Tom Gundersen [Thu, 23 Jul 2015 11:13:43 +0000 (13:13 +0200)]
resolved: rr - don't read past end of RR when parsing NSEC(3)
We can never read past the end of the packet, so this seems impossible
to exploit, but let's error out early as reading past the end of the
current RR is clearly an error.
Tom Gundersen [Thu, 23 Jul 2015 10:57:58 +0000 (12:57 +0200)]
resolved: packet - fail on invalid zero-length data
Most blobs (keys, signatures, ...) should have a specific size given by
the relevant algorithm. However, as we don't use/verify the algorithms
yet, let's just ensure that we don't read out zero-length data in cases
where this does not make sense.
The only exceptions, where zero-length data is allowed are in the NSEC3
salt field, and the generic data (which we don't know anything about,
so better not make any assumptions).
No need to actually reset the bitmap, we can just truncate it back zero
size. That not only makes bitmap_clear() quicker, but also subsequent
bitmap_isclear().
Let's make dns_packet_read_public_key() more generic by renaming it to
dns_packet_read_memdup() (which more accurately describes what it
does...). Then, patch all cases where we memdup() RR data to use this
new call.
This specifically checks for zero-length objects, and handles them
gracefully. It will set zero length payload fields as a result.
Special care should be taken to ensure that any code using this call
can handle the returned allocated field to be NULL if the size is
specified as 0!
Mike Gilbert [Thu, 23 Jul 2015 02:34:57 +0000 (22:34 -0400)]
nspawn: Don't pass uid mount option for devpts
Mounting devpts with a uid breaks pty allocation with recent glibc
versions, which expect that the kernel will set the correct owner for
user-allocated ptys.
The kernel seems to be smart enough to use the correct uid for root when
we switch to a user namespace.
tmpfiles: downgrade errors when a file system does not support file attributes
This downgrades errors from setting file attributes via tmpfiles to
warnings and makes them non-fatal.
Also, as a special case, if a file system does not support file
attributes at all, then the message is downgraded to debug, so that it
is not seen at all.
With this change reiserfs should not see any messages at all anymore
(since it apparently does not implement file attributes at all), but XFS
will still get a warning but no failure. The warning is something the
XFS kernel folks should fix though, by adjusting their file attributes
behaviour to be identical to ext234's.
Michal Schmidt [Wed, 22 Jul 2015 15:50:44 +0000 (17:50 +0200)]
basic: more optimizable IN_SET macro
Making the array static allows gcc -O2 to generate smaller code:
"size systemd" before:
text data bss dec hex filename 1377286 128608 2632 1508526 1704ae systemd
After:
text data bss dec hex filename 1374326 128572 2664 1505562 16f91a systemd
(IN_SET still results in worse generated code than using
"x == FOO || x == BAR || ...". I don't think we'll be able to match
that with the C preprocessor.)
This change limits the use of IN_SET to sets with constant elements. All
present callers use constants. The compiler would report an "initializer
element is not constant" error otherwise.
Michal Schmidt [Wed, 22 Jul 2015 15:05:41 +0000 (17:05 +0200)]
basic: better readable IN_SET macro
Putting the set elements in an array variable and using ELEMENTSOF makes
it clearer what's going on.
Incidentally, it also makes gcc -O2 generate slightly smaller code:
"size systemd", before:
text data bss dec hex filename 1378318 128608 2632 1509558 1708b6 systemd
After:
text data bss dec hex filename 1377286 128608 2632 1508526 1704ae systemd
Michal Schmidt [Tue, 21 Jul 2015 17:07:24 +0000 (19:07 +0200)]
core: adjust job completion message log levels
We do not print all non-OK job completion status messages to the console
in red, because not all of them are plain errors. We do however log the
same messages as LOG_ERR.
Differentiate the log levels by deducing them from the job result in a
way that more or less matches the color of the console message.
Michal Schmidt [Tue, 21 Jul 2015 12:54:24 +0000 (14:54 +0200)]
core: try harder to get job completion messages too
This is similar to "core: always try harder to get unit status
message format string", but for job completion status messages.
It makes generic status messages applicable for printing to the console.
And it rewrites the functions in a more table-based style.
