Karel Zak [Mon, 10 Aug 2026 11:47:24 +0000 (13:47 +0200)]
Merge branch 'testcoverage_sh_find_shared_tsdirs' of https://github.com/cgoesche/util-linux-fork
* 'testcoverage_sh_find_shared_tsdirs' of https://github.com/cgoesche/util-linux-fork:
tests: (minix) make long options visible for test coverage analysis
tests: (fsck.cramfs) make long options visible for test coverage analysis
tools: (testcoverage.sh) find shared test directories
tools: (testcoverage.sh) find shared test directories
Some programs share a common test directory whose name
differs from the program names and made it so that we
could not find the tools' test scripts. Adding a hash
table that contains the names of exceptional programs
and their actual test directory makes it easy to find
what we need.
Signed-off-by: Christian Goeschel Ndjomouo <cgoesc2@wgu.edu>
Karel Zak [Thu, 6 Aug 2026 15:44:47 +0000 (17:44 +0200)]
Merge branch 'test_mkfds--use-libsmartcols' of https://github.com/masatake/util-linux
* 'test_mkfds--use-libsmartcols' of https://github.com/masatake/util-linux:
test_mkfds: use libsmartcols in -W, --multiplexers output
test_mkfds: use libsmartcols in -O, --output-values output
test_mkfds: use libsmartcols in -I, --parameters output
test_mkfds: use libsmartcols in -l, --list output
Karel Zak [Thu, 6 Aug 2026 07:53:19 +0000 (09:53 +0200)]
Merge branch 'lsfd/io_uring' of https://github.com/echoechoin/util-linux
* 'lsfd/io_uring' of https://github.com/echoechoin/util-linux:
tests: (lsfd) add mkfds-io_uring test case
test: (mkfds::io_uring) new factory
lsfd: introduce io_uring anon-inode support
include/strutils: add parse helpers for struct members
Clayton Craft [Wed, 5 Aug 2026 22:22:56 +0000 (15:22 -0700)]
libblkid: minix: don't detect erofs images as minix
The erofs superblock starts at 0x400, the same offset as the minix
superblock, and its inode count field overlaps the offset where minix
keeps its magic. An erofs image that has an inode count which happens
to equal the minix magic can be incorrectly reported as containing both
filesystems, and probe fails with an ambivalent result. This can lead to
e.g. so udev failing to create by-partuuid symlink for the partition.
This reject a minix match when the erofs magic is present at 0x400, the
same way an ext superblock is already handled in probe_minix.
The fs_type_compiled structure allocated by compile_fs_type() was not
freed before program exit, resulting in a minor memory leak. Add
free_fs_type_compile() to release the memory properly.
[karelzak@redhat.com: fix indentation]
Signed-off-by: lijian <lijian01@kylinos.cn> Signed-off-by: Karel Zak <karelzak@redhat.com> Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Wed, 5 Aug 2026 16:14:33 +0000 (18:14 +0200)]
cfdisk: move subwin() after scols_print_table_to_string() check
Move subwin() call after the scols_print_table_to_string() error
check to avoid creating a window that would be leaked on the error
path. Also add a NULL check for the subwin() result itself.
Karel Zak [Wed, 5 Aug 2026 08:57:05 +0000 (10:57 +0200)]
Merge branch 'dlopen' of https://github.com/bluca/util-linux
* 'dlopen' of https://github.com/bluca/util-linux:
tools: switch libeconf to runtime optional via dlopen
tools: switch libsystemd to runtime optional via dlopen
build: fix build with binutils < 2.36
lib/dl-utils: fix build on alpha
WanBingjiang [Wed, 5 Aug 2026 02:17:10 +0000 (10:17 +0800)]
include/strutils: add parse helpers for struct members
Add ul_strtou32_to_offset()/ul_strtou32_to_struct_member() and
ul_strtos32_to_offset()/ul_strtos32_to_struct_member(), following the
existing strdup_to_offset()/strdup_to_struct_member() pattern.
The helpers wrap ul_strtou32()/ul_strtos32() and write the parsed value
into a struct member addressed by offsetof(), so callers get proper
error and range checking without hand-rolling strtoul().
