Karel Zak [Wed, 29 Jul 2026 11:06:05 +0000 (13:06 +0200)]
Merge branch 'lsfd/fix-bpf-map' of https://github.com/echoechoin/util-linux
* 'lsfd/fix-bpf-map' of https://github.com/echoechoin/util-linux:
tests: (lsfd) add mapped-bpf-map test case
test: (mkfds::mapped-bpf-map) new factory
lsfd: improve bpf-map display when fdinfo is not available
Karel Zak [Tue, 28 Jul 2026 12:57:52 +0000 (14:57 +0200)]
agetty: move man page to agetty-cmd/
The agetty source was moved to agetty-cmd/ but the man page
agetty.8.adoc was left behind in term-utils/. Move it to agetty-cmd/
and update references in meson.build, Makemodule.am, and po-man/po4a.cfg.
agetty: show default issue file when built without issue.d support
Commit d1cf7ef refactored the issue file handling to read the default
issue file (/etc/issue) together with the issue.d drop-in directory
through ul_configs_file_list(). That call was placed inside an
"#ifdef ISSUEDIR_SUPPORT" block, so on builds without issue.d support
(e.g. systems where scandirat()/openat() are unavailable, such as musl
libc) the default issue file was no longer read at all.
As a result `agetty --show-issue` and the login prompt printed nothing
on such builds unless --issue-file was given, regressing the long-standing
behaviour of displaying /etc/issue.
ul_configs_file_list() returns the main issue file even when drop-in
directory support is unavailable (it skips the drop-in scan but still
locates the main configuration file), so move the call out from under
ISSUEDIR_SUPPORT and include configs.h unconditionally. The drop-in
directory scanning itself still requires ISSUEDIR_SUPPORT, which is
unchanged.
[kzak: removed github issue URL from in-code comment]
Karel Zak [Tue, 28 Jul 2026 12:16:31 +0000 (14:16 +0200)]
pty-session: defer raw mode until after signals are blocked
ul_pty_setup() switches the user's terminal to raw mode before
ul_pty_signals_setup() blocks signals. A terminating signal delivered
in this window kills the process without reaching ul_pty_cleanup(),
leaving the terminal in raw mode.
Move the raw-mode tcsetattr() out of ul_pty_setup() into a new
ul_pty_terminal_setup() function, to be called after
ul_pty_signals_setup(). This ensures signals are already directed
to signalfd when raw mode is activated, closing the race window.
The setup sequence is now:
ul_pty_setup() -- open pty, save terminal attrs
<app-specific work> -- e.g. utempter (needs SIGCHLD unblocked)
ul_pty_signals_setup() -- block signals, create signalfd
ul_pty_terminal_setup() -- set raw mode (signals already blocked)
fork()
Addresses: https://github.com/util-linux/util-linux/issues/4499 Signed-off-by: Karel Zak <kzak@redhat.com>
fdisk: fix -t/--type when auto-creating a label on empty devices
fdisk_create_disklabel(cxt, NULL) always resolves to "dos" or "sun",
regardless of any restriction set via -t/--type. If -t disabled "dos"
(like in -t gpt) auto-creation on an empty device fails with -EINVAL.
As the return code was never checked, the failure was silent,
thus no label got created and no error was shown.
The requested label via -t is now passed to the auto-create call,
which warns if creation still fails.
There is no behavior change when -t is not used in the program.
ul_pty_signals_setup() subscribes to SIGALRM through the signalfd set,
but handle_signal() has no case for it, so a SIGALRM delivered to the
proxy (e.g. an alarm(2) timer armed before execve(), or an external
"kill -ALRM") falls through to "default: abort()".
The abort() terminates script/su --pty/runuser --pty with SIGABRT before
ul_pty_cleanup() runs, leaving the user's terminal in raw mode (no echo,
no canonical mode, no signal generation) until "stty sane" is run.
Treat SIGALRM like the other terminating signals (SIGHUP/SIGTERM/SIGINT/
SIGQUIT): record it in delivered_signal and forward SIGTERM to the child
so the proxy leaves its poll() loop through the normal path and
ul_pty_cleanup() restores the saved terminal settings. The default
disposition of SIGALRM is termination, so this preserves the previous
outcome while adding the cleanup.
