sysext: Support global sysext/confext

Load global sysext/confext from /.extra/global_{sysext,confext} which
systemd-stub puts there from ESP/loader/credentials/*.{sysext,confext}.raw.
Global extensions are handled the exact same way as per-UKI ones.

diff --git a/src/shared/discover-image.c b/src/shared/discover-image.c
index 089d656f40015c325915879c1ade4bf453929b2b..d39c3a13563422c112dca6846a3f6efb66ca3ac7 100644 (file)
--- a/src/shared/discover-image.c
+++ b/src/shared/discover-image.c
@@ -76,20 +76,22 @@ const char* const image_search_path[_IMAGE_CLASS_MAX] = {
                             "/usr/lib/confexts\0",
 };
 
-/* Inside the initrd, use a slightly different set of search path (i.e. include .extra/sysext/ and
- * .extra/confext/ in extension search dir) */
+/* Inside the initrd, use a slightly different set of search path (i.e. include .extra/sysext/,
+ * /.extra/global_sysext, .extra/confext/, and /.extra/global_confext in extension search dir) */
 static const char* const image_search_path_initrd[_IMAGE_CLASS_MAX] = {
         /* (entries that aren't listed here will get the same search path as for the non initrd-case) */
 
         [IMAGE_SYSEXT] =    "/etc/extensions\0"            /* only place symlinks here */
                             "/run/extensions\0"            /* and here too */
                             "/var/lib/extensions\0"        /* the main place for images */
-                            "/.extra/sysext\0",            /* put sysext picked up by systemd-stub last, since not trusted */
+                            "/.extra/sysext\0"             /* put sysext (per-UKI and global) picked up by systemd-stub */
+                            "/.extra/global_sysext\0",     /* last, since not trusted */
 
         [IMAGE_CONFEXT] =   "/run/confexts\0"              /* only place symlinks here */
                             "/var/lib/confexts\0"          /* the main place for images */
                             "/usr/local/lib/confexts\0"
-                            "/.extra/confext\0",           /* put confext picked up by systemd-stub last, since not trusted */
+                            "/.extra/confext\0"            /* put confext (per-UKI and global) picked up by systemd-stub */
+                            "/.extra/global_confext\0",    /* last, since not trusted. */
 };
 
 static const char* image_class_suffix_table[_IMAGE_CLASS_MAX] = {

diff --git a/src/sysext/sysext.c b/src/sysext/sysext.c
index b232ee4fc19682c4b369c3688641982978d887c8..97a835b8c851175ab94acccc921423b1e6de2478 100644 (file)
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@@ -1660,15 +1660,19 @@ static const ImagePolicy *pick_image_policy(const Image *img) {
         if (arg_image_policy)
                 return arg_image_policy;
 
-        /* If located in /.extra/sysext/ in the initrd, then it was placed there by systemd-stub, and was
+        /* If located in /.extra/ in the initrd, then it was placed there by systemd-stub, and was
          * picked up from an untrusted ESP. Thus, require a stricter policy by default for them. (For the
          * other directories we assume the appropriate level of trust was already established already.  */
 
         if (in_initrd()) {
                 if (path_startswith(img->path, "/.extra/sysext/"))
                         return &image_policy_sysext_strict;
+                if (path_startswith(img->path, "/.extra/global_sysext/"))
+                        return &image_policy_sysext_strict;
                 if (path_startswith(img->path, "/.extra/confext/"))
                         return &image_policy_confext_strict;
+                if (path_startswith(img->path, "/.extra/global_confext/"))
+                        return &image_policy_confext_strict;
 
                 /* Better safe than sorry, refuse everything else passed in via the untrusted /.extra/ dir */
                 if (path_startswith(img->path, "/.extra/"))

diff --git a/units/systemd-confext-initrd.service b/units/systemd-confext-initrd.service
index 22461fa7120a4f2d391a54dddec5182f8e556aab..073307edcce7fe56ff9c9177342acf8ad8a31805 100644 (file)
--- a/units/systemd-confext-initrd.service
+++ b/units/systemd-confext-initrd.service
@@ -17,6 +17,7 @@ ConditionDirectoryNotEmpty=|/var/lib/confexts
 ConditionDirectoryNotEmpty=|/usr/local/lib/confexts
 ConditionDirectoryNotEmpty=|/usr/lib/confexts
 ConditionDirectoryNotEmpty=|/.extra/confext
+ConditionDirectoryNotEmpty=|/.extra/global_confext
 ConditionPathExists=/etc/initrd-release
 
 DefaultDependencies=no

diff --git a/units/systemd-sysext-initrd.service b/units/systemd-sysext-initrd.service
index f21990aad0127fcf6a2f4cb83295fb4fba9371c6..4a411bb65e0efe3a632bbecf26556183121c7486 100644 (file)
--- a/units/systemd-sysext-initrd.service
+++ b/units/systemd-sysext-initrd.service
@@ -16,6 +16,7 @@ ConditionDirectoryNotEmpty=|/etc/extensions
 ConditionDirectoryNotEmpty=|/run/extensions
 ConditionDirectoryNotEmpty=|/var/lib/extensions
 ConditionDirectoryNotEmpty=|/.extra/sysext
+ConditionDirectoryNotEmpty=|/.extra/global_sysext
 ConditionPathExists=/etc/initrd-release
 
 DefaultDependencies=no