Michal Schmidt [Mon, 20 Jul 2015 16:36:12 +0000 (18:36 +0200)]
core: unit_get_status_message_format() never returns NULL
unit_get_status_message_format() is used only with one of JOB_START,
JOB_STOP, JOB_RELOAD, all of which have fallback message strings
defined, so the function may never return NULL.
Daniel Mack [Mon, 20 Jul 2015 21:17:37 +0000 (23:17 +0200)]
user-sessions: fix write_string_file() fallout
WRITE_STRING_FILE_ATOMIC is only valid if WRITE_STRING_FILE_CREATE is also
given. IOW, an atomic file write operation is only possible when creating a
file is also being asked for.
This is a regression from the recent write_string_file() rework.
Daniel Mack [Mon, 20 Jul 2015 21:17:37 +0000 (23:17 +0200)]
logind: fix write_string_file() fallout
WRITE_STRING_FILE_ATOMIC is only valid if WRITE_STRING_FILE_CREATE is also
given. IOW, an atomic file write operation is only possible when creating a
file is also being asked for.
This is a regression from the recent write_string_file() rework.
Michal Schmidt [Mon, 20 Jul 2015 15:18:13 +0000 (17:18 +0200)]
core: always try harder to get unit status message format string
The starting/stopping messages are printed to the console only if the
corresponding format string is defined in the unit's vtable. To avoid
excessive messages on the console, the unit types whose start/stop
jobs are instantaneous had the format strings intentionally undefined.
When logging the same event to the journal, a fallback to generic
Starting/Stopping/Reloading messages is used.
The problem of excessive console messages with instantaneous jobs
is already resolved in a nicer way ("core: fix confusing logging of
instantaneous jobs"), so there's no longer a need to have two ways of
getting the format strings. Let's fold them into one function with
the fallback to generic message strings.
Michal Schmidt [Thu, 16 Jul 2015 19:39:56 +0000 (21:39 +0200)]
core: correct return value from reload methods
Return 1 from *_reload() methods to signify "we did something", just
like in *_start(). This causes "Reloading foo..." messages to be logged.
"Reloaded foo." messages are already logged.
Michal Schmidt [Thu, 16 Jul 2015 18:08:30 +0000 (20:08 +0200)]
core: fix confusing logging of instantaneous jobs
For instantaneous jobs (e.g. starting of targets, sockets, slices, or
Type=simple services) the log shows the job completion
before starting:
systemd[1]: Created slice -.slice.
systemd[1]: Starting -.slice.
systemd[1]: Created slice System Slice.
systemd[1]: Starting System Slice.
systemd[1]: Listening on Journal Audit Socket.
systemd[1]: Starting Journal Audit Socket.
systemd[1]: Reached target Timers.
systemd[1]: Starting Timers.
...
The reason is that the job completes before the ->start() method returns
and only then does unit_start() print the "Starting ..." message.
The same thing happens when stopping units.
Rather than fixing the order of the messages, let's just not emit the
Starting/Stopping message at all when the job completes instantaneously.
The job completion message is sufficient in this case.
If Linux efi stub is used, embedded cmdline in efi stub is
not shown. As a result, it is required to rewrite all the
line, if is only required to modify it. This behavior only
happen using Linux efi stub.
This patch allows boot loader to show embedded cmdline when
'e' key is pressed to edit boot loader options.
David Herrmann [Thu, 16 Jul 2015 16:46:12 +0000 (18:46 +0200)]
logind: never select closing sessions for a VT
If a session is in closing state (and already got rid of its VT), then
never re-select it for that VT. There is no reason why we should grant
something to a session that is already going away *AND* already got rid
of exactly that.
David Herrmann [Thu, 16 Jul 2015 16:18:01 +0000 (18:18 +0200)]
logind: prefer new sessions over older ones on VT switches
Our seat->positions[] array keeps track of the 'preferred' session on a
VT. The only situation this is used, is to select the session to activate
when a VT is activated. In the normal case, there's only one session per
VT so the selection is trivial.
Older greeters, however, implement take-overs when they start sessions on
the same VT that the greeter ran on. We recently limited such take-overs
to VTs where a greeter is running on, to force people to never share VTs
in new code that is written.
For legacy reasons, we need to be compatible to old greeters, though.
