Karel Zak [Mon, 20 Jul 2026 08:40:00 +0000 (10:40 +0200)]
Merge branch 'PR/libmount-vfs' of https://github.com/karelzak/util-linux-work
* 'PR/libmount-vfs' of https://github.com/karelzak/util-linux-work:
docs: add VFS symbols to libmount-sections.txt
tests: add libmount VFS test
libmount: add VFS test to test_mount_context
libmount: add pluggable VFS I/O support
Karel Zak [Wed, 15 Jul 2026 10:46:06 +0000 (12:46 +0200)]
libmount: add VFS test to test_mount_context
Add --vfs test that exercises the pluggable VFS I/O operations with
three sub-options:
--table <file> parse a mount table through VFS fopen
--cache <dev> probe device via cache (udev, then blkid)
--blkid <dev> probe device directly via libblkid VFS
The test sets up VFS callbacks that wrap standard syscalls and report
call counts, verifying that I/O is routed through the pluggable layer.
Karel Zak [Wed, 15 Jul 2026 10:21:29 +0000 (12:21 +0200)]
libmount: add pluggable VFS I/O support
Add three new public APIs for pluggable VFS I/O operations:
- mnt_context_set_vfs(cxt, ops) -- set VFS on mount context (owned copy)
- mnt_cache_refer_vfs(cache, vfs) -- set VFS reference on cache (borrowed)
- mnt_table_refer_vfs(tb, vfs) -- set VFS reference on table (borrowed)
The VFS operations are automatically propagated from the context to its
cache and tables when they are created or set.
Convert blkid probe calls in cache.c (read_from_blkid, fstype_from_blkid)
from blkid_new_probe_from_filename() to the VFS-aware 3-step pattern:
blkid_new_probe() + blkid_probe_set_vfs() + blkid_probe_open_device().
Convert mnt_table_parse_file() to use ul_vfs_fopen() for VFS-aware
file opening.
Karel Zak [Wed, 15 Jul 2026 11:19:37 +0000 (13:19 +0200)]
Merge branch 'PR/dl-utils' of https://github.com/karelzak/util-linux-work
* 'PR/dl-utils' of https://github.com/karelzak/util-linux-work:
tools: switch SELinux to runtime optional via dlopen
libmount: use shared dl-utils for SELinux dlopen
libmount: fix -Wunterminated-string-initialization warning
libmount: use shared dl-utils for cryptsetup dlopen
lib/dl-utils: add shared dlopen/dlsym infrastructure
Karel Zak [Tue, 14 Jul 2026 12:48:39 +0000 (14:48 +0200)]
docs: findmnt: clarify that --target returns one filesystem
The --target option identifies the filesystem for a given path, and a
file always resides on exactly one filesystem. Document that --target
returns at most one entry and skips over-mounted entries.
Addresses: https://github.com/util-linux/util-linux/issues/4424 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Mon, 13 Jul 2026 14:28:43 +0000 (16:28 +0200)]
tools: switch SELinux to runtime optional via dlopen
Replace direct libselinux linking with runtime dlopen() using the
shared dl-utils infrastructure. All tools that use SELinux functions
now call them through selinux_call() macro and gracefully handle the
case when libselinux is not installed at runtime.
Karel Zak [Mon, 13 Jul 2026 14:18:29 +0000 (16:18 +0200)]
libmount: use shared dl-utils for SELinux dlopen
Add lib/dl-selinux.c and include/dl-selinux.h as a SELinux dlopen
wrapper using the shared dl-utils infrastructure. This replaces the
direct libselinux linking with runtime dlopen(), allowing libmount to
gracefully handle the case when libselinux is not installed.
The hook_selinux.c and lib/selinux-utils.c now use selinux_call()
macro to call SELinux functions through the dlopen'd function pointer
table.
The "xx\0" string literal is 4 bytes but buf is only 3, truncating
the NUL terminator. Since the buffer is immediately overwritten by
memcpy, just zero-initialize it instead.