Karel Zak [Tue, 4 Aug 2026 16:03:33 +0000 (18:03 +0200)]
fsck.minix, mkfs.minix: fix integer overflows on 32-bit builds
On 32-bit builds, block-number-to-byte-offset multiplications
(block_nr * MINIX_BLOCK_SIZE) can overflow when zone numbers exceed
4,194,304. This causes lseek to wrong positions and data to be
read from or written to incorrect offsets. Cast block numbers to
off_t before multiplication to ensure 64-bit arithmetic.
Also add a superblock validation check for inode buffer size
overflow (inode_blocks * MINIX_BLOCK_SIZE can wrap to zero with
crafted Minix v3 s_ninodes values on 32-bit), and fix verbose
percentage display overflow.
Karel Zak [Tue, 4 Aug 2026 15:24:05 +0000 (17:24 +0200)]
Merge branch 'ipcmk-do-not-print-a-bogus-errno-for-an-unparsable-mode-s01' of https://github.com/prownd/util-linux
* 'ipcmk-do-not-print-a-bogus-errno-for-an-unparsable-mode-s01' of https://github.com/prownd/util-linux:
ipcmk: do not print a bogus errno for an unparsable --mode
Karel Zak [Tue, 4 Aug 2026 15:03:07 +0000 (17:03 +0200)]
Merge branch 'setpriv-landlock-improvements' of https://github.com/Skyb0rg007/util-linux
* 'setpriv-landlock-improvements' of https://github.com/Skyb0rg007/util-linux:
setpriv: improve --landlock-support option
setpriv: add bash completion to landlock options
setpriv: add --landlock-support option
setpriv: limit landlock-rule to access restrictions
setpriv: error when a landlock rule has no access
setpriv: add resolve-unix filesystem access option
setpriv: use rules supported by the current kernel
setpriv: replace landlock header with our own definitions
Skye Soss [Mon, 3 Aug 2026 15:47:46 +0000 (10:47 -0500)]
setpriv: improve --landlock-support option
The `--landlock-support` option now reports the Landlock errata in
addition to the version, and properly restricts the reported rights
based on the running kernel's Landlock ABI version. It also wraps the
strings with the gettext translation macro.
Karel Zak [Wed, 29 Jul 2026 10:12:27 +0000 (12:12 +0200)]
libfdisk: add pluggable VFS I/O support
Add fdisk_set_vfs() to allow replacing standard I/O syscalls
(read/write/lseek/open/close/fsync) with custom implementations,
matching the existing VFS support in libblkid and libmount.
All direct I/O calls in the library (context.c, utils.c, dos.c,
gpt.c, bsd.c, sgi.c, sun.c) are replaced with ul_vfs_* wrappers
that fall back to standard syscalls when no VFS is set.
The VFS is also propagated to libblkid probes used in wipe.c
for collision detection and signature wiping.
hanjinpeng [Sun, 2 Aug 2026 16:41:11 +0000 (12:41 -0400)]
ipcmk: do not print a bogus errno for an unparsable --mode
The --mode option is the only one in ipcmk(1) that parses its argument
by hand instead of using the strutils helpers, and it reports the
failure with err(), which appends strerror(errno). strtoul() only sets
errno on overflow, so for a malformed argument errno is still 0 and the
user gets:
$ ipcmk --queue --mode abc
ipcmk: failed to parse mode: Success
Use str2unum_or_err(), like the other options in this file already do.
It picks err()/errx() based on errno and prints the offending string:
$ ipcmk --queue --mode abc
ipcmk: failed to parse mode: 'abc'
$ ipcmk --queue --mode 100000
ipcmk: failed to parse mode: '100000': Numerical result out of range
The 07777 upper bound is the range of the mode bits that the resource
creation calls accept; values above it were silently truncated to int
before.
