mountpoint-util: assume MS_NOSYMFOLLOW is available

Since our kernel baseline is v5.10 now.

diff --git a/README b/README
index 56361f5eef30f1ca2da9fba324e11dbbbee7a9a1..2410174138e9cffd8b825540d1a72543b6571a54 100644 (file)
--- a/README
+++ b/README
@@ -52,7 +52,7 @@ REQUIREMENTS:
                                BPF links and the BPF LSM hook
                      ≥ 5.8 for LOOP_CONFIGURE and STATX_ATTR_MOUNT_ROOT
                      ≥ 5.9 for close_range()
-                     ≥ 5.10 for STATX_MNT_ID
+                     ≥ 5.10 for STATX_MNT_ID and MS_NOSYMFOLLOW mount option
 
         ⛔ Kernel versions below 5.10 ("minimum baseline") are not supported at all,
            and are missing required functionality as listed above.

diff --git a/TODO b/TODO
index 6fb1d6597b56d9ea146e4c3e8f2f9fa935122bbb..e24eade38166fb6becf0f226c970646d6bb5493a 100644 (file)
--- a/TODO
+++ b/TODO
@@ -107,8 +107,6 @@ Deprecations and removals:
 * drop support for LOOP_CONFIGURE-less loopback block devices, once kernel
   baseline is 5.8.
 
-* Once baseline is 5.10, remove support or MS_NOSYMFOLLOW-less kernels
-
 * Remove /dev/mem ACPI FPDT parsing when /sys/firmware/acpi/fpdt is ubiquitous.
   That requires distros to enable CONFIG_ACPI_FPDT, and have kernels v5.12 for
   x86 and v6.2 for arm.

diff --git a/src/basic/mountpoint-util.c b/src/basic/mountpoint-util.c
index 35bf3bdfccd7555baaac728472cc554e34548678..9c04d381f392f4536b7d65dda57f5d6e1089150b 100644 (file)
--- a/src/basic/mountpoint-util.c
+++ b/src/basic/mountpoint-util.c
@@ -529,66 +529,6 @@ bool mount_new_api_supported(void) {
         return (cache = true);
 }
 
-unsigned long ms_nosymfollow_supported(void) {
-        _cleanup_close_ int fsfd = -EBADF, mntfd = -EBADF;
-        static int cache = -1;
-
-        /* Returns MS_NOSYMFOLLOW if it is supported, zero otherwise. */
-
-        if (cache >= 0)
-                return cache ? MS_NOSYMFOLLOW : 0;
-
-        if (!mount_new_api_supported())
-                goto not_supported;
-
-        /* Checks if MS_NOSYMFOLLOW is supported (which was added in 5.10). We use the new mount API's
-         * mount_setattr() call for that, which was added in 5.12, which is close enough. */
-
-        fsfd = fsopen("tmpfs", FSOPEN_CLOEXEC);
-        if (fsfd < 0) {
-                if (ERRNO_IS_NOT_SUPPORTED(errno))
-                        goto not_supported;
-
-                log_debug_errno(errno, "Failed to open superblock context for tmpfs: %m");
-                return 0;
-        }
-
-        if (fsconfig(fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0) < 0) {
-                if (ERRNO_IS_NOT_SUPPORTED(errno))
-                        goto not_supported;
-
-                log_debug_errno(errno, "Failed to create tmpfs superblock: %m");
-                return 0;
-        }
-
-        mntfd = fsmount(fsfd, FSMOUNT_CLOEXEC, 0);
-        if (mntfd < 0) {
-                if (ERRNO_IS_NOT_SUPPORTED(errno))
-                        goto not_supported;
-
-                log_debug_errno(errno, "Failed to turn superblock fd into mount fd: %m");
-                return 0;
-        }
-
-        if (mount_setattr(mntfd, "", AT_EMPTY_PATH|AT_RECURSIVE,
-                          &(struct mount_attr) {
-                                  .attr_set = MOUNT_ATTR_NOSYMFOLLOW,
-                          }, sizeof(struct mount_attr)) < 0) {
-                if (ERRNO_IS_NOT_SUPPORTED(errno))
-                        goto not_supported;
-
-                log_debug_errno(errno, "Failed to set MOUNT_ATTR_NOSYMFOLLOW mount attribute: %m");
-                return 0;
-        }
-
-        cache = true;
-        return MS_NOSYMFOLLOW;
-
-not_supported:
-        cache = false;
-        return 0;
-}
-
 int mount_option_supported(const char *fstype, const char *key, const char *value) {
         _cleanup_close_ int fd = -EBADF;
         int r;

diff --git a/src/basic/mountpoint-util.h b/src/basic/mountpoint-util.h
index 899e9635d198dd48e72ad17962d7fe978bdf077c..659f0385560a83c9e126f096e4c75606b152f48b 100644 (file)
--- a/src/basic/mountpoint-util.h
+++ b/src/basic/mountpoint-util.h
@@ -75,7 +75,6 @@ int mount_propagation_flag_from_string(const char *name, unsigned long *ret);
 bool mount_propagation_flag_is_valid(unsigned long flag);
 
