From: Luca Boccassi Date: Fri, 19 Jun 2026 16:58:56 +0000 (+0100) Subject: executor: also preload libcrypto X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=45920af4a41a6f97f3e7aeac9aff6da907d85dcd;p=thirdparty%2Fsystemd.git executor: also preload libcrypto It's needed for the userspace fallback verity verification, so it needs to be pre-loaded to avoid getting blocked by RTLD_NOLOAD: [ 57.163995] (cat)[1560]: minimal-app0-foo.service: Validation of dm-verity signature failed via the kernel, trying userspace validation instead: Required key not available [ 57.194696] (cat)[1560]: minimal-app0-foo.service: Refusing loading of 'libcrypto.so.3', as loading further dlopen() modules has been blocked. [ 57.197940] (cat)[1560]: minimal-app0-foo.service: Shared library 'libcrypto.so.3' is not available: Operation not permitted [ 57.204283] (cat)[1560]: minimal-app0-foo.service: Failed to activate verity device /dev/mapper/2b2fd83f324c3aa2ea1a979899f9c630761f1de3c5e00ce8c6bb36f4d137f450-verity: Operation not supported [ 57.272782] (cat)[1560]: minimal-app0-foo.service: Failed to set up mount namespacing: Operation not supported [ 57.274250] (cat)[1560]: minimal-app0-foo.service: Failed at step NAMESPACE spawning cat: Operation not supported Follow-up for efaf5a763d6a06645dba8e88ebc15e887d59cbef --- diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c index 6e65883ef9e..a06852a6b5f 100644 --- a/src/core/exec-invoke.c +++ b/src/core/exec-invoke.c @@ -33,6 +33,7 @@ #include "constants.h" #include "copy.h" #include "coredump-util.h" +#include "crypto-util.h" #include "cryptsetup-util.h" #include "dissect-image.h" #include "dynamic-user.h" @@ -6002,6 +6003,8 @@ int exec_invoke( (void) DLOPEN_CRYPTSETUP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED); (void) DLOPEN_LIBMOUNT(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED); (void) DLOPEN_LIBSECCOMP(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED); + /* Needed for userspace verity verification fallback */ + (void) DLOPEN_LIBCRYPTO(LOG_DEBUG, SD_ELF_NOTE_DLOPEN_PRIORITY_RECOMMENDED); /* Let's now disable further dlopen()ing of libraries, since we are about to do namespace * shenanigans, and do not want to mix resources from host and namespace */