From a62784f9f6415a89d5cf518c906aea6ecd2516cf Mon Sep 17 00:00:00 2001 From: Yangyang Shen Date: Mon, 11 May 2020 22:10:57 +0800 Subject: [PATCH 01/29] solve the build failure caused by the upgrade of libseccomp --- ...prehensive-protection-against-libsec.patch | 145 ++++++++++++++++++ systemd.spec | 9 +- 2 files changed, 153 insertions(+), 1 deletion(-) create mode 100644 seccomp-more-comprehensive-protection-against-libsec.patch diff --git a/seccomp-more-comprehensive-protection-against-libsec.patch b/seccomp-more-comprehensive-protection-against-libsec.patch new file mode 100644 index 0000000..8e28c85 --- /dev/null +++ b/seccomp-more-comprehensive-protection-against-libsec.patch @@ -0,0 +1,145 @@ +From 4df8fe8415eaf4abd5b93c3447452547c6ea9e5f Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Thu, 14 Nov 2019 17:51:30 +0100 +Subject: [PATCH] seccomp: more comprehensive protection against libseccomp's + __NR_xyz namespace invasion + +A follow-up for 59b657296a2fe104f112b91bbf9301724067cc81, adding the +same conditioning for all cases of our __NR_xyz use. + +Fixes: #14031 +--- + src/basic/missing_syscall.h | 10 +++++----- + src/test/test-seccomp.c | 19 ++++++++++--------- + 2 files changed, 15 insertions(+), 14 deletions(-) + +diff --git a/src/basic/missing_syscall.h b/src/basic/missing_syscall.h +index 6d9b125..1255d8b 100644 +--- a/src/basic/missing_syscall.h ++++ b/src/basic/missing_syscall.h +@@ -274,7 +274,7 @@ static inline int missing_renameat2(int oldfd, const char *oldname, int newfd, c + + #if !HAVE_KCMP + static inline int missing_kcmp(pid_t pid1, pid_t pid2, int type, unsigned long idx1, unsigned long idx2) { +-# ifdef __NR_kcmp ++# if defined __NR_kcmp && __NR_kcmp > 0 + return syscall(__NR_kcmp, pid1, pid2, type, idx1, idx2); + # else + errno = ENOSYS; +@@ -289,7 +289,7 @@ static inline int missing_kcmp(pid_t pid1, pid_t pid2, int type, unsigned long i + + #if !HAVE_KEYCTL + static inline long missing_keyctl(int cmd, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5) { +-# ifdef __NR_keyctl ++# if defined __NR_keyctl && __NR_keyctl > 0 + return syscall(__NR_keyctl, cmd, arg2, arg3, arg4, arg5); + # else + errno = ENOSYS; +@@ -300,7 +300,7 @@ static inline long missing_keyctl(int cmd, unsigned long arg2, unsigned long arg + } + + static inline key_serial_t missing_add_key(const char *type, const char *description, const void *payload, size_t plen, key_serial_t ringid) { +-# ifdef __NR_add_key ++# if defined __NR_add_key && __NR_add_key > 0 + return syscall(__NR_add_key, type, description, payload, plen, ringid); + # else + errno = ENOSYS; +@@ -311,7 +311,7 @@ static inline key_serial_t missing_add_key(const char *type, const char *descrip + } + + static inline key_serial_t missing_request_key(const char *type, const char *description, const char * callout_info, key_serial_t destringid) { +-# ifdef __NR_request_key ++# if defined __NR_request_key && __NR_request_key > 0 + return syscall(__NR_request_key, type, description, callout_info, destringid); + # else + errno = ENOSYS; +@@ -496,7 +496,7 @@ enum { + static inline long missing_set_mempolicy(int mode, const unsigned long *nodemask, + unsigned long maxnode) { + long i; +-# ifdef __NR_set_mempolicy ++# if defined __NR_set_mempolicy && __NR_set_mempolicy > 0 + i = syscall(__NR_set_mempolicy, mode, nodemask, maxnode); + # else + errno = ENOSYS; +diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c +index 018c20f..c669204 100644 +--- a/src/test/test-seccomp.c ++++ b/src/test/test-seccomp.c +@@ -28,7 +28,8 @@ + #include "tmpfile-util.h" + #include "virt.h" + +-#if SCMP_SYS(socket) < 0 || defined(__i386__) || defined(__s390x__) || defined(__s390__) ++/* __NR_socket may be invalid due to libseccomp */ ++#if !defined(__NR_socket) || __NR_socket <= 0 || defined(__i386__) || defined(__s390x__) || defined(__s390__) + /* On these archs, socket() is implemented via the socketcall() syscall multiplexer, + * and we can't restrict it hence via seccomp. */ + # define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 1 +@@ -304,14 +305,14 @@ static void test_protect_sysctl(void) { + assert_se(pid >= 0); + + if (pid == 0) { +-#if __NR__sysctl > 0 ++#if defined __NR__sysctl && __NR__sysctl > 0 + assert_se(syscall(__NR__sysctl, NULL) < 0); + assert_se(errno == EFAULT); + #endif + + assert_se(seccomp_protect_sysctl() >= 0); + +-#if __NR__sysctl > 0 ++#if defined __NR__sysctl && __NR__sysctl > 0 + assert_se(syscall(__NR__sysctl, 0, 0, 0) < 0); + assert_se(errno == EPERM); + #endif +@@ -640,7 +641,7 @@ static void test_load_syscall_filter_set_raw(void) { + assert_se(poll(NULL, 0, 0) == 0); + + assert_se(s = hashmap_new(NULL)); +-#if SCMP_SYS(access) >= 0 ++#if defined __NR_access && __NR_access > 0 + assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_access + 1), INT_TO_PTR(-1)) >= 0); + #else + assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_faccessat + 1), INT_TO_PTR(-1)) >= 0); +@@ -656,7 +657,7 @@ static void test_load_syscall_filter_set_raw(void) { + s = hashmap_free(s); + + assert_se(s = hashmap_new(NULL)); +-#if SCMP_SYS(access) >= 0 ++#if defined __NR_access && __NR_access > 0 + assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_access + 1), INT_TO_PTR(EILSEQ)) >= 0); + #else + assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_faccessat + 1), INT_TO_PTR(EILSEQ)) >= 0); +@@ -672,7 +673,7 @@ static void test_load_syscall_filter_set_raw(void) { + s = hashmap_free(s); + + assert_se(s = hashmap_new(NULL)); +-#if SCMP_SYS(poll) >= 0 ++#if defined __NR_poll && __NR_poll > 0 + assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_poll + 1), INT_TO_PTR(-1)) >= 0); + #else + assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_ppoll + 1), INT_TO_PTR(-1)) >= 0); +@@ -689,7 +690,7 @@ static void test_load_syscall_filter_set_raw(void) { + s = hashmap_free(s); + + assert_se(s = hashmap_new(NULL)); +-#if SCMP_SYS(poll) >= 0 ++#if defined __NR_poll && __NR_poll > 0 + assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_poll + 1), INT_TO_PTR(EILSEQ)) >= 0); + #else + assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_ppoll + 1), INT_TO_PTR(EILSEQ)) >= 0); +@@ -767,8 +768,8 @@ static int real_open(const char *path, int flags, mode_t mode) { + * testing purposes that calls the real syscall, on architectures where SYS_open is defined. On + * other architectures, let's just fall back to the glibc call. */ + +-#ifdef SYS_open +- return (int) syscall(SYS_open, path, flags, mode); ++#if defined __NR_open && __NR_open > 0 ++ return (int) syscall(__NR_open, path, flags, mode); + #else + return open(path, flags, mode); + #endif +-- +1.8.3.1 + diff --git a/systemd.spec b/systemd.spec index 931a944..f2e9435 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 21 +Release: 22 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -85,6 +85,7 @@ Patch0036: revert-pid1-use-a-cache-for-all-unit-aliases.patch Patch0037: revert-shared-unit-file-add-a-function-to-validate-u.patch Patch0038: systemd-Fix-busctl-crash-on-aarch64-when-setting-out.patch +Patch0039: seccomp-more-comprehensive-protection-against-libsec.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1490,6 +1491,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Mon May 11 2020 openEuler Buildteam - 243-22 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:solve the build failure caused by the upgrade of libseccomp + * Mon Apr 27 2020 openEuler Buildteam - 243-21 - Type:enhancement - ID:NA -- Gitee From 163783835d1db1b98990acbe5e1aa375b1d80640 Mon Sep 17 00:00:00 2001 From: Yangyang Shen Date: Thu, 28 May 2020 11:27:23 +0800 Subject: [PATCH 02/29] add requirement of systemd to libs --- systemd.spec | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-) diff --git a/systemd.spec b/systemd.spec index f2e9435..8d7c993 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 22 +Release: 23 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -114,6 +114,7 @@ BuildRequires: python3-devel, python3-lxml, firewalld-filesystem, libseccomp-de BuildRequires: gnu-efi gnu-efi-devel BuildRequires: valgrind-devel, util-linux +Requires: %{name}-libs = %{version}-%{release} Requires(post): coreutils Requires(post): sed Requires(post): acl @@ -134,22 +135,8 @@ Obsoletes: systemd-sysv < 206 Obsoletes: %{name} < 229-5 Provides: systemd-sysv = 206 Conflicts: initscripts < 9.56.1 -Conflicts: fedora-release < 23-0.12 Recommends: %{name}-help -#libs -Obsoletes: libudev < 183 -Obsoletes: systemd < 185-4 -Conflicts: systemd < 185-4 -Obsoletes: systemd-compat-libs < 230 -Obsoletes: nss-myhostname < 0.4 -Provides: nss-myhostname = 0.4 -Provides: nss-myhostname%{_isa} = 0.4 -Requires(post): coreutils -Requires(post): sed -Requires(post): grep -Requires(post): /usr/bin/getent - Provides: %{name}-pam Provides: %{name}-rpm-config Obsoletes: %{name}-pam @@ -1491,6 +1478,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Thu May 28 2020 openEuler Buildteam - 243-23 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:add requirement of systemd to libs + * Mon May 11 2020 openEuler Buildteam - 243-22 - Type:enhancement - ID:NA -- Gitee From 2400efa839dfa7b7616773faa176a90180928d7c Mon Sep 17 00:00:00 2001 From: Yangyang Shen Date: Thu, 4 Jun 2020 21:29:56 +0800 Subject: [PATCH 03/29] fix double free in macsec_receive_channel_free() and fix crash in network L2TP --- network-L2TP-fix-crash.patch | 59 +++++++++++++++++++ ...le-free-in-macsec_receive_channel_fr.patch | 45 ++++++++++++++ systemd.spec | 11 +++- 3 files changed, 114 insertions(+), 1 deletion(-) create mode 100644 network-L2TP-fix-crash.patch create mode 100644 network-fix-double-free-in-macsec_receive_channel_fr.patch diff --git a/network-L2TP-fix-crash.patch b/network-L2TP-fix-crash.patch new file mode 100644 index 0000000..d3cd0e9 --- /dev/null +++ b/network-L2TP-fix-crash.patch @@ -0,0 +1,59 @@ +From a1422af564e3b1128fc7754596b4c2f8b36a4620 Mon Sep 17 00:00:00 2001 +From: Susant Sahani +Date: Sat, 30 May 2020 06:35:28 +0200 +Subject: [PATCH] network: L2TP fix crash + +``` +=220358== Invalid read of size 8 +==220358== at 0x452F05: l2tp_session_free (l2tp-tunnel.c:46) +==220358== by 0x456926: l2tp_tunnel_done (l2tp-tunnel.c:725) +==220358== by 0x43CF4D: netdev_free (netdev.c:205) +==220358== by 0x43D045: netdev_unref (netdev.c:210) +==220358== by 0x4198B7: manager_free (networkd-manager.c:1877) +==220358== by 0x40D0B3: manager_freep (networkd-manager.h:105) +==220358== by 0x40DE1C: run (networkd.c:21) +==220358== by 0x40DE75: main (networkd.c:130) +==220358== Address 0x5c035d0 is 0 bytes inside a block of size 40 free'd +==220358== at 0x483A9F5: free (vg_replace_malloc.c:538) +==220358== by 0x452F87: l2tp_session_free (l2tp-tunnel.c:57) +==220358== by 0x456857: netdev_l2tp_tunnel_verify (l2tp-tunnel.c:710) +==220358== by 0x440947: netdev_load_one (netdev.c:738) +==220358== by 0x441222: netdev_load (netdev.c:851) +==220358== by 0x419C50: manager_load_config (networkd-manager.c:1934) +==220358== by 0x40D7BE: run (networkd.c:87) +==220358== by 0x40DE75: main (networkd.c:130) +==220358== Block was alloc'd at +==220358== at 0x4839809: malloc (vg_replace_malloc.c:307) +==220358== by 0x452A76: malloc_multiply (alloc-util.h:96) +==220358== by 0x4531E6: l2tp_session_new_static (l2tp-tunnel.c:82) +==220358== by 0x455C01: config_parse_l2tp_session_id (l2tp-tunnel.c:535) +==220358== by 0x48E6D72: next_assignment (conf-parser.c:133) +==220358== by 0x48E77A3: parse_line (conf-parser.c:271) +==220358== by 0x48E7E4F: config_parse (conf-parser.c:396) +==220358== by 0x48E80E5: config_parse_many_files (conf-parser.c:453) +==220358== by 0x48E8490: config_parse_many (conf-parser.c:512) +==220358== by 0x44089C: netdev_load_one (netdev.c:729) +==220358== by 0x441222: netdev_load (netdev.c:851) +==220358== by 0x419C50: manager_load_config (networkd-manager.c:1934) + +``` +--- + src/network/netdev/l2tp-tunnel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/network/netdev/l2tp-tunnel.c b/src/network/netdev/l2tp-tunnel.c +index 19683c0a00..91788c3681 100644 +--- a/src/network/netdev/l2tp-tunnel.c ++++ b/src/network/netdev/l2tp-tunnel.c +@@ -44,7 +44,7 @@ static void l2tp_session_free(L2tpSession *s) { + return; + + if (s->tunnel && s->section) +- ordered_hashmap_remove(s->tunnel->sessions_by_section, s); ++ ordered_hashmap_remove(s->tunnel->sessions_by_section, s->section); + + network_config_section_free(s->section); + +-- +2.23.0 + diff --git a/network-fix-double-free-in-macsec_receive_channel_fr.patch b/network-fix-double-free-in-macsec_receive_channel_fr.patch new file mode 100644 index 0000000..4b266b6 --- /dev/null +++ b/network-fix-double-free-in-macsec_receive_channel_fr.patch @@ -0,0 +1,45 @@ +From 0e77fc66bceb9832da82a56a4c1040fe49f8d805 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Fri, 29 May 2020 16:56:09 +0900 +Subject: [PATCH] network: fix double free in macsec_receive_channel_free() + +Fixes #15941. +Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22547 +--- + src/network/netdev/macsec.c | 2 +- + test/fuzz/fuzz-netdev-parser/oss-fuzz-22547 | 10 ++++++++++ + 2 files changed, 11 insertions(+), 1 deletion(-) + create mode 100644 test/fuzz/fuzz-netdev-parser/oss-fuzz-22547 + +diff --git a/src/network/netdev/macsec.c b/src/network/netdev/macsec.c +index 3542f9652a..8f7559e9ae 100644 +--- a/src/network/netdev/macsec.c ++++ b/src/network/netdev/macsec.c +@@ -102,7 +102,7 @@ static void macsec_receive_channel_free(ReceiveChannel *c) { + + if (c->macsec) { + if (c->sci.as_uint64 > 0) +- ordered_hashmap_remove(c->macsec->receive_channels, &c->sci.as_uint64); ++ ordered_hashmap_remove_value(c->macsec->receive_channels, &c->sci.as_uint64, c); + + if (c->section) + ordered_hashmap_remove(c->macsec->receive_channels_by_section, c->section); +diff --git a/test/fuzz/fuzz-netdev-parser/oss-fuzz-22547 b/test/fuzz/fuzz-netdev-parser/oss-fuzz-22547 +new file mode 100644 +index 0000000000..ca55a33ae9 +--- /dev/null ++++ b/test/fuzz/fuzz-netdev-parser/oss-fuzz-22547 +@@ -0,0 +1,10 @@ ++[NetDev] ++Name=o ++Kind=macsec ++ ++[MACsecReceiveChannel] ++MACAddress=12.0.4 ++Port=913 ++[MACsecReceiveChannel] ++MACAddress=12.0.4 ++Port=913 +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index 8d7c993..e7bc021 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 23 +Release: 24 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -86,6 +86,8 @@ Patch0037: revert-shared-unit-file-add-a-function-to-validate-u.patch Patch0038: systemd-Fix-busctl-crash-on-aarch64-when-setting-out.patch Patch0039: seccomp-more-comprehensive-protection-against-libsec.patch +Patch0040: network-fix-double-free-in-macsec_receive_channel_fr.patch +Patch0041: network-L2TP-fix-crash.