Karel Zak [Mon, 13 Jul 2026 13:42:14 +0000 (15:42 +0200)]
libmount: use shared dl-utils for cryptsetup dlopen
Move the cryptsetup dlopen wrapper out of hook_veritydev.c into
lib/dl-cryptsetup.c with a global cached load function
ul_dlopen_libcryptsetup(). The function pointers are resolved once
and shared across all callers.
This removes the CRYPTSETUP_VIA_DLOPEN conditional -- dlopen is now the
only supported way to use libcryptsetup. The library is never linked
directly.
An ELF .note.dlopen metadata note is emitted so that packaging tools
can automatically derive the optional runtime dependency.
Also fix the CFLAGS order in libmount Makemodule.am to ensure local
include paths (-I for blkid, libmount) come before external pkg-config
flags that may pull in system headers.
Add generic helpers for optional runtime dependencies loaded via dlopen().
Each optional library gets its own struct of function pointers and a symbol
table mapping names to offsets in that struct. The shared ul_dlopen_symbols()
resolves all entries in one call.
This also includes a copy of the ELF .note.dlopen metadata macro (from
systemd's sd-dlopen.h, MIT-0 licensed) so that packaging tools can
automatically derive optional dlopen() dependencies.
Library-specific wrappers will live in lib/dl-<name>.c.
dengbo [Thu, 25 Jun 2026 13:52:16 +0000 (21:52 +0800)]
findmnt: skip shadowed entries when matching by --target
The previous approach filtered shadowed entries in match_func() using
mnt_table_over_fs() with is_defined_match(COL_TARGET) as the trigger.
This was fragile because COL_TARGET matching is also enabled by other
code paths (source/target swap fallback in get_next_fs(), poll_match()
swap logic, and positional arguments).
Replace with the standard mountinfo iteration pattern: read
/proc/self/mountinfo backward (MNT_ITER_BACKWARD), stop at the first
match (FL_FIRSTONLY), and disable source/target swapping
(FL_NOSWAPMATCH). Since later mounts appear later in mountinfo,
backward iteration naturally finds the visible (topmost) filesystem
for the given target path.
Karel Zak [Thu, 9 Jul 2026 14:44:20 +0000 (16:44 +0200)]
Merge branch 'PR/libblkid-vfs' of https://github.com/karelzak/util-linux-work
* 'PR/libblkid-vfs' of https://github.com/karelzak/util-linux-work:
lib/sysfs: add VFS parameter to sysfs_devno_is_dm_*()
lib/procfs: use VFS dispatch for read and close
lib/path: add VFS support
vfs: add FILE* stream support to the VFS abstraction layer
vfs: move mode2flags() to include/vfs.h as ul_mode_to_flags()
wipefs: use blkid_probe_open_device()
libblkid: use blkid_probe_open_device() in evaluate and verify
libblkid: add blkid_probe_open_device()
libblkid: use VFS I/O operations in probe
libblkid: add blkid_probe_set_vfs() for pluggable I/O
include: add VFS I/O abstraction layer
all-io: rename read_all/write_all to ul_read_all/ul_write_all
Karel Zak [Tue, 30 Jun 2026 15:30:33 +0000 (17:30 +0200)]
lib/sysfs: add VFS parameter to sysfs_devno_is_dm_*()
Add const struct ul_vfs_ops *vfs parameter to sysfs_devno_is_dm_hidden()
and sysfs_devno_is_dm_private() so the internal sysfs reads go through
VFS dispatch.
Wire pr->vfs in libblkid probe.c and topology/sysfs.c callers.
Non-library callers pass NULL.
Addresses: https://github.com/util-linux/util-linux/issues/4308 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 30 Jun 2026 14:53:56 +0000 (16:53 +0200)]
vfs: move mode2flags() to include/vfs.h as ul_mode_to_flags()
Move the fopen-style mode string to open(2) flags parser from
lib/path.c to include/vfs.h for reuse across the project,
especially in the upcoming ul_vfs_fopen() helper.