Hence, we allow those greeters to implement take-over. In such take-overs,
however, we should really make sure that the new sessions gets preferred
over the old one under all circumstances. Hence, make sure we override
the previous preferred session with a new session.
David Herrmann [Thu, 16 Jul 2015 13:14:43 +0000 (15:14 +0200)]
bus-proxy: never pass on unmatched broadcasts
The lovely libvirtd goes into crazy mode if it receives broadcasts that
it didn't subscribe to. With bus-proxyd, this might happen in 2 cases:
1) The kernel passes us an unmatched signal due to a false-positive
bloom-match.
2) We generate NameOwnerChanged/NameAcquired/NameLost locally even
though the peer didn't subscribe to it.
dbus-daemon is reliable in what signals it passes on. So make sure we
follow that style. Never ever send a signal to a local peer if it doesn't
match an installed filter of that peer.
David Herrmann [Thu, 16 Jul 2015 14:33:22 +0000 (16:33 +0200)]
sd-bus: add new test for NameAcquired via proxy/dbus-daemon
This adds test-bus-proxy which should be used to test correct behavior of
systemd-bus-proxyd. The first test that was added is to verify we actually
receive NameAcquired signals for ourselves on bus-connect.
While 235c6e6 gets LTO builds running again, it goes back to using fat
LTO objects instead of using gcc-{ar,nm,ranlib}. Building these fat
objects takes significantly more time.
Use the suggested solution and look for gcc-{ar,nm,ranlib}, which launch
the binutils tools with the appropriate --plugin parameter. GCC versions
that do not ship these should either default to -ffat-lto-objects or do
not support LTO at all.
On another note, nm from binutils 2.25 seems to be smart enough to load
the LTO plugin when needed without having to specify --plugin.
David Herrmann [Thu, 16 Jul 2015 12:37:08 +0000 (14:37 +0200)]
sd-bus: properly match ID changes
If the caller does not specify arg1 for NameOwnerChanged matches, we
really must take the ID from arg2 or arg3, if provided. They are
guaranteed to be identical to arg1 if either is supplied, but there is no
strict requiredment that arg1 is supplied. Hence, make sure to always
take the more restrictive match. Otherwise, we install rather wide
matches without anyone requiring them.
David Herrmann [Thu, 16 Jul 2015 12:35:15 +0000 (14:35 +0200)]
sd-bus: destination-matches cannot match NameOwnerChanged
Make sure we don't install NameOwnerChanged matches if the caller passed
a destination='' match (except if it is the broadcast address). Per spec,
all NameOwnerChanged signals are broadcasts.
Only the NameLost/NameAcquired signals are unicasts, but those are never
received through sd-bus. Instead, the bus-proxy synthesizes them and it
already installs proper matches for them.
David Herrmann [Thu, 16 Jul 2015 09:00:55 +0000 (11:00 +0200)]
sd-bus: fix gvariant structure encoding
In gvariant, all fixed-size objects need to be sized a multiple of their
alignment. If a structure has only fixed-size members, it is required to
be fixed size itself. If you imagine a structure like (ty), you have an
8-byte member followed by an 1-byte member. Hence, the overall inner-size
is 9. The alignment of the object is 8, though. Therefore, the specs
mandates final padding after fixed-size structures, to make sure it's
sized a multiple of its alignment (=> 16).
On the gvariant decoder side, we already account for this in
bus_gvariant_get_size(), as we apply overall padding to the size of the
structure. Therefore, our decoder correctly skips such final padding when
parsing fixed-size structure.
On the gvariant encoder side, however, we don't account for this final
padding. This patch fixes the structure and dict-entry encoders to
properly place such padding at the end of non-uniform fixed-size
structures.
The problem can be easily seen by running:
$ busctl --user monitor
and
$ busctl call --user org.freedesktop.systemd1 / org.foobar foobar "(ty)" 777 8
The monitor will fail to parse the message and print an error. With this
patch applied, everything works fine again.
This patch also adds a bunch of test-cases to force non-uniform
structures with non-pre-aligned positions.
Thanks to Jan Alexander Steffens <jan.steffens@gmail.com> for spotting
this and narrowing it down to non-uniform gvariant structures. Fixes #597.
projects / thirdparty / systemd.git / log
