sanitizer: ${{ matrix.sanitizer }}
output-sarif: true
- name: Upload Crash
- uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
+ uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8
if: failure() && steps.build.outcome == 'success'
with:
name: ${{ matrix.sanitizer }}-${{ matrix.architecture }}-artifacts
echo ${{ github.event.number }} >./${{ env.PULL_REQUEST_METADATA_DIR }}/${{ env.PULL_REQUEST_METADATA_FILE }}
- name: Upload Pull Request Metadata artifact
- uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
+ uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8
with:
name: ${{ env.PULL_REQUEST_METADATA_FILE }}
path: ${{ env.PULL_REQUEST_METADATA_DIR }}
template-path: .github/ISSUE_TEMPLATE/${{ matrix.template }}
- name: Set labels based on component field
- uses: redhat-plumbers-in-action/advanced-issue-labeler@71bcf99aef4b9ea844db9a43755e8ac02c8e661e
+ uses: redhat-plumbers-in-action/advanced-issue-labeler@9e55064634b67244f7deb4211452b4a7217b93de
with:
issue-form: ${{ steps.issue-parser.outputs.jsonString }}
template: ${{ matrix.template }}
reauthentication when unlocking a secret.
* teach systemd --user to properly load credentials off disk, with
- /etc/credstore equivalent and similar. Mkae sure that $CREDENTIALS_DIRECTORY=
+ /etc/credstore equivalent and similar. Make sure that $CREDENTIALS_DIRECTORY=
actually works too when run with user privs.
* extend the smbios11 logic for passing credentials so that instead of passing
}
/* Set up a new bus object for the system bus, configure it to wait for D-Bus to be available
- * instead of failing if it is not, and start it. All the following operations are asyncronous
+ * instead of failing if it is not, and start it. All the following operations are asynchronous
* and will not block waiting for D-Bus to be available.
* https://www.freedesktop.org/software/systemd/man/sd_bus_new.html
* https://www.freedesktop.org/software/systemd/man/sd_bus_set_address.html
to select which user the credential is from. Such credentials may only be decrypted from the
specified user's context, except if privileges can be acquired. Generally, when an encrypted
credential shall be used in the per-user service manager it should be encrypted with this option set,
- when it shall be used in the system service manager it should be encypted without.</para>
+ when it shall be used in the system service manager it should be encrypted without.</para>
<para>Internally, this ensures that the selected user's numeric UID and username, as well as the
system's
/* All real cgroup v2 controllers */
CGROUP_MASK_V2 = CGROUP_MASK_CPU|CGROUP_MASK_CPUSET|CGROUP_MASK_IO|CGROUP_MASK_MEMORY|CGROUP_MASK_PIDS,
- /* All controllers we want to delegate in case of Delegate=yes. Which are prety much the v2 controllers only, as delegation on v1 is not safe, and bpf stuff isn't a real controller */
+ /* All controllers we want to delegate in case of Delegate=yes. Which are pretty much the v2 controllers only, as delegation on v1 is not safe, and bpf stuff isn't a real controller */
CGROUP_MASK_DELEGATE = CGROUP_MASK_V2,
/* All cgroup v2 BPF pseudo-controllers */
return 0;
}
-int posix_spawn_wrapper(const char *path, char *const *argv, char *const *envp, pid_t *ret_pid) {
+int posix_spawn_wrapper(const char *path, char *const *argv, char *const *envp, PidRef *ret_pidref) {
posix_spawnattr_t attr;
sigset_t mask;
pid_t pid;
assert(path);
assert(argv);
- assert(ret_pid);
+ assert(ret_pidref);
assert_se(sigfillset(&mask) >= 0);
if (r != 0)
goto fail;
- *ret_pid = pid;
-
posix_spawnattr_destroy(&attr);
- return 0;
+
+ return pidref_set_pid(ret_pidref, pid);
fail:
assert(r > 0);
int is_reaper_process(void);
int make_reaper_process(bool b);
-int posix_spawn_wrapper(const char *path, char *const *argv, char *const *envp, pid_t *ret_pid);
+int posix_spawn_wrapper(const char *path, char *const *argv, char *const *envp, PidRef *ret_pidref);
int proc_dir_open(DIR **ret);
int proc_dir_read(DIR *d, pid_t *ret);
int r;
/* A wrapper around getpwnam_r() that allocates the necessary buffer on the heap. The caller must
- * free() the returned sructured! */
+ * free() the returned structures! */
if (isempty(name))
return -EINVAL;
return PAM_CONV_ERR;
}
+static int pam_close_session_and_delete_credentials(pam_handle_t *handle, int flags) {
+ int r, s;
+