Addresses: https://github.com/util-linux/util-linux/issues/4308 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 30 Jun 2026 13:52:08 +0000 (15:52 +0200)]
wipefs: use blkid_probe_open_device()
Convert wipefs new_probe() to use blkid_probe_open_device() instead
of open() + blkid_probe_set_device(). The flags argument allows
passing the open mode directly.
Karel Zak [Tue, 30 Jun 2026 13:40:46 +0000 (15:40 +0200)]
libblkid: use blkid_probe_open_device() in evaluate and verify
Convert evaluate.c and verify.c to use blkid_probe_open_device()
instead of open() + blkid_probe_set_device(). This makes these
internal callers VFS-aware and simplifies fd ownership.
Clean up verify.c error paths with dev_err/dev_free labels.
Karel Zak [Tue, 30 Jun 2026 13:18:25 +0000 (15:18 +0200)]
libblkid: add blkid_probe_open_device()
Add a convenience function that opens a device and assigns it to
the probe, using VFS operations if previously set. This enables
the composable pattern:
Karel Zak [Tue, 30 Jun 2026 12:47:19 +0000 (14:47 +0200)]
libblkid: use VFS I/O operations in probe
Replace all direct I/O syscalls in the probe path with ul_vfs_*
dispatch functions that route through the pluggable VFS layer when
set, falling back to real syscalls otherwise.
Add ul_vfs_copy() to include/vfs.h for cloning VFS ops structs.
Changed call sites:
- read_buffer(): lseek + read
- is_sector_readable(): lseek + read, changed signature to take
blkid_probe instead of bare fd
- blkid_probe_set_device(): close
- blkid_do_wipe(): lseek + write_all + fsync
- blkid_free_probe(): close + free(pr->vfs)
- blkid_clone_probe(): allocate private VFS copy via ul_vfs_copy()
Addresses: https://github.com/util-linux/util-linux/issues/4308 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 30 Jun 2026 12:38:56 +0000 (14:38 +0200)]
libblkid: add blkid_probe_set_vfs() for pluggable I/O
Add public API to set custom VFS I/O operations on a blkid probe.
This allows callers (e.g., systemd fibers) to replace standard
read/write/lseek/open/close/fsync with custom implementations.
The ops struct is copied into a private allocation owned by the
probe. NULL function pointers fall back to standard syscalls.
Passing NULL resets to defaults.
New public symbol: blkid_probe_set_vfs()
New struct in public header: struct ul_vfs_ops (with include guard
shared with include/vfs.h)
Addresses: https://github.com/util-linux/util-linux/issues/4308 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 30 Jun 2026 12:20:50 +0000 (14:20 +0200)]
include: add VFS I/O abstraction layer
Add include/vfs.h with struct ul_vfs_ops — a pluggable I/O operations
table with function pointers matching POSIX signatures (read, write,
open, close, lseek, fsync). NULL function pointers fall back to real
syscalls. The size field enables forward/backward compatible struct
evolution.
Refactor include/all-io.h to use VFS dispatch internally:
- ul_write_all() and ul_read_all() become macros calling
__write_all(NULL, ...) and __read_all(NULL, ...)
- New ul_vfs_write_all() and ul_vfs_read_all() macros pass
through a VFS ops struct for custom I/O
Addresses: https://github.com/util-linux/util-linux/issues/4308 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Thu, 9 Jul 2026 10:09:14 +0000 (12:09 +0200)]
tests: lslocks filter, workaround duplicate lines in output
Duplicate lines have been observed in lslocks output on ppc64le
(kernel 7.0). The root cause is unknown. No duplication path has
been found in the lslocks code itself.
Wrap lslocks calls in do_lslocks() helper that deduplicates
consecutive identical lines via uniq. If duplicates are detected,
warn and mark the test as KNOWN FAILED.
Karel Zak [Wed, 8 Jul 2026 12:03:43 +0000 (14:03 +0200)]
mount: fix grammar and typo in X-mount.idmap documentation
Apply grammar improvements from PR #4400 (field order change
intentionally omitted as the current order matches the code).
