Dan Streetman [Fri, 14 Jul 2023 17:15:48 +0000 (13:15 -0400)]
tpm2: handle older tpm enrollments without a saved pcr bank
Older code did not save the pcr bank (i.e. pcr hash algorithm), and instead let
tpm2_unseal() find the best pcr bank to use. In commit 2cd9d57548b0dadd52523df486d33aa4cf7c3b84 we changed tpm2_unseal() to no longer
handle an unset pcr bank. This adds back in the handling of an unset pcr_bank
so older sealed data should continue to work.
Dan Streetman [Fri, 14 Jul 2023 15:21:43 +0000 (11:21 -0400)]
test: reduce the number of loops in tpm2 test_tpms_pcr_selection_mask_and_hash()
This test loops through masks, but is a relatively long test due to the
increment size between loops; this slightly increases the increment size (from
3->5) which greatly speeds up the test.
efi: add helper API for detecting confidential virtualization
This helper is a simplified version of detect_confidential_virtualization()
that merely returns a boolean status flag reflecting whether we are believed
to be running inside a confidential VM.
This flag can be used for turning off features that are inappropriate to
use from a CVM, but must not be used for releasing sensitive data. The
latter must only be done in response to an attestation for the environment.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
mkosi now supports CentOS SIGs natively so we drop our own definition
of that and use the mkosi builtin one. We also enable hyperscale for
both CentOS 8 and CentOS 9 for consistency and add epel-next as well
which is a requirement for Hyperscale.
CentOS 8 ships python 3.6 so let's try and stay compatible with that
since the only feature we're using that requires python 3.9 is the
streamlined type annotations which are trivial to convert back to
the older stuff to stay compatible with python 3.6.
kernel-install: Avoid reopening file descriptor via /proc
kernel-install used to work without /proc mounted before the rewrite
in C. Let's restore that property by making sure we don't reopen
file descriptors via /proc. In this case, parse_env_file_fdv() calls
fdopen_independent() to get a FILE * for the given file descriptor
(which itself calls fd_reopen()). Let's avoid the call to
fdopen_independent() by using chase_and_fopenat_unlocked() which
gives us a FILE * immediately without having to reopen any file
descriptors.
network: check lifetime of address and route before configure
Otherwise, we may configure a route that depends on the existence
of an address or another route, and may fail when lifetime of one
of them are already zero.
proc-cmdline: re-implement proc_cmdline_filter_pid1_args() without using getopt_long()
If getopt_long() is called for a list of arguments and it is freed, then
calling getopt_long() for another list will trigger use-after-free.
The function proc_cmdline_filter_pid1_args() may be called before or during
parsing program arguments (typically named as parse_argv()), hence we cannot
use getopt_long() in proc_cmdline_filter_pid1_args().
Mike Yuan [Thu, 13 Jul 2023 14:44:19 +0000 (22:44 +0800)]
fstab-generator: resolve bind mount source when in initrd
We currently prepend /sysroot to mount points for entries
in /sysroot/etc/fstab. But when it comes to bind mounts,
the source needs to canonicalized too.
David Tardon [Thu, 29 Jun 2023 14:35:21 +0000 (16:35 +0200)]
bus-polkit: allow to auth. a bus call for multiple actions
In #20155, verify_shutdown_creds() needs to authenticate for both
org.freedesktop.login1.hibernate-multiple-sessions and
org.freedesktop.login1.hibernate-ignore-inhibit . Previously, the second
authentication attempt would fail with -ESTALE.
Users get prompted with these, so they should be translated.
Note that a comment is moved up, as otherwise the pot generation picks
it up and copies it into the translation file.
This allows using it with CLEANUP_ARRAY(). For the 2 call sites
where we don't need to free the array, we do a regular for loop
calling json_variant_unref() instead.
We currently concatenate ANSI_UNDERLINE to the color of our choice
in DEFINE_ANSI_FUNC_UNDERLINE() and DEFINE_ANSI_FUNC_UNDERLINE_256().
The first thing that ANSI_UNDERLINE does is reset all previous ansi
escape sequences, so you just get underlining without any colors.
Let's fix the issue by actually concatenating _UNDERLINE to the given
color macro name so this works properly.
Also add missing color macros that this uncovered.
The mentioned change makes all jobs in the transaction unmergeable
if mode == JOB_RESTART_DEPENDENCIES, but we only want the anchor job
to be re-enqueued.
There were a couple spelling/grammatical errors in the docs that made
it hard to read and understand parts of this doc. I cleaned up those
errors and reflowed the line breaks to keep to the 80 char limit.
test: copy out the necessary test data before we start overmounting stuff
Otherwise the get_testdata_dir() call fails if the source tree is under
/root (which is usually the case in CIs).
I got bitten by this after leaving the source tree under /root but moving the
$BUILD_DIR elsewhere. This used to work by accident, as load_testdata_env()
would try to read $BUILD_DIR/systemd-runtest.env, but would fail if the
$BUILD_DIR is also under /root and fall back to SYSTEMD_TEST_DATA
(/lib/systemd/tests/testdata), which usually exist as we install the just built
revision. However, if the $BUILD_DIR is outside of /root we'd read
$BUILD_DIR/systemd-runtest.env which contains
SYSTEMD_TEST_DATA=/path/to/source/tree/test and that source tree is not visible
once we overmount /root with tmpfs making the test fail:
/* test_run_tests_unprivileged */
Successfully forked off '(test-execute-unprivileged)' as PID 10672.
Changing mount flags / (MS_REMOUNT|MS_BIND "")...
Changing mount propagation / (MS_REC|MS_SHARED "")
Mounting tmpfs (tmpfs) on /dev/shm (MS_NOSUID|MS_NODEV "")...
Mounting tmpfs (tmpfs) on /root (MS_NOSUID|MS_NODEV "")...
Mounting tmpfs (tmpfs) on /tmp (MS_NOSUID|MS_NODEV "")...
Mounting tmpfs (tmpfs) on /var/tmp (MS_NOSUID|MS_NODEV "")...
Mounting tmpfs (tmpfs) on /var/lib (MS_NOSUID|MS_NODEV "")...
Mounting tmpfs (tmpfs) on /run/test-execute-unit-dir (MS_NOSUID|MS_NODEV "")...
ERROR: $SYSTEMD_TEST_DATA directory [/root/systemd/test] not accessible: No such file or directory
Assertion 'get_testdata_dir("test-execute/", &unit_dir) >= 0' failed at src/test/test-execute.c:1306, function prepare_ns(). Aborting.
(test-execute-unprivileged) terminated by signal ABRT.
bus-unit-util: add common code for reloading PID 1
We have this very similar code in various places, and it#s not entirely
obvious (since we want a prolonged timeout for the reload), hence unify
this at one place.
When running from the build directory systemd-detect-virt might not be installed,
so tell meson to set up the PATH accordingly to point to the build directory.
So the multiple-machines tests run last to avoid a race where the
checked signal would get ignored while the stub init is still processing
the previous signals:
projects / thirdparty / systemd.git / log
