From: dongshengyuan <545258830@qq.com>
Date: Tue, 28 Jul 2026 08:40:24 +0000 (+0800)
Subject: tmpfiles: reject unused argument fields
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e347f63b0f04fc71b545ef10dfcda2df95f0c757;p=thirdparty%2Fsystemd.git

tmpfiles: reject unused argument fields

Line types which do not use the argument field used to warn and ignore
a non-empty field. Treat that as invalid configuration instead, so typos
are not silently accepted.

Follow-up for: 614cc34f3a2a7c64a21c3f5256f2e2b2c1de1d51
---

diff --git a/NEWS b/NEWS
index 1c6e644137a..60fcc0a5182 100644
--- a/NEWS
+++ b/NEWS
@@ -73,6 +73,12 @@ CHANGES WITH 262:
         * bootctl, systemd-oomd, systemd-repart, systemd-sysusers, and
           systemd-tmpfiles now accept -n as a short option for --dry-run.
 
+        Changes in systemd-tmpfiles:
+
+        * systemd-tmpfiles now rejects non-empty argument fields for tmpfiles.d
+          line types that do not use the argument field. Previously, such
+          fields were silently ignored after a warning.
+
         Changes in the TPM Subsystem:
 
         * The way that NvPCRs are anchored has been improved. They are now
diff --git a/TODO.md b/TODO.md
index 689bcf8549a..d456d3117dd 100644
--- a/TODO.md
+++ b/TODO.md
@@ -2730,7 +2730,6 @@ SPDX-License-Identifier: LGPL-2.1-or-later
 
 - **tmpfiles:**
   - allow time-based cleanup in r and R too
-  - instead of ignoring unknown fields, reject them.
   - creating new directories/subvolumes/fifos/device nodes
     should not follow symlinks. None of the other adjustment or creation
     calls follow symlinks.
diff --git a/man/tmpfiles.d.xml b/man/tmpfiles.d.xml
index 00c6ecb3995..d19ae862973 100644
--- a/man/tmpfiles.d.xml
+++ b/man/tmpfiles.d.xml
@@ -164,7 +164,9 @@ L     /tmp/foobar -    -    -     -   /dev/null</programlisting>
     <para>Fields may contain C-style escapes. With the exception of the seventh field (the "argument") all
     fields may be enclosed in quotes. Note that any whitespace found in the line after the beginning of the
     argument field will be considered part of the argument field. To begin the argument field with a
-    whitespace character, use C-style escapes (e.g. <literal>\x20</literal>).</para>
+    whitespace character, use C-style escapes (e.g. <literal>\x20</literal>). Line types which do not
+    document use of the argument field reject a non-empty argument field; use <literal>-</literal> to leave
+    the argument field empty.</para>
 
     <refsect2>
       <title>Type</title>
@@ -743,7 +745,8 @@ d /tmp/foo/bar - - - bmA:1h -</programlisting></para>
       and <varname>T</varname>, determines extended attributes to be set. For <varname>a</varname> and
       <varname>A</varname>, determines ACL attributes to be set. For <varname>h</varname> and <varname>H</varname>,
       determines the file attributes to set. For <varname>k</varname> and <varname>K</varname>, determines
-      file capabilities to be set. Ignored for all other lines.</para>
+      file capabilities to be set. For line types that do not document use of this field, a non-empty
+      argument is rejected; use <literal>-</literal> to leave it unset.</para>
 
       <para>This field can contain specifiers, see below.</para>
     </refsect2>
diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index 28a4c9a9870..2e4b3e2989e 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -4043,9 +4043,11 @@ static int parse_line(
         case ADJUST_MODE:
         case RELABEL_PATH:
         case RECURSIVE_RELABEL_PATH:
-                if (i.argument)
-                        log_syntax(NULL, LOG_WARNING, fname, line, 0,
-                                   "%c lines don't take argument fields, ignoring.", (char) i.type);
+                if (i.argument) {
+                        *invalid_config = true;
+                        return log_syntax(NULL, LOG_ERR, fname, line, SYNTHETIC_ERRNO(EBADMSG),
+                                          "%c lines don't take argument fields.", (char) i.type);
+                }
                 break;
 
         case CREATE_FILE:
diff --git a/test/units/TEST-22-TMPFILES.01.sh b/test/units/TEST-22-TMPFILES.01.sh
index 4062c838dc6..132bfed59ac 100755
--- a/test/units/TEST-22-TMPFILES.01.sh
+++ b/test/units/TEST-22-TMPFILES.01.sh
@@ -21,12 +21,19 @@ test ! -e /tmp/fifo
 test ! -e /tmp/test
 
 # Test invalid config
+ret=0
 systemd-tmpfiles --inline --remove 'garbage' || ret=$?
 test "$ret" -eq 65   # EX_DATAERR
 
+ret=0
+systemd-tmpfiles --inline --create 'd /tmp/test - - - - unexpected' || ret=$?
+test "$ret" -eq 65   # EX_DATAERR
+
 echo 'garbage' >/tmp/config.conf
+ret=0
 systemd-tmpfiles --remove /tmp/config.conf || ret=$?
 test "$ret" -eq 65   # EX_DATAERR
 
+ret=0
 systemd-tmpfiles --remove /tmp/config-missing.conf || ret=$?
 test "$ret" -eq 1
diff --git a/test/units/TEST-22-TMPFILES.12.sh b/test/units/TEST-22-TMPFILES.12.sh
index b2288bcf016..97cb974ef49 100755
--- a/test/units/TEST-22-TMPFILES.12.sh
+++ b/test/units/TEST-22-TMPFILES.12.sh
@@ -84,7 +84,7 @@ else
 fi
 
 # Check for an invalid "age" and "age-by" arguments.
-for a in ':' ':1s' '2:1h' 'nope:42h' '"  :7m"' 'm:' '::' '"+r^w-x:2/h"' 'b ar::64'; do
+for a in ':' ':1s' '2:1h' 'nope:42h' '"  :7m"' 'm:' '::' '"+r^w-x:2/h"' '"b ar::64"'; do
     systemd-tmpfiles --clean - <<EOF 2>&1 | grep -F 'Invalid age' >/dev/null
 d /tmp/ageby - - - ${a} -
 EOF