Karel Zak [Mon, 3 Aug 2026 12:12:15 +0000 (14:12 +0200)]
Merge branch 'fix-befs-fuzz' of https://github.com/mbroz/util-linux
* 'fix-befs-fuzz' of https://github.com/mbroz/util-linux:
libblkid: befs: fix possible load of misaligned address
libblkid: befs: fix possible too large shift
Karel Zak [Mon, 3 Aug 2026 11:14:14 +0000 (13:14 +0200)]
Merge branch 'addgptasdefaultinstdout' of https://github.com/Persioqq/util-linux
* 'addgptasdefaultinstdout' of https://github.com/Persioqq/util-linux:
libfdisk: recommend GPT on interactive terminals on EFI systems for an empty device
hanjinpeng [Sun, 2 Aug 2026 16:44:24 +0000 (12:44 -0400)]
bits: fix the layout of the --help output
The -w/--width and -f/--fail-width entries are printed after
USAGE_HELP_OPTIONS(), so --help and --version show up in the middle of
the option list instead of at its end, unlike every other util-linux
program. The description of -f is also indented by one column too many
and does not line up with the rest.
Options:
-h, --help display this help
-V, --version display version
-w <num>, --width <num>
maximum width of bit masks (default 8192)
-f, --fail-width fail if bit list contains values wider than width
libfdisk: recommend GPT on interactive terminals on EFI systems for an empty device
When running fdisk or sfdisk on a device without any partition label, on a terminal
(stdin) and on an EFI system, the function fdisk_get_recommended_labelname() suggests
the GPT disklabel; otherwise, it returns DOS, or SUN on SPARC.
--landlock-access and --landlock-rule accept colon-separated arguments,
which is difficult to generate completions for as Bash defaults to
splitting words on colon. This implementation takes inspiration from the
git's bash completion script and re-combines the words that were split
in this way before processing the rest of the options.
For example, `setpriv --landlock-access fs:execute<TAB>` is provided as
COMP_WORDS=('setpriv' '--landlock-access' 'fs' ':' 'execute'). The glue
code then constructs words=('setpriv' '--landlock-access' 'fs:execute'),
which is used to produce the completion.
Adds the --landlock-support option to query the current running kernel's
support for landlock. Also adds the --list-landlock-access and
--list-landlock-rights options which are used for implementing bash
completion (much like --list-caps).
setpriv: limit landlock-rule to access restrictions
When `--landlock-rule` is provided without an explicit list of
restrictions (ex. `--landlock-rule path-beneath::/`), setpriv would
treat this as if it was specifying all access restrictions. If the
`--landlock-access` argument only specified a limited set of
restrictions, then the call to landlock_add_rule would fail as setpriv
would attempt to allow an access pattern that wasn't being restricted.
Now, passing an empty list of access patterns is instead treated as "all
access restrictions that are enabled". So `setpriv --landlock-access
fs:execute --landlock-rule path-beneath::/usr -- true` will now be
treated as if `--landlock-rule path-beneath:execute:/usr` was provided.
The --landlock-rule option is used to allow operations through the
restriction introduced by a --landlock-access option. Specifying
--landlock-rule without specifying the corresponding --landlock-access
is always a user error, so produce an error message when that happens.
setpriv: use rules supported by the current kernel
When an empty filesystem access list is provided to --landlock-access or
to --landlock-rule, setpriv enables all access rules. This causes
errors when run on older kernel versions. Now when an explicit list is
not provided, setpriv will only use the access rules supported by the
running kernel version.
setpriv: replace landlock header with our own definitions
The version of Landlock that the current kernel supports may be
different from the version of the <linux/landlock.h> header from the
build machine. Instead of using the header, define the values used by
setpriv directly; unsupported options will be determined at runtime.
The configuration checks now use the presence of the __NR_landlock_*
macros to determine Landlock support.
tools: switch libeconf to runtime optional via dlopen
Replace direct libeconf linking with runtime dlopen() using the
shared dl-utils infrastructure. All tools that use libeconf functions
now call them through econf_call() macro and gracefully handle the
case when libeconf is not installed at runtime.
tools: switch libsystemd to runtime optional via dlopen
Replace direct libsystemd linking with runtime dlopen() using the
shared dl-utils infrastructure. All tools that use libsystemd functions
now call them through systemd_call() macro and gracefully handle the
case when libsystemd is not installed at runtime.
uuidd and logger when called for the systemd-specific functionality
will fail if the library is missing. Other tools will gracefully
degrade to systemd-less functionality.
The R (SHF_GNU_RETAIN) section flag is only understood by binutils >= 2.36.
Detect it at compile time. When not available, the ELF note section
might be duplicated. Parsing tools can deal with it, so it's better than
failing the build.
