From: Luca Boccassi Date: Wed, 6 Apr 2022 16:25:35 +0000 (+0100) Subject: core: fix dm-verity auto-discovery in MountImageUnit() X-Git-Tag: v251-rc2~166 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cedf5b1aef4da2443f00eef2c242c8b005071aca;p=thirdparty%2Fsystemd.git core: fix dm-verity auto-discovery in MountImageUnit() The implementation of MountImageUnit()/systemctl mount-image was changed to use a /proc/self/fd path as the source, but that causes the dm-verity files autodiscovery to fail, as it looks for files in the same directory as the image. Use the original file path when setting up dm-verity. --- diff --git a/src/core/namespace.c b/src/core/namespace.c index 4ede17788b1..e6aa7b6473e 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -1216,7 +1216,7 @@ static int mount_image(const MountEntry *m, const char *root_directory) { } r = verity_dissect_and_mount( - mount_entry_source(m), mount_entry_path(m), m->image_options, + /* src_fd= */ -1, mount_entry_source(m), mount_entry_path(m), m->image_options, host_os_release_id, host_os_release_version_id, host_os_release_sysext_level, NULL); if (r == -ENOENT && m->ignore) return 0; diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c index e63b168c24a..6e287ecac72 100644 --- a/src/shared/dissect-image.c +++ b/src/shared/dissect-image.c @@ -3448,6 +3448,7 @@ static const char *const partition_designator_table[] = { }; int verity_dissect_and_mount( + int src_fd, const char *src, const char *dest, const MountOptions *options, @@ -3466,14 +3467,17 @@ int verity_dissect_and_mount( assert(src); assert(dest); + /* We might get an FD for the image, but we use the original path to look for the dm-verity files */ r = verity_settings_load(&verity, src, NULL, NULL); if (r < 0) return log_debug_errno(r, "Failed to load root hash: %m"); dissect_image_flags = verity.data_path ? DISSECT_IMAGE_NO_PARTITION_TABLE : 0; + /* Note that we don't use loop_device_make here, as the FD is most likely O_PATH which would not be + * accepted by LOOP_CONFIGURE, so just let loop_device_make_by_path reopen it as a regular FD. */ r = loop_device_make_by_path( - src, + src_fd >= 0 ? FORMAT_PROC_FD_PATH(src_fd) : src, -1, verity.data_path ? 0 : LO_FLAGS_PARTSCAN, &loop_device); diff --git a/src/shared/dissect-image.h b/src/shared/dissect-image.h index b74adf5f8de..1bc8d2ef9a3 100644 --- a/src/shared/dissect-image.h +++ b/src/shared/dissect-image.h @@ -285,4 +285,4 @@ bool dissected_image_verity_sig_ready(const DissectedImage *image, PartitionDesi int mount_image_privately_interactively(const char *path, DissectImageFlags flags, char **ret_directory, LoopDevice **ret_loop_device, DecryptedImage **ret_decrypted_image); -int verity_dissect_and_mount(const char *src, const char *dest, const MountOptions *options, const char *required_host_os_release_id, const char *required_host_os_release_version_id, const char *required_host_os_release_sysext_level, const char *required_sysext_scope); +int verity_dissect_and_mount(int src_fd, const char *src, const char *dest, const MountOptions *options, const char *required_host_os_release_id, const char *required_host_os_release_version_id, const char *required_host_os_release_sysext_level, const char *required_sysext_scope); diff --git a/src/shared/mount-util.c b/src/shared/mount-util.c index 78f06b25fee..e76e4a0b389 100644 --- a/src/shared/mount-util.c +++ b/src/shared/mount-util.c @@ -789,6 +789,7 @@ static int mount_in_namespace( bool mount_slave_created = false, mount_slave_mounted = false, mount_tmp_created = false, mount_tmp_mounted = false, mount_outside_created = false, mount_outside_mounted = false; + _cleanup_free_ char *chased_src_path = NULL; struct stat st, self_mntns_st; pid_t child; int r; @@ -826,9 +827,10 @@ static int mount_in_namespace( if (r < 0) return log_debug_errno(r == -ENOENT ? SYNTHETIC_ERRNO(EOPNOTSUPP) : r, "Target does not allow propagation of mount points"); - r = chase_symlinks(src, NULL, CHASE_TRAIL_SLASH, NULL, &chased_src_fd); + r = chase_symlinks(src, NULL, 0, &chased_src_path, &chased_src_fd); if (r < 0) return log_debug_errno(r, "Failed to resolve source path of %s: %m", src); + log_debug("Chased source path of %s to %s", src, chased_src_path); if (fstat(chased_src_fd, &st) < 0) return log_debug_errno(errno, "Failed to stat() resolved source path %s: %m", src); @@ -873,7 +875,7 @@ static int mount_in_namespace( mount_tmp_created = true; if (is_image) - r = verity_dissect_and_mount(FORMAT_PROC_FD_PATH(chased_src_fd), mount_tmp, options, NULL, NULL, NULL, NULL); + r = verity_dissect_and_mount(chased_src_fd, chased_src_path, mount_tmp, options, NULL, NULL, NULL, NULL); else r = mount_follow_verbose(LOG_DEBUG, FORMAT_PROC_FD_PATH(chased_src_fd), mount_tmp, NULL, MS_BIND, NULL); if (r < 0) diff --git a/test/units/testsuite-50.sh b/test/units/testsuite-50.sh index 6aabbd139c3..2f1844ccf74 100755 --- a/test/units/testsuite-50.sh +++ b/test/units/testsuite-50.sh @@ -285,7 +285,7 @@ Type=notify RemainAfterExit=yes MountAPIVFS=yes PrivateTmp=yes -ExecStart=/bin/sh -c 'systemd-notify --ready; while ! grep -q -F MARKER /tmp/img/usr/lib/os-release; do sleep 0.1; done; mount | grep -F "/tmp/img" | grep -q -F "nosuid"' +ExecStart=/bin/sh -c 'systemd-notify --ready; while ! grep -q -F MARKER /tmp/img/usr/lib/os-release; do sleep 0.1; done; mount | grep -F "/dev/mapper/${roothash}-verity" | grep -q -F "nosuid"' EOF systemctl start testservice-50d.service