None of script, su --pty or runuser --pty arms SIGALRM internally on this
code path.
This addresses the deterministic SIGALRM path reported in #4499. The
separate, much narrower window where a terminating signal arrives
between ul_pty_setup() (raw mode on) and ul_pty_signals_setup() (signals
blocked) is not addressed here; closing it requires reworking the signal
mask contract between those two calls.
fdisk: derive first usable LBA from the real primary entries location
fdisk_gpt_set_npartitions() (the expert "change table length" command)
computed the first usable LBA with gpt_calculate_first_lba(), which
assumes the primary partition entries array is at the default LBA 2. The
primary entries array is not relocated when the table length changes, so
on a GPT whose primary entries are not at the default location the usable
area ended up overlapping the entries array and a partition could be
created on top of it.
Derive the first usable LBA from the actual on-disk location of the
primary entries array (pheader->partition_entry_lba) instead. The backup
entries array is recalculated to the default end-of-device location by
gpt_mknew_header_common(), so gpt_calculate_last_lba() is still based on
the default layout and is left unchanged.
Add a regression test that relocates the primary entries array to a
non-default LBA and checks the first usable LBA after a "change table
length" operation.
Karel Zak [Thu, 23 Jul 2026 08:05:31 +0000 (10:05 +0200)]
Merge branch 'lsfd/bpf-link' of https://github.com/echoechoin/util-linux
* 'lsfd/bpf-link' of https://github.com/echoechoin/util-linux:
test: (lsfd) add a case for testing bpf-link related columns
test: (mkfds::bpf-link) new factory
lsfd: add configure check for BPF_LINK_CREATE
lsfd: introduce bpf-link anon-inode support
replay_get_next_step() divided the tv_sec and tv_usec fields of the
recorded delay by the divisor independently. Both fields are integers, so
the fractional part of the whole-seconds field was discarded instead of
being carried into microseconds. Replaying a 1.000000 s delay with
--divisor 2 therefore produced a 0.000000 s delay (the next step was
emitted immediately) instead of the expected 0.500000 s, and the error
could approach one second per step and accumulate across recordings with
multiple pauses.
Scale the complete duration once in microseconds, then split the result
back into seconds and microseconds so the fractional whole-seconds part is
preserved. This affects both scriptreplay and scriptlive, which share the
helper.
Add a "divisor-fractional" subtest to tests/ts/script/replay that verifies
a 1.000000 s delay scaled by --divisor 2 takes about half a second rather
than collapsing to zero.
pg: fix out-of-bounds access past wbuf on a trailing tab
endline_for_mb() and its single-byte twin endline() advance the scan
pointer twice when the last character of a buffer-filling line is a tab
(once in the tab branch, once via the shared *++p) with no terminator
re-check in between. A full line (wl == READBUF-1) ending in a tab makes
*++p read wbuf[READBUF] and the following *end = L'\0' write it -- one
element past the wbuf[READBUF] array.
Re-check for the terminator before the second advance.
more: fix out-of-bounds write in get_line() on invalid multibyte input
In get_line(), the invalid-multibyte switch arm (case (size_t)-1) writes
*p++ = mbc[0] without the bounds check that its sibling write paths use,
and the "goto process_mbc" back-edge lets it re-run within one loop
iteration, bypassing the loop-head guard. A line that first fills line_buf
with zero-width combining characters (which advance p but not column) and
then supplies an invalid multibyte sequence can step p past the
num_columns*4 + 2 byte allocation -- a heap out-of-bounds write.
Guard the write the same way the sibling path does.