+ assert(handle);
+
+ r = pam_close_session(handle, flags);
+ if (r != PAM_SUCCESS)
+ log_debug("pam_close_session() failed: %s", pam_strerror(handle, r));
+
+ s = pam_setcred(handle, PAM_DELETE_CRED | flags);
+ if (s != PAM_SUCCESS)
+ log_debug("pam_setcred(PAM_DELETE_CRED) failed: %s", pam_strerror(handle, s));
+
+ return r != PAM_SUCCESS ? r : s;
+}
+
#endif
static int setup_pam(
pam_code = pam_setcred(handle, PAM_ESTABLISH_CRED | flags);
if (pam_code != PAM_SUCCESS)
- log_debug("pam_setcred() failed, ignoring: %s", pam_strerror(handle, pam_code));
+ log_debug("pam_setcred(PAM_ESTABLISH_CRED) failed, ignoring: %s", pam_strerror(handle, pam_code));
pam_code = pam_open_session(handle, flags);
if (pam_code != PAM_SUCCESS)
assert(sig == SIGTERM);
}
- pam_code = pam_setcred(handle, PAM_DELETE_CRED | flags);
- if (pam_code != PAM_SUCCESS)
- goto child_finish;
-
/* If our parent died we'll end the session */
if (getppid() != parent_pid) {
- pam_code = pam_close_session(handle, flags);
+ pam_code = pam_close_session_and_delete_credentials(handle, flags);
if (pam_code != PAM_SUCCESS)
goto child_finish;
}
if (handle) {
if (close_session)
- pam_code = pam_close_session(handle, flags);
+ pam_code = pam_close_session_and_delete_credentials(handle, flags);
(void) pam_end(handle, pam_code | flags);
}
ExecParameters *params,
ExecRuntime *runtime,
const CGroupContext *cgroup_context,
- pid_t *ret) {
+ PidRef *ret) {
char serialization_fd_number[DECIMAL_STR_MAX(int) + 1];
_cleanup_free_ char *subcgroup_path = NULL, *log_level = NULL, *executor_path = NULL;
+ _cleanup_(pidref_done) PidRef pidref = PIDREF_NULL;
_cleanup_fdset_free_ FDSet *fdset = NULL;
_cleanup_fclose_ FILE *f = NULL;
- pid_t pid;
int r;
assert(unit);
"--log-level", log_level,
"--log-target", log_target_to_string(manager_get_executor_log_target(unit->manager))),
environ,
- &pid);
+ &pidref);
if (r < 0)
return log_unit_error_errno(unit, r, "Failed to spawn executor: %m");
- log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
+ log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pidref.pid);
/* We add the new process to the cgroup both in the child (so that we can be sure that no user code is ever
* executed outside of the cgroup) and in the parent (so that we can be sure that when we kill the cgroup the
* process will be killed too). */
if (subcgroup_path)
- (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path, pid);
+ (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path, pidref.pid);
- exec_status_start(&command->exec_status, pid);
+ exec_status_start(&command->exec_status, pidref.pid);
- *ret = pid;
+ *ret = TAKE_PIDREF(pidref);
return 0;
}
ExecParameters *exec_params,
ExecRuntime *runtime,
const CGroupContext *cgroup_context,
- pid_t *ret);
+ PidRef *ret);
void exec_command_done(ExecCommand *c);
void exec_command_done_array(ExecCommand *c, size_t n);
_cleanup_(exec_params_shallow_clear) ExecParameters exec_params = EXEC_PARAMETERS_INIT(
EXEC_APPLY_SANDBOXING|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN);
_cleanup_(pidref_done) PidRef pidref = PIDREF_NULL;
- pid_t pid;
int r;
assert(m);
&exec_params,
m->exec_runtime,
&m->cgroup_context,
- &pid);
- if (r < 0)
- return r;
-
- r = pidref_set_pid(&pidref, pid);
+ &pidref);
if (r < 0)
return r;
_cleanup_strv_free_ char **final_env = NULL, **our_env = NULL;
_cleanup_(pidref_done) PidRef pidref = PIDREF_NULL;
size_t n_env = 0;
- pid_t pid;
int r;
assert(caller);
&exec_params,
s->exec_runtime,
&s->cgroup_context,
- &pid);
+ &pidref);
if (r < 0)
return r;
s->exec_fd_event_source = TAKE_PTR(exec_fd_source);
s->exec_fd_hot = false;
- r = pidref_set_pid(&pidref, pid);
- if (r < 0)
- return r;
-
r = unit_watch_pidref(UNIT(s), &pidref, /* exclusive= */ true);
if (r < 0)
return r;
_cleanup_(exec_params_shallow_clear) ExecParameters exec_params = EXEC_PARAMETERS_INIT(
EXEC_APPLY_SANDBOXING|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN);
_cleanup_(pidref_done) PidRef pidref = PIDREF_NULL;
- pid_t pid;
int r;
assert(s);
&exec_params,
s->exec_runtime,
&s->cgroup_context,
- &pid);
- if (r < 0)
- return r;
-
- r = pidref_set_pid(&pidref, pid);
+ &pidref);
if (r < 0)
return r;
_cleanup_(exec_params_shallow_clear) ExecParameters exec_params = EXEC_PARAMETERS_INIT(
EXEC_APPLY_SANDBOXING|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN);
