summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2016-09-28Merge pull request #4185 from endocode/djalal-sandbox-first-protection-v1Evgeny Vereshchagin
core:sandbox: Add new ProtectKernelTunables=, ProtectControlGroups=, ProtectSystem=strict and fixes
2016-09-27Merge pull request #4220 from keszybz/show-and-formatting-fixesMartin Pitt
Show and formatting fixes
2016-09-27basic: fix for IPv6 status (#4224)Susant Sahani
Even if ``` cat /proc/sys/net/ipv6/conf/all/disable_ipv6 1 ``` is disabled cat /proc/net/sockstat6 ``` TCP6: inuse 2 UDP6: inuse 1 UDPLITE6: inuse 0 RAW6: inuse 0 FRAG6: inuse 0 memory 0 ``` Looking for /proc/net/if_inet6 is the right choice.
2016-09-27test: make sure that {readonly|inaccessible|readwrite}paths disconnect mount ↵Djalal Harouni
propagation Better safe.
2016-09-27test: add tests for simple ReadOnlyPaths= caseDjalal Harouni
2016-09-26test-bus-creds: are more debugging infoZbigniew Jędrzejewski-Szmek
This test sometimes fails in semaphore, but not when run interactively, so it's hard to debug.
2016-09-26udev/path_id: introduce support for NVMe devices (#4169)Keith Busch
This appends the nvme name and namespace identifier attribute the the PCI path for by-path links. Symlinks like the following are now present: lrwxrwxrwx. 1 root root 13 Sep 16 12:12 pci-0000:01:00.0-nvme-1 -> ../../nvme0n1 lrwxrwxrwx. 1 root root 15 Sep 16 12:12 pci-0000:01:00.0-nvme-1-part1 -> ../../nvme0n1p1 Cc: Michal Sekletar <sekletar.m@gmail.com> Signed-off-by: Keith Busch <keith.busch@intel.com>
2016-09-26core: Fix USB functionfs activation and clarify its documentation (#4188)Paweł Szewczyk
There was no certainty about how the path in service file should look like for usb functionfs activation. Because of this it was treated differently in different places, which made this feature unusable. This patch fixes the path to be the *mount directory* of functionfs, not ep0 file path and clarifies in the documentation that ListenUSBFunction should be the location of functionfs mount point, not ep0 file itself.
2016-09-26machinectl: prefer user@ to --uid=user for shell (#4006)Zbigniew Jędrzejewski-Szmek
It seems to me that the explicit positional argument should have higher priority than "an option".
2016-09-26journald,ratelimit: fix wrong calculation of burst_modulate() (#4218)HATAYAMA Daisuke
This patch fixes wrong calculation of burst_modulate(), which now calculates the values smaller than really expected ones if available disk space is strictly more than 1MB. In particular, if available disk space is strictly more than 1MB and strictly less than 16MB, the resulted value becomes smaller than its original one. >>> (math.log2(1*1024**2)-16) / 4 1.0 >>> (math.log2(16*1024**2)-16) / 4 2.0 >>> (math.log2(256*1024**2)-16) / 4 3.0 → This matches the comment in the function.
2016-09-26coredump: initialize coredump_size in submit_coredump() (#4219)Matej Habrnal
If ulimit is smaller than page_size(), function save_external_coredump() returns -EBADSLT and this causes skipping whole core dumping part in submit_coredump(). Initializing coredump_size to UINT64_MAX prevents evaluating a condition with uninitialized varialbe which leads to calling allocate_journal_field() with coredump_fd = -1 which causes aborting. Signed-off-by: Matej Habrnal <mhabrnal@redhat.com>
2016-09-26treewide: fix typos (#4217)Torstein Husebø
2016-09-25test: add CAP_MKNOD tests for PrivateDevices=Djalal Harouni
2016-09-25core: Use @raw-io syscall group to filter I/O syscalls when PrivateDevices= ↵Djalal Harouni
is set Instead of having a local syscall list, use the @raw-io group which contains the same set of syscalls to filter.
2016-09-25core:namespace: simplify ProtectHome= implementationDjalal Harouni
As with previous patch simplify ProtectHome and don't care about duplicates, they will be sorted by most restrictive mode and cleaned.
2016-09-25core: simplify ProtectSystem= implementationDjalal Harouni
ProtectSystem= with all its different modes and other options like PrivateDevices= + ProtectKernelTunables= + ProtectHome= are orthogonal, however currently it's a bit hard to parse that from the implementation view. Simplify it by giving each mode its own table with all paths and references to other Protect options. With this change some entries are duplicated, but we do not care since duplicate mounts are first sorted by the most restrictive mode then cleaned.
