Masatake YAMATO [Wed, 4 Feb 2026 20:42:16 +0000 (05:42 +0900)]
lsfd: (refactor) call ioctl(TUNGETDEVNETNS) from target_fd related methods
In the original code, the attach_xinfo method of the cdev_tun_ops
struct called the ioctl. The attach_xinfo method retrieved the fd
passing to the ioctl by calling call_with_foreign_fd utility function.
In the last commit, we added the target_fd related methods in
cdev_tun_ops struct. The caller side of the target_fd related methods
calls call_with_foreign_fd.
We can reduce the code calling call_with_foreign_fd by moving the code
calling ioctl from the attach_xinfo method to the target_fd related
methods.
Karel Zak [Tue, 24 Feb 2026 08:54:12 +0000 (09:54 +0100)]
man pages: consolidate libsmartcols environment variables
Introduce man-common/env-smartcols.adoc to describe all libsmartcols
environment variables (LIBSMARTCOLS_DEBUG, LIBSMARTCOLS_DEBUG_PADDING,
LIBSMARTCOLS_JSON) in one place.
Replace duplicated LIBSMARTCOLS_DEBUG descriptions in cfdisk, fdisk,
sfdisk, findmnt, lsblk, and column man pages with an include of the
new common file.
Addresses: https://github.com/util-linux/util-linux/issues/3971 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 24 Feb 2026 11:41:39 +0000 (12:41 +0100)]
libblkid: iso9660: validate root directory to reduce false positives
The CD001 magic signature at 32KB offset can match file data content
on other filesystems (e.g. an .iso file stored on XFS whose data
blocks happen to land at the device offset where blkid looks for the
ISO 9660 Primary Volume Descriptor). This causes blkid to report
ambivalent results for a device that has only one real filesystem.
Add validation of the root directory record from the PVD: read the
root directory extent and verify that the first entry is a valid "."
self-reference (file_id_len == 1, file_id == 0x00, extent location
pointing back to itself). This check reliably rejects false positive
CD001 signatures because the root directory LBA from the PVD points
to a different location on the device that contains unrelated data.
Addresses: https://github.com/util-linux/util-linux/issues/4031 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 24 Feb 2026 08:38:09 +0000 (09:38 +0100)]
Merge branch 'feat/3971_compact_json_and_jsonl_support' of https://github.com/echoechoin/util-linux
* 'feat/3971_compact_json_and_jsonl_support' of https://github.com/echoechoin/util-linux:
jsonwrt: simplify ul_jsonwrt_empty() and add comments for COMPACT format
column: using switch-case replaces if-else
column: add JSON compact format output subtest.
column: add JSON LINES format output subtest.
column: introduce LIBSMARTCOLS_JSON environment argument
jsonwrt: support Compact JSON format output
libsmartcols: support JSON Lines format output
Karel Zak [Tue, 24 Feb 2026 08:13:15 +0000 (09:13 +0100)]
Merge branch 'libblkid_fix_cache_garbage_collection' of https://github.com/cgoesche/util-linux-fork
* 'libblkid_fix_cache_garbage_collection' of https://github.com/cgoesche/util-linux-fork:
blkid: add --garbage-collect test
libblkid: remove empty loop devices from cache when garbage collecting
Wilfred Mallawa [Mon, 23 Feb 2026 23:43:29 +0000 (09:43 +1000)]
blkzone: add more checks when printing zone write_pointer
The zone write pointer is also invalid for READONLY and OFFLINE zones, so
handle such cases appropriately by not displaying a write pointer for
READONLY and OFFLINE zones.
Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Fixes: b032247f48 ("blkzone: don't show wptr when zones are full")
Accessing pager_process.pid from within a signal handler is, by strict C
language interpretation, not signal safe.
Wait for all children (and thus for pager_process.pid as well) instead.
The current users dmesg and fdisk have no further children so this is a
good compromise here.