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1478,6 +1480,13 @@ fi %exclude /usr/share/man/man3/* %changelog +* Thu May 28 2020 openEuler Buildteam - 243-24 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:fix double free in macsec_receive_channel_free() and + fix crash in network L2TP + * Thu May 28 2020 openEuler Buildteam - 243-23 - Type:enhancement - ID:NA -- Gitee From 44102a945c2840480f2bce16002fdef4e7903b03 Mon Sep 17 00:00:00 2001 From: licunlong Date: Thu, 18 Jun 2020 11:04:22 +0800 Subject: [PATCH 04/29] dbus commissioning enhancement --- analyze-fix-minor-memleak.patch | 25 + ...ble-avoid-crash-when-table-is-sparse.patch | 27 + ...-priority-value-via-dbus-only-if-it-.patch | 42 ++ ...ix-re-realization-of-cgroup-siblings.patch | 59 ++ ...priority_set-when-parsing-swap-unit-.patch | 99 +++ ...initialize-swap-structure-fields-if-.patch | 35 + core-set-error-value-correctly.patch | 28 + core-swap-priority-can-be-negative.patch | 115 +++ ...pParseFlags-between-dbus-execute-and.patch | 54 ++ ...sed-logging-instead-of-generic-loggi.patch | 47 ++ ...t-systemctl-with-dependencies-switch.patch | 39 + ...k-Add-support-to-advertie-ipv6-route.patch | 711 ++++++++++++++++++ ...k-add-one-more-section-validty-check.patch | 28 + network-fix-invalid-cleanup-function.patch | 34 + ...ork-fix-memleak-in-route_prefix_free.patch | 33 + network-fix-memleak.patch | 34 + network-use-fix-invalid-free-function.patch | 26 + ...spection-bug-in-signal-parameter-nam.patch | 25 + ...validate-connection-when-Hello-fails.patch | 66 ++ sd-radv-fix-memleak.patch | 30 + ...-bus-util-Don-t-replace-exsting-strv.patch | 33 + systemctl-Add-with-dependencies-flag.patch | 330 ++++++++ ...memleak-caused-by-wrong-cleanup-func.patch | 25 + systemd.spec | 33 +- ...we-forgot-to-destroy-some-bus-errors.patch | 39 + 25 files changed, 2016 insertions(+), 1 deletion(-) create mode 100644 analyze-fix-minor-memleak.patch create mode 100644 basic-string-table-avoid-crash-when-table-is-sparse.patch create mode 100644 core-expose-swap-priority-value-via-dbus-only-if-it-.patch create mode 100644 core-fix-re-realization-of-cgroup-siblings.patch create mode 100644 core-initialize-priority_set-when-parsing-swap-unit-.patch create mode 100644 core-no-need-to-initialize-swap-structure-fields-if-.patch create mode 100644 core-set-error-value-correctly.patch create mode 100644 core-swap-priority-can-be-negative.patch create mode 100644 core-sync-SeccompParseFlags-between-dbus-execute-and.patch create mode 100644 core-use-unit-based-logging-instead-of-generic-loggi.patch create mode 100644 man-Document-systemctl-with-dependencies-switch.patch create mode 100644 network-Add-support-to-advertie-ipv6-route.patch create mode 100644 network-add-one-more-section-validty-check.patch create mode 100644 network-fix-invalid-cleanup-function.patch create mode 100644 network-fix-memleak-in-route_prefix_free.patch create mode 100644 network-fix-memleak.patch create mode 100644 network-use-fix-invalid-free-function.patch create mode 100644 sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch create mode 100644 sd-bus-invalidate-connection-when-Hello-fails.patch create mode 100644 sd-radv-fix-memleak.patch create mode 100644 shared-bus-util-Don-t-replace-exsting-strv.patch create mode 100644 systemctl-Add-with-dependencies-flag.patch create mode 100644 systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch create mode 100644 tree-wide-we-forgot-to-destroy-some-bus-errors.patch diff --git a/analyze-fix-minor-memleak.patch b/analyze-fix-minor-memleak.patch new file mode 100644 index 0000000..8e62c2c --- /dev/null +++ b/analyze-fix-minor-memleak.patch @@ -0,0 +1,25 @@ +From 81610e9609c966a33dcff15a4f3b173aa8f07e4b Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Fri, 25 Oct 2019 16:05:11 +0200 +Subject: [PATCH] analyze: fix minor memleak + +--- + src/analyze/analyze.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/analyze/analyze.c b/src/analyze/analyze.c +index 1871a4363e..2d541fe701 100644 +--- a/src/analyze/analyze.c ++++ b/src/analyze/analyze.c +@@ -1713,7 +1713,7 @@ static void kernel_syscalls_remove(Set *s, const SyscallFilterSet *set) { + if (syscall[0] == '@') + continue; + +- (void) set_remove(s, syscall); ++ free(set_remove(s, syscall)); + } + } + +-- +2.23.0 + diff --git a/basic-string-table-avoid-crash-when-table-is-sparse.patch b/basic-string-table-avoid-crash-when-table-is-sparse.patch new file mode 100644 index 0000000..a41e066 --- /dev/null +++ b/basic-string-table-avoid-crash-when-table-is-sparse.patch @@ -0,0 +1,27 @@ +From aa73f181e92ce991cff4e6890822764698befc90 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Thu, 27 Feb 2020 21:28:54 +0100 +Subject: [PATCH] basic/string-table: avoid crash when table is sparse + +Generated _from_string() would crash when invoked on a table with some +holes. +--- + src/basic/string-table.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/basic/string-table.h b/src/basic/string-table.h +index 2d3cf81435..96924778f5 100644 +--- a/src/basic/string-table.h ++++ b/src/basic/string-table.h +@@ -44,7 +44,7 @@ ssize_t string_table_lookup(const char * const *table, size_t len, const char *k + char *s; \ + if (i < 0 || i > max) \ + return -ERANGE; \ +- if (i < (type) ELEMENTSOF(name##_table)) { \ ++ if (i < (type) ELEMENTSOF(name##_table) && name##_table[i]) { \ + s = strdup(name##_table[i]); \ + if (!s) \ + return -ENOMEM; \ +-- +2.23.0 + diff --git a/core-expose-swap-priority-value-via-dbus-only-if-it-.patch b/core-expose-swap-priority-value-via-dbus-only-if-it-.patch new file mode 100644 index 0000000..4baab93 --- /dev/null +++ b/core-expose-swap-priority-value-via-dbus-only-if-it-.patch @@ -0,0 +1,42 @@ +From 6d9e0ca400133aeffa4a53c707db43b3e6c98c7b Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Thu, 9 Jan 2020 17:01:14 +0100 +Subject: [PATCH] core: expose swap priority value via dbus only if it is set + +--- + src/core/dbus-swap.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/src/core/dbus-swap.c b/src/core/dbus-swap.c +index 353fa20132..57c8c42091 100644 +--- a/src/core/dbus-swap.c ++++ b/src/core/dbus-swap.c +@@ -12,16 +12,23 @@ + #include "unit.h" + + static int swap_get_priority(Swap *s) { +- if (s->from_proc_swaps) ++ assert(s); ++ ++ if (s->from_proc_swaps && s->parameters_proc_swaps.priority_set) + return s->parameters_proc_swaps.priority; +- if (s->from_fragment) ++ ++ if (s->from_fragment && s->parameters_fragment.priority_set) + return s->parameters_fragment.priority; ++ + return -1; + } + + static const char *swap_get_options(Swap *s) { ++ assert(s); ++ + if (s->from_fragment) + return s->parameters_fragment.options; ++ + return NULL; + } + +-- +2.23.0 + diff --git a/core-fix-re-realization-of-cgroup-siblings.patch b/core-fix-re-realization-of-cgroup-siblings.patch new file mode 100644 index 0000000..8e5af6f --- /dev/null +++ b/core-fix-re-realization-of-cgroup-siblings.patch @@ -0,0 +1,59 @@ +From 65f6b6bdcb500c576674b5838e4cc4c35e18bfde Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Thu, 9 Jan 2020 17:30:31 +0100 +Subject: [PATCH] core: fix re-realization of cgroup siblings + +This is a fix-up for eef85c4a3f8054d29383a176f6cebd1ef3a15b9a which +broke this. + +Tracked down by @w-simon + +Fixes: #14453 +--- + src/core/cgroup.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/src/core/cgroup.c b/src/core/cgroup.c +index abcd057d6a..af2efd46fa 100644 +--- a/src/core/cgroup.c ++++ b/src/core/cgroup.c +@@ -2334,29 +2334,25 @@ unsigned manager_dispatch_cgroup_realize_queue(Manager *m) { + static void unit_add_siblings_to_cgroup_realize_queue(Unit *u) { + Unit *slice; + +- /* This adds the siblings of the specified unit and the +- * siblings of all parent units to the cgroup queue. (But +- * neither the specified unit itself nor the parents.) */ ++ /* This adds the siblings of the specified unit and the siblings of all parent units to the cgroup ++ * queue. (But neither the specified unit itself nor the parents.) */ + + while ((slice = UNIT_DEREF(u->slice))) { + Iterator i; + Unit *m; + void *v; + +- HASHMAP_FOREACH_KEY(v, m, u->dependencies[UNIT_BEFORE], i) { +- /* Skip units that have a dependency on the slice +- * but aren't actually in it. */ ++ HASHMAP_FOREACH_KEY(v, m, slice->dependencies[UNIT_BEFORE], i) { ++ /* Skip units that have a dependency on the slice but aren't actually in it. */ + if (UNIT_DEREF(m->slice) != slice) + continue; + +- /* No point in doing cgroup application for units +- * without active processes. */ ++ /* No point in doing cgroup application for units without active processes. */ + if (UNIT_IS_INACTIVE_OR_FAILED(unit_active_state(m))) + continue; + +- /* If the unit doesn't need any new controllers +- * and has current ones realized, it doesn't need +- * any changes. */ ++ /* If the unit doesn't need any new controllers and has current ones realized, it ++ * doesn't need any changes. */ + if (unit_has_mask_realized(m, + unit_get_target_mask(m), + unit_get_enable_mask(m))) +-- +2.23.0 + diff --git a/core-initialize-priority_set-when-parsing-swap-unit-.patch b/core-initialize-priority_set-when-parsing-swap-unit-.patch new file mode 100644 index 0000000..134470a --- /dev/null +++ b/core-initialize-priority_set-when-parsing-swap-unit-.patch @@ -0,0 +1,99 @@ +From eb34a981d67165ec346c69aba53168facc556b64 Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Thu, 9 Jan 2020 17:02:56 +0100 +Subject: [PATCH] core: initialize priority_set when parsing swap unit files + +Fixes: #14524 +--- + src/core/load-fragment-gperf.gperf.m4 | 2 +- + src/core/load-fragment.c | 48 +++++++++++++++++++++++++++ + src/core/load-fragment.h | 1 + + 3 files changed, 50 insertions(+), 1 deletion(-) + +diff --git a/src/core/load-fragment-gperf.gperf.m4 b/src/core/load-fragment-gperf.gperf.m4 +index de08f7d067..c1f8ac7bb2 100644 +--- a/src/core/load-fragment-gperf.gperf.m4 ++++ b/src/core/load-fragment-gperf.gperf.m4 +@@ -435,7 +435,7 @@ Automount.DirectoryMode, config_parse_mode, 0, + Automount.TimeoutIdleSec, config_parse_sec_fix_0, 0, offsetof(Automount, timeout_idle_usec) + m4_dnl + Swap.What, config_parse_unit_path_printf, 0, offsetof(Swap, parameters_fragment.what) +-Swap.Priority, config_parse_int, 0, offsetof(Swap, parameters_fragment.priority) ++Swap.Priority, config_parse_swap_priority, 0, 0 + Swap.Options, config_parse_unit_string_printf, 0, offsetof(Swap, parameters_fragment.options) + Swap.TimeoutSec, config_parse_sec_fix_0, 0, offsetof(Swap, timeout_usec) + EXEC_CONTEXT_CONFIG_ITEMS(Swap)m4_dnl +diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c +index 1679e047dd..8f9a2f64db 100644 +--- a/src/core/load-fragment.c ++++ b/src/core/load-fragment.c +@@ -5129,6 +5129,54 @@ int config_parse_crash_chvt( + return 0; + } + ++int config_parse_swap_priority( ++ const char *unit, ++ const char *filename, ++ unsigned line, ++ const char *section, ++ unsigned section_line, ++ const char *lvalue, ++ int ltype, ++ const char *rvalue, ++ void *data, ++ void *userdata) { ++ ++ Swap *s = userdata; ++ int r, priority; ++ ++ assert(s); ++ assert(filename); ++ assert(lvalue); ++ assert(rvalue); ++ assert(data); ++ ++ if (isempty(rvalue)) { ++ s->parameters_fragment.priority = -1; ++ s->parameters_fragment.priority_set = false; ++ return 0; ++ } ++ ++ r = safe_atoi(rvalue, &priority); ++ if (r < 0) { ++ log_syntax(unit, LOG_ERR, filename, line, r, "Invalid swap pririty '%s', ignoring.", rvalue); ++ return 0; ++ } ++ ++ if (priority < -1) { ++ log_syntax(unit, LOG_ERR, filename, line, 0, "Sorry, swap priorities smaller than -1 may only be assigned by the kernel itself, ignoring: %s", rvalue); ++ return 0; ++ } ++ ++ if (priority > 32767) { ++ log_syntax(unit, LOG_ERR, filename, line, 0, "Swap priority out of range, ignoring: %s", rvalue); ++ return 0; ++ } ++ ++ s->parameters_fragment.priority = priority; ++ s->parameters_fragment.priority_set = true; ++ return 0; ++} ++ + int config_parse_timeout_abort( + const char* unit, + const char *filename, +diff --git a/src/core/load-fragment.h b/src/core/load-fragment.h +index b81887d510..28613ef5b3 100644 +--- a/src/core/load-fragment.h ++++ b/src/core/load-fragment.h +@@ -121,6 +121,7 @@ CONFIG_PARSER_PROTOTYPE(config_parse_status_unit_format); + CONFIG_PARSER_PROTOTYPE(config_parse_output_restricted); + CONFIG_PARSER_PROTOTYPE(config_parse_crash_chvt); + CONFIG_PARSER_PROTOTYPE(config_parse_timeout_abort); ++CONFIG_PARSER_PROTOTYPE(config_parse_swap_priority); + + /* gperf prototypes */ + const struct ConfigPerfItem* load_fragment_gperf_lookup(const char *key, GPERF_LEN_TYPE length); +-- +2.23.0 + diff --git a/core-no-need-to-initialize-swap-structure-fields-if-.patch b/core-no-need-to-initialize-swap-structure-fields-if-.patch new file mode 100644 index 0000000..cdfab1a --- /dev/null +++ b/core-no-need-to-initialize-swap-structure-fields-if-.patch @@ -0,0 +1,35 @@ +From 6afc31615e63b7db941684be84da82a06373a778 Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Thu, 9 Jan 2020 17:01:46 +0100 +Subject: [PATCH] core: no need to initialize swap structure fields if all + zeroes anyway + +--- + src/core/swap.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/src/core/swap.c b/src/core/swap.c +index 03f443daec..6caf20ea66 100644 +--- a/src/core/swap.c ++++ b/src/core/swap.c +@@ -63,7 +63,6 @@ static void swap_unset_proc_swaps(Swap *s) { + return; + + s->parameters_proc_swaps.what = mfree(s->parameters_proc_swaps.what); +- + s->from_proc_swaps = false; + } + +@@ -117,9 +116,6 @@ static void swap_init(Unit *u) { + s->exec_context.std_output = u->manager->default_std_output; + s->exec_context.std_error = u->manager->default_std_error; + +- s->parameters_proc_swaps.priority = s->parameters_fragment.priority = 0; +- s->parameters_fragment.priority_set = false; +- + s->control_command_id = _SWAP_EXEC_COMMAND_INVALID; + + u->ignore_on_isolate = true; +-- +2.23.0 + diff --git a/core-set-error-value-correctly.patch b/core-set-error-value-correctly.patch new file mode 100644 index 0000000..9a07379 --- /dev/null +++ b/core-set-error-value-correctly.patch @@ -0,0 +1,28 @@ +From 6fca66a7f125607864850ac9a4d6cc56a27594dd Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Thu, 9 Jan 2020 17:04:25 +0100 +Subject: [PATCH] core: set error value correctly + +--- + src/core/swap.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/core/swap.c b/src/core/swap.c +index d4f6db6ddc..225488282e 100644 +--- a/src/core/swap.c ++++ b/src/core/swap.c +@@ -777,8 +777,10 @@ static void swap_enter_activating(Swap *s) { + r = asprintf(&opts, "%s,pri=%i", s->parameters_fragment.options, s->parameters_fragment.priority); + else + r = asprintf(&opts, "pri=%i", s->parameters_fragment.priority); +- if (r < 0) ++ if (r < 0) { ++ r = -ENOMEM; + goto fail; ++ } + } + } + +-- +2.23.0 + diff --git a/core-swap-priority-can-be-negative.patch b/core-swap-priority-can-be-negative.patch new file mode 100644 index 0000000..b7f7089 --- /dev/null +++ b/core-swap-priority-can-be-negative.patch @@ -0,0 +1,115 @@ +From 7477451b691d288dad67b4c8ce9e519e9b75770d Mon Sep 17 00:00:00 2001 +From: Topi Miettinen +Date: Tue, 3 Dec 2019 20:36:37 +0200 +Subject: [PATCH] core: swap priority can be negative + +Negative priorities are useful for swap targets which should be only used as +last resort. +--- + src/core/swap.c | 10 ++++++---- + src/core/swap.h | 1 + + src/shared/fstab-util.c | 10 +++------- + src/test/test-fstab-util.c | 3 +++ + 4 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/src/core/swap.c b/src/core/swap.c +index e4b018616d..03f443daec 100644 +--- a/src/core/swap.c ++++ b/src/core/swap.c +@@ -117,7 +117,8 @@ static void swap_init(Unit *u) { + s->exec_context.std_output = u->manager->default_std_output; + s->exec_context.std_error = u->manager->default_std_error; + +- s->parameters_proc_swaps.priority = s->parameters_fragment.priority = -1; ++ s->parameters_proc_swaps.priority = s->parameters_fragment.priority = 0; ++ s->parameters_fragment.priority_set = false; + + s->control_command_id = _SWAP_EXEC_COMMAND_INVALID; + +@@ -433,6 +434,7 @@ static int swap_setup_unit( + SWAP(u)->from_proc_swaps = true; + + p->priority = priority; ++ p->priority_set = true; + + unit_add_to_dbus_queue(u); + return 0; +@@ -766,15 +768,15 @@ static void swap_enter_activating(Swap *s) { + s->control_command = s->exec_command + SWAP_EXEC_ACTIVATE; + + if (s->from_fragment) { +- int priority = -1; ++ int priority = 0; + + r = fstab_find_pri(s->parameters_fragment.options, &priority); + if (r < 0) + log_warning_errno(r, "Failed to parse swap priority \"%s\", ignoring: %m", s->parameters_fragment.options); +- else if (r == 1 && s->parameters_fragment.priority >= 0) ++ else if (r == 1 && s->parameters_fragment.priority_set) + log_warning("Duplicate swap priority configuration by Priority and Options fields."); + +- if (r <= 0 && s->parameters_fragment.priority >= 0) { ++ if (r <= 0 && s->parameters_fragment.priority_set) { + if (s->parameters_fragment.options) + r = asprintf(&opts, "%s,pri=%i", s->parameters_fragment.options, s->parameters_fragment.priority); + else +diff --git a/src/core/swap.h b/src/core/swap.h +index 389faf584d..cb24cec7aa 100644 +--- a/src/core/swap.h ++++ b/src/core/swap.h +@@ -33,6 +33,7 @@ typedef struct SwapParameters { + char *what; + char *options; + int priority; ++ bool priority_set; + } SwapParameters; + + struct Swap { +diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c +index f90501eb92..86a57e6b2c 100644 +--- a/src/shared/fstab-util.c ++++ b/src/shared/fstab-util.c +@@ -186,8 +186,7 @@ int fstab_extract_values(const char *opts, const char *name, char ***values) { + + int fstab_find_pri(const char *options, int *ret) { + _cleanup_free_ char *opt = NULL; +- int r; +- unsigned pri; ++ int r, pri; + + assert(ret); + +@@ -197,14 +196,11 @@ int fstab_find_pri(const char *options, int *ret) { + if (r == 0 || !opt) + return 0; + +- r = safe_atou(opt, &pri); ++ r = safe_atoi(opt, &pri); + if (r < 0) + return r; + +- if ((int) pri < 0) +- return -ERANGE; +- +- *ret = (int) pri; ++ *ret = pri; + return 1; + } + +diff --git a/src/test/test-fstab-util.c b/src/test/test-fstab-util.c +index 4cd504e45c..c1c7ec9114 100644 +--- a/src/test/test-fstab-util.c ++++ b/src/test/test-fstab-util.c +@@ -100,6 +100,9 @@ static void test_fstab_find_pri(void) { + assert_se(fstab_find_pri("pri=11", &pri) == 1); + assert_se(pri == 11); + ++ assert_se(fstab_find_pri("pri=-2", &pri) == 1); ++ assert_se(pri == -2); ++ + assert_se(fstab_find_pri("opt,pri=12,opt", &pri) == 1); + assert_se(pri == 12); + +-- +2.23.0 + diff --git a/core-sync-SeccompParseFlags-between-dbus-execute-and.patch b/core-sync-SeccompParseFlags-between-dbus-execute-and.patch new file mode 100644 index 0000000..3b6e1b5 --- /dev/null +++ b/core-sync-SeccompParseFlags-between-dbus-execute-and.patch @@ -0,0 +1,54 @@ +From 72545ae05745f99e194eb83e3fa865f276601378 Mon Sep 17 00:00:00 2001 +From: Anita Zhang +Date: Thu, 6 Feb 2020 15:34:17 -0800 +Subject: [PATCH] core: sync SeccompParseFlags between dbus-execute and + load-fragment + +9e486265716963439fb0fd7f2a97abf109f24f75 added some new syscalls to the +filter lists. However, on systems that do not yet support the new calls, +running systemd-run with the filter set results in error: + +``` +$ sudo systemd-run -t -r -p "SystemCallFilter=~@mount" /bin/true +Failed to start transient service unit: Invalid argument +``` + +Having the same properties in a unit file will start the service +without issue. This is because the load-fragment code will parse the +syscall filters in permissive mode: +https://github.com/systemd/systemd/blob/master/src/core/load-fragment.c#L2909 +whereas the dbus-execute equivalent of the code does not. + +Since the permissive mode appears to be the right setting to support +older kernels/libseccomp, this will update the dbus-execute parsing +to also be permissive. +--- + src/core/dbus-execute.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c +index 9ff3f157f5..d8ba3e5d92 100644 +--- a/src/core/dbus-execute.c ++++ b/src/core/dbus-execute.c +@@ -1587,6 +1587,7 @@ int bus_exec_context_set_transient_property( + r = seccomp_parse_syscall_filter("@default", + -1, + c->syscall_filter, ++ SECCOMP_PARSE_PERMISSIVE | + SECCOMP_PARSE_WHITELIST | invert_flag, + u->id, + NULL, 0); +@@ -1606,7 +1607,9 @@ int bus_exec_context_set_transient_property( + r = seccomp_parse_syscall_filter(n, + e, + c->syscall_filter, +- (c->syscall_whitelist ? SECCOMP_PARSE_WHITELIST : 0) | invert_flag, ++ SECCOMP_PARSE_LOG | SECCOMP_PARSE_PERMISSIVE | ++ invert_flag | ++ (c->syscall_whitelist ? SECCOMP_PARSE_WHITELIST : 0), + u->id, + NULL, 0); + if (r < 0) +-- +2.23.0 + diff --git a/core-use-unit-based-logging-instead-of-generic-loggi.patch b/core-use-unit-based-logging-instead-of-generic-loggi.patch new file mode 100644 index 0000000..045d60b --- /dev/null +++ b/core-use-unit-based-logging-instead-of-generic-loggi.patch @@ -0,0 +1,47 @@ +From af4454cb17da6727e490522afb7d4bddf8dae7fd Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Thu, 9 Jan 2020 17:03:57 +0100 +Subject: [PATCH] core: use unit-based logging instead of generic logging where + appropriate + +--- + src/core/swap.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/src/core/swap.c b/src/core/swap.c +index 6caf20ea66..d4f6db6ddc 100644 +--- a/src/core/swap.c ++++ b/src/core/swap.c +@@ -768,9 +768,9 @@ static void swap_enter_activating(Swap *s) { + + r = fstab_find_pri(s->parameters_fragment.options, &priority); + if (r < 0) +- log_warning_errno(r, "Failed to parse swap priority \"%s\", ignoring: %m", s->parameters_fragment.options); +- else if (r == 1 && s->parameters_fragment.priority_set) +- log_warning("Duplicate swap priority configuration by Priority and Options fields."); ++ log_unit_warning_errno(UNIT(s), r, "Failed to parse swap priority \"%s\", ignoring: %m", s->parameters_fragment.options); ++ else if (r > 0 && s->parameters_fragment.priority_set) ++ log_unit_warning(UNIT(s), "Duplicate swap priority configuration by Priority= and Options= fields."); + + if (r <= 0 && s->parameters_fragment.priority_set) { + if (s->parameters_fragment.options) +@@ -788,7 +788,7 @@ static void swap_enter_activating(Swap *s) { + + if (s->parameters_fragment.options || opts) { + r = exec_command_append(s->control_command, "-o", +- opts ? : s->parameters_fragment.options, NULL); ++ opts ?: s->parameters_fragment.options, NULL); + if (r < 0) + goto fail; + } +@@ -804,7 +804,6 @@ static void swap_enter_activating(Swap *s) { + goto fail; + + swap_set_state(s, SWAP_ACTIVATING); +- + return; + + fail: +-- +2.23.0 + diff --git a/man-Document-systemctl-with-dependencies-switch.patch b/man-Document-systemctl-with-dependencies-switch.patch new file mode 100644 index 0000000..46d3314 --- /dev/null +++ b/man-Document-systemctl-with-dependencies-switch.patch @@ -0,0 +1,39 @@ +From a602a0b44b9eb9af0027d054dd24e405a658e375 Mon Sep 17 00:00:00 2001 +From: Kevin Kuehler +Date: Mon, 9 Dec 2019 01:40:47 -0800 +Subject: [PATCH] man: Document systemctl --with-dependencies switch + +--- + man/systemctl.xml | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/man/systemctl.xml b/man/systemctl.xml +index 3d86f7dffa..5828477e8d 100644 +--- a/man/systemctl.xml ++++ b/man/systemctl.xml +@@ -1592,6 +1592,22 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err + + + ++ ++ ++ ++ ++ When used with status, ++ cat, list-units, and ++ list-unit-files, those commands print all ++ specified units and the dependencies of those units. ++ ++ Options , ++ , ++ may be used to change what types of dependencies ++ are shown. ++ ++ ++ + + + +-- +2.23.0 + diff --git a/network-Add-support-to-advertie-ipv6-route.patch b/network-Add-support-to-advertie-ipv6-route.patch new file mode 100644 index 0000000..4c3e404 --- /dev/null +++ b/network-Add-support-to-advertie-ipv6-route.patch @@ -0,0 +1,711 @@ +From 203d4df5732b1fdcf50db498ddeb74a934b21f87 Mon Sep 17 00:00:00 2001 +From: Susant Sahani +Date: Sat, 14 Sep 2019 16:44:22 +0530 +Subject: [PATCH] network: Add support