summaryrefslogtreecommitdiff
path: root/src/partition
Commit message (Collapse)AuthorAgeFilesLines
* dissect-image: port mount_image_privately_interactively() to use ↵Lennart Poettering2023-05-161-1/+1
| | | | | | | | | | /run/systemd/mount-rootfs/ too Let's use the same common directory as the unit logic uses. This means we have less to clean up, and opens the door to eventually allow unprivileged operation of the mount_image_privately_interactively() logic.
* repart: Make sure we look up dropin files in the root directoryDaan De Meyer2023-05-121-1/+1
|
* conf-parser: Add root argument to config_parse_many()Daan De Meyer2023-05-121-0/+1
|
* repart: Make sure r is declared lastDaan De Meyer2023-05-121-1/+1
|
* repart: Read arguments directly instead of passing them inDaan De Meyer2023-05-121-8/+4
|
* mkfs-util: Add quiet argument to make_filesystem()Daan De Meyer2023-05-122-4/+13
| | | | | | | | We default to quiet operation everywhere except for repart, where we disable quiet and have the mkfs tools write to stdout. We also make sure --quiet or equivalent is implemented for all mkfs tools.
* repart: Fix deny list logicDaan De Meyer2023-05-101-91/+129
| | | | | | | | | | | | | | | | | | | | | | Until now, we always excluded the top level directories that were covered by child partition mount points, regardless of the source directory and the target directory of the copy files operation. This means that even if we were populating a XBOOTLDR partition, if there was an EFI partition in the image, we'd exclude /boot unconditionally, leading to the XBOOTLDR partition to be empty. Also, because of the same cause, if we were copying a nested source directory (e.g. /abc/def) to the root directory in the root partition, if /abc/def/usr existed and was populated with files and directories, the root partition would have those files under /usr, even if a /usr partition was defined. To fix these issues, instead of unconditionally excluding the top level partition mount points under <source>, let's make sure that when we're copying files from any source directory to the root directory of a root partition, that we exclude the partition mount point directories under the source directory instead of the top level ones.
* repart: Add Minimize= support for verity hash partitionsDaan De Meyer2023-04-261-9/+91
| | | | Fixes #27414
* repart: Extend error logging for format_verity_hash/sig()Daan De Meyer2023-04-261-12/+17
|
* repart: Allow passing target to format_verity_hash()Daan De Meyer2023-04-261-9/+16
| | | | | Let's allow specifying where the verity hash data should be written as preparation for adding verity hash partition minimize support.
* repart: Move partition_defer() out of format_verity_hash/sig()Daan De Meyer2023-04-261-10/+4
| | | | | To allow re-using format_verity_hash() for minimizing verity hash partitions.
* repart: Turn condition into assertDaan De Meyer2023-04-261-3/+1
| | | | | format_verity_hash() should only be called with VERITY_HASH type partitions, so assert() if that's not the case.
* image-policy: introduce parse_image_policy_argument() helperYu Watanabe2023-04-131-14/+8
| | | | | | | | | Addresses https://github.com/systemd/systemd/pull/25608/commits/84be0c710d9d562f6d2cf986cc2a8ff4c98a138b#r1060130312, https://github.com/systemd/systemd/pull/25608/commits/84be0c710d9d562f6d2cf986cc2a8ff4c98a138b#r1067927293, and https://github.com/systemd/systemd/pull/25608/commits/84be0c710d9d562f6d2cf986cc2a8ff4c98a138b#r1067926416. Follow-up for 84be0c710d9d562f6d2cf986cc2a8ff4c98a138b.
* repart: Discard from/to first/last usable lbaSjoerd Simons2023-04-131-2/+6
| | | | | | | | | | | | | | | | Repart considers the start and end of the usable space to the first multiple of grainsz (at least 4096 bytes). However the first usable LBA of a GPT partition is at sector 34 (512 bytes sectors) which is not a multiple of 4096. The backup GPT label at the end also takes up 33 sectors, meaning the last usable LBA is at 34 sectors from the end, unlikely to be a 4096 multiple as well. This meant that the very first and last sectors were never discarded. However more problematically if an existing partition started before the first usable grainsz multiple its start didn't get taken into account as a valid starting point and got its data discarded. Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>
* repart: always take BSD lock when whole block device is openedYu Watanabe2023-04-131-15/+40
| | | | Fixes #27236.
* Merge pull request #25608 from poettering/dissect-moarLennart Poettering2023-04-121-0/+20
|\ | | | | dissect: add dissection policies
| * tree-wide: hook up image dissection policy logic everywhereLennart Poettering2023-04-051-0/+20
| |
* | repart: Add more loggingDaan De Meyer2023-04-061-2/+23
|/
* repart: use id128_get_machine()Yu Watanabe2023-04-051-16/+6
| | | | | This also makes that the seed is actually randomized when the read machine ID is NULL.