The signal handler is used for SIGINT, SIGHUP, SIGTERM, SIGQUIT. From a
terminal perspective, these are normally intercepted by the child, not
the parent.
Since wait_for_pager is never reached by a signal handler anymore, a
regular err() call is now possible. Just make sure that no exit function
handler could ever loop endlessly.
umount: new --graceful option to exit successfully even if filesystem is unmounted
This new option makes it so that umount(8) exits successfully even
if the filesystem has already been unmounted or has no directory
entry. The usefulness of this behavior becomes apparent in cases
where idempotency is important, that is the focus lies in the
destruction of the mountpoint only.
Closes: #2132 Signed-off-by: Christian Goeschel Ndjomouo <cgoesc2@wgu.edu>
Karel Zak [Mon, 23 Feb 2026 13:06:57 +0000 (14:06 +0100)]
Merge branch 'lsmem_show_zones_on_uncommon_phy_mem_layout' of https://github.com/cgoesche/util-linux-fork
* 'lsmem_show_zones_on_uncommon_phy_mem_layout' of https://github.com/cgoesche/util-linux-fork:
lsmem: fix missing zone info when memory blocks start at an index other than 0
libblkid: remove empty loop devices from cache when garbage collecting
The cache garbage collection (blkid --garbage-collect) does not work for
entries of loop devices even when these have been detached. The previous
logic performed a simple stat() on the dev node path, however this is not
enough for loop devices as their nodes can remain present even if they
aren't backed by any file or other block device.
Therefore, it is more sane to verify if the loop device has a backing file
and if not, we remove it from the cache.
Closes: #4061 Signed-off-by: Christian Goeschel Ndjomouo <cgoesc2@wgu.edu>
Karel Zak [Mon, 23 Feb 2026 10:00:20 +0000 (11:00 +0100)]
login: improve comments for signal handling in fork_session()
Add more detailed comments explaining the signal blocking and
sigsuspend() pattern introduced by the previous commit. The key
insight is that sigsuspend() is the actual wait point where
SIGTERM/SIGHUP are forwarded to the child, while waitpid() with
WNOHANG only performs non-blocking checks for terminated children.
lsmem: fix missing zone info when memory blocks start at an index other than 0
On systems that have an uncommon physical memory layout, e.g. where hotpluggable
memory blocks start at an offset greater than 0, we failed to set the 'have_zones'
control flag, which caused an omission of the ZONES information of the listed
individual memory block or a block range. This is because we explicitly tested for
/sys/devices/system/memory/memory0/valid_zones, however it is better to simply
look for any memory<n> directory entry and validate the existence of the valid_zones
attribute.
Closes: #4055 Signed-off-by: Christian Goeschel Ndjomouo <cgoesc2@wgu.edu>
Two cases exist in which login might send signals to a process which is
actually not a child process:
- If SIGCHLD is set to SIG_IGN by login's parent process (unlikely),
then no zombie process exists. The kernel could already reuse the PID
for another process just before login's signal_handler function sends
a signal to its stored child PID -- which was already reused
- If wait succeeds, the PID can be reused by the kernel for another
process. The registered signal_handlers could still use the stored
child PID to send signals -- but erroneously to a wrong process
Fix these cases by blocking and unblocking SIGCHLD and signal_handler
triggering signals around the wait call. Set child_pid to 0 after wait
succeeded and before signal_handler signals are unblocked again.
A user might prematurely close the pager before the parent wrote its
full output into the pipe. This triggers SIGPIPE, which would eventually
lead to an error return value.
The programs dmesg and fdisk can keep running just fine in these cases.
In fact, dmesg's source code was already prepared for EPIPE error return
values.
If the pager returns with a success return value, ignore SIGPIPE. If
there was an error within the pager, stop the parent as well.
With this, dmesg does not return an error anymore if the ring buffer was
not fully sent to the pager before it was closed.
Just calling exit with a success return value in case of an EPIPE error
in safe_fwrite is not precise enough. If dmesg was called with "-c",
i.e. to print and then clear the ring buffer, a successful return value
should mean that the ring buffer is cleared as well.