_cleanup_(pidref_done) PidRef pidref = PIDREF_NULL;
- pid_t pid;
int r;
assert(s);
&exec_params,
s->exec_runtime,
&s->cgroup_context,
- &pid);
- if (r < 0)
- return r;
-
- r = pidref_set_pid(&pidref, pid);
+ &pidref);
if (r < 0)
return r;
assert(ret);
assert(ret_target);
- /* This function determintes the correct freezer state transitions for a unit
+ /* This function determines the correct freezer state transitions for a unit
* given the action being requested. It returns the next state, and also the "target",
* which is either FREEZER_FROZEN or FREEZER_RUNNING, depending on what actual state we
* ultimately want to achieve. */
bool own_scope = p.scope == CREDENTIAL_USER && p.uid == peer_uid;
if (!own_scope || !timestamp_fresh) {
- /* Insist on PK if client wants to encrypt for another user or the system, or if the timestamp was explicitly overriden. */
+ /* Insist on PK if client wants to encrypt for another user or the system, or if the timestamp was explicitly overridden. */
r = varlink_verify_polkit_async(
link,
/* bus= */ NULL,
assert(hr);
/* For PKCS#11 derived keys (which are generated randomly and are of high quality already) we use a
- * minimal PBKDF */
+ * minimal PBKDF and CRYPT_PBKDF_NO_BENCHMARK flag to skip benchmark. */
*buffer = (struct crypt_pbkdf_type) {
.hash = user_record_luks_pbkdf_hash_algorithm(hr),
.type = CRYPT_KDF_PBKDF2,
- .iterations = 1,
- .time_ms = 1,
+ .iterations = 1000, /* recommended minimum count for pbkdf2
+ * according to NIST SP 800-132, ch. 5.2 */
+ .flags = CRYPT_PBKDF_NO_BENCHMARK
};
return buffer;
}
} else if (need_gids && streq(m, "UnixGroupIDs")) {
- /* Note that D-Bus actualy only gives us a combined list of
+ /* Note that D-Bus actually only gives us a combined list of
* primary gid and supplementary gids. And we don't know
* which one the primary one is. We'll take the whole shebang
* hence and use it as the supplementary group list, and not
r = getpeerpidfd(b->input_fd);
if (r < 0)
- log_debug_errno(r, "Failed to determin peer pidfd, ignoring: %m");
+ log_debug_errno(r, "Failed to determine peer pidfd, ignoring: %m");
else
close_and_replace(b->pidfd, r);
return 0;
}
- /* Set the retransmission time for Neigbor Solicitations. */
+ /* Set the retransmission time for Neighbor Solicitations. */
r = sysctl_write_ip_neighbor_property_uint32(AF_INET6, link->ifname, "retrans_time_ms", (uint32_t) msec);
if (r < 0)
log_link_warning_errno(
return log_error_errno(errno, "Failed to stat %s: %m", context->node);
if (IN_SET(arg_empty, EMPTY_REQUIRE, EMPTY_FORCE, EMPTY_CREATE) && S_ISREG(st.st_mode))
- /* Don't probe sector size from partition table if we are supposed to strat from an empty disk */
+ /* Don't probe sector size from partition table if we are supposed to start from an empty disk */
fs_secsz = ssz = 512;
else {
/* Auto-detect sector size if not specified. */
int r;
/* The RTA_VIA attribute is used only for IPv4 routes with an IPv6 gateway. If IPv4 gateways are
- * requested (af == AF_INET), then we do not return IPv6 gateway addresses. Similary, if IPv6
+ * requested (af == AF_INET), then we do not return IPv6 gateway addresses. Similarly, if IPv6
* gateways are requested (af == AF_INET6), then we do not return gateway addresses for IPv4 routes.
* So, the RTA_VIA attribute is only parsed when af == AF_UNSPEC. */
bool allow_via = af == AF_UNSPEC;
return 0;
}
- return log_error_errno(errno, "Faile to open system credentials directory.");
+ return log_error_errno(errno, "Failed to open system credentials directory.");
}
_cleanup_free_ DirectoryEntries *de = NULL;
#
# sudo ./systemd-networkd-tests.py NetworkdMTUTests.test_ipv6_mtu
#
-# Similarly, other indivdual tests can be run, eg.:
+# Similarly, other individual tests can be run, eg.:
#
# sudo ./systemd-networkd-tests.py NetworkdNetworkTests.test_ipv6_neigh_retrans_time
# See: https://github.com/systemd/systemd/issues/9858
OUT="$(mktemp)"
for _ in {0..4}; do
- curl --fail-with-body -d "plese process this🐱 $RANDOM" -L http://localhost:19531/upload | tee "$OUT"
+ curl --fail-with-body -d "please process this🐱 $RANDOM" -L http://localhost:19531/upload | tee "$OUT"
(! grep '[^[:print:]]' "$OUT")
done
curl --fail-with-body --upload-file "$GATEWAYD_FILE" -L http://localhost:19531/upload | tee "$OUT"
projects / thirdparty / systemd.git / commitdiff