2016-09-25core:sandbox: add more /proc/* entries to ProtectKernelTunables=Djalal Harouni
Make ALSA entries, latency interface, mtrr, apm/acpi, suspend interface, filesystems configuration and IRQ tuning readonly. Most of these interfaces now days should be in /sys but they are still available through /proc, so just protect them. This patch does not touch /proc/net/...
2016-09-25core:namespace: simplify mount calculationDjalal Harouni
Move out mount calculation on its own function. Actually the logic is smart enough to later drop nop and duplicates mounts, this change improves code readability. --- src/core/namespace.c | 47 ++++++++++++++++++++++++++++++++++++----------- 1 file changed, 36 insertions(+), 11 deletions(-)
2016-09-25core:namespace: put paths protected by ProtectKernelTunables= inDjalal Harouni
Instead of having all these paths everywhere, put the ones that are protected by ProtectKernelTunables= into their own table. This way it is easy to add paths and track which ones are protected.
2016-09-25core:namespace: minor improvements to append_mounts()Djalal Harouni
2016-09-25execute: move SMACK setup code into its own functionLennart Poettering
While we are at it, move PAM code #ifdeffery into setup_pam() to simplify the main execution logic a bit.
2016-09-25namespace: drop all mounts outside of the new root directoryLennart Poettering
There's no point in mounting these, if they are outside of the root directory we'll move to.
2016-09-25main: minor simplificationLennart Poettering
2016-09-25execute: filter low-level I/O syscalls if PrivateDevices= is setLennart Poettering
If device access is restricted via PrivateDevices=, let's also block the various low-level I/O syscalls at the same time, so that we know that the minimal set of devices in our virtualized /dev are really everything the unit can access.
2016-09-25namespace: don't make the root directory of a namespace a mount if it ↵Lennart Poettering
already is one Let's not stack mounts needlessly.
2016-09-25namespace: chase symlinks for mounts to set up in userspaceLennart Poettering
This adds logic to chase symlinks for all mount points that shall be created in a namespace environment in userspace, instead of leaving this to the kernel. This has the advantage that we can correctly handle absolute symlinks that shall be taken relative to a specific root directory. Moreover, we can properly handle mounts created on symlinked files or directories as we can merge their mounts as necessary. (This also drops the "done" flag in the namespace logic, which was never actually working, but was supposed to permit a partial rollback of the namespace logic, which however is only mildly useful as it wasn't clear in which case it would or would not be able to roll back.) Fixes: #3867
2016-09-25namespace: invoke unshare() only after checking all parametersLennart Poettering
Let's create the new namespace only after we validated and processed all parameters, right before we start with actually mounting things. This way, the window where we can roll back is larger (not that it matters IRL...)
2016-09-25execute: drop group priviliges only after setting up namespaceLennart Poettering
If PrivateDevices=yes is set, the namespace code creates device nodes in /dev that should be owned by the host's root, hence let's make sure we set up the namespace before dropping group privileges.
2016-09-25nspawn: let's mount /proc/sysrq-trigger read-only by defaultLennart Poettering
LXC does this, and we should probably too. Better safe than sorry.
2016-09-25core: imply ProtectHome=read-only and ProtectSystem=strict if DynamicUser=1Lennart Poettering
Let's make sure that services that use DynamicUser=1 cannot leave files in the file system should the system accidentally have a world-writable directory somewhere. This effectively ensures that directories need to be whitelisted rather than blacklisted for access when DynamicUser=1 is set.
2016-09-25core: introduce ProtectSystem=strictLennart Poettering
Let's tighten our sandbox a bit more: with this change ProtectSystem= gains a new setting "strict". If set, the entire directory tree of the system is mounted read-only, but the API file systems /proc, /dev, /sys are excluded (they may be managed with PrivateDevices= and ProtectKernelTunables=). Also, /home and /root are excluded as those are left for ProtectHome= to manage. In this mode, all "real" file systems (i.e. non-API file systems) are mounted read-only, and specific directories may only be excluded via ReadWriteDirectories=, thus implementing an effective whitelist instead of blacklist of writable directories. While we are at, also add /efi to the list of paths always affected by ProtectSystem=. This is a follow-up for b52a109ad38cd37b660ccd5394ff5c171a5e5355 which added /efi as alternative for /boot. Our namespacing logic should respect that too.