to advertie ipv6 route + +Implements https://tools.ietf.org/html/rfc4191 + +cat veth99.network +``` +[Match] +Name=veth99 + +[Network] +DHCP=no +IPv6PrefixDelegation=yes +Address=2001:db8:0:1::1/64 + +[IPv6Prefix] +Prefix=2001:db8:0:1::4/64 + +[IPv6RoutePrefix] +Route=2001:db0:fff::/48 + +``` +Wireshark + +``` +Frame 481: 142 bytes on wire (1136 bits), 142 bytes captured (1136 bits) on interface 0 +Ethernet II, Src: 1e:04:f8:b8:2f:d4 (1e:04:f8:b8:2f:d4), Dst: IPv6mcast_01 (33:33:00:00:00:01) +Internet Protocol Version 6, Src: fe80::1c04:f8ff:feb8:2fd4, Dst: ff02::1 +Internet Control Message Protocol v6 + Type: Router Advertisement (134) + Code: 0 + Checksum: 0xec77 [correct] + [Checksum Status: Good] + Cur hop limit: 0 + Flags: 0x00, Prf (Default Router Preference): Medium + Router lifetime (s): 0 + Reachable time (ms): 0 + Retrans timer (ms): 0 + ICMPv6 Option (Source link-layer address : 1e:04:f8:b8:2f:d4) + Type: Source link-layer address (1) + Length: 1 (8 bytes) + Link-layer address: 1e:04:f8:b8:2f:d4 (1e:04:f8:b8:2f:d4) + ICMPv6 Option (MTU : 1500) + Type: MTU (5) + Length: 1 (8 bytes) + Reserved + MTU: 1500 + ICMPv6 Option (Prefix information : 2001:db8:0:1::4/64) + Type: Prefix information (3) + Length: 4 (32 bytes) + Prefix Length: 64 + Flag: 0xc0, On-link flag(L), Autonomous address-configuration flag(A) + Valid Lifetime: 2592000 + Preferred Lifetime: 604800 + Reserved + Prefix: 2001:db8:0:1::4 + ICMPv6 Option (Route Information : Medium 2001:db0:fff::/48) + Type: Route Information (24) + Length: 3 (24 bytes) + Prefix Length: 48 + Flag: 0x00, Route Preference: Medium + ...0 0... = Route Preference: Medium (0) + 000. .000 = Reserved: 0 + Route Lifetime: 604800 + Prefix: 2001:db0:fff:: +``` +--- + man/systemd.network.xml | 33 ++- + src/libsystemd-network/radv-internal.h | 26 +++ + src/libsystemd-network/sd-radv.c | 130 +++++++++++- + src/network/networkd-network-gperf.gperf | 2 + + src/network/networkd-network.c | 1 + + src/network/networkd-network.h | 3 + + src/network/networkd-radv.c | 195 +++++++++++++++++- + src/network/networkd-radv.h | 9 + + src/systemd/sd-radv.h | 10 + + .../fuzz-network-parser/directives.network | 3 + + 10 files changed, 400 insertions(+), 12 deletions(-) + +diff --git a/man/systemd.network.xml b/man/systemd.network.xml +index 155c0868b2..8ecc39ce5e 100644 +--- a/man/systemd.network.xml ++++ b/man/systemd.network.xml +@@ -1886,7 +1886,7 @@ + + + +- ++ + [IPv6Prefix] Section Options + One or more [IPv6Prefix] sections contain the IPv6 + prefixes that are announced via Router Advertisements. See +@@ -1931,6 +1931,37 @@ + + + ++ ++ [IPv6RoutePrefix] Section Options ++ One or more [IPv6RoutePrefix] sections contain the IPv6 ++ prefix routes that are announced via Router Advertisements. See ++ RFC 4191 ++ for further details. ++ ++ ++ ++ ++ Route= ++ ++ The IPv6 route that is to be distributed to hosts. ++ Similarly to configuring static IPv6 routes, the setting is ++ configured as an IPv6 prefix routes and its prefix route length, ++ separated by a/ character. Use multiple ++ [IPv6PrefixRoutes] sections to configure multiple IPv6 ++ prefix routes. ++ ++ ++ ++ LifetimeSec= ++ ++ Lifetime for the route prefix measured in ++ seconds. LifetimeSec= defaults to 604800 seconds (one week). ++ ++ ++ ++ ++ ++ + + [Bridge] Section Options + The [Bridge] section accepts the +diff --git a/src/libsystemd-network/radv-internal.h b/src/libsystemd-network/radv-internal.h +index 7b09c7a66c..fb6617bedd 100644 +--- a/src/libsystemd-network/radv-internal.h ++++ b/src/libsystemd-network/radv-internal.h +@@ -19,6 +19,7 @@ assert_cc(SD_RADV_DEFAULT_MIN_TIMEOUT_USEC <= SD_RADV_DEFAULT_MAX_TIMEOUT_USEC); + #define SD_RADV_MIN_DELAY_BETWEEN_RAS 3 + #define SD_RADV_MAX_RA_DELAY_TIME_USEC (500*USEC_PER_MSEC) + ++#define SD_RADV_OPT_ROUTE_INFORMATION 24 + #define SD_RADV_OPT_RDNSS 25 + #define SD_RADV_OPT_DNSSL 31 + +@@ -58,6 +59,9 @@ struct sd_radv { + unsigned n_prefixes; + LIST_HEAD(sd_radv_prefix, prefixes); + ++ unsigned n_route_prefixes; ++ LIST_HEAD(sd_radv_route_prefix, route_prefixes); ++ + size_t n_rdnss; + struct sd_radv_opt_dns *rdnss; + struct sd_radv_opt_dns *dnssl; +@@ -98,6 +102,28 @@ struct sd_radv_prefix { + usec_t preferred_until; + }; + ++#define radv_route_prefix_opt__contents { \ ++ uint8_t type; \ ++ uint8_t length; \ ++ uint8_t prefixlen; \ ++ uint8_t flags_reserved; \ ++ be32_t lifetime; \ ++ struct in6_addr in6_addr; \ ++} ++ ++struct radv_route_prefix_opt radv_route_prefix_opt__contents; ++ ++struct radv_route_prefix_opt__packed radv_route_prefix_opt__contents _packed_; ++assert_cc(sizeof(struct radv_route_prefix_opt) == sizeof(struct radv_route_prefix_opt__packed)); ++ ++struct sd_radv_route_prefix { ++ unsigned n_ref; ++ ++ struct radv_route_prefix_opt opt; ++ ++ LIST_FIELDS(struct sd_radv_route_prefix, prefix); ++}; ++ + #define log_radv_full(level, error, fmt, ...) log_internal(level, error, PROJECT_FILE, __LINE__, __func__, "RADV: " fmt, ##__VA_ARGS__) + #define log_radv_errno(error, fmt, ...) log_radv_full(LOG_DEBUG, error, fmt, ##__VA_ARGS__) + #define log_radv(fmt, ...) log_radv_errno(0, fmt, ##__VA_ARGS__) +diff --git a/src/libsystemd-network/sd-radv.c b/src/libsystemd-network/sd-radv.c +index 185b55e1c5..d531f52326 100644 +--- a/src/libsystemd-network/sd-radv.c ++++ b/src/libsystemd-network/sd-radv.c +@@ -116,6 +116,7 @@ static sd_radv *radv_free(sd_radv *ra) { + DEFINE_PUBLIC_TRIVIAL_REF_UNREF_FUNC(sd_radv, sd_radv, radv_free); + + static int radv_send(sd_radv *ra, const struct in6_addr *dst, uint32_t router_lifetime) { ++ sd_radv_route_prefix *rt; + sd_radv_prefix *p; + struct sockaddr_in6 dst_addr = { + .sin6_family = AF_INET6, +@@ -136,9 +137,9 @@ static int radv_send(sd_radv *ra, const struct in6_addr *dst, uint32_t router_li + .nd_opt_mtu_type = ND_OPT_MTU, + .nd_opt_mtu_len = 1, + }; +- /* Reserve iov space for RA header, linkaddr, MTU, N prefixes, RDNSS ++ /* Reserve iov space for RA header, linkaddr, MTU, N prefixes, N routes, RDNSS + and DNSSL */ +- struct iovec iov[5 + ra->n_prefixes]; ++ struct iovec iov[5 + ra->n_prefixes + ra->n_route_prefixes]; + struct msghdr msg = { + .msg_name = &dst_addr, + .msg_namelen = sizeof(dst_addr), +@@ -190,6 +191,9 @@ static int radv_send(sd_radv *ra, const struct in6_addr *dst, uint32_t router_li + iov[msg.msg_iovlen++] = IOVEC_MAKE(&p->opt, sizeof(p->opt)); + } + ++ LIST_FOREACH(prefix, rt, ra->route_prefixes) ++ iov[msg.msg_iovlen++] = IOVEC_MAKE(&rt->opt, sizeof(rt->opt)); ++ + if (ra->rdnss) + iov[msg.msg_iovlen++] = IOVEC_MAKE(ra->rdnss, ra->rdnss->length * 8); + +@@ -606,6 +610,77 @@ _public_ sd_radv_prefix *sd_radv_remove_prefix(sd_radv *ra, + return cur; + } + ++_public_ int sd_radv_add_route_prefix(sd_radv *ra, sd_radv_route_prefix *p, int dynamic) { ++ char time_string_valid[FORMAT_TIMESPAN_MAX]; ++ usec_t time_now, valid, valid_until; ++ _cleanup_free_ char *pretty = NULL; ++ sd_radv_route_prefix *cur; ++ int r; ++ ++ assert_return(ra, -EINVAL); ++ ++ if (!p) ++ return -EINVAL; ++ ++ (void) in_addr_to_string(AF_INET6, ++ (union in_addr_union*) &p->opt.in6_addr, ++ &pretty); ++ ++ LIST_FOREACH(prefix, cur, ra->route_prefixes) { ++ _cleanup_free_ char *addr = NULL; ++ ++ r = in_addr_prefix_intersect(AF_INET6, ++ (union in_addr_union*) &cur->opt.in6_addr, ++ cur->opt.prefixlen, ++ (union in_addr_union*) &p->opt.in6_addr, ++ p->opt.prefixlen); ++ if (r < 0) ++ return r; ++ if (r == 0) ++ continue; ++ ++ if (dynamic && cur->opt.prefixlen == p->opt.prefixlen) ++ goto update; ++ ++ (void) in_addr_to_string(AF_INET6, ++ (union in_addr_union*) &cur->opt.in6_addr, ++ &addr); ++ log_radv("IPv6 route prefix %s/%u already configured, ignoring %s/%u", ++ strempty(addr), cur->opt.prefixlen, ++ strempty(pretty), p->opt.prefixlen); ++ ++ return -EEXIST; ++ } ++ ++ p = sd_radv_route_prefix_ref(p); ++ ++ LIST_APPEND(prefix, ra->route_prefixes, p); ++ ra->n_route_prefixes++; ++ ++ cur = p; ++ if (!dynamic) { ++ log_radv("Added prefix %s/%u", strempty(pretty), p->opt.prefixlen); ++ return 0; ++ } ++ ++ update: ++ r = sd_event_now(ra->event, clock_boottime_or_monotonic(), &time_now); ++ if (r < 0) ++ return r; ++ ++ valid = be32toh(p->opt.lifetime) * USEC_PER_SEC; ++ valid_until = usec_add(valid, time_now); ++ if (valid_until == USEC_INFINITY) ++ return -EOVERFLOW; ++ ++ log_radv("%s route prefix %s/%u valid %s", ++ cur? "Updated": "Added", ++ strempty(pretty), p->opt.prefixlen, ++ format_timespan(time_string_valid, FORMAT_TIMESPAN_MAX, valid, USEC_PER_SEC)); ++ ++ return 0; ++} ++ + _public_ int sd_radv_set_rdnss(sd_radv *ra, uint32_t lifetime, + const struct in6_addr *dns, size_t n_dns) { + _cleanup_free_ struct sd_radv_opt_dns *opt_rdnss = NULL; +@@ -770,3 +845,54 @@ _public_ int sd_radv_prefix_set_preferred_lifetime(sd_radv_prefix *p, + + return 0; + } ++ ++_public_ int sd_radv_route_prefix_new(sd_radv_route_prefix **ret) { ++ sd_radv_route_prefix *p; ++ ++ assert_return(ret, -EINVAL); ++ ++ p = new(sd_radv_route_prefix, 1); ++ if (!p) ++ return -ENOMEM; ++ ++ *p = (sd_radv_route_prefix) { ++ .n_ref = 1, ++ ++ .opt.type = SD_RADV_OPT_ROUTE_INFORMATION, ++ .opt.length = DIV_ROUND_UP(sizeof(p->opt), 8), ++ .opt.prefixlen = 64, ++ ++ .opt.lifetime = htobe32(604800), ++ }; ++ ++ *ret = p; ++ return 0; ++} ++ ++DEFINE_PUBLIC_TRIVIAL_REF_UNREF_FUNC(sd_radv_route_prefix, sd_radv_route_prefix, mfree); ++ ++_public_ int sd_radv_prefix_set_route_prefix(sd_radv_route_prefix *p, const struct in6_addr *in6_addr, ++ unsigned char prefixlen) { ++ assert_return(p, -EINVAL); ++ assert_return(in6_addr, -EINVAL); ++ ++ if (prefixlen > 128) ++ return -EINVAL; ++ ++ if (prefixlen > 64) ++ /* unusual but allowed, log it */ ++ log_radv("Unusual prefix length %u greater than 64", prefixlen); ++ ++ p->opt.in6_addr = *in6_addr; ++ p->opt.prefixlen = prefixlen; ++ ++ return 0; ++} ++ ++_public_ int sd_radv_route_prefix_set_lifetime(sd_radv_route_prefix *p, uint32_t valid_lifetime) { ++ assert_return(p, -EINVAL); ++ ++ p->opt.lifetime = htobe32(valid_lifetime); ++ ++ return 0; ++} +diff --git a/src/network/networkd-network-gperf.gperf b/src/network/networkd-network-gperf.gperf +index d4d108ad25..43163a31ec 100644 +--- a/src/network/networkd-network-gperf.gperf ++++ b/src/network/networkd-network-gperf.gperf +@@ -223,6 +223,8 @@ IPv6Prefix.OnLink, config_parse_prefix_flags, + IPv6Prefix.AddressAutoconfiguration, config_parse_prefix_flags, 0, 0 + IPv6Prefix.ValidLifetimeSec, config_parse_prefix_lifetime, 0, 0 + IPv6Prefix.PreferredLifetimeSec, config_parse_prefix_lifetime, 0, 0 ++IPv6RoutePrefix.Route, config_parse_route_prefix, 0, 0 ++IPv6RoutePrefix.LifetimeSec, config_parse_route_prefix_lifetime, 0, 0 + CAN.BitRate, config_parse_si_size, 0, offsetof(Network, can_bitrate) + CAN.SamplePoint, config_parse_permille, 0, offsetof(Network, can_sample_point) + CAN.RestartSec, config_parse_sec, 0, offsetof(Network, can_restart_us) +diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c +index 70dbd31f50..0608219429 100644 +--- a/src/network/networkd-network.c ++++ b/src/network/networkd-network.c +@@ -458,6 +458,7 @@ int network_load_one(Manager *manager, const char *filename) { + "BridgeVLAN\0" + "IPv6PrefixDelegation\0" + "IPv6Prefix\0" ++ "IPv6RoutePrefix\0" + "CAN\0", + config_item_perf_lookup, network_network_gperf_lookup, + CONFIG_PARSE_WARN, network); +diff --git a/src/network/networkd-network.h b/src/network/networkd-network.h +index bc760744e5..486b8c31a5 100644 +--- a/src/network/networkd-network.h ++++ b/src/network/networkd-network.h +@@ -221,6 +221,7 @@ struct Network { + LIST_HEAD(Neighbor, neighbors); + LIST_HEAD(AddressLabel, address_labels); + LIST_HEAD(Prefix, static_prefixes); ++ LIST_HEAD(Prefix, static_route_prefixes); + LIST_HEAD(RoutingPolicyRule, rules); + + unsigned n_static_addresses; +@@ -230,6 +231,7 @@ struct Network { + unsigned n_neighbors; + unsigned n_address_labels; + unsigned n_static_prefixes; ++ unsigned n_static_route_prefixes; + unsigned n_rules; + + Hashmap *addresses_by_section; +@@ -238,6 +240,7 @@ struct Network { + Hashmap *neighbors_by_section; + Hashmap *address_labels_by_section; + Hashmap *prefixes_by_section; ++ Hashmap *route_prefixes_by_section; + Hashmap *rules_by_section; + + /* All kinds of DNS configuration */ +diff --git a/src/network/networkd-radv.c b/src/network/networkd-radv.c +index 25321aefed..8972c661ae 100644 +--- a/src/network/networkd-radv.c ++++ b/src/network/networkd-radv.c +@@ -101,16 +101,100 @@ static int prefix_new_static(Network *network, const char *filename, + return 0; + } + ++int route_prefix_new(Prefix **ret) { ++ _cleanup_(prefix_freep) Prefix *prefix = NULL; ++ ++ prefix = new0(Prefix, 1); ++ if (!prefix) ++ return -ENOMEM; ++ ++ if (sd_radv_route_prefix_new(&prefix->radv_route_prefix) < 0) ++ return -ENOMEM; ++ ++ *ret = TAKE_PTR(prefix); ++ ++ return 0; ++} ++ ++void route_prefix_free(Prefix *prefix) { ++ if (!prefix) ++ return; ++ ++ if (prefix->network) { ++ LIST_REMOVE(prefixes, prefix->network->static_route_prefixes, prefix); ++ assert(prefix->network->n_static_route_prefixes > 0); ++ prefix->network->n_static_route_prefixes--; ++ ++ if (prefix->section) ++ hashmap_remove(prefix->network->route_prefixes_by_section, ++ prefix->section); ++ } ++ ++ network_config_section_free(prefix->section); ++ ++ free(prefix); ++} ++ ++static int route_prefix_new_static(Network *network, const char *filename, ++ unsigned section_line, Prefix **ret) { ++ _cleanup_(network_config_section_freep) NetworkConfigSection *n = NULL; ++ _cleanup_(prefix_freep) Prefix *prefix = NULL; ++ int r; ++ ++ assert(network); ++ assert(ret); ++ assert(!!filename == (section_line > 0)); ++ ++ if (filename) { ++ r = network_config_section_new(filename, section_line, &n); ++ if (r < 0) ++ return r; ++ ++ if (section_line) { ++ prefix = hashmap_get(network->route_prefixes_by_section, n); ++ if (prefix) { ++ *ret = TAKE_PTR(prefix); ++ ++ return 0; ++ } ++ } ++ } ++ ++ r = route_prefix_new(&prefix); ++ if (r < 0) ++ return r; ++ ++ prefix->network = network; ++ LIST_APPEND(prefixes, network->static_route_prefixes, prefix); ++ network->n_static_route_prefixes++; ++ ++ if (filename) { ++ prefix->section = TAKE_PTR(n); ++ ++ r = hashmap_ensure_allocated(&network->route_prefixes_by_section, &network_config_hash_ops); ++ if (r < 0) ++ return r; ++ ++ r = hashmap_put(network->route_prefixes_by_section, prefix->section, prefix); ++ if (r < 0) ++ return r; ++ } ++ ++ *ret = TAKE_PTR(prefix); ++ ++ return 0; ++} ++ + int config_parse_prefix(const char *unit, +- const char *filename, +- unsigned line, +- const char *section, +- unsigned section_line, +- const char *lvalue, +- int ltype, +- const char *rvalue, +- void *data, +- void *userdata) { ++ const char *filename, ++ unsigned line, ++ const char *section, ++ unsigned section_line, ++ const char *lvalue, ++ int ltype, ++ const char *rvalue, ++ void *data, ++ void *userdata) { + + Network *network = userdata; + _cleanup_(prefix_free_or_set_invalidp) Prefix *p = NULL; +@@ -234,6 +318,90 @@ int config_parse_prefix_lifetime(const char *unit, + return 0; + } + ++int config_parse_route_prefix(const char *unit, ++ const char *filename, ++ unsigned line, ++ const char *section, ++ unsigned section_line, ++ const char *lvalue, ++ int ltype, ++ const char *rvalue, ++ void *data, ++ void *userdata) { ++ ++ Network *network = userdata; ++ _cleanup_(prefix_free_or_set_invalidp) Prefix *p = NULL; ++ uint8_t prefixlen = 64; ++ union in_addr_union in6addr; ++ int r; ++ ++ assert(filename); ++ assert(section); ++ assert(lvalue); ++ assert(rvalue); ++ assert(data); ++ ++ r = route_prefix_new_static(network, filename, section_line, &p); ++ if (r < 0) ++ return r; ++ ++ r = in_addr_prefix_from_string(rvalue, AF_INET6, &in6addr, &prefixlen); ++ if (r < 0) { ++ log_syntax(unit, LOG_ERR, filename, line, r, "Route prefix is invalid, ignoring assignment: %s", rvalue); ++ return 0; ++ } ++ ++ if (sd_radv_prefix_set_route_prefix(p->radv_route_prefix, &in6addr.in6, prefixlen) < 0) ++ return -EADDRNOTAVAIL; ++ ++ log_syntax(unit, LOG_INFO, filename, line, r, "Found route prefix %s", rvalue); ++ ++ p = NULL; ++ ++ return 0; ++} ++ ++int config_parse_route_prefix_lifetime(const char *unit, ++ const char *filename, ++ unsigned line, ++ const char *section, ++ unsigned section_line, ++ const char *lvalue, ++ int ltype, ++ const char *rvalue, ++ void *data, ++ void *userdata) { ++ Network *network = userdata; ++ _cleanup_(prefix_free_or_set_invalidp) Prefix *p = NULL; ++ usec_t usec; ++ int r; ++ ++ assert(filename); ++ assert(section); ++ assert(lvalue); ++ assert(rvalue); ++ assert(data); ++ ++ r = route_prefix_new_static(network, filename, section_line, &p); ++ if (r < 0) ++ return r; ++ ++ r = parse_sec(rvalue, &usec); ++ if (r < 0) { ++ log_syntax(unit, LOG_ERR, filename, line, r, "Roure lifetime is invalid, ignoring assignment: %s", rvalue); ++ return 0; ++ } ++ ++ /* a value of 0xffffffff represents infinity */ ++ r = sd_radv_route_prefix_set_lifetime(p->radv_route_prefix, DIV_ROUND_UP(usec, USEC_PER_SEC)); ++ if (r < 0) ++ return r; ++ ++ p = NULL; ++ ++ return 0; ++} ++ + static int radv_get_ip6dns(Network *network, struct in6_addr **dns, + size_t *n_dns) { + _cleanup_free_ struct in6_addr *addresses = NULL; +@@ -438,6 +606,15 @@ int radv_configure(Link *link) { + if (r < 0) + return r; + } ++ ++ LIST_FOREACH(prefixes, p, link->network->static_route_prefixes) { ++ r = sd_radv_add_route_prefix(link->radv, p->radv_route_prefix, false); ++ if (r == -EEXIST) ++ continue; ++ if (r < 0) ++ return r; ++ } ++ + } + + return radv_emit_dns(link); +diff --git a/src/network/networkd-radv.h b/src/network/networkd-radv.h +index 45be083bfe..2f60b285ae 100644 +--- a/src/network/networkd-radv.h ++++ b/src/network/networkd-radv.h +@@ -26,8 +26,10 @@ struct Prefix { + NetworkConfigSection *section; + + sd_radv_prefix *radv_prefix; ++ sd_radv_route_prefix *radv_route_prefix; + + LIST_FIELDS(Prefix, prefixes); ++ LIST_FIELDS(Prefix, route_prefixes); + }; + + int prefix_new(Prefix **ret); +@@ -35,6 +37,11 @@ void prefix_free(Prefix *prefix); + + DEFINE_NETWORK_SECTION_FUNCTIONS(Prefix, prefix_free); + ++int route_prefix_new(Prefix **ret); ++void route_prefix_free(Prefix *prefix); ++ ++DEFINE_NETWORK_SECTION_FUNCTIONS(Prefix, route_prefix_free); ++ + int radv_emit_dns(Link *link); + int radv_configure(Link *link); + +@@ -48,3 +55,5 @@ CONFIG_PARSER_PROTOTYPE(config_parse_prefix_flags); + CONFIG_PARSER_PROTOTYPE(config_parse_prefix_lifetime); + CONFIG_PARSER_PROTOTYPE(config_parse_radv_dns); + CONFIG_PARSER_PROTOTYPE(config_parse_radv_search_domains); ++CONFIG_PARSER_PROTOTYPE(config_parse_route_prefix); ++CONFIG_PARSER_PROTOTYPE(config_parse_route_prefix_lifetime); +diff --git a/src/systemd/sd-radv.h b/src/systemd/sd-radv.h +index 93861b9d24..f085231934 100644 +--- a/src/systemd/sd-radv.h ++++ b/src/systemd/sd-radv.h +@@ -37,6 +37,7 @@ _SD_BEGIN_DECLARATIONS; + + typedef struct sd_radv sd_radv; + typedef struct sd_radv_prefix sd_radv_prefix; ++typedef struct sd_radv_route_prefix sd_radv_route_prefix; + + /* Router Advertisement */ + int sd_radv_new(sd_radv **ret); +@@ -59,6 +60,7 @@ int sd_radv_set_managed_information(sd_radv *ra, int managed); + int sd_radv_set_other_information(sd_radv *ra, int other); + int sd_radv_set_preference(sd_radv *ra, unsigned preference); + int sd_radv_add_prefix(sd_radv *ra, sd_radv_prefix *p, int dynamic); ++int sd_radv_add_route_prefix(sd_radv *ra, sd_radv_route_prefix *p, int dynamic); + sd_radv_prefix *sd_radv_remove_prefix(sd_radv *ra, const struct in6_addr *prefix, + unsigned char prefixlen); + int sd_radv_set_rdnss(sd_radv *ra, uint32_t lifetime, +@@ -80,8 +82,16 @@ int sd_radv_prefix_set_valid_lifetime(sd_radv_prefix *p, + int sd_radv_prefix_set_preferred_lifetime(sd_radv_prefix *p, + uint32_t preferred_lifetime); + ++int sd_radv_route_prefix_new(sd_radv_route_prefix **ret); ++sd_radv_route_prefix *sd_radv_route_prefix_ref(sd_radv_route_prefix *ra); ++sd_radv_route_prefix *sd_radv_route_prefix_unref(sd_radv_route_prefix *ra); ++ ++int sd_radv_prefix_set_route_prefix(sd_radv_route_prefix *p, const struct in6_addr *in6_addr, unsigned char prefixlen); ++int sd_radv_route_prefix_set_lifetime(sd_radv_route_prefix *p, uint32_t valid_lifetime); ++ + _SD_DEFINE_POINTER_CLEANUP_FUNC(sd_radv, sd_radv_unref); + _SD_DEFINE_POINTER_CLEANUP_FUNC(sd_radv_prefix, sd_radv_prefix_unref); ++_SD_DEFINE_POINTER_CLEANUP_FUNC(sd_radv_route_prefix, sd_radv_route_prefix_unref); + + _SD_END_DECLARATIONS; + +diff --git a/test/fuzz/fuzz-network-parser/directives.network b/test/fuzz/fuzz-network-parser/directives.network +index 848d4bd187..b688d37d08 100644 +--- a/test/fuzz/fuzz-network-parser/directives.network ++++ b/test/fuzz/fuzz-network-parser/directives.network +@@ -174,6 +174,9 @@ OnLink= + PreferredLifetimeSec= + AddressAutoconfiguration= + ValidLifetimeSec= ++[IPv6RoutePrefix] ++Route= ++LifetimeSec= + [BridgeVLAN] + EgressUntagged= + VLAN= +-- +2.23.0 + diff --git a/network-add-one-more-section-validty-check.patch b/network-add-one-more-section-validty-check.patch new file mode 100644 index 0000000..f2107bb --- /dev/null +++ b/network-add-one-more-section-validty-check.patch @@ -0,0 +1,28 @@ +From 714a199e481c294b9986b7d5160a89a65d8b375a Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Thu, 19 Sep 2019 15:20:00 +0900 +Subject: [PATCH] network: add one more section validty check + +Follow-up for 203d4df5732b1fdcf50db498ddeb74a934b21f87. +--- + src/network/networkd-network.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c +index d1c4cddeb1..a2cd7f4c60 100644 +--- a/src/network/networkd-network.c ++++ b/src/network/networkd-network.c +@@ -300,6 +300,10 @@ int network_verify(Network *network) { + if (section_is_invalid(prefix->section)) + prefix_free(prefix); + ++ LIST_FOREACH_SAFE(prefixes, prefix, prefix_next, network->static_route_prefixes) ++ if (section_is_invalid(prefix->section)) ++ prefix_free(prefix); ++ + LIST_FOREACH_SAFE(rules, rule, rule_next, network->rules) + if (routing_policy_rule_section_verify(rule) < 0) + routing_policy_rule_free(rule); +-- +2.23.0 + diff --git a/network-fix-invalid-cleanup-function.patch b/network-fix-invalid-cleanup-function.patch new file mode 100644 index 0000000..0b7d423 --- /dev/null +++ b/network-fix-invalid-cleanup-function.patch @@ -0,0 +1,34 @@ +From e7825b2359d484c606bc1ff8ae3e5ab9aaf980c1 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Tue, 5 Nov 2019 10:39:15 +0900 +Subject: [PATCH] network: fix invalid cleanup function + +--- + src/network/networkd-radv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/network/networkd-radv.c b/src/network/networkd-radv.c +index 8972c661ae..4e74756d17 100644 +--- a/src/network/networkd-radv.c ++++ b/src/network/networkd-radv.c +@@ -330,7 +330,7 @@ int config_parse_route_prefix(const char *unit, + void *userdata) { + + Network *network = userdata; +- _cleanup_(prefix_free_or_set_invalidp) Prefix *p = NULL; ++ _cleanup_(route_prefix_free_or_set_invalidp) Prefix *p = NULL; + uint8_t prefixlen = 64; + union in_addr_union in6addr; + int r; +@@ -372,7 +372,7 @@ int config_parse_route_prefix_lifetime(const char *unit, + void *data, + void *userdata) { + Network *network = userdata; +- _cleanup_(prefix_free_or_set_invalidp) Prefix *p = NULL; ++ _cleanup_(route_prefix_free_or_set_invalidp) Prefix *p = NULL; + usec_t usec; + int r; + +-- +2.23.0 + diff --git a/network-fix-memleak-in-route_prefix_free.patch b/network-fix-memleak-in-route_prefix_free.patch new file mode 100644 index 0000000..a63765e --- /dev/null +++ b/network-fix-memleak-in-route_prefix_free.patch @@ -0,0 +1,33 @@ +From 471e126b254dccac66cb2987be3a5f58592d8932 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Tue, 5 Nov 2019 10:46:44 +0900 +Subject: [PATCH] network: fix memleak in route_prefix_free() + +--- + src/network/networkd-radv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/network/networkd-radv.c b/src/network/networkd-radv.c +index 8d933f1901..87db34d6cc 100644 +--- a/src/network/networkd-radv.c ++++ b/src/network/networkd-radv.c +@@ -31,7 +31,7 @@ void prefix_free(Prefix *prefix) { + } + + network_config_section_free(prefix->section); +- prefix->radv_prefix = sd_radv_prefix_unref(prefix->radv_prefix); ++ sd_radv_prefix_unref(prefix->radv_prefix); + + free(prefix); + } +@@ -131,6 +131,7 @@ void route_prefix_free(Prefix *prefix) { + } + + network_config_section_free(prefix->section); ++ sd_radv_route_prefix_unref(prefix->radv_route_prefix); + + free(prefix); + } +-- +2.23.0 + diff --git a/network-fix-memleak.patch b/network-fix-memleak.patch new file mode 100644 index 0000000..5aef90c --- /dev/null +++ b/network-fix-memleak.patch @@ -0,0 +1,34 @@ +From 9be6ae775fb303deb49ee8e4c5013ce98dc48b93 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Tue, 5 Nov 2019 09:39:44 +0900 +Subject: [PATCH] network: fix memleak + +--- + src/network/networkd-network.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c +index 5e82b3c5e0..f6d02fb274 100644 +--- a/src/network/networkd-network.c ++++ b/src/network/networkd-network.c +@@ -586,6 +586,9 @@ static Network *network_free(Network *network) { + while ((prefix = network->static_prefixes)) + prefix_free(prefix); + ++ while ((prefix = network->static_route_prefixes)) ++ route_prefix_free(prefix); ++ + while ((rule = network->rules)) + routing_policy_rule_free(rule); + +@@ -596,6 +599,7 @@ static Network *network_free(Network *network) { + hashmap_free(network->neighbors_by_section); + hashmap_free(network->address_labels_by_section); + hashmap_free(network->prefixes_by_section); ++ hashmap_free(network->route_prefixes_by_section); + hashmap_free(network->rules_by_section); + + if (network->manager) { +-- +2.23.0 + diff --git a/network-use-fix-invalid-free-function.patch b/network-use-fix-invalid-free-function.patch new file mode 100644 index 0000000..e811470 --- /dev/null +++ b/network-use-fix-invalid-free-function.patch @@ -0,0 +1,26 @@ +From acb71754e12f98ebd01963869a297ea262494740 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Tue, 5 Nov 2019 09:36:39 +0900 +Subject: [PATCH] network: use fix invalid free function + +Fixes #13938. +--- + src/network/networkd-network.