Karel Zak [Wed, 29 Jul 2026 11:06:05 +0000 (13:06 +0200)]
Merge branch 'lsfd/fix-bpf-map' of https://github.com/echoechoin/util-linux
* 'lsfd/fix-bpf-map' of https://github.com/echoechoin/util-linux:
tests: (lsfd) add mapped-bpf-map test case
test: (mkfds::mapped-bpf-map) new factory
lsfd: improve bpf-map display when fdinfo is not available
Karel Zak [Tue, 28 Jul 2026 12:57:52 +0000 (14:57 +0200)]
agetty: move man page to agetty-cmd/
The agetty source was moved to agetty-cmd/ but the man page
agetty.8.adoc was left behind in term-utils/. Move it to agetty-cmd/
and update references in meson.build, Makemodule.am, and po-man/po4a.cfg.
agetty: show default issue file when built without issue.d support
Commit d1cf7ef refactored the issue file handling to read the default
issue file (/etc/issue) together with the issue.d drop-in directory
through ul_configs_file_list(). That call was placed inside an
"#ifdef ISSUEDIR_SUPPORT" block, so on builds without issue.d support
(e.g. systems where scandirat()/openat() are unavailable, such as musl
libc) the default issue file was no longer read at all.
As a result `agetty --show-issue` and the login prompt printed nothing
on such builds unless --issue-file was given, regressing the long-standing
behaviour of displaying /etc/issue.
ul_configs_file_list() returns the main issue file even when drop-in
directory support is unavailable (it skips the drop-in scan but still
locates the main configuration file), so move the call out from under
ISSUEDIR_SUPPORT and include configs.h unconditionally. The drop-in
directory scanning itself still requires ISSUEDIR_SUPPORT, which is
unchanged.
[kzak: removed github issue URL from in-code comment]
Karel Zak [Tue, 28 Jul 2026 12:16:31 +0000 (14:16 +0200)]
pty-session: defer raw mode until after signals are blocked
ul_pty_setup() switches the user's terminal to raw mode before
ul_pty_signals_setup() blocks signals. A terminating signal delivered
in this window kills the process without reaching ul_pty_cleanup(),
leaving the terminal in raw mode.
Move the raw-mode tcsetattr() out of ul_pty_setup() into a new
ul_pty_terminal_setup() function, to be called after
ul_pty_signals_setup(). This ensures signals are already directed
to signalfd when raw mode is activated, closing the race window.
The setup sequence is now:
ul_pty_setup() -- open pty, save terminal attrs
<app-specific work> -- e.g. utempter (needs SIGCHLD unblocked)
ul_pty_signals_setup() -- block signals, create signalfd
ul_pty_terminal_setup() -- set raw mode (signals already blocked)
fork()
Addresses: https://github.com/util-linux/util-linux/issues/4499 Signed-off-by: Karel Zak <kzak@redhat.com>
fdisk: fix -t/--type when auto-creating a label on empty devices
fdisk_create_disklabel(cxt, NULL) always resolves to "dos" or "sun",
regardless of any restriction set via -t/--type. If -t disabled "dos"
(like in -t gpt) auto-creation on an empty device fails with -EINVAL.
As the return code was never checked, the failure was silent,
thus no label got created and no error was shown.
The requested label via -t is now passed to the auto-create call,
which warns if creation still fails.
There is no behavior change when -t is not used in the program.
ul_pty_signals_setup() subscribes to SIGALRM through the signalfd set,
but handle_signal() has no case for it, so a SIGALRM delivered to the
proxy (e.g. an alarm(2) timer armed before execve(), or an external
"kill -ALRM") falls through to "default: abort()".
The abort() terminates script/su --pty/runuser --pty with SIGABRT before
ul_pty_cleanup() runs, leaving the user's terminal in raw mode (no echo,
no canonical mode, no signal generation) until "stty sane" is run.
Treat SIGALRM like the other terminating signals (SIGHUP/SIGTERM/SIGINT/
SIGQUIT): record it in delivered_signal and forward SIGTERM to the child
so the proxy leaves its poll() loop through the normal path and
ul_pty_cleanup() restores the saved terminal settings. The default
disposition of SIGALRM is termination, so this preserves the previous
outcome while adding the cleanup.