* tpm2: add support for a trusted SRKWilliam Roberts2023-04-031-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prevent attackers from spoofing the tpmKey portion of the AuthSession by adding a trusted key to the LUKS header metadata. Also, use a persistent object rather than a transient object. This provides the following benifits: 1. No way to MITM the tpmKey portion of the session, see [1] for details. 2. Strengthens the encrypted sessions, note that the bindKey could be dropped now. 3. Speed, once it's created we just use it. 4. Owner Auth is needed to call create primary, so using the SRK creates a scratch space for normal users. This is a "first to set" model, in where the first person to set the key in the LUKS header wins. Thus, setup should be done in a known good state. If an SRK, which is a primary key at a special persistent address, is found, it will use whatever is there. If not, it creates an SRK. The SRK follows the convetions used through the tpm2-software organization code on GitHub [2], however, a split has occured between Windows and Linux with respect to SRK templates. The Linux SRK is generated with the unique field size set to 0, in Windows, it properly sets the size to key size in bytes and the unique data to all 0's of that size. Note the proper templates for SRKs is covered in spec [3]. However, the most important thing, is that both SRKs are passwordless, and thus they should be interchangable. If Windows is the first to make the SRK, systemd will gladly accept it and vice-versa. 1. Without the bindKey being utilized, an attacker was able to intercept this and fake a key, thus being able to decrypt and encrypt traffic as needed. Introduction of the bindKey strengthened this, but allows for the attacker to brute force AES128CFB using pin guesses. Introduction of the salt increases the difficulty of this attack as well as DA attacks on the TPM objects itself. 2. https://github.com/tpm2-software 3. https://trustedcomputinggroup.org/wp-content/uploads/TCG-TPM-v2.0-Provisioning-Guidance-Published-v1r1.pdf Fixes: #20668 Fixes: #22637 Signed-off-by: William Roberts <william.c.roberts@intel.com>
* chase-symlinks: Rename chase_symlinks() to chase()Daan De Meyer2023-03-241-11/+11
| | | | | | | | | Chasing symlinks is a core function that's used in a lot of places so it deservers a less verbose names so let's rename it to chase() and chaseat(). We also slightly change the pattern used for the chaseat() helpers so we get chase_and_openat() and similar.
* repart: Report better errors if partition sizes are too smallDaan De Meyer2023-03-161-1/+22
|
* repart: Zero full verity signature partition sizeDaan De Meyer2023-03-161-7/+4
| | | | | systemd-dissect requires the entirety of the partition following the signature to be zeroed, so let's do just that.
* repart: Make sure we seek to beginning of partition target before copyDaan De Meyer2023-03-161-0/+3
|
* chase-symlinks: Remove unused ret_fd argumentsDaan De Meyer2023-03-141-1/+1
|
* src: Fixup copy-paste error for terminal_urlify_manMorten Linderud2023-03-101-1/+1
| | | | Signed-off-by: Morten Linderud <morten@linderud.pw>
* repart: Add support for reading mkfs options from environmentDaan De Meyer2023-03-101-3/+17
|
* repart: Exclude APIVFS mountpoint directoriesDaan De Meyer2023-02-221-0/+6
| | | | | Also exclude APIVFS and temporary files directories from the copy operation so that these files don't accidentally end up in images.
* copy: Support both inode exclusion and contents exclusionDaan De Meyer2023-02-221-12/+15
| | | | | | | | | | | | In some cases, we want to exclude a directory's contents but not the directory itself. In other cases, we want to exclude a directory and its contents. Let's extend the denylist logic in copy.h to support both by changing the denylist from a set to hashmap so we can store the deny type as the value. We also modify the repart ExcludeFiles= option to make use of this. If a directory to exclude ends with a "/", we'll only exclude its contents. Otherwise, we'll exclude the full directory.
* repart: Refactor make_copy_files_denylist() a bitDaan De Meyer2023-02-221-37/+35
|
* Merge pull request #26437 from DaanDeMeyer/repart-excludeDaan De Meyer2023-02-201-39/+104
|\ | | | | repart: Add ExcludeFiles= option
| * repart: Add ExcludeFiles= optionDaan De Meyer2023-02-201-37/+102
| |
| * repart: Make config_parse_copy_files() more genericDaan De Meyer2023-02-161-3/+3
| |
* | dissect-image: Return mount point fd if requestedDaan De Meyer2023-02-171-0/+1
|/
* repart: Remove outdated commentDaan De Meyer2023-02-141-4/+0
|
* repart: Initialize root directory metadata correctlyDaan De Meyer2023-02-141-0/+25
| | | | | Let's make sure we copy the root directory metadata from an appropriate source directory.