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c +index 90d86f35a9..5e82b3c5e0 100644 +--- a/src/network/networkd-network.c ++++ b/src/network/networkd-network.c +@@ -306,7 +306,7 @@ int network_verify(Network *network) { + + LIST_FOREACH_SAFE(prefixes, prefix, prefix_next, network->static_route_prefixes) + if (section_is_invalid(prefix->section)) +- prefix_free(prefix); ++ route_prefix_free(prefix); + + LIST_FOREACH_SAFE(rules, rule, rule_next, network->rules) + if (routing_policy_rule_section_verify(rule) < 0) +-- +2.23.0 + diff --git a/sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch b/sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch new file mode 100644 index 0000000..d937f86 --- /dev/null +++ b/sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch @@ -0,0 +1,25 @@ +From 58abbbcc6bcedc4eebd1f5c7733cd41518e1f2e3 Mon Sep 17 00:00:00 2001 +From: sangelovic +Date: Mon, 27 Jan 2020 21:40:37 +0100 +Subject: [PATCH] sd-bus: fix introspection bug in signal parameter names + +--- + src/libsystemd/sd-bus/bus-introspect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/libsystemd/sd-bus/bus-introspect.c b/src/libsystemd/sd-bus/bus-introspect.c +index beab80687d..e8934489b5 100644 +--- a/src/libsystemd/sd-bus/bus-introspect.c ++++ b/src/libsystemd/sd-bus/bus-introspect.c +@@ -160,7 +160,7 @@ int introspect_write_interface(struct introspect *i, const sd_bus_vtable *v) { + case _SD_BUS_VTABLE_SIGNAL: + fprintf(i->f, " \n", v->x.signal.member); + if (bus_vtable_has_names(vtable)) +- names = strempty(v->x.method.names); ++ names = strempty(v->x.signal.names); + introspect_write_arguments(i, strempty(v->x.signal.signature), &names, NULL); + introspect_write_flags(i, v->type, v->flags); + fputs(" \n", i->f); +-- +2.23.0 + diff --git a/sd-bus-invalidate-connection-when-Hello-fails.patch b/sd-bus-invalidate-connection-when-Hello-fails.patch new file mode 100644 index 0000000..2b09b25 --- /dev/null +++ b/sd-bus-invalidate-connection-when-Hello-fails.patch @@ -0,0 +1,66 @@ +From 19fa17c7c4ac228924bd9b7499653a6018abf0b5 Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Fri, 15 Nov 2019 14:23:53 +0100 +Subject: [PATCH] sd-bus: invalidate connection when Hello() fails + +Fixes: #13969 +--- + src/libsystemd/sd-bus/sd-bus.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/src/libsystemd/sd-bus/sd-bus.c b/src/libsystemd/sd-bus/sd-bus.c +index ebbfc588ca..058492a83e 100644 +--- a/src/libsystemd/sd-bus/sd-bus.c ++++ b/src/libsystemd/sd-bus/sd-bus.c +@@ -537,29 +537,41 @@ static int hello_callback(sd_bus_message *reply, void *userdata, sd_bus_error *e + assert(IN_SET(bus->state, BUS_HELLO, BUS_CLOSING)); + + r = sd_bus_message_get_errno(reply); +- if (r > 0) +- return -r; ++ if (r > 0) { ++ r = -r; ++ goto fail; ++ } + + r = sd_bus_message_read(reply, "s", &s); + if (r < 0) +- return r; ++ goto fail; + +- if (!service_name_is_valid(s) || s[0] != ':') +- return -EBADMSG; ++ if (!service_name_is_valid(s) || s[0] != ':') { ++ r = -EBADMSG; ++ goto fail; ++ } + + r = free_and_strdup(&bus->unique_name, s); + if (r < 0) +- return r; ++ goto fail; + + if (bus->state == BUS_HELLO) { + bus_set_state(bus, BUS_RUNNING); + + r = synthesize_connected_signal(bus); + if (r < 0) +- return r; ++ goto fail; + } + + return 1; ++ ++fail: ++ /* When Hello() failed, let's propagate this in two ways: first we return the error immediately here, ++ * which is the propagated up towards the event loop. Let's also invalidate the connection, so that ++ * if the user then calls back into us again we won't wait any longer. */ ++ ++ bus_set_state(bus, BUS_CLOSING); ++ return r; + } + + static int bus_send_hello(sd_bus *bus) { +-- +2.23.0 + diff --git a/sd-radv-fix-memleak.patch b/sd-radv-fix-memleak.patch new file mode 100644 index 0000000..78b1310 --- /dev/null +++ b/sd-radv-fix-memleak.patch @@ -0,0 +1,30 @@ +From 69d7eba1880095f4a9bf9350de777fe7d370c188 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Tue, 5 Nov 2019 13:30:00 +0900 +Subject: [PATCH] sd-radv: fix memleak + +--- + src/libsystemd-network/sd-radv.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/libsystemd-network/sd-radv.c b/src/libsystemd-network/sd-radv.c +index 5c7f727faa..873a2f40f8 100644 +--- a/src/libsystemd-network/sd-radv.c ++++ b/src/libsystemd-network/sd-radv.c +@@ -99,6 +99,13 @@ static sd_radv *radv_free(sd_radv *ra) { + sd_radv_prefix_unref(p); + } + ++ while (ra->route_prefixes) { ++ sd_radv_route_prefix *p = ra->route_prefixes; ++ ++ LIST_REMOVE(prefix, ra->route_prefixes, p); ++ sd_radv_route_prefix_unref(p); ++ } ++ + free(ra->rdnss); + free(ra->dnssl); + +-- +2.23.0 + diff --git a/shared-bus-util-Don-t-replace-exsting-strv.patch b/shared-bus-util-Don-t-replace-exsting-strv.patch new file mode 100644 index 0000000..6b6ae8a --- /dev/null +++ b/shared-bus-util-Don-t-replace-exsting-strv.patch @@ -0,0 +1,33 @@ +From 411975ce63b28194b21b964268efaa04b19cbb37 Mon Sep 17 00:00:00 2001 +From: Kevin Kuehler +Date: Tue, 10 Dec 2019 01:58:01 -0800 +Subject: [PATCH] shared/bus-util: Don't replace exsting strv + +Change the behavior of string arrays in a bus property map. Previously, +passing the same strv pointer to more than one map entry would result in +the old strv being freed and overwritten. With this change, an existing +strv pointer is appended to. + +This is important if we want to create one strv comprised of multiple +dependencies. This makes it so callers don't have to create one strv per +dependency and subsequently merge them into one strv. +--- + src/shared/bus-util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/shared/bus-util.c b/src/shared/bus-util.c +index aea46d3119..10c05eba18 100644 +--- a/src/shared/bus-util.c ++++ b/src/shared/bus-util.c +@@ -1127,7 +1127,7 @@ static int map_basic(sd_bus *bus, const char *member, sd_bus_message *m, unsigne + if (r < 0) + return r; + +- return strv_free_and_replace(*p, l); ++ return strv_extend_strv(p, l, false); + } + + case SD_BUS_TYPE_BOOLEAN: { +-- +2.23.0 + diff --git a/systemctl-Add-with-dependencies-flag.patch b/systemctl-Add-with-dependencies-flag.patch new file mode 100644 index 0000000..8fc4800 --- /dev/null +++ b/systemctl-Add-with-dependencies-flag.patch @@ -0,0 +1,330 @@ +From e9c387c8293c57d1c773fc80d23239350eb3b370 Mon Sep 17 00:00:00 2001 +From: Kevin Kuehler +Date: Sun, 8 Dec 2019 15:23:27 -0800 +Subject: [PATCH] systemctl: Add --with-dependencies flag + +Will print a unit and all of its dependencies. Works with cat, status, +list-units, and list-unit-files. This flag can also be used in conjunction +with --reverse, --before, and --after. + +We also vastly simplify the list_dependencies_get_dependencies logic. +Instead of using 5 strvs and merging them into one, use one strv and +have the bus append all the map values to it. + +Fixes #9273 +--- + src/systemctl/systemctl.c | 227 +++++++++++++++++++++++++------------- + 1 file changed, 148 insertions(+), 79 deletions(-) + +diff --git a/src/systemctl/systemctl.c b/src/systemctl/systemctl.c +index 6a0e59a4d7..0873045173 100644 +--- a/src/systemctl/systemctl.c ++++ b/src/systemctl/systemctl.c +@@ -117,6 +117,7 @@ static bool arg_dry_run = false; + static bool arg_quiet = false; + static bool arg_full = false; + static bool arg_recursive = false; ++static bool arg_with_dependencies = false; + static bool arg_show_transaction = false; + static int arg_force = 0; + static bool arg_ask_password = false; +@@ -799,6 +800,107 @@ static int expand_names(sd_bus *bus, char **names, const char* suffix, char ***r + return c; + } + ++static int list_dependencies_get_dependencies(sd_bus *bus, const char *name, char ***ret) { ++ _cleanup_strv_free_ char **deps = NULL; ++ ++ static const struct bus_properties_map map[_DEPENDENCY_MAX][6] = { ++ [DEPENDENCY_FORWARD] = { ++ { "Requires", "as", NULL, 0 }, ++ { "Requisite", "as", NULL, 0 }, ++ { "Wants", "as", NULL, 0 }, ++ { "ConsistsOf", "as", NULL, 0 }, ++ { "BindsTo", "as", NULL, 0 }, ++ {} ++ }, ++ [DEPENDENCY_REVERSE] = { ++ { "RequiredBy", "as", NULL, 0 }, ++ { "RequisiteOf", "as", NULL, 0 }, ++ { "WantedBy", "as", NULL, 0 }, ++ { "PartOf", "as", NULL, 0 }, ++ { "BoundBy", "as", NULL, 0 }, ++ {} ++ }, ++ [DEPENDENCY_AFTER] = { ++ { "After", "as", NULL, 0 }, ++ {} ++ }, ++ [DEPENDENCY_BEFORE] = { ++ { "Before", "as", NULL, 0 }, ++ {} ++ }, ++ }; ++ ++ _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL; ++ _cleanup_free_ char *dbus_path = NULL; ++ int r; ++ ++ assert(bus); ++ assert(name); ++ assert(ret); ++ ++ dbus_path = unit_dbus_path_from_name(name); ++ if (!dbus_path) ++ return log_oom(); ++ ++ r = bus_map_all_properties(bus, ++ "org.freedesktop.systemd1", ++ dbus_path, ++ map[arg_dependency], ++ BUS_MAP_STRDUP, ++ &error, ++ NULL, ++ &deps); ++ if (r < 0) ++ return log_error_errno(r, "Failed to get properties of %s: %s", name, bus_error_message(&error, r)); ++ ++ *ret = TAKE_PTR(deps); ++ ++ return 0; ++} ++ ++static int append_unit_dependencies(sd_bus *bus, char **names, char ***ret) { ++ _cleanup_strv_free_ char **with_deps = NULL; ++ char **name; ++ ++ assert(bus); ++ assert(ret); ++ ++ STRV_FOREACH(name, names) { ++ _cleanup_strv_free_ char **deps = NULL; ++ ++ if (strv_extend(&with_deps, *name) < 0) ++ return log_oom(); ++ ++ (void) list_dependencies_get_dependencies(bus, *name, &deps); ++ ++ if (strv_extend_strv(&with_deps, deps, true) < 0) ++ return log_oom(); ++ } ++ ++ *ret = TAKE_PTR(with_deps); ++ ++ return 0; ++} ++ ++static int maybe_extend_with_unit_dependencies(sd_bus *bus, char ***list) { ++ assert(bus); ++ assert(list); ++ ++ if (arg_with_dependencies) { ++ int r; ++ _cleanup_strv_free_ char **list_with_deps = NULL; ++ ++ r = append_unit_dependencies(bus, *list, &list_with_deps); ++ if (r < 0) ++ return log_error_errno(r, "Failed to append unit dependencies: %m"); ++ ++ strv_free(*list); ++ *list = TAKE_PTR(list_with_deps); ++ } ++ ++ return 0; ++} ++ + static int list_units(int argc, char *argv[], void *userdata) { + _cleanup_free_ UnitInfo *unit_infos = NULL; + _cleanup_(message_set_freep) Set *replies = NULL; +@@ -812,9 +914,21 @@ static int list_units(int argc, char *argv[], void *userdata) { + + (void) pager_open(arg_pager_flags); + +- r = get_unit_list_recursive(bus, strv_skip(argv, 1), &unit_infos, &replies, &machines); +- if (r < 0) +- return r; ++ if (arg_with_dependencies) { ++ _cleanup_strv_free_ char **names = NULL; ++ ++ r = append_unit_dependencies(bus, strv_skip(argv, 1), &names); ++ if (r < 0) ++ return r; ++ ++ r = get_unit_list_recursive(bus, names, &unit_infos, &replies, &machines); ++ if (r < 0) ++ return r; ++ } else { ++ r = get_unit_list_recursive(bus, strv_skip(argv, 1), &unit_infos, &replies, &machines); ++ if (r < 0) ++ return r; ++ } + + typesafe_qsort(unit_infos, r, compare_unit_info); + return output_units_list(unit_infos, r); +@@ -1571,9 +1685,21 @@ static int list_unit_files(int argc, char *argv[], void *userdata) { + if (r < 0) + return bus_log_create_error(r); + +- r = sd_bus_message_append_strv(m, strv_skip(argv, 1)); +- if (r < 0) +- return bus_log_create_error(r); ++ if (arg_with_dependencies) { ++ _cleanup_strv_free_ char **names_with_deps = NULL; ++ ++ r = append_unit_dependencies(bus, strv_skip(argv, 1), &names_with_deps); ++ if (r < 0) ++ return log_error_errno(r, "Failed to append unit dependencies: %m"); ++ ++ r = sd_bus_message_append_strv(m, names_with_deps); ++ if (r < 0) ++ return bus_log_create_error(r); ++ } else { ++ r = sd_bus_message_append_strv(m, strv_skip(argv, 1)); ++ if (r < 0) ++ return bus_log_create_error(r); ++ } + + r = sd_bus_call(bus, m, 0, &error, &reply); + if (r < 0 && sd_bus_error_has_name(&error, SD_BUS_ERROR_UNKNOWN_METHOD)) { +@@ -1677,79 +1803,6 @@ static int list_dependencies_print(const char *name, int level, unsigned branche + return 0; + } + +-static int list_dependencies_get_dependencies(sd_bus *bus, const char *name, char ***deps) { +- struct DependencyStatusInfo { +- char **dep[5]; +- } info = {}; +- +- static const struct bus_properties_map map[_DEPENDENCY_MAX][6] = { +- [DEPENDENCY_FORWARD] = { +- { "Requires", "as", NULL, offsetof(struct DependencyStatusInfo, dep[0]) }, +- { "Requisite", "as", NULL, offsetof(struct DependencyStatusInfo, dep[1]) }, +- { "Wants", "as", NULL, offsetof(struct DependencyStatusInfo, dep[2]) }, +- { "ConsistsOf", "as", NULL, offsetof(struct DependencyStatusInfo, dep[3]) }, +- { "BindsTo", "as", NULL, offsetof(struct DependencyStatusInfo, dep[4]) }, +- {} +- }, +- [DEPENDENCY_REVERSE] = { +- { "RequiredBy", "as", NULL, offsetof(struct