Sometimes it's useful from shell scripts to check if we have a working
TPM2 chip around. For example, when putting together encrypted
credentials for the initrd (after all: it might be wise to place the
root pw in a credential for the initrd to consume, but do so only if we
can lock it to the TPM2, and not otherwise, so that we risk nothing).
Hence, let's add a new "systemd-creds has-tpm2" verb: it returns zero if we
have a working TPM2 (which means: supported by kernel + firmware + us),
or non-zero otherwise. Also show which parts are available.
Use-case: in future the 'kernel-install' script should use this when
deciding whether to augment kernels with security sensitive credentials.
bootctl: use new tpm2_support() helper to show TPM2 info
Let's improve the output regarding TPM2 support in "bootctl": let's show
whether we have local driver support and/or firmware support, and
colorize it.
(For now, don't show if we natively support TPM2, since the tool is
mostly bout boot time stuff, where it dosn't really matter much what we
do in userspace)
tpm2-util: add helper that checks for the various facets of TPM2 support
So far we were a bit sloppy regarding checks for TPM2 support. Let's
make things more precise and introduce a single helper that checks for
three axis of TPM2 support: whether we have a loaded kernel driver,
whether the firmware used it, and whether we ourselves are compiled for
it.
This only adds the helper. Follow-up patches will use it at various
places.
journal-def.h should be self-contained too, as it represents the journal object ABI.
Duplicate the enums, as they also need to be in config.h for it to be self-contained,
and enums are not available to the preprocessor. Use an assert to ensure they don't
diverge.
clone3() passes arguments in a structure referenced by a pointer, so we can't
filter on the flags as with clone(). Let's disallow the whole function call.
nspawn: fix locating config files with --ephemeral
When --ephemeral is used, a random 16 characters suffix is added to the image
name, so matching on .nspawn files based on the image name no longer works.
compression: add build-time option to select default
Compression and decompression are controlled by the same build flag,
so if one wants to use, say, LZ4 to compress, ZSTD has to be disabled,
which means one loses the ability to read zstd-compressed journals.
Add a default-compression meson option, that allows to select any of
the available compression algorithms as the default.
systemctl: colorize "enabled" in 'systemctl status ...'
"enabled" state is highlighted in green and "disabled" state is
highlighted in yellow because I felt that white and grey colors were not
so distinguishable. Other states are not highlighted. Any other coloring
suggestions are welcome!
After a couple of manual tests LGTM finally appears to have the fix for
https://github.com/github/codeql/issues/8409, so let's reenable the
check for the last time.
Jan Janssen [Wed, 16 Feb 2022 11:28:20 +0000 (12:28 +0100)]
boot: Fix integer format specifiers
gnu-efi only knows two sizes for formatting integers: 32bit without
a length prefix and 64bit with 'l' prefix. Provide a PRI-style format
specifier for (U)INTN so that Print() can read the right amount of
bytes instead of printing garbage or worse.
sd-device: skip diskseq verification when ID_IGNORE_DISKSEQ property is set
Some drivers do not announce the diskseq change.
E.g. for md devices, the kernel increments the diskseq *after*
emitting a 'change' uevent when backing block devices are added to
a md device, and udevd does not receive no uevent which contains
the new diskseq.
basic: split out dev_t related calls into new devno-util.[ch]
No actual code changes, just splitting out of some dev_t handling
related calls from stat-util.[ch], they are quite a number already, and
deserve their own module now I think.
Also, try to settle on the name "devnum" as the name for the concept,
instead of "devno" or "dev" or "devid". "devnum" is the name exported in
udev APIs, hence probably best to stick to that. (this just renames a
few symbols to "devum", local variables are left untouched, to make the
patch not too invasive)
Currently if enumerating with debug logging you'll likely see something
like this:
sd-device: the syspath "/sys/class/devcoredump/disabled" is not a directory.
sd-device: the syspath "/sys/class/firmware/timeout" is not a directory.
sd-device: the syspath "/sys/class/zram-control/hot_remove" is not a directory.
sd-device: the syspath "/sys/class/zram-control/hot_add" is not a directory.
sd-device: the syspath "/sys/class/drm/version" is not a directory.
This is because these sysfs classes place regular files in these
directories, which we so far didn't expect.
Let's filter them early, and only bother with enumerated inodes if they
actually are dirs or symlinks, i.e. can be kobject dirs. Regular file
definitely never are kobject dirs...
sd-device: generate e better error code when trying to allocate sd_device for non-dir
Currently, for sysfs paths outside of /sys/devices/ we do better
checking if something is a suitable path: we check if it's actually a
directory, and if not return ENODEV.
Let's make the codepath for nodes *inside* of /sys/device/ similar:
let's also return ENODEV if the path supplied is not a directory.
Previously, we'd return ENOTDIR in that case, which is quite confusing I
think.
There are some file systems mounted below /sys/ that are not actually
sysfs, i.e. are not arranged in a sysfs/kobject style. Let's refuse
those early. (Example, /sys/fs/cgroup/ and similar.)
(Also, let's add an env var for this, so that it can be turned off for
test cases.)
chase_symlinks() can return its last O_PATH fd to us. Let's use that and
make the access() check a bit tighter by going via faccessat() on the
O_PATH fd.
This doesn't really change too much, but is nice in context of the next
commit, which uses the O_PATH fd in one other way.
Given it's easy for PID 1 to pass this to generators, I thin we should.
All generators not written by us likely want to know these things so
that the can adjust to the execution environment.
projects / thirdparty / systemd.git / log
