Daan De Meyer [Thu, 16 May 2024 15:18:38 +0000 (17:18 +0200)]
mkosi: Sanitizer improvements
- Let's set the environment on the kernel command line so it applies
to initrd and main system.
- Let's add the necessary wrappers that are also added in test-functions.
Unlike test-functions we don't use gcc/clang to get the library path as
that requires installing gcc/clang in the initrd.
- Let's drop the hack to get journald writing to the console and have
it write to kmsg instead. We'll get the output either way.
- Stop removing libstdc++ and sanitizer libraries from Arch Linux
initrds and other images as it's required by the sanitizer libraries.
- Add a workaround for specifying extra meson options for opensuse
- Add a leak sanitizer suppression file as a workaround for a false
positive leak in verify_selinuxmnt() in libselinux. We do a soname match
because the stacktrace can't be properly symbolized on Debian.
Mike Yuan [Fri, 31 May 2024 04:41:31 +0000 (12:41 +0800)]
core/unit: refuse to spawn units under frozen cgroup
Currently, Unit.freezer_state is always initialized to
FREEZER_RUNNING. While realizing cgroups for frozen units
was disabled in 7923e9493c48694b32d1a6de7b9a996c0194bf17,
the commit only checked for freezer_state of the unit inself,
meaning that newly-loaded units might be started and the kernel
would hang pid1 when trying to spawn sd-executor into sub-cgroup.
This can be easily reproduced by the following:
Daan De Meyer [Fri, 31 May 2024 08:25:08 +0000 (10:25 +0200)]
mkosi: Unify device timeout for CI and local runs
Now that we use KVM and don't use repart anymore to create a root
partition on first boot, let's see if we can use the same device timeout
for both local and CI runs.
Chris Packham [Thu, 30 May 2024 21:51:38 +0000 (09:51 +1200)]
basic: Add BCACHEFS magic
Import magic.h from Linux 6.9 to get the definition of
BCACHEFS_SUPER_MAGIC. Update filesystems-gperf.gperf to add knowledge of
bcachefs.
This fixes the following error building against a bleeding edge kernel.
```
src/basic/meson.build:234:8: ERROR: Problem encountered: Unknown filesystems defined in kernel headers:
Filesystem found in kernel header but not in filesystems-gperf.gperf: BCACHEFS_SUPER_MAGIC
```
Victor Berchet [Fri, 31 May 2024 00:08:00 +0000 (02:08 +0200)]
hwdb: Lenovo 16G6IRL volume keys and friends (#33107)
This prevents volume keys on the machine from repeating.
Full modalias:
```
$ cat /sys/class/dmi/id/modalias
dmi:bvnLENOVO:bvrMMCN36WW:bd03/26/2024:br1.36:efr1.30:svnLENOVO:pn21KH:pvrThinkBook16G6IRL:rvnLENOVO:rnLNVNB161216:rvrSDK0T76530WIN:cvnLENOVO:ct10:cvrThinkBook16G6IRL:skuLENOVO_MT_21KH_BU_idea_FM_ThinkBook16G6IRL:
```
Daan De Meyer [Thu, 30 May 2024 20:19:00 +0000 (22:19 +0200)]
mkosi: Override rpm's _fixperms script to be a noop
Since rpm 4.20 it tries to fix the permissions of all source files
in the sources. This takes forever and fails in our case with a
permission error. Since we don't want rpm touching our source files,
override the script to be a noop.
Daan De Meyer [Thu, 30 May 2024 20:17:29 +0000 (22:17 +0200)]
mkosi: Disable add-determinism on Fedora
This was added for reproducible builds which we don't really care
about when building rpms in mkosi, so disable it from running as it's
broken and breaks our rpm builds.
Daan De Meyer [Thu, 30 May 2024 20:16:13 +0000 (22:16 +0200)]
mkosi: Skip debuginfo workaround on newer rpm
The corresponding bug was fixed in rpm 4.20 (of which the alpha is in
rawhide as rpm 4.19.91) so skip the workaround when we detect a newer
rpm version.