DependencyStatusInfo, dep[0]) }, +- { "RequisiteOf", "as", NULL, offsetof(struct DependencyStatusInfo, dep[1]) }, +- { "WantedBy", "as", NULL, offsetof(struct DependencyStatusInfo, dep[2]) }, +- { "PartOf", "as", NULL, offsetof(struct DependencyStatusInfo, dep[3]) }, +- { "BoundBy", "as", NULL, offsetof(struct DependencyStatusInfo, dep[4]) }, +- {} +- }, +- [DEPENDENCY_AFTER] = { +- { "After", "as", NULL, offsetof(struct DependencyStatusInfo, dep[0]) }, +- {} +- }, +- [DEPENDENCY_BEFORE] = { +- { "Before", "as", NULL, offsetof(struct DependencyStatusInfo, dep[0]) }, +- {} +- }, +- }; +- +- _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL; +- _cleanup_strv_free_ char **ret = NULL; +- _cleanup_free_ char *dbus_path = NULL; +- int i, r; +- +- assert(bus); +- assert(name); +- assert(deps); +- +- dbus_path = unit_dbus_path_from_name(name); +- if (!dbus_path) +- return log_oom(); +- +- r = bus_map_all_properties(bus, +- "org.freedesktop.systemd1", +- dbus_path, +- map[arg_dependency], +- BUS_MAP_STRDUP, +- &error, +- NULL, +- &info); +- if (r < 0) +- return log_error_errno(r, "Failed to get properties of %s: %s", name, bus_error_message(&error, r)); +- +- if (IN_SET(arg_dependency, DEPENDENCY_AFTER, DEPENDENCY_BEFORE)) { +- *deps = info.dep[0]; +- return 0; +- } +- +- for (i = 0; i < 5; i++) { +- r = strv_extend_strv(&ret, info.dep[i], true); +- if (r < 0) +- return log_oom(); +- info.dep[i] = strv_free(info.dep[i]); +- } +- +- *deps = TAKE_PTR(ret); +- +- return 0; +-} +- + static int list_dependencies_compare(char * const *a, char * const *b) { + if (unit_name_to_type(*a) == UNIT_TARGET && unit_name_to_type(*b) != UNIT_TARGET) + return 1; +@@ -5909,6 +5962,10 @@ static int show(int argc, char *argv[], void *userdata) { + if (r < 0) + return log_error_errno(r, "Failed to expand names: %m"); + ++ r = maybe_extend_with_unit_dependencies(bus, &names); ++ if (r < 0) ++ return r; ++ + STRV_FOREACH(name, names) { + _cleanup_free_ char *path; + +@@ -5959,6 +6016,10 @@ static int cat(int argc, char *argv[], void *userdata) { + if (r < 0) + return log_error_errno(r, "Failed to expand names: %m"); + ++ r = maybe_extend_with_unit_dependencies(bus, &names); ++ if (r < 0) ++ return r; ++ + (void) pager_open(arg_pager_flags); + + STRV_FOREACH(name, names) { +@@ -7945,6 +8006,9 @@ static int systemctl_help(void) { + " -l --full Don't ellipsize unit names on output\n" + " -r --recursive Show unit list of host and local containers\n" + " --reverse Show reverse dependencies with 'list-dependencies'\n" ++ " --with-dependencies\n" ++ " Show unit dependencies with 'status', 'cat',\n" ++ " 'list-units', and 'list-unit-files'.\n" + " --job-mode=MODE Specify how to deal with already queued jobs, when\n" + " queueing a new job\n" + " -T --show-transaction\n" +@@ -8235,6 +8298,7 @@ static int systemctl_parse_argv(int argc, char *argv[]) { + ARG_BOOT_LOADER_ENTRY, + ARG_NOW, + ARG_MESSAGE, ++ ARG_WITH_DEPENDENCIES, + ARG_WAIT, + ARG_WHAT, + }; +@@ -8281,6 +8345,7 @@ static int systemctl_parse_argv(int argc, char *argv[]) { + { "plain", no_argument, NULL, ARG_PLAIN }, + { "state", required_argument, NULL, ARG_STATE }, + { "recursive", no_argument, NULL, 'r' }, ++ { "with-dependencies", no_argument, NULL, ARG_WITH_DEPENDENCIES }, + { "preset-mode", required_argument, NULL, ARG_PRESET_MODE }, + { "firmware-setup", no_argument, NULL, ARG_FIRMWARE_SETUP }, + { "boot-loader-menu", required_argument, NULL, ARG_BOOT_LOADER_MENU }, +@@ -8641,6 +8706,10 @@ static int systemctl_parse_argv(int argc, char *argv[]) { + arg_show_transaction = true; + break; + ++ case ARG_WITH_DEPENDENCIES: ++ arg_with_dependencies = true; ++ break; ++ + case ARG_WHAT: { + const char *p; + +-- +2.23.0 + diff --git a/systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch b/systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch new file mode 100644 index 0000000..20d450f --- /dev/null +++ b/systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch @@ -0,0 +1,25 @@ +From 13f697b7b1f3837d144ba6f60188bc7dc4d1fbaa Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Sun, 13 Oct 2019 00:54:34 +0900 +Subject: [PATCH] systemctl: fix memleak caused by wrong cleanup func + +--- + src/systemctl/systemctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/systemctl/systemctl.c b/src/systemctl/systemctl.c +index 98a71c4460..738b9af536 100644 +--- a/src/systemctl/systemctl.c ++++ b/src/systemctl/systemctl.c +@@ -7977,7 +7977,7 @@ static void help_states(void) { + + static int help_boot_loader_entry(void) { + _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL; +- _cleanup_free_ char **l = NULL; ++ _cleanup_strv_free_ char **l = NULL; + sd_bus *bus; + char **i; + int r; +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index e7bc021..baf372a 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 24 +Release: 25 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -89,6 +89,31 @@ Patch0039: seccomp-more-comprehensive-protection-against-libsec.patch Patch0040: network-fix-double-free-in-macsec_receive_channel_fr.patch Patch0041: network-L2TP-fix-crash.patch +Patch0042: systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch +Patch0043: analyze-fix-minor-memleak.patch +Patch0044: network-add-one-more-section-validty-check.patch +Patch0045: network-use-fix-invalid-free-function.patch +Patch0046: network-fix-memleak.patch +Patch0047: network-Add-support-to-advertie-ipv6-route.patch +Patch0048: network-fix-invalid-cleanup-function.patch +Patch0049: network-fix-memleak-in-route_prefix_free.patch +Patch0050: sd-radv-fix-memleak.patch +Patch0051: sd-bus-invalidate-connection-when-Hello-fails.patch +Patch0052: shared-bus-util-Don-t-replace-exsting-strv.patch +Patch0053: systemctl-Add-with-dependencies-flag.patch +Patch0054: man-Document-systemctl-with-dependencies-switch.patch +Patch0055: core-expose-swap-priority-value-via-dbus-only-if-it-.patch +Patch0056: tree-wide-we-forgot-to-destroy-some-bus-errors.patch +Patch0057: sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch +Patch0058: core-sync-SeccompParseFlags-between-dbus-execute-and.patch +Patch0059: core-swap-priority-can-be-negative.patch +Patch0060: core-no-need-to-initialize-swap-structure-fields-if-.patch +Patch0061: core-initialize-priority_set-when-parsing-swap-unit-.patch +Patch0062: core-use-unit-based-logging-instead-of-generic-loggi.patch +Patch0063: core-set-error-value-correctly.patch +Patch0064: core-fix-re-realization-of-cgroup-siblings.patch +Patch0065: basic-string-table-avoid-crash-when-table-is-sparse.patch + #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch Patch9003: 1602-activation-service-must-be-restarted-when-reactivated.patch @@ -1480,6 +1505,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Thu Jun 18 2020 openEuler Buildteam - 243-25 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:dbus commissioning enhancement + * Thu May 28 2020 openEuler Buildteam - 243-24 - Type:enhancement - ID:NA diff --git a/tree-wide-we-forgot-to-destroy-some-bus-errors.patch b/tree-wide-we-forgot-to-destroy-some-bus-errors.patch new file mode 100644 index 0000000..92beba2 --- /dev/null +++ b/tree-wide-we-forgot-to-destroy-some-bus-errors.patch @@ -0,0 +1,39 @@ +From 7e284b054ec599012f0dad6a745f6b52eba87853 Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Fri, 17 Jan 2020 15:37:56 +0100 +Subject: [PATCH] tree-wide: we forgot to destroy some bus errors + +--- + src/libsystemd/sd-bus/test-bus-server.c | 2 +- + src/locale/localed.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/libsystemd/sd-bus/test-bus-server.c b/src/libsystemd/sd-bus/test-bus-server.c +index e38bcdcc76..82eb35e5b1 100644 +--- a/src/libsystemd/sd-bus/test-bus-server.c ++++ b/src/libsystemd/sd-bus/test-bus-server.c +@@ -108,7 +108,7 @@ fail: + static int client(struct context *c) { + _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL, *reply = NULL; + _cleanup_(sd_bus_unrefp) sd_bus *bus = NULL; +- sd_bus_error error = SD_BUS_ERROR_NULL; ++ _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL; + int r; + + assert_se(sd_bus_new(&bus) >= 0); +diff --git a/src/locale/localed.c b/src/locale/localed.c +index baf0bd102b..2031cd25ce 100644 +--- a/src/locale/localed.c ++++ b/src/locale/localed.c +@@ -33,7 +33,7 @@ static int locale_update_system_manager(Context *c, sd_bus *bus) { + _cleanup_free_ char **l_unset = NULL; + _cleanup_strv_free_ char **l_set = NULL; + _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL; +- sd_bus_error error = SD_BUS_ERROR_NULL; ++ _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL; + size_t c_set, c_unset; + LocaleVariable p; + int r; +-- +2.23.0 + -- Gitee From 657ad8be9ad33e8e1550d18c31050f94c530c5e9 Mon Sep 17 00:00:00 2001 From: fayeinseu <15651793630@163.com> Date: Tue, 7 Jul 2020 16:30:00 +0800 Subject: [PATCH 05/29] fix buffer overrun when urlifying. --- ...al-fix-buffer-overrun-when-urlifying.patch | 49 +++++++++++++++++++ systemd.spec | 9 +++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 journal-fix-buffer-overrun-when-urlifying.patch diff --git a/journal-fix-buffer-overrun-when-urlifying.patch b/journal-fix-buffer-overrun-when-urlifying.patch new file mode 100644 index 0000000..d46e191 --- /dev/null +++ b/journal-fix-buffer-overrun-when-urlifying.patch @@ -0,0 +1,49 @@ +From 85fbebe61a1aec2f86e36fb464283b6b55d3d76d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Tue, 23 Jun 2020 20:51:13 +0200 +Subject: [PATCH] journal: fix buffer overrun when urlifying + +Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21122. + +message is only valid until message_len, and we need to make sure we're not +reading pass that. Bug introduced in 2108b56749ebb8d17f06d08b6ada2f79ae4f0. +--- + src/shared/logs-show.c | 9 ++++++--- + test/fuzz/fuzz-journal-remote/oss-fuzz-21122 | Bin 0 -> 35798 bytes + 2 files changed, 6 insertions(+), 3 deletions(-) + create mode 100644 test/fuzz/fuzz-journal-remote/oss-fuzz-21122 + +diff --git a/src/shared/logs-show.c b/src/shared/logs-show.c +index 570377dc76..fee6ccdf2a 100644 +--- a/src/shared/logs-show.c ++++ b/src/shared/logs-show.c +@@ -573,19 +573,22 @@ static int output_short( + if (config_file && + message_len >= config_file_len && + memcmp(message, config_file, config_file_len) == 0 && +- IN_SET(message[config_file_len], ':', ' ', '\0') && ++ (message_len == config_file_len || IN_SET(message[config_file_len], ':', ' ')) && + (!highlight || highlight_shifted[0] == 0 || highlight_shifted[0] > config_file_len)) { + + _cleanup_free_ char *t = NULL, *urlified = NULL; + + t = strndup(config_file, config_file_len); + if (t && terminal_urlify_path(t, NULL, &urlified) >= 0) { +- size_t shift = strlen(urlified) - config_file_len; ++ size_t urlified_len = strlen(urlified); ++ size_t shift = urlified_len - config_file_len; + char *joined; + +- joined = strjoin(urlified, message + config_file_len); ++ joined = realloc(urlified, message_len + shift); + if (joined) { ++ memcpy(joined + urlified_len, message + config_file_len, message_len - config_file_len); + free_and_replace(message, joined); ++ TAKE_PTR(urlified); + message_len += shift; + if (highlight) { + highlight_shifted[0] += shift; + +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index baf372a..6a90b19 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 25 +Release: 26 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -113,6 +113,7 @@ Patch0062: core-use-unit-based-logging-instead-of-generic-loggi.patch Patch0063: core-set-error-value-correctly.patch Patch0064: core-fix-re-realization-of-cgroup-siblings.patch Patch0065: basic-string-table-avoid-crash-when-table-is-sparse.patch +Patch0066: journal-fix-buffer-overrun-when-urlifying.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1505,6 +1506,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Tue Jul 7 2020 openEuler Buildteam - 243-26 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:fix buffer overrun when urlifying + * Thu Jun 18 2020 openEuler Buildteam - 243-25 - Type:enhancement - ID:NA -- Gitee From 33904a01d7e1740b798c0d05e1dc56bdcd8ee7ca Mon Sep 17 00:00:00 2001 From: Yangyang Shen Date: Mon, 23 Nov 2020 16:26:49 +0800 Subject: [PATCH 06/29] add elevator= kernel command line parameter and don't enable bfq by default --- ...dev-use-bfq-as-the-default-scheduler.patch | 40 ------------------- ...le-that-adds-elevator-kernel-command.patch | 6 +-- systemd.spec | 11 +++-- 3 files changed, 11 insertions(+), 46 deletions(-) delete mode 100644 0001-udev-use-bfq-as-the-default-scheduler.patch diff --git a/0001-udev-use-bfq-as-the-default-scheduler.patch b/0001-udev-use-bfq-as-the-default-scheduler.patch deleted file mode 100644 index bbb294b..0000000 --- a/0001-udev-use-bfq-as-the-default-scheduler.