Karel Zak [Mon, 20 Jul 2026 08:40:00 +0000 (10:40 +0200)]
Merge branch 'PR/libmount-vfs' of https://github.com/karelzak/util-linux-work
* 'PR/libmount-vfs' of https://github.com/karelzak/util-linux-work:
docs: add VFS symbols to libmount-sections.txt
tests: add libmount VFS test
libmount: add VFS test to test_mount_context
libmount: add pluggable VFS I/O support
Karel Zak [Wed, 15 Jul 2026 10:46:06 +0000 (12:46 +0200)]
libmount: add VFS test to test_mount_context
Add --vfs test that exercises the pluggable VFS I/O operations with
three sub-options:
--table <file> parse a mount table through VFS fopen
--cache <dev> probe device via cache (udev, then blkid)
--blkid <dev> probe device directly via libblkid VFS
The test sets up VFS callbacks that wrap standard syscalls and report
call counts, verifying that I/O is routed through the pluggable layer.
Karel Zak [Wed, 15 Jul 2026 10:21:29 +0000 (12:21 +0200)]
libmount: add pluggable VFS I/O support
Add three new public APIs for pluggable VFS I/O operations:
- mnt_context_set_vfs(cxt, ops) -- set VFS on mount context (owned copy)
- mnt_cache_refer_vfs(cache, vfs) -- set VFS reference on cache (borrowed)
- mnt_table_refer_vfs(tb, vfs) -- set VFS reference on table (borrowed)
The VFS operations are automatically propagated from the context to its
cache and tables when they are created or set.
Convert blkid probe calls in cache.c (read_from_blkid, fstype_from_blkid)
from blkid_new_probe_from_filename() to the VFS-aware 3-step pattern:
blkid_new_probe() + blkid_probe_set_vfs() + blkid_probe_open_device().
Convert mnt_table_parse_file() to use ul_vfs_fopen() for VFS-aware
file opening.
Karel Zak [Wed, 15 Jul 2026 11:19:37 +0000 (13:19 +0200)]
Merge branch 'PR/dl-utils' of https://github.com/karelzak/util-linux-work
* 'PR/dl-utils' of https://github.com/karelzak/util-linux-work:
tools: switch SELinux to runtime optional via dlopen
libmount: use shared dl-utils for SELinux dlopen
libmount: fix -Wunterminated-string-initialization warning
libmount: use shared dl-utils for cryptsetup dlopen
lib/dl-utils: add shared dlopen/dlsym infrastructure
Karel Zak [Tue, 14 Jul 2026 12:48:39 +0000 (14:48 +0200)]
docs: findmnt: clarify that --target returns one filesystem
The --target option identifies the filesystem for a given path, and a
file always resides on exactly one filesystem. Document that --target
returns at most one entry and skips over-mounted entries.
Addresses: https://github.com/util-linux/util-linux/issues/4424 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Mon, 13 Jul 2026 14:28:43 +0000 (16:28 +0200)]
tools: switch SELinux to runtime optional via dlopen
Replace direct libselinux linking with runtime dlopen() using the
shared dl-utils infrastructure. All tools that use SELinux functions
now call them through selinux_call() macro and gracefully handle the
case when libselinux is not installed at runtime.
Karel Zak [Mon, 13 Jul 2026 14:18:29 +0000 (16:18 +0200)]
libmount: use shared dl-utils for SELinux dlopen
Add lib/dl-selinux.c and include/dl-selinux.h as a SELinux dlopen
wrapper using the shared dl-utils infrastructure. This replaces the
direct libselinux linking with runtime dlopen(), allowing libmount to
gracefully handle the case when libselinux is not installed.
The hook_selinux.c and lib/selinux-utils.c now use selinux_call()
macro to call SELinux functions through the dlopen'd function pointer
table.
The "xx\0" string literal is 4 bytes but buf is only 3, truncating
the NUL terminator. Since the buffer is immediately overwritten by
memcpy, just zero-initialize it instead.
Karel Zak [Mon, 13 Jul 2026 13:42:14 +0000 (15:42 +0200)]
libmount: use shared dl-utils for cryptsetup dlopen
Move the cryptsetup dlopen wrapper out of hook_veritydev.c into
lib/dl-cryptsetup.c with a global cached load function
ul_dlopen_libcryptsetup(). The function pointers are resolved once
and shared across all callers.
This removes the CRYPTSETUP_VIA_DLOPEN conditional -- dlopen is now the
only supported way to use libcryptsetup. The library is never linked
directly.
An ELF .note.dlopen metadata note is emitted so that packaging tools
can automatically derive the optional runtime dependency.