Daan De Meyer [Thu, 30 May 2024 14:24:42 +0000 (16:24 +0200)]
mkosi: Replace submodules with our own thing
Unfortunately, git submodules break in all sorts of ways:
- Various github workflows (dependabot, github pages) try to do a shallow
clone of git submodules which does not work at all when the git repository
is hosted on pagure (https://pagure.io/pagure/issue/5453,
https://github.com/dependabot/dependabot-core/issues/9391).
- If the git forge hosting the git repository uses SHA256, then it breaks our
usage of it as a submodule as SHA256 repositories cannot be used as submodules
in SHA1 repositories (src.opensuse.org moved to SHA256 which broke our usage of
opensuse's systemd spec as a submodule).
- git submodules completely break usage of git worktrees.
- ...
Let's avoid all these issues by just doing our own home grown implementation of
git submodules. We lose the automatic dependabot updates this way but since dependabot
fails to run more often that not with submodules we don't really lose anything.
Mike Yuan [Thu, 30 May 2024 06:43:41 +0000 (14:43 +0800)]
bus-unit-util: rework UnitFreezer, explicitly thaw unit
Currently, we don't explicitly call unit_freezer_thaw(),
but rely on the destructor to thaw the frozen unit on
return. This has several problems though, one of them
being that we ignore the return value of ThawUnit(),
which is something we really shouldn't do here,
since such failure can easily leave the whole system
in unusable state. Moreover, the logging is kinda messy,
e.g. homed might log "Everything completed" yet immediately
followed by "Failed to thaw unit". Instead, we should log
consistently and at higher level, to make things more
debuggable.
Therefore, let's step away from the practice. Plus,
make UnitFreezer object heap-allocated, to match
with existing unit_freezer_new() and allow us to
use NULL to denote that the freezer is disabled.
Daan De Meyer [Thu, 16 May 2024 15:18:38 +0000 (17:18 +0200)]
mkosi: Sanitizer improvements
- Let's set the environment on the kernel command line so it applies
to initrd and main system.
- Let's add the necessary wrappers that are also added in test-functions.
Unlike test-functions we don't use gcc/clang to get the library path as
that requires installing gcc/clang in the initrd.
- Let's drop the hack to get journald writing to the console and have
it write to kmsg instead. We'll get the output either way.
- Stop removing libstdc++ and sanitizer libraries from Arch Linux
initrds and other images as it's required by the sanitizer libraries.
- Add a workaround for specifying extra meson options for opensuse
- Add a leak sanitizer suppression file as a workaround for a false
positive leak in verify_selinuxmnt() in libselinux. We do a soname match
because the stacktrace can't be properly symbolized on Debian.
Daan De Meyer [Mon, 27 May 2024 11:34:40 +0000 (13:34 +0200)]
test-execute: Load systemd-asan-env environment file if available
When DynamicUser= is enabled, we need LD_PRELOAD to be configured
correctly as the tests will load systemd's nss module which will complain
when built with sanitizers if the sanitizer libraries were not loaded
first.
Daan De Meyer [Thu, 30 May 2024 08:22:51 +0000 (10:22 +0200)]
test-execute: Skip test_exec_mount_apivfs() when running with sanitizers
The test fails when running under sanitizers due to missing sanitizer
libraries. For now, let's skip the test until we can make the necessary
changes to run it under sanitizers.
This makes output a bit shorter and nicer. For us, shorter output is generally
better.
Also, drop unnecessary UINT64_C macros. The left operand is always uint64_t,
and C upcasting rules mean that it doesn't matter if the right operand is
narrower or signed, the operation is always done on the wider unsigned type.