Also fix a GUID -> GID typo in the example.
Karel Zak [Wed, 8 Jul 2026 11:57:12 +0000 (13:57 +0200)]
tests: (chrt) improve skip_policy with runtime probe
The skip_policy function relied solely on "chrt --max" output to
detect kernel support for scheduling policies. This is unreliable
for SCHED_EXT where sched_get_priority_max() returns 0 even on
kernels without CONFIG_SCHED_CLASS_EXT, causing the test to fail
with EINVAL instead of skipping gracefully.
Rework skip_policy to accept optional chrt probe arguments and
verify actual kernel support by attempting to set the policy on
the chrt process itself (--pid 0). Cache "chrt --max" output once
at startup to avoid repeated execution.
Additionally, filter the platform-dependent runtime parameter from
do_chrt output unless --sched-runtime was explicitly used. This
removes the need for kernel version gating on the basic batch and
other subtests, allowing them to run on all kernel versions.
Fixes: https://github.com/util-linux/util-linux/issues/4429 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Wed, 8 Jul 2026 09:28:22 +0000 (11:28 +0200)]
Merge branch 'col-cur-col-underflow' of https://github.com/aizu-m/util-linux
* 'col-cur-col-underflow' of https://github.com/aizu-m/util-linux:
col: guard c_width sign before size_t cast in BS branch
col: fix cur_col underflow on backspace over a wide char
Modifies setpriv to support the securebits `no_cap_ambient_raise`,
`exec_restrict_file`, `exec_deny_interactive`, and each of their
`_locked` variants.
The NO_CAP_AMBIENT_RAISE securebit was added in Linux 4.3, and the
EXEC_RESTRICT_FILE and EXEC_DENY_INTERACTIVE securebits were added in
Linux 6.14.
Karel Zak [Tue, 7 Jul 2026 09:19:07 +0000 (11:19 +0200)]
Merge branch 'feat/4117-agetty-no-login-message' of https://github.com/mvanhorn/util-linux
* 'feat/4117-agetty-no-login-message' of https://github.com/mvanhorn/util-linux:
agetty: clarify nologin message and skip login wait under --chroot
agetty: handle systems without a shell or /bin/login
libblkid: (iso9660) fix out-of-bounds read of root dir record
root_len comes from the on-disk root directory record (rdr+10) and was only rejected when zero. The extent is then mapped for min(root_len, 2048) bytes and the first record is validated by reading rootdata[0], rootdata[32], rootdata[33] and isonum_731(rootdata+2). blkid_probe_get_buffer() only rounds a request up to io_size when the rounded region still fits the probing area, so a root extent sitting in the final partial io_size block of a crafted image returns a buffer of exactly root_len bytes. With root_len between 1 and 33 and rootdata[0] >= 34, the validation reads offsets 32/33 past that buffer. Reject an extent too small to hold the 34-byte record, which the surrounding comment already assumes.
Matt Van Horn [Sat, 4 Jul 2026 03:48:16 +0000 (20:48 -0700)]
agetty: clarify nologin message and skip login wait under --chroot
Address review notes from Karel: reword DEFAULT_NOLOGIN_MESSAGE so it
tells the user a keypress re-checks for the login program, and skip
wait_for_login_program() when --chroot is used since the path check
would test the wrong root. Update the man page accordingly.
Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
libmount provides a context API that can be used to replace
the fork+exec code pattern needed to leverage umount(8).
This does not only simplify the code base but also removes
the concern for signal handling due to a wait(2) call, avoids
forking and allocating additional system resources, reduces
security management and makes the code more consistent as other
functions were already using some libmount functionalities.
Signed-off-by: Christian Goeschel Ndjomouo <cgoesc2@wgu.edu>
col: fix cur_col underflow on backspace over a wide char
The BS handler in handle_not_graphic() subtracts the last stored
character's width from lns->cur_col (a size_t) and only guards against
cur_col == 0. When the last graphic character is double-width and the
column was reset by CR then advanced by a single space, cur_col is 1 and
cur_col -= 2 wraps to SIZE_MAX. That feeds l_max_col and the stored
c_column, so flush_line() sizes count[] as l_max_col + 1 (== 0) and then
memsets sizeof(size_t) * l_max_col bytes and indexes count[SIZE_MAX] --
an out-of-bounds write reachable from stdin under a UTF-8 locale. Clamp
the subtraction so the column cannot go below zero.