Also fix the CFLAGS order in libmount Makemodule.am to ensure local
include paths (-I for blkid, libmount) come before external pkg-config
flags that may pull in system headers.
Add generic helpers for optional runtime dependencies loaded via dlopen().
Each optional library gets its own struct of function pointers and a symbol
table mapping names to offsets in that struct. The shared ul_dlopen_symbols()
resolves all entries in one call.
This also includes a copy of the ELF .note.dlopen metadata macro (from
systemd's sd-dlopen.h, MIT-0 licensed) so that packaging tools can
automatically derive optional dlopen() dependencies.
Library-specific wrappers will live in lib/dl-<name>.c.
dengbo [Thu, 25 Jun 2026 13:52:16 +0000 (21:52 +0800)]
findmnt: skip shadowed entries when matching by --target
The previous approach filtered shadowed entries in match_func() using
mnt_table_over_fs() with is_defined_match(COL_TARGET) as the trigger.
This was fragile because COL_TARGET matching is also enabled by other
code paths (source/target swap fallback in get_next_fs(), poll_match()
swap logic, and positional arguments).
Replace with the standard mountinfo iteration pattern: read
/proc/self/mountinfo backward (MNT_ITER_BACKWARD), stop at the first
match (FL_FIRSTONLY), and disable source/target swapping
(FL_NOSWAPMATCH). Since later mounts appear later in mountinfo,
backward iteration naturally finds the visible (topmost) filesystem
for the given target path.
Karel Zak [Thu, 9 Jul 2026 14:44:20 +0000 (16:44 +0200)]
Merge branch 'PR/libblkid-vfs' of https://github.com/karelzak/util-linux-work
* 'PR/libblkid-vfs' of https://github.com/karelzak/util-linux-work:
lib/sysfs: add VFS parameter to sysfs_devno_is_dm_*()
lib/procfs: use VFS dispatch for read and close
lib/path: add VFS support
vfs: add FILE* stream support to the VFS abstraction layer
vfs: move mode2flags() to include/vfs.h as ul_mode_to_flags()
wipefs: use blkid_probe_open_device()
libblkid: use blkid_probe_open_device() in evaluate and verify
libblkid: add blkid_probe_open_device()
libblkid: use VFS I/O operations in probe
libblkid: add blkid_probe_set_vfs() for pluggable I/O
include: add VFS I/O abstraction layer
all-io: rename read_all/write_all to ul_read_all/ul_write_all
Karel Zak [Tue, 30 Jun 2026 15:30:33 +0000 (17:30 +0200)]
lib/sysfs: add VFS parameter to sysfs_devno_is_dm_*()
Add const struct ul_vfs_ops *vfs parameter to sysfs_devno_is_dm_hidden()
and sysfs_devno_is_dm_private() so the internal sysfs reads go through
VFS dispatch.
Wire pr->vfs in libblkid probe.c and topology/sysfs.c callers.
Non-library callers pass NULL.
Addresses: https://github.com/util-linux/util-linux/issues/4308 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 30 Jun 2026 14:53:56 +0000 (16:53 +0200)]
vfs: move mode2flags() to include/vfs.h as ul_mode_to_flags()
Move the fopen-style mode string to open(2) flags parser from
lib/path.c to include/vfs.h for reuse across the project,
especially in the upcoming ul_vfs_fopen() helper.
Addresses: https://github.com/util-linux/util-linux/issues/4308 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 30 Jun 2026 13:52:08 +0000 (15:52 +0200)]
wipefs: use blkid_probe_open_device()
Convert wipefs new_probe() to use blkid_probe_open_device() instead
of open() + blkid_probe_set_device(). The flags argument allows
passing the open mode directly.
Karel Zak [Tue, 30 Jun 2026 13:40:46 +0000 (15:40 +0200)]
libblkid: use blkid_probe_open_device() in evaluate and verify
Convert evaluate.c and verify.c to use blkid_probe_open_device()
instead of open() + blkid_probe_set_device(). This makes these
internal callers VFS-aware and simplifies fd ownership.