Daan De Meyer [Wed, 29 May 2024 20:03:38 +0000 (22:03 +0200)]
cgroup-util: Don't try to open pidfd for pids from cgroup.threads
Opening pidfds for non thread group leaders only works from 6.9 onwards with PIDFD_THREAD. On
older kernels or without PIDFD_THREAD pidfd_open() fails with EINVAL. Since we might read non
thread group leader IDs from cgroup.threads, we introduce and set CGROUP_NO_PIDFD to avoid
trying open pidfd's for them and instead use the pid as is.
pcrlock: tweak error messages when we are not looking at a TPM2 event log
If we are looking at a TPM1.2 event log the first log record will not be
the "EfiSpecIdEvent" but something else. Let's improve the log messages
about this, and say explicitly that this is likely not a TPM2.0 event
log.
efi-api: check /sys/class/tpm/tpm0/tpm_version_major, too
If the ceck for the ACPI TPM2 table did not work we currently check if
the EFI TPM table exists to check if the firmware supports TPM2.
Specifically we check if
/sys/kernel/security/tpm0/binary_bios_measurements exists. But that's
not enough, since that also exists on TPM1.2 systems. Hence, let's also
check /sys/class/tpm/tpm0/tpm_version_major which should exist under
similar conditions and tells us the kernel's idea of the TPM version in
use.
I originally intended to read the signature of the
/sys/kernel/security/tpm0/binary_bios_measurements contents for this,
but this is not ideal since that file has tight access mode, and our TPM
availability check would thus not work anymore if invoked unpriv.
Daan De Meyer [Tue, 28 May 2024 08:14:07 +0000 (10:14 +0200)]
mkosi: Stop installing dbus-broker on OpenSUSE
dbus-broker and dbus-daemon have not been made interchangable on
OpenSUSE so we currently end up with dbus-broker used for the system
bus and dbus-daemon for the session bus. Let's stick to dbus-daemon
on OpenSUSE until they switch to dbus-broker.
shutdown: explicitly close watchdog with disarm=false before we destroy watchdog resources
Otherwise we'll close the device disarming it as side-effect of
watchdog_free_device(), which is not intended. Hence, let's close the fd
first explicitly leaving it armed.
watchdog: reset last ping timestamp when opening watchdog
When we open a watchdog fresh we have never pinged it, hence reset the
ping timestamp explicitly, so that it is not only reset the first time
we open the device, but all times.
Daan De Meyer [Tue, 28 May 2024 12:08:18 +0000 (14:08 +0200)]
TEST-64-UDEV-STORAGE: Replace megasas2 controller with virtio scsi controller
The virtio-scsi driver is available in the KVM/cloud kernel
packages provided by distributions whereas the megasas2 driver is
not. Let's switch to virtio-scsi so we can switch back to the KVM/cloud
kernel packages.
Daan De Meyer [Tue, 28 May 2024 21:15:25 +0000 (23:15 +0200)]
mkosi: Switch from btrfs to ext4
Mounting multiple btrfs filesystems with the same fsid only works
properly from kernel 6.7 onwards. Let's switch to ext4 for now which
does support this.
Luca Boccassi [Tue, 28 May 2024 17:59:24 +0000 (18:59 +0100)]
bpf: add helper to translate kernel error codes from libbpf
libbpf returns error codes from the kernel unmodified, and we don't understand
them so non-fatal ones are handled as hard errors.
Add a translation helper, and start by translating 524 to EOPNOTSUPP, which is
returned when nsresourced tries to use LSM BPF hooks that are not
implemented on a given arch (in this case, arm64 is misssing trampolines).
Yu Watanabe [Tue, 28 May 2024 09:15:02 +0000 (18:15 +0900)]
test-network: tun/tap fd may be owned by tentative worker processes
PID1 may invoke a helper process, e.g. sd-close, during the test.
So, processes other than networkd and PID1 may be shown.
```
testtap99: tap pi multi_queue vnet_hdr persist filter
Attached to processes:systemd-network(2852)(sd-close)(2863)systemd(1)
```
projects / thirdparty / systemd.git / log