Karel Zak [Wed, 1 Jul 2026 10:49:25 +0000 (12:49 +0200)]
libmount: add mnt_table_parse_utab()
Add new public API to parse the utab file into a table. The utab path
and format are private library details; this function hides them from
callers. NULL as filename is recommended to let the library determine
the correct path.
This is needed by systemd for incremental fanotify-based mount
monitoring, where utab needs to be parsed independently of the full
mountinfo/listmount rescan path.
Karel Zak [Tue, 30 Jun 2026 10:49:26 +0000 (12:49 +0200)]
libsmartcols: reject large interval repetition bounds in filter regex
ERE interval expressions like {,32232} cause glibc regcomp() to
allocate gigabytes for the NFA, triggering OOM even on tiny inputs.
The existing consecutive-quantifier and nested-group checks do not
catch this pattern.
Scan numbers inside {...} and reject any bound exceeding
SCOLS_FILTER_MAX_REPCNT (1024). Document the new limit in
scols-filter(5).
Addresses: https://oss-fuzz.com/testcase-detail/6017673394454528 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 30 Jun 2026 08:37:06 +0000 (10:37 +0200)]
Merge branch 'PR/libmount-utab-uniqid' of https://github.com/karelzak/util-linux-work
* 'PR/libmount-utab-uniqid' of https://github.com/karelzak/util-linux-work:
tests: (mount) strip UNIQID= from utab in special test
libmount: merge utab into listmount-based tables
libmount: use uniq_id for target mount verification
libmount: add mnt_fs_fetch_ids() and populate uniq_id for utab
libmount: fix missing space after UNIQID= in utab
libmount: copy uniq_id in mnt_copy_fs()
Chris Webb [Mon, 29 Jun 2026 15:37:27 +0000 (15:37 +0000)]
unshare: Fix --map-auto regression
Commit 07935158 fixed an unshare --user bug which wasted a UID/GID when
--map-auto was used with --map-root-user. This bug meant that, for example,
a user with a single extra UID and GID delegated to them in /etc/subuid
and /etc/subgid would not get that user or group mapped at all if they
attempted unshare -r --map-auto.
Two years later, commit b64b769b added unshare --map-subids to identity-map
subuids and subgids into a user namespace, but incorrectly removed a
load-bearing 'else if' in passing, and reintroduced the original bug.
Ironically, map->inner != -1 for an identity mapping, so the 'if' vs
'else if' change has no effect on the --map-subids option; it only breaks
--map-auto.
Karel Zak [Mon, 29 Jun 2026 11:58:35 +0000 (13:58 +0200)]
docs: remove obsolete mount.txt, update AUTHORS
Move mount/umount original authors (Doug Quale, H.J. Lu,
Rick Sladkey, Stephen Tweedie) to the AUTHORS file. Remove
the obsolete Documentation/mount.txt with its pre-libmount
developer notes.
Karel Zak [Mon, 29 Jun 2026 11:56:25 +0000 (13:56 +0200)]
docs: integrate release-schedule.txt into HOWTO-CONTRIBUTING.md
Move the release schedule and RC cadence information into the
HOWTO-CONTRIBUTING.md file. Drop the "Release criteria" section
as tests should always pass regardless of release status.
Karel Zak [Mon, 29 Jun 2026 11:54:10 +0000 (13:54 +0200)]
docs: replace howto-*.txt with HOWTO-*.md and add AGENTS.md
Replace the eight Documentation/howto-*.txt files with four consolidated
markdown documents:
HOWTO-BUILDING.md - compilation and build system internals
HOWTO-CONTRIBUTING.md - contribution guidelines and PR workflow
HOWTO-HACKING.md - usage functions, man pages, debugging
HOWTO-TESTING.md - test framework, env variables, fuzz targets
Add AGENTS.md to the project root with AI-specific coding guidance
(code style pitfalls, return conventions, memory management, commit
message format) and links to the new documentation files.
