
1425 };
1426
1427 DEFINE_STRING_TABLE_LOOKUP(boot_entry_type, BootEntryType);