None of script, su --pty or runuser --pty arms SIGALRM internally on this
code path.
This addresses the deterministic SIGALRM path reported in #4499. The
separate, much narrower window where a terminating signal arrives
between ul_pty_setup() (raw mode on) and ul_pty_signals_setup() (signals
blocked) is not addressed here; closing it requires reworking the signal
mask contract between those two calls.
fdisk: derive first usable LBA from the real primary entries location
fdisk_gpt_set_npartitions() (the expert "change table length" command)
computed the first usable LBA with gpt_calculate_first_lba(), which
assumes the primary partition entries array is at the default LBA 2. The
primary entries array is not relocated when the table length changes, so
on a GPT whose primary entries are not at the default location the usable
area ended up overlapping the entries array and a partition could be
created on top of it.
Derive the first usable LBA from the actual on-disk location of the
primary entries array (pheader->partition_entry_lba) instead. The backup
entries array is recalculated to the default end-of-device location by
gpt_mknew_header_common(), so gpt_calculate_last_lba() is still based on
the default layout and is left unchanged.
Add a regression test that relocates the primary entries array to a
non-default LBA and checks the first usable LBA after a "change table
length" operation.
Karel Zak [Thu, 23 Jul 2026 08:05:31 +0000 (10:05 +0200)]
Merge branch 'lsfd/bpf-link' of https://github.com/echoechoin/util-linux
* 'lsfd/bpf-link' of https://github.com/echoechoin/util-linux:
test: (lsfd) add a case for testing bpf-link related columns
test: (mkfds::bpf-link) new factory
lsfd: add configure check for BPF_LINK_CREATE
lsfd: introduce bpf-link anon-inode support
replay_get_next_step() divided the tv_sec and tv_usec fields of the
recorded delay by the divisor independently. Both fields are integers, so
the fractional part of the whole-seconds field was discarded instead of
being carried into microseconds. Replaying a 1.000000 s delay with
--divisor 2 therefore produced a 0.000000 s delay (the next step was
emitted immediately) instead of the expected 0.500000 s, and the error
could approach one second per step and accumulate across recordings with
multiple pauses.
Scale the complete duration once in microseconds, then split the result
back into seconds and microseconds so the fractional whole-seconds part is
preserved. This affects both scriptreplay and scriptlive, which share the
helper.
Add a "divisor-fractional" subtest to tests/ts/script/replay that verifies
a 1.000000 s delay scaled by --divisor 2 takes about half a second rather
than collapsing to zero.
pg: fix out-of-bounds access past wbuf on a trailing tab
endline_for_mb() and its single-byte twin endline() advance the scan
pointer twice when the last character of a buffer-filling line is a tab
(once in the tab branch, once via the shared *++p) with no terminator
re-check in between. A full line (wl == READBUF-1) ending in a tab makes
*++p read wbuf[READBUF] and the following *end = L'\0' write it -- one
element past the wbuf[READBUF] array.
Re-check for the terminator before the second advance.
more: fix out-of-bounds write in get_line() on invalid multibyte input
In get_line(), the invalid-multibyte switch arm (case (size_t)-1) writes
*p++ = mbc[0] without the bounds check that its sibling write paths use,
and the "goto process_mbc" back-edge lets it re-run within one loop
iteration, bypassing the loop-head guard. A line that first fills line_buf
with zero-width combining characters (which advance p but not column) and
then supplies an invalid multibyte sequence can step p past the
num_columns*4 + 2 byte allocation -- a heap out-of-bounds write.
Guard the write the same way the sibling path does.
Karel Zak [Mon, 20 Jul 2026 08:40:00 +0000 (10:40 +0200)]
Merge branch 'PR/libmount-vfs' of https://github.com/karelzak/util-linux-work
* 'PR/libmount-vfs' of https://github.com/karelzak/util-linux-work:
docs: add VFS symbols to libmount-sections.txt
tests: add libmount VFS test
libmount: add VFS test to test_mount_context
libmount: add pluggable VFS I/O support
Karel Zak [Wed, 15 Jul 2026 10:46:06 +0000 (12:46 +0200)]
libmount: add VFS test to test_mount_context
Add --vfs test that exercises the pluggable VFS I/O operations with
three sub-options:
--table <file> parse a mount table through VFS fopen
--cache <dev> probe device via cache (udev, then blkid)
--blkid <dev> probe device directly via libblkid VFS
The test sets up VFS callbacks that wrap standard syscalls and report
call counts, verifying that I/O is routed through the pluggable layer.