Instead, continue operation on EPIPE error but stop any further regular
output.
Karel Zak [Thu, 19 Feb 2026 11:20:28 +0000 (12:20 +0100)]
login: use original FQDN for PAM_RHOST
When login -h <remotehost> is invoked, init_remote_info() strips the
local domain suffix from the hostname (FQDN to short name) before
storing it in cxt->hostname. This truncated value is then used for
PAM_RHOST, which can bypass pam_access host deny rules that match on
the FQDN.
Preserve the original -h hostname in a new cmd_hostname field and use
it for PAM_RHOST, while keeping the truncated hostname for utmp/wtmp
and logging unchanged.
Note, the real-world impact is low -- login -h is only used by legacy
telnet/rlogin daemons, and exploitation requires FQDN-specific
pam_access rules on a system still using these obsolete services.
Reported-by: Asim Viladi Oglu Manizada <manizada@pm.me> Signed-off-by: Karel Zak <kzak@redhat.com>
Using the Linux Crypto API stores hash sums of read chunks in memory. It
trusts that get_digest is called as often as "read blocks" exist in file.
It becomes an issue with files which have less content than st_size
suggests, e.g. files in sysfs. Eventually, the iterator n will be
eq->blocksmax, because the EOF is never noticed. Writing this next hash
sum into memory would lead to an out of boundary write.
Verify that n is less than eq->blocksmax. If this is not true anymore,
treat it as an error so files are considered to be not equal. This is
much safer than erroneously treating them as equal.
Seen compiler warning with GCC 15.2.1 and glibc 2.43:
```
text-utils/pg.c: In function ‘prompt’:
text-utils/pg.c:621:24: warning: assignment discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
621 | if ((p = strstr(pstring, "%d")) == NULL) {
| ^
```
This happens if strstr is actually a preprocessor definition with a
__glibc_const_generic. For this, __GLIBC_USE (ISOC23) must be true.
Setting the pointer to const does not hurt and clarifies that the
content is not modfied.
Karel Zak [Wed, 18 Feb 2026 11:36:16 +0000 (12:36 +0100)]
Merge branch 'PR/pidfd-utils-have-defines' of https://github.com/karelzak/util-linux-work
* 'PR/pidfd-utils-have-defines' of https://github.com/karelzak/util-linux-work:
pidfd-utils: move USE_PIDFD_INO_SUPPORT after syscall fallbacks
pidfd-utils: define HAVE_PIDFD_* when syscall fallbacks are used
Karel Zak [Wed, 18 Feb 2026 09:59:30 +0000 (10:59 +0100)]
nsenter: use USE_NAMESPACE_ID_SUPPORT macro for nsid feature
Replace direct HAVE_STRUCT_NSFS_FILE_HANDLE ifdefs with a
feature-specific USE_NAMESPACE_ID_SUPPORT macro that also
requires HAVE_PIDFD_OPEN, since the namespace ID support
depends on pidfd_open().
Addresses: https://github.com/util-linux/util-linux/pull/4044 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Wed, 18 Feb 2026 09:47:19 +0000 (10:47 +0100)]
nsenter: fix minor issues with namespace ID support
- fix pidfd_self FD leak when ioctl(PIDFD_GET_MNT_NAMESPACE) fails
- fix "namesapces" typo in man page
- document "./" disambiguation for files starting with ":"
- use standard C initializer = { 0 } instead of = {}
Addresses: https://github.com/util-linux/util-linux/pull/4044 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 17 Feb 2026 11:33:58 +0000 (12:33 +0100)]
setpriv: use AppArmor LSM-specific proc interface
Remove the check for /sys/kernel/security/apparmor (securityfs) before
writing to the proc attr interface. The securityfs check fails in
environments where AppArmor is enabled but securityfs is not mounted
(e.g., containers, WSL2, embedded systems).