Clean up verify.c error paths with dev_err/dev_free labels.
Karel Zak [Tue, 30 Jun 2026 13:18:25 +0000 (15:18 +0200)]
libblkid: add blkid_probe_open_device()
Add a convenience function that opens a device and assigns it to
the probe, using VFS operations if previously set. This enables
the composable pattern:
Karel Zak [Tue, 30 Jun 2026 12:47:19 +0000 (14:47 +0200)]
libblkid: use VFS I/O operations in probe
Replace all direct I/O syscalls in the probe path with ul_vfs_*
dispatch functions that route through the pluggable VFS layer when
set, falling back to real syscalls otherwise.
Add ul_vfs_copy() to include/vfs.h for cloning VFS ops structs.
Changed call sites:
- read_buffer(): lseek + read
- is_sector_readable(): lseek + read, changed signature to take
blkid_probe instead of bare fd
- blkid_probe_set_device(): close
- blkid_do_wipe(): lseek + write_all + fsync
- blkid_free_probe(): close + free(pr->vfs)
- blkid_clone_probe(): allocate private VFS copy via ul_vfs_copy()
Addresses: https://github.com/util-linux/util-linux/issues/4308 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 30 Jun 2026 12:38:56 +0000 (14:38 +0200)]
libblkid: add blkid_probe_set_vfs() for pluggable I/O
Add public API to set custom VFS I/O operations on a blkid probe.
This allows callers (e.g., systemd fibers) to replace standard
read/write/lseek/open/close/fsync with custom implementations.
The ops struct is copied into a private allocation owned by the
probe. NULL function pointers fall back to standard syscalls.
Passing NULL resets to defaults.
New public symbol: blkid_probe_set_vfs()
New struct in public header: struct ul_vfs_ops (with include guard
shared with include/vfs.h)
Addresses: https://github.com/util-linux/util-linux/issues/4308 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 30 Jun 2026 12:20:50 +0000 (14:20 +0200)]
include: add VFS I/O abstraction layer
Add include/vfs.h with struct ul_vfs_ops — a pluggable I/O operations
table with function pointers matching POSIX signatures (read, write,
open, close, lseek, fsync). NULL function pointers fall back to real
syscalls. The size field enables forward/backward compatible struct
evolution.
Refactor include/all-io.h to use VFS dispatch internally:
- ul_write_all() and ul_read_all() become macros calling
__write_all(NULL, ...) and __read_all(NULL, ...)
- New ul_vfs_write_all() and ul_vfs_read_all() macros pass
through a VFS ops struct for custom I/O
Addresses: https://github.com/util-linux/util-linux/issues/4308 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Thu, 9 Jul 2026 10:09:14 +0000 (12:09 +0200)]
tests: lslocks filter, workaround duplicate lines in output
Duplicate lines have been observed in lslocks output on ppc64le
(kernel 7.0). The root cause is unknown. No duplication path has
been found in the lslocks code itself.
Wrap lslocks calls in do_lslocks() helper that deduplicates
consecutive identical lines via uniq. If duplicates are detected,
warn and mark the test as KNOWN FAILED.
Karel Zak [Wed, 8 Jul 2026 12:03:43 +0000 (14:03 +0200)]
mount: fix grammar and typo in X-mount.idmap documentation
Apply grammar improvements from PR #4400 (field order change
intentionally omitted as the current order matches the code).
Also fix a GUID -> GID typo in the example.
Karel Zak [Wed, 8 Jul 2026 11:57:12 +0000 (13:57 +0200)]
tests: (chrt) improve skip_policy with runtime probe
The skip_policy function relied solely on "chrt --max" output to
detect kernel support for scheduling policies. This is unreliable
for SCHED_EXT where sched_get_priority_max() returns 0 even on
kernels without CONFIG_SCHED_CLASS_EXT, causing the test to fail
with EINVAL instead of skipping gracefully.
Rework skip_policy to accept optional chrt probe arguments and
verify actual kernel support by attempting to set the policy on
the chrt process itself (--pid 0). Cache "chrt --max" output once
at startup to avoid repeated execution.