Karel Zak [Wed, 15 Jul 2026 10:21:29 +0000 (12:21 +0200)]
libmount: add pluggable VFS I/O support
Add three new public APIs for pluggable VFS I/O operations:
- mnt_context_set_vfs(cxt, ops) -- set VFS on mount context (owned copy)
- mnt_cache_refer_vfs(cache, vfs) -- set VFS reference on cache (borrowed)
- mnt_table_refer_vfs(tb, vfs) -- set VFS reference on table (borrowed)
The VFS operations are automatically propagated from the context to its
cache and tables when they are created or set.
Convert blkid probe calls in cache.c (read_from_blkid, fstype_from_blkid)
from blkid_new_probe_from_filename() to the VFS-aware 3-step pattern:
blkid_new_probe() + blkid_probe_set_vfs() + blkid_probe_open_device().
Convert mnt_table_parse_file() to use ul_vfs_fopen() for VFS-aware
file opening.
Karel Zak [Wed, 15 Jul 2026 11:19:37 +0000 (13:19 +0200)]
Merge branch 'PR/dl-utils' of https://github.com/karelzak/util-linux-work
* 'PR/dl-utils' of https://github.com/karelzak/util-linux-work:
tools: switch SELinux to runtime optional via dlopen
libmount: use shared dl-utils for SELinux dlopen
libmount: fix -Wunterminated-string-initialization warning
libmount: use shared dl-utils for cryptsetup dlopen
lib/dl-utils: add shared dlopen/dlsym infrastructure
Karel Zak [Tue, 14 Jul 2026 12:48:39 +0000 (14:48 +0200)]
docs: findmnt: clarify that --target returns one filesystem
The --target option identifies the filesystem for a given path, and a
file always resides on exactly one filesystem. Document that --target
returns at most one entry and skips over-mounted entries.
Addresses: https://github.com/util-linux/util-linux/issues/4424 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Mon, 13 Jul 2026 14:28:43 +0000 (16:28 +0200)]
tools: switch SELinux to runtime optional via dlopen
Replace direct libselinux linking with runtime dlopen() using the
shared dl-utils infrastructure. All tools that use SELinux functions
now call them through selinux_call() macro and gracefully handle the
case when libselinux is not installed at runtime.
Karel Zak [Mon, 13 Jul 2026 14:18:29 +0000 (16:18 +0200)]
libmount: use shared dl-utils for SELinux dlopen
Add lib/dl-selinux.c and include/dl-selinux.h as a SELinux dlopen
wrapper using the shared dl-utils infrastructure. This replaces the
direct libselinux linking with runtime dlopen(), allowing libmount to
gracefully handle the case when libselinux is not installed.
The hook_selinux.c and lib/selinux-utils.c now use selinux_call()
macro to call SELinux functions through the dlopen'd function pointer
table.
The "xx\0" string literal is 4 bytes but buf is only 3, truncating
the NUL terminator. Since the buffer is immediately overwritten by
memcpy, just zero-initialize it instead.
Karel Zak [Mon, 13 Jul 2026 13:42:14 +0000 (15:42 +0200)]
libmount: use shared dl-utils for cryptsetup dlopen
Move the cryptsetup dlopen wrapper out of hook_veritydev.c into
lib/dl-cryptsetup.c with a global cached load function
ul_dlopen_libcryptsetup(). The function pointers are resolved once
and shared across all callers.
This removes the CRYPTSETUP_VIA_DLOPEN conditional -- dlopen is now the
only supported way to use libcryptsetup. The library is never linked
directly.
An ELF .note.dlopen metadata note is emitted so that packaging tools
can automatically derive the optional runtime dependency.
Also fix the CFLAGS order in libmount Makemodule.am to ensure local
include paths (-I for blkid, libmount) come before external pkg-config
flags that may pull in system headers.
projects / thirdparty / util-linux.git / log