2016-09-25namespace: add some debug logging when enforcing InaccessiblePaths=Lennart Poettering
2016-09-25namespace: rework how ReadWritePaths= is appliedLennart Poettering
Previously, if ReadWritePaths= was nested inside a ReadOnlyPaths= specification, then we'd first recursively apply the ReadOnlyPaths= paths, and make everything below read-only, only in order to then flip the read-only bit again for the subdirs listed in ReadWritePaths= below it. This is not only ugly (as for the dirs in question we first turn on the RO bit, only to turn it off again immediately after), but also problematic in containers, where a container manager might have marked a set of dirs read-only and this code will undo this is ReadWritePaths= is set for any. With this patch behaviour in this regard is altered: ReadOnlyPaths= will not be applied to the children listed in ReadWritePaths= in the first place, so that we do not need to turn off the RO bit for those after all. This means that ReadWritePaths=/ReadOnlyPaths= may only be used to turn on the RO bit, but never to turn it off again. Or to say this differently: if some dirs are marked read-only via some external tool, then ReadWritePaths= will not undo it. This is not only the safer option, but also more in-line with what the man page currently claims: "Entries (files or directories) listed in ReadWritePaths= are accessible from within the namespace with the same access rights as from outside." To implement this change bind_remount_recursive() gained a new "blacklist" string list parameter, which when passed may contain subdirs that shall be excluded from the read-only mounting. A number of functions are updated to add more debug logging to make this more digestable.
2016-09-25namespace: when enforcing fs namespace restrictions suppress redundant mountsLennart Poettering
If /foo is marked to be read-only, and /foo/bar too, then the latter may be suppressed as it has no effect.
2016-09-25namespace: simplify mount_path_compare() a bitLennart Poettering
2016-09-25execute: if RuntimeDirectory= is set, it should be writableLennart Poettering
Implicitly make all dirs set with RuntimeDirectory= writable, as the concept otherwise makes no sense.
2016-09-25execute: move suppression of HOME=/ and SHELL=/bin/nologin into user-util.cLennart Poettering
This adds a new call get_user_creds_clean(), which is just like get_user_creds() but returns NULL in the home/shell parameters if they contain no useful information. This code previously lived in execute.c, but by generalizing this we can reuse it in run.c.
2016-09-25execute: split out creation of runtime dirs into its own functionsLennart Poettering
2016-09-25namespace: make sure InaccessibleDirectories= masks all mounts further downLennart Poettering
If a dir is marked to be inaccessible then everything below it should be masked by it.
2016-09-25core: add two new service settings ProtectKernelTunables= and ↵Lennart Poettering
ProtectControlGroups= If enabled, these will block write access to /sys, /proc/sys and /proc/sys/fs/cgroup.
2016-09-25core: enforce seccomp for secondary archs too, for all rulesLennart Poettering
Let's make sure that all our rules apply to all archs the local kernel supports.
2016-09-24journal-remote: fix error format stringZbigniew Jędrzejewski-Szmek
Bug introduced in 1b4cd64683.
2016-09-24systemctl: suppress errors with "show" for nonexistent units and propertiesZbigniew Jędrzejewski-Szmek
Show is documented to be program-parseable, and printing the warning about about a non-existent unit, while useful for humans, broke a lot of scripts. Restore previous behaviour of returning success and printing empty or useless stuff for units which do not exist, and printing empty values for properties which do not exists. With SYSTEMD_LOG_LEVEL=debug, hints are printed, but the return value is still 0. This undoes parts of e33a06a and 3dced37b7 and fixes #3856. We might consider adding an explicit switch to fail on missing units/properties (e.g. --ensure-exists or similar), and make -P foobar equivalent to --ensure-exists --property=foobar.
2016-09-24systemctl,networkctl,busctl,backlight: use STRPTR_IN_SETZbigniew Jędrzejewski-Szmek
2016-09-24basic/strv: add STRPTR_IN_SETZbigniew Jędrzejewski-Szmek
Also some trivial tests for STR_IN_SET and STRPTR_IN_SET.
2016-09-24systemctl: use STR_IN_SETZbigniew Jędrzejewski-Szmek
2016-09-24Merge pull request #4182 from jkoelker/routetableZbigniew Jędrzejewski-Szmek
2016-09-24networkd: do not drop config for pending interfaces (#4187)Martin Pitt
While an interface is still being processed by udev, it is in state "pending", instead of "unmanaged". We must not flush device configuration then. Further fixes commit 3104883ddc24 after commit c436d55397. Fixes #4186
2016-09-24kernel-install: allow plugins to terminate the procedure (#4174)Zbigniew Jędrzejewski-Szmek
Replaces #4103.
2016-09-24Merge pull request #4207 from fbuihuu/fix-journal-hmac-calculationZbigniew Jędrzejewski-Szmek
Fix journal hmac calculation.