Additionally, filter the platform-dependent runtime parameter from
do_chrt output unless --sched-runtime was explicitly used. This
removes the need for kernel version gating on the basic batch and
other subtests, allowing them to run on all kernel versions.
Fixes: https://github.com/util-linux/util-linux/issues/4429 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Wed, 8 Jul 2026 09:28:22 +0000 (11:28 +0200)]
Merge branch 'col-cur-col-underflow' of https://github.com/aizu-m/util-linux
* 'col-cur-col-underflow' of https://github.com/aizu-m/util-linux:
col: guard c_width sign before size_t cast in BS branch
col: fix cur_col underflow on backspace over a wide char
Modifies setpriv to support the securebits `no_cap_ambient_raise`,
`exec_restrict_file`, `exec_deny_interactive`, and each of their
`_locked` variants.
The NO_CAP_AMBIENT_RAISE securebit was added in Linux 4.3, and the
EXEC_RESTRICT_FILE and EXEC_DENY_INTERACTIVE securebits were added in
Linux 6.14.
Karel Zak [Tue, 7 Jul 2026 09:19:07 +0000 (11:19 +0200)]
Merge branch 'feat/4117-agetty-no-login-message' of https://github.com/mvanhorn/util-linux
* 'feat/4117-agetty-no-login-message' of https://github.com/mvanhorn/util-linux:
agetty: clarify nologin message and skip login wait under --chroot
agetty: handle systems without a shell or /bin/login
libblkid: (iso9660) fix out-of-bounds read of root dir record
root_len comes from the on-disk root directory record (rdr+10) and was only rejected when zero. The extent is then mapped for min(root_len, 2048) bytes and the first record is validated by reading rootdata[0], rootdata[32], rootdata[33] and isonum_731(rootdata+2). blkid_probe_get_buffer() only rounds a request up to io_size when the rounded region still fits the probing area, so a root extent sitting in the final partial io_size block of a crafted image returns a buffer of exactly root_len bytes. With root_len between 1 and 33 and rootdata[0] >= 34, the validation reads offsets 32/33 past that buffer. Reject an extent too small to hold the 34-byte record, which the surrounding comment already assumes.
Matt Van Horn [Sat, 4 Jul 2026 03:48:16 +0000 (20:48 -0700)]
agetty: clarify nologin message and skip login wait under --chroot
Address review notes from Karel: reword DEFAULT_NOLOGIN_MESSAGE so it
tells the user a keypress re-checks for the login program, and skip
wait_for_login_program() when --chroot is used since the path check
would test the wrong root. Update the man page accordingly.
Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
libmount provides a context API that can be used to replace
the fork+exec code pattern needed to leverage umount(8).
This does not only simplify the code base but also removes
the concern for signal handling due to a wait(2) call, avoids
forking and allocating additional system resources, reduces
security management and makes the code more consistent as other
functions were already using some libmount functionalities.
Signed-off-by: Christian Goeschel Ndjomouo <cgoesc2@wgu.edu>
col: fix cur_col underflow on backspace over a wide char
The BS handler in handle_not_graphic() subtracts the last stored
character's width from lns->cur_col (a size_t) and only guards against
cur_col == 0. When the last graphic character is double-width and the
column was reset by CR then advanced by a single space, cur_col is 1 and
cur_col -= 2 wraps to SIZE_MAX. That feeds l_max_col and the stored
c_column, so flush_line() sizes count[] as l_max_col + 1 (== 0) and then
memsets sizeof(size_t) * l_max_col bytes and indexes count[SIZE_MAX] --
an out-of-bounds write reachable from stdin under a UTF-8 locale. Clamp
the subtraction so the column cannot go below zero.
Karel Zak [Wed, 1 Jul 2026 10:49:25 +0000 (12:49 +0200)]
libmount: add mnt_table_parse_utab()
Add new public API to parse the utab file into a table. The utab path
and format are private library details; this function hides them from
callers. NULL as filename is recommended to let the library determine
the correct path.
This is needed by systemd for incremental fanotify-based mount
monitoring, where utab needs to be parsed independently of the full
mountinfo/listmount rescan path.
projects / thirdparty / util-linux.git / log