Use the LSM-specific /proc/self/attr/apparmor/exec interface introduced
in Linux 5.8 (kernel commit 6413f852ce08) which is not affected by LSM
load ordering issues. Fall back to the legacy /proc/self/attr/exec for
older kernels.
Fixes: https://github.com/util-linux/util-linux/issues/4033 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 17 Feb 2026 10:35:17 +0000 (11:35 +0100)]
lib/netlink: set SOCK_CLOEXEC on netlink socket
Set SOCK_CLOEXEC when creating the NETLINK_ROUTE socket in
ul_nl_open() to prevent the file descriptor from leaking to
child processes across execv().
In agetty, the netlink socket used to monitor IP address changes
for \4/\6 issue escapes was inherited by the login program, causing
SELinux AVC denials (local_login_t denied read/write on getty_t's
netlink_route_socket).
Fixes: https://github.com/util-linux/util-linux/issues/4032 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 17 Feb 2026 10:20:38 +0000 (11:20 +0100)]
libblkid: (btrfs) use BTRFS_NR_SB_LOG_ZONES and rep->zones
Use the BTRFS_NR_SB_LOG_ZONES constant instead of a hardcoded 2 when
calling blkdev_get_zonereport() to be consistent with the rest of the
function that already uses this constant.
Replace the pointer arithmetic (struct blk_zone *)(rep + 1) with the
more readable rep->zones flexible array member access.
Addresses: https://github.com/util-linux/util-linux/pull/3995 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 17 Feb 2026 10:09:09 +0000 (11:09 +0100)]
blkid: move error checks before JSON output initialization
Move the lowprobe and lookup error checks (missing device and missing
search type) before the JSON writer initialization. This prevents
partial JSON output being written to stdout before errx() terminates
the program.
Addresses: https://github.com/util-linux/util-linux/pull/4036 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 17 Feb 2026 09:56:23 +0000 (10:56 +0100)]
Merge branch 'master' of https://github.com/aschnell/util-linux
* 'master' of https://github.com/aschnell/util-linux:
avoid repetitive code
always use array with name in json output
updated test case
include device in json output and use json array when needed
If dmesg uses a pager, some of its error messages end up in the pager
output. Use the pager only for data that is supposed to be paged and
print error messages before the pager is started or after it is shut
down again.
Karel Zak [Mon, 16 Feb 2026 13:43:00 +0000 (14:43 +0100)]
prlimit: raise a nicer error message when modifying NOFILE
When attempting to set RLIMIT_NOFILE to a value exceeding the kernel's
fs.nr_open limit, prlimit(2) returns EPERM. This can mislead users into
thinking they need elevated permissions, even when running as root.
Add a check to detect when the requested NOFILE limit exceeds
fs.nr_open and provide a clear error message indicating the actual
constraint. The check is optional: if /proc/sys/fs/nr_open cannot be
read (e.g., /proc not mounted), the validation is silently skipped to
avoid introducing a hard dependency on /proc.
The nr_open value is cached and read only once per prlimit invocation
for efficiency when setting multiple limits.
Addresses: https://github.com/util-linux/util-linux/issues/4017 Co-authored-by: krajpuro <krajpuro@akamai.com> Signed-off-by: Karel Zak <kzak@redhat.com>
Michael Trapp [Tue, 10 Feb 2026 14:39:21 +0000 (15:39 +0100)]
libuuid: reset initial cont-clock time on service start
When uuidd starts with --cont-clock enabled and reads a stale timestamp
from the state file, the continuous clock logic would apply a backwards
offset (default 2 hours), causing generated UUIDs to have incorrect
timestamps in the past.
Fix this by resetting last_clock_reg to the current time when the saved
timestamp is older than the current clock. This prevents the backwards
offset from being applied at service start.
Karel Zak [Mon, 16 Feb 2026 12:30:55 +0000 (13:30 +0100)]
blkzone: make N/A string translatable
The "N/A" string for write pointer should be marked for translation
to support localization, following the pattern used elsewhere in
util-linux (e.g., blockdev.c).