 bool mount_new_api_supported(void);
-unsigned long ms_nosymfollow_supported(void);
 
 int mount_option_supported(const char *fstype, const char *key, const char *value);
 

diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 851454dafa6905a3d1fff68ff8ea0736c4ca2760..6cfc0e7395df1096e0c86bf51387ab45809c9b80 100644 (file)
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -3767,7 +3767,7 @@ static int setup_unix_export_dir_outside(char **ret) {
                         "tmpfs",
                         q,
                         "tmpfs",
-                        MS_NODEV|MS_NOEXEC|MS_NOSUID|ms_nosymfollow_supported(),
+                        MS_NODEV|MS_NOEXEC|MS_NOSUID|MS_NOSYMFOLLOW,
                         "size=4M,nr_inodes=64,mode=0755");
         if (r < 0)
                 return r;
@@ -3781,7 +3781,7 @@ static int setup_unix_export_dir_outside(char **ret) {
                         /* what= */ NULL,
                         w,
                         /* fstype= */ NULL,
-                        MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NODEV|MS_NOEXEC|MS_NOSUID|ms_nosymfollow_supported(),
+                        MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NODEV|MS_NOEXEC|MS_NOSUID|MS_NOSYMFOLLOW,
                         /* options= */ NULL);
         if (r < 0)
                 return r;
@@ -3826,7 +3826,7 @@ static int setup_unix_export_host_inside(const char *directory, const char *unix
                         /* what= */ NULL,
                         p,
                         /* fstype= */ NULL,
-                        MS_BIND|MS_REMOUNT|MS_NODEV|MS_NOEXEC|MS_NOSUID|ms_nosymfollow_supported(),
+                        MS_BIND|MS_REMOUNT|MS_NODEV|MS_NOEXEC|MS_NOSUID|MS_NOSYMFOLLOW,
                         /* options= */ NULL);
         if (r < 0)
                 return r;

diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
index 14120f2d574fbe394b195c981d08eb47ec33747b..97dc89e5a427e0c27870cedaa27df8ed8dbce873 100644 (file)
--- a/src/shared/dissect-image.c
+++ b/src/shared/dissect-image.c
@@ -2383,7 +2383,7 @@ int partition_pick_mount_options(
 
         case PARTITION_ESP:
         case PARTITION_XBOOTLDR:
-                flags |= MS_NOSUID|MS_NOEXEC|ms_nosymfollow_supported();
+                flags |= MS_NOSUID|MS_NOEXEC|MS_NOSYMFOLLOW;
 
                 /* The ESP might contain a pre-boot random seed. Let's make this unaccessible to regular
                  * userspace. ESP/XBOOTLDR is almost certainly VFAT, hence if we don't know assume it is. */

diff --git a/src/shared/mount-util.c b/src/shared/mount-util.c
index 31b1ca2b363490f51be730c17f999a37f0cd10ec..f3eaa7ba97ad9763f34ca6b01033420b1778c287 100644 (file)
--- a/src/shared/mount-util.c
+++ b/src/shared/mount-util.c
@@ -1951,7 +1951,7 @@ int trigger_automount_at(int dir_fd, const char *path) {
 
 unsigned long credentials_fs_mount_flags(bool ro) {
         /* A tight set of mount flags for credentials mounts */
-        return MS_NODEV|MS_NOEXEC|MS_NOSUID|ms_nosymfollow_supported()|(ro ? MS_RDONLY : 0);
+        return MS_NODEV|MS_NOEXEC|MS_NOSUID|MS_NOSYMFOLLOW|(ro ? MS_RDONLY : 0);
 }
 
 int fsmount_credentials_fs(int *ret_fsfd) {

diff --git a/src/shared/mount-util.h b/src/shared/mount-util.h
index 8d907988ebcf8f6c377fd07dc6970a8ec36ffecb..768aacf09c401cdb2131c213aafaad32126b70c2 100644 (file)
--- a/src/shared/mount-util.h
+++ b/src/shared/mount-util.h
@@ -166,7 +166,7 @@ int make_mount_point_inode_from_path(const char *source, const char *dest, mode_
 
 int trigger_automount_at(int dir_fd, const char *path);
 
-unsigned long credentials_fs_mount_flags(bool ro);
+unsigned long credentials_fs_mount_flags(bool ro) _const_;
 int fsmount_credentials_fs(int *ret_fsfd);
 int mount_credentials_fs(const char *path);
 

diff --git a/src/test/test-mountpoint-util.c b/src/test/test-mountpoint-util.c
index ba2ed3b3479448dc226e92482d6c33317ef4d068..7381357336eeefa99a60273fa58c8e39168519cc 100644 (file)
--- a/src/test/test-mountpoint-util.c
+++ b/src/test/test-mountpoint-util.c
@@ -359,10 +359,6 @@ TEST(is_mount_point_at) {
         ASSERT_OK(is_mount_point_at(fd, "regular", 0));
 }
 
-TEST(ms_nosymfollow_supported) {
-        log_info("MS_NOSYMFOLLOW supported: %s", yes_no(ms_nosymfollow_supported()));
-}
-
 TEST(mount_option_supported) {
         int r;