Rename 00-about-docs.txt to 00-about-docs.md with updated references.
Karel Zak [Thu, 25 Jun 2026 12:52:21 +0000 (14:52 +0200)]
libmount: merge utab into listmount-based tables
Extract utab merge logic from __mnt_table_parse_mountinfo() into a
shared mnt_table_merge_utab() function and call it at the end of
mnt_table_fetch_listmount(). This makes userspace mount options
(x-systemd.*, user=, etc.) available when the mount table is obtained
via listmount/statmount syscalls.
The merge sets user_optstr directly (instead of the combined optstr)
to avoid conflicts with lazy statmount() which populates kernel
options on demand.
Add mnt_table_disable_useropts() public API to allow callers to skip
utab merging when only kernel-side data is needed.
Use the new API in findmnt --kernel=listmount to keep backward
compatible behavior (kernel-only data); users who want userspace
options can use --mtab.
Karel Zak [Thu, 25 Jun 2026 10:32:46 +0000 (12:32 +0200)]
libmount: use uniq_id for target mount verification
Prefer the unique mount ID (STATX_MNT_ID_UNIQUE) over the old mount ID
when verifying that a mount landed on the expected target in
mnt_context_reopen_target_fd(). Fall back to the old ID when uniq_id is
not available.
Karel Zak [Thu, 25 Jun 2026 10:32:31 +0000 (12:32 +0200)]
libmount: add mnt_fs_fetch_ids() and populate uniq_id for utab
Add mnt_fs_fetch_ids() helper that fetches mount IDs from the kernel
via statx(). It prefers STATX_MNT_ID_UNIQUE and falls back to the old
STATX_MNT_ID on older kernels. Accepts an optional fd argument; when
fd < 0 it falls back to path-based lookup via fs->target.
Use it in hook_create_mount() (new mount API) with fd_tree for robust
fd-based ID, and in hook_mount() (legacy mount(2)) after
reopen_target_fd with fd_target when available.
This ensures utab entries contain UNIQID, which is needed for reliable
utab merging with listmount-based tables.
Karel Zak [Thu, 25 Jun 2026 10:17:13 +0000 (12:17 +0200)]
libmount: fix missing space after UNIQID= in utab
The fprintf format for UNIQID= was missing a trailing space separator,
causing the field to run into the next field (e.g.,
"UNIQID=2147492389SRC=tmpfs").
Karel Zak [Thu, 25 Jun 2026 10:17:02 +0000 (12:17 +0200)]
libmount: copy uniq_id in mnt_copy_fs()
The mnt_copy_fs() function copies all filesystem entry fields but
missed uniq_id, causing the unique mount ID to be lost when fs entries
are duplicated (e.g., for utab updates).
WanBingjiang [Thu, 25 Jun 2026 11:08:53 +0000 (19:08 +0800)]
hexdump: stop after stdout write errors
Stop the display loop once stdout reports an error. Otherwise hexdump keeps formatting and writing after the output stream has already failed, which can loop for a long time on errors such as ENOSPC.
Save the errno from the first stdout error before cleanup can overwrite it. Report that saved error from hexdump itself and bypass close_stdout_atexit, as ferror() only preserves the stream error state and does not recover the original errno.
Add a regression test that writes hexdump output to /dev/full and checks that the command fails with the ENOSPC write error.
Karel Zak [Thu, 25 Jun 2026 13:11:19 +0000 (15:11 +0200)]
bitops: avoid macro redefinition on macOS
Newer macOS SDKs provide htobe16/htole16/be16toh/etc. via
<sys/endian.h>. Skip our OSSwap-based definitions when that
header is available to avoid -Wmacro-redefined errors.
projects / thirdparty / util-linux.git / log