Karel Zak [Mon, 16 Feb 2026 10:11:59 +0000 (11:11 +0100)]
Merge branch 'feat/3971' of https://github.com/echoechoin/util-linux
* 'feat/3971' of https://github.com/echoechoin/util-linux:
column: add bash-completion for table-header-as-columns
column: add option '--table-header-as-columns' for using first line as table columns names.
Karel Zak [Mon, 16 Feb 2026 09:45:27 +0000 (10:45 +0100)]
lib/pager: Rename caught_signal to pager_caught_signal
The variable name caught_signal is too generic. Rename it to
pager_caught_signal to follow the existing naming convention in the
file where pager-related static variables use the pager_ prefix
(pager_process, pager_argv, etc.).
Karel Zak [Mon, 16 Feb 2026 09:44:03 +0000 (10:44 +0100)]
Merge branch 'pager_fd' of https://github.com/stoeckmann/util-linux
* 'pager_fd' of https://github.com/stoeckmann/util-linux:
lib/pager: Use original stderr in pager_close
lib/pager: Use pager_open/close for pager_redirect
lib/pager: Clear potential stdout/stderr errors
lib/pager: Flush outputs in pager_close
lib/pager: Improve signal handling in pager_close
Karel Zak [Mon, 16 Feb 2026 09:18:56 +0000 (10:18 +0100)]
dmesg: update prepare_buffer() comment
The function was renamed from process_buffer() to prepare_buffer()
and no longer handles printing. Update the comment to reflect that
it only reads and prepares the message buffer.
Karel Zak [Mon, 16 Feb 2026 09:04:43 +0000 (10:04 +0100)]
dmesg: improve buffer size error message
Improve the error message when buffer size is too large to include
the maximum allowed size. This helps users understand what the actual
limit is rather than just reporting an invalid value.
Before: invalid buffer size argument: '...'
After: buffer size ... is too large (maximum is ...)
Karel Zak [Mon, 16 Feb 2026 08:58:17 +0000 (09:58 +0100)]
Merge branch 'lsfd--SIOCGSKNS-based-SOCK_NETNS' of https://github.com/masatake/util-linux
* 'lsfd--SIOCGSKNS-based-SOCK_NETNS' of https://github.com/masatake/util-linux:
lsfd: fill SOCK.NETNS even when sock_diag netlink can't report sockets
tests: (test_mkfds:netns) conditionally report EPERM when ioctl(SIOCGSKNS) fails
tests: (test_mkfd::tcp-bare) new factory creating an unbound/unconnected TCP socket
lsfd: add inspect_target_fd method to file_class
lsfd: (refactor) make call_with_foreign_fd reusable
lsfd: make pidfd for the target process available while collecting fds
lsfd: (comment) update the description of sock_xinfo::netns_inode
lsfd: (cosmetic) delete an empty line
Wilfred Mallawa [Thu, 12 Feb 2026 03:02:03 +0000 (13:02 +1000)]
blkzone: don't show wptr when zones are full
blkzone report displays the write pointer when zones are full, however, the
writepointer value is not accurate for full zones as all zone LBAs have been
written. Instead, fix this so that we show "N/A" for the writepointer field
if the zone condition is full.
While we are at it, extend this behavior for convetional zones instead
of displaying 0 for the writepointer.
Having restored stdout/stderr before calling wait_for_pager allows
potential error messages to be printed on terminal instead of being lost
due to an already closed pipe stderr.
Although dup2 closes the target descriptor, make sure that the pipe
is closed even if dup2 fails.
With everything in place, call exit after restoring the original signal
handlers. This way, signals received between wait_for_pager and signal
restoration are processed as well. A race condition exists if multiple
signals are received, which would allow original handlers to be
processed before exit is called, yet the overhead of properly blocking
signals and unblocking them is most likely not worth the effort.
projects / thirdparty / util-linux.git / log