* repart: Create temporary root directory using var_tmp_dir()Daan De Meyer2023-02-141-6/+11
| | | | | This allows users to override the directory used with environment variables.
* copy: Make copy_xattr() more genericDaan De Meyer2023-02-141-1/+1
| | | | | Let's make copy_xattr() a little more generic in preparation for copying symlink xattrs.
* repart: silence bogus gcc warningZbigniew Jędrzejewski-Szmek2023-02-061-1/+2
| | | | | | | | | | | | | | | | [2/3] Compiling C object systemd-repart.p/src_partition_repart.c.o ../src/partition/repart.c: In function ‘context_open_copy_block_paths’: ../src/partition/repart.c:5194:41: warning: ‘devno’ may be used uninitialized [-Wmaybe-uninitialized] 5194 | source_fd = r = device_open_from_devnum(S_IFBLK, devno, O_RDONLY|O_CLOEXEC|O_NONBLOCK, &opened); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../src/partition/repart.c:5188:31: note: ‘devno’ was declared here 5188 | dev_t devno; | ^~~~~ This is with gcc-13.0.1-0.2.fc38.x86_64, -O2. I'm pretty sure the code is correct. I also tried adding some asserts where errno is used for the return value, but that didn't help. I think resolve_copy_blocks_auto() is just too long for gcc to understand.
* repart: fix invalid errno in logZbigniew Jędrzejewski-Szmek2023-02-061-1/+1
|
* id128: introduce ERRNO_IS_MACHINE_ID_UNSET() helper macroLennart Poettering2023-02-011-3/+5
|
* repart: Add roothash to output of all verity siblingsDaan De Meyer2023-01-251-2/+4
| | | | | This can be used to match verity partitions together using the repart JSON output.
* partition: fix build with newer linux/btrfs.h uapi headerFrantisek Sumsal2023-01-251-1/+6
| | | | | | | | | | | | | | | | | | | | linux/btrfs.h needs to be included after sys/mount.h, as since [0] linux/btrfs.h includes linux/fs.h causing build errors: ``` In file included from /usr/include/linux/fs.h:19, from ../src/basic/linux/btrfs.h:29, from ../src/partition/growfs.c:6: /usr/include/sys/mount.h:35:3: error: expected identifier before numeric constant 35 | MS_RDONLY = 1, /* Mount read-only. */ | ^~~~~~~~~ [1222/2169] Compiling C object systemd-creds.p/src_creds_creds.c.o ninja: build stopped: subcommand failed. ``` See: https://github.com/systemd/systemd/issues/8507 [0] https://github.com/torvalds/linux/commit/a28135303a669917002f569aecebd5758263e4aa
* Revert "repart: Ensure files end up owned by root in generated filesystems"Daan De Meyer2023-01-231-4/+3
| | | | | | | | | | | This reverts commit e59678b2cf42e4206ddabc959d3cf9a5a865ecdc. We also modify the repart integration tests to make them pass with the changes in this commit. In short, we have to make sure every file is owned by the user executing repart. We use tee instead of cat since it makes that easier. This also has the benefit of improving debugability as seeing the config file contents on stdout makes it easier to know which test is failing.
* Revert "repart: Make sure all files in the image are owned by root"Daan De Meyer2023-01-231-17/+9
| | | | This reverts commit d2ac7698cb43807a2dd0af727599db486180ebf1.
* tpm2: add salt to pinWilliam Roberts2023-01-181-0/+1
| | | | | | | | | | Add a salt to the pin and store it in the TPM2 LUKS header for future this. This adds entropy to user supplied pins and helps brute forcing the passphrase on the key residing in the TPM or brute forcing bind key encrypted sessions with low entropy passphrases. Signed-off-by: malikabhi05 <abhishek.malik@intel.com> Signed-off-by: William Roberts <william.c.roberts@intel.com>
* repart: auto-probe sector size when not specifiedLennart Poettering2023-01-181-3/+17
|
* homework: when creating/resizing GPT partitions, also set sector size explicitlyLennart Poettering2023-01-181-6/+9
|
* repart: Allow configuring sector sizeDaan De Meyer2023-01-172-13/+32
| | | | | | Let's allow users to configure the (logical) sector size of their image. This is required when building images for a 4k sector size disk on a 512b sector size host or vice-versa.
* tree-wide: fix return value handling of base64mem()Lennart Poettering2023-01-111-4/+5
| | | | | | | | | | | This returns an ssize_t, not an int. On populare archs that's the difference between 64bit and 32bit. hence, let's be more careful here, and not silently drop half the bits on the ground by assigning the return value to "int". As noticed by @malikabhi05: https://github.com/systemd/systemd/pull/24754#discussion_r1062903159
View Lorry Controller Status