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 5ab4d083dbe0a1ae095875c4af6ac26749b67211 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= -Date: Wed, 14 Aug 2019 15:57:42 +0200 -Subject: [PATCH] udev: use bfq as the default scheduler - -As requested in https://bugzilla.redhat.com/show_bug.cgi?id=1738828. -Test results are that bfq seems to behave better and more consistently on -typical hardware. The kernel does not have a configuration option to set -the default scheduler, and it currently needs to be set by userspace. - -See the bug for more discussion and links. ---- - rules/60-block-scheduler.rules | 5 +++++ - rules/meson.build | 1 + - 2 files changed, 6 insertions(+) - create mode 100644 rules/60-block-scheduler.rules - -diff --git a/rules/60-block-scheduler.rules b/rules/60-block-scheduler.rules -new file mode 100644 -index 00000000000..480b941761f ---- /dev/null -+++ b/rules/60-block-scheduler.rules -@@ -0,0 +1,5 @@ -+# do not edit this file, it will be overwritten on update -+ -+ACTION=="add", SUBSYSTEM=="block", \ -+ KERNEL=="mmcblk*[0-9]|msblk*[0-9]|mspblk*[0-9]|sd*[!0-9]|sr*", \ -+ ATTR{queue/scheduler}="bfq" -diff --git a/rules/meson.build b/rules/meson.build -index b6a32ba77e2..1da958b4d46 100644 ---- a/rules/meson.build -+++ b/rules/meson.build -@@ -2,6 +2,7 @@ - - rules = files(''' - 60-block.rules -+ 60-block-scheduler.rules - 60-cdrom_id.rules - 60-drm.rules - 60-evdev.rules diff --git a/rules-add-the-rule-that-adds-elevator-kernel-command.patch b/rules-add-the-rule-that-adds-elevator-kernel-command.patch index dd20b73..2e5faab 100644 --- a/rules-add-the-rule-that-adds-elevator-kernel-command.patch +++ b/rules-add-the-rule-that-adds-elevator-kernel-command.patch @@ -11,7 +11,7 @@ Resolves: #1670126 1 file changed, 1 insertion(+) diff --git a/rules/meson.build b/rules/meson.build -index 1da958b..043313a 100644 +index 0fb5c6a..a2dbf2b 100644 --- a/rules/meson.build +++ b/rules/meson.build @@ -1,6 +1,7 @@ @@ -20,8 +20,8 @@ index 1da958b..043313a 100644 rules = files(''' + 40-elevator.rules 60-block.rules - 60-block-scheduler.rules 60-cdrom_id.rules + 60-drm.rules -- -2.19.1 +2.23.0 diff --git a/systemd.spec b/systemd.spec index 6a90b19..28e6d50 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 26 +Release: 27 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -44,7 +44,6 @@ Source105: rule_generator.functions Source106: write_net_rules Source107: detect_virt -Patch0001: 0001-udev-use-bfq-as-the-default-scheduler.patch Patch0002: 0001-udev-ignore-error-caused-by-device-disconnection.patch Patch0003: 0001-core-dont-check-error-parameter-of-get_name_owner_handler.patch Patch0004: 0001-core-dont-check-potentially-NULL-error.patch @@ -1409,7 +1408,6 @@ fi %{_udevrulesdir}/60-persistent-v4l.rules %{_udevrulesdir}/70-joystick.rules %{_udevrulesdir}/70-power-switch.rules -%{_udevrulesdir}/60-block-scheduler.rules %{_udevrulesdir}/60-persistent-storage.rules %{_udevrulesdir}/80-net-setup-link.rules %{_udevrulesdir}/60-evdev.rules @@ -1506,6 +1504,13 @@ fi %exclude /usr/share/man/man3/* %changelog +* Mon Nov 23 2020 openEuler Buildteam - 243-27 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:add elevator= kernel command line parameter and don't enable bfq + by default + * Tue Jul 7 2020 openEuler Buildteam - 243-26 - Type:enhancement - ID:NA -- Gitee From 6aa75ab3773d8a7a9eb0aa3c115b4ffa2400b4c0 Mon Sep 17 00:00:00 2001 From: Yangyang Shen Date: Wed, 25 Nov 2020 10:59:27 +0800 Subject: [PATCH 07/29] don't enable systemd-journald-audit.socket by default --- ...able-systemd-journald-audit.socket-b.patch | 19 +++++++++++++++++-- systemd.spec | 9 +++++++-- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/journal-don-t-enable-systemd-journald-audit.socket-b.patch b/journal-don-t-enable-systemd-journald-audit.socket-b.patch index bdb9129..1c4f54a 100644 --- a/journal-don-t-enable-systemd-journald-audit.socket-b.patch +++ b/journal-don-t-enable-systemd-journald-audit.socket-b.patch @@ -7,9 +7,24 @@ Subject: [PATCH] journal: don't enable systemd-journald-audit.socket Resolves: #1699287 --- + units/meson.build | 3 +-- units/systemd-journald.service.in | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) + 2 files changed, 2 insertions(+), 3 deletions(-) +diff --git a/units/meson.build b/units/meson.build +index e105ade..48c621d 100644 +--- a/units/meson.build ++++ b/units/meson.build +@@ -88,8 +88,7 @@ units = [ + 'sockets.target.wants/'], + ['systemd-journal-gatewayd.socket', 'ENABLE_REMOTE HAVE_MICROHTTPD'], + ['systemd-journal-remote.socket', 'ENABLE_REMOTE HAVE_MICROHTTPD'], +- ['systemd-journald-audit.socket', '', +- 'sockets.target.wants/'], ++ ['systemd-journald-audit.socket', ''], + ['systemd-journald-dev-log.socket', '', + 'sockets.target.wants/'], + ['systemd-journald.socket', '', diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 089bc38..7436619 100644 --- a/units/systemd-journald.service.in @@ -24,5 +39,5 @@ index 089bc38..7436619 100644 SystemCallArchitectures=native SystemCallErrorNumber=EPERM -- -2.19.1 +2.23.0 diff --git a/systemd.spec b/systemd.spec index 28e6d50..e4bbaba 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 27 +Release: 28 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -1139,7 +1139,6 @@ fi %{_unitdir}/multi-user.target.wants/systemd-update-utmp-runlevel.service %{_unitdir}/systemd-hostnamed.service.d/disable-privatedevices.conf %{_unitdir}/sockets.target.wants/systemd-coredump.socket -%{_unitdir}/sockets.target.wants/systemd-journald-audit.socket %{_unitdir}/sockets.target.wants/systemd-journald-dev-log.socket %{_unitdir}/sockets.target.wants/systemd-journald.socket %{_unitdir}/sockets.target.wants/systemd-initctl.socket @@ -1504,6 +1503,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Wed Nov 25 2020 shenyangyang - 243-28 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:don't enable systemd-journald-audit.socket by default + * Mon Nov 23 2020 openEuler Buildteam - 243-27 - Type:enhancement - ID:NA -- Gitee From ccd97e8e83936269351d019ec84bcf512b4334da Mon Sep 17 00:00:00 2001 From: Yangyang Shen Date: Mon, 14 Dec 2020 14:10:47 +0800 Subject: [PATCH 08/29] revert don't enable systemd-journald-audit.socket by default --- ...able-systemd-journald-audit.socket-b.patch | 19 ++----------------- systemd.spec | 11 ++++++++++- 2 files changed, 12 insertions(+), 18 deletions(-) diff --git a/journal-don-t-enable-systemd-journald-audit.socket-b.patch b/journal-don-t-enable-systemd-journald-audit.socket-b.patch index 1c4f54a..bdb9129 100644 --- a/journal-don-t-enable-systemd-journald-audit.socket-b.patch +++ b/journal-don-t-enable-systemd-journald-audit.socket-b.patch @@ -7,24 +7,9 @@ Subject: [PATCH] journal: don't enable systemd-journald-audit.socket Resolves: #1699287 --- - units/meson.build | 3 +-- units/systemd-journald.service.in | 2 +- - 2 files changed, 2 insertions(+), 3 deletions(-) + 1 file changed, 1 insertion(+), 1 deletion(-) -diff --git a/units/meson.build b/units/meson.build -index e105ade..48c621d 100644 ---- a/units/meson.build -+++ b/units/meson.build -@@ -88,8 +88,7 @@ units = [ - 'sockets.target.wants/'], - ['systemd-journal-gatewayd.socket', 'ENABLE_REMOTE HAVE_MICROHTTPD'], - ['systemd-journal-remote.socket', 'ENABLE_REMOTE HAVE_MICROHTTPD'], -- ['systemd-journald-audit.socket', '', -- 'sockets.target.wants/'], -+ ['systemd-journald-audit.socket', ''], - ['systemd-journald-dev-log.socket', '', - 'sockets.target.wants/'], - ['systemd-journald.socket', '', diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 089bc38..7436619 100644 --- a/units/systemd-journald.service.in @@ -39,5 +24,5 @@ index 089bc38..7436619 100644 SystemCallArchitectures=native SystemCallErrorNumber=EPERM -- -2.23.0 +2.19.1 diff --git a/systemd.spec b/systemd.spec index e4bbaba..82ab381 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 28 +Release: 29 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -1139,6 +1139,7 @@ fi %{_unitdir}/multi-user.target.wants/systemd-update-utmp-runlevel.service %{_unitdir}/systemd-hostnamed.service.d/disable-privatedevices.conf %{_unitdir}/sockets.target.wants/systemd-coredump.socket +%{_unitdir}/sockets.target.wants/systemd-journald-audit.socket %{_unitdir}/sockets.target.wants/systemd-journald-dev-log.socket %{_unitdir}/sockets.target.wants/systemd-journald.socket %{_unitdir}/sockets.target.wants/systemd-initctl.socket @@ -1503,6 +1504,14 @@ fi %exclude /usr/share/man/man3/* %changelog +* Mon Dec 14 2020 shenyangyang - 243-29 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:revert don't enable systemd-journald-audit.socket by default + that may cause reboot problem if update systemd with out dracut -f + from LTS-20.03 + * Wed Nov 25 2020 shenyangyang - 243-28 - Type:enhancement - ID:NA -- Gitee From 5f8e8fb7c9d8baf533a4ec032d444f9ae4b23b9d Mon Sep 17 00:00:00 2001 From: Yangyang Shen Date: Wed, 16 Dec 2020 11:17:28 +0800 Subject: [PATCH 09/29] do not create /var/log/journal on initial installation --- systemd.spec | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/systemd.spec b/systemd.spec index 82ab381..08882f6 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 29 +Release: 30 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -576,12 +576,6 @@ systemctl daemon-reexec &>/dev/null || : journalctl --update-catalog &>/dev/null || : systemd-tmpfiles --create &>/dev/null || : -# create /var/log/journal only on initial installation, -# and only if it's writable (it won't be in rpm-ostree). -if [ $1 -eq 1 ] && [ -w %{_localstatedir} ]; then - mkdir -p %{_localstatedir}/log/journal -fi - # Make sure new journal files will be owned by the "systemd-journal" group machine_id=$(cat /etc/machine-id 2>/dev/null) chgrp systemd-journal /{run,var}/log/journal/{,${machine_id}} &>/dev/null || : @@ -1504,6 +1498,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Wed Dec 16 2020 shenyangyang - 243-30 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:do not create /var/log/journal on initial installation + * Mon Dec 14 2020 shenyangyang - 243-29 - Type:enhancement - ID:NA @@ -1953,7 +1953,7 @@ fi - Type:bugfix - ID:NA - SUG:restart -- DESC:do not create /var/log/journal on initial installation refer to redhat8 +- DESC:do not create /var/log/journal on initial installation * Sat Feb 02 2019 Yi Cang - 239-3.h3 - Type:enhance -- Gitee From f5e09308d150e55317accad6759435099bd0b617 Mon Sep 17 00:00:00 2001 From: Hexiaowen Date: Fri, 18 Dec 2020 10:13:11 +0800 Subject: [PATCH 10/29] Fix bug of memory offline udev rules in 40-openEuler.rules --- systemd.spec | 8 +++++++- udev-40-openEuler.rules | 3 ++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/systemd.spec b/systemd.spec index 08882f6..26cab8d 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 30 +Release: 31 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -1498,6 +1498,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Fri Dec 18 2020 overweight - 243-31 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC: fix 40-openEuler.rules for memory offline + * Wed Dec 16 2020 shenyangyang - 243-30 - Type:enhancement - ID:NA diff --git a/udev-40-openEuler.rules b/udev-40-openEuler.rules index ed85acb..dcf0ef0 100644 --- a/udev-40-openEuler.rules +++ b/udev-40-openEuler.rules @@ -4,7 +4,8 @@ SUBSYSTEM=="cpu", ACTION=="add", TEST=="online", ATTR{online}=="0", ATTR{online}="1" # Memory hotadd request -SUBSYSTEM!="memory", ACTION!="add", GOTO="memory_hotplug_end" +SUBSYSTEM!="memory", GOTO="memory_hotplug_end" +ACTION!="add", GOTO="memory_hotplug_end" PROGRAM="/bin/uname -p", RESULT=="s390*", GOTO="memory_hotplug_end" ENV{.state}="online" -- Gitee From d11b24bbe4cf2f5389ec158addc5fafcca8aba6d Mon Sep 17 00:00:00 2001 From: overweight Date: Thu, 28 Jan 2021 22:26:52 -0800 Subject: [PATCH 11/29] fix cve-2018-21029 --- ...-in-resolved.conf-man-page-with-rega.patch | 37 ++ ...mplement-SNI-when-using-DNS-over-TLS.patch | 330 ++++++++++++++++++ ...-resolve-error-handling-improvements.patch | 80 +++++ ...or-IP-in-certificate-when-using-DoT-.patch | 51 +++ ...nection-failures-with-TLS-1.3-and-Gn.patch | 34 ++ ...-at-least-version-3.6.0-of-GnuTLS-fo.patch | 58 +++ ...-use-hostname-for-certificate-valida.patch | 124 +++++++ systemd.spec | 17 +- 8 files changed, 730 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch create mode 100644 backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch create mode 100644 backport-CVE-2018-21029-resolve-error-handling-improvements.patch create mode 100644 backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch create mode 100644 backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch create mode 100644 backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch create mode 100644 backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch diff --git a/backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch b/backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch new file mode 100644 index 0000000..95167a5 --- /dev/null +++ b/backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch @@ -0,0 +1,37 @@ +From 2f2b28ab35e80855042c69e324feaf7418636aa2 Mon Sep 17 00:00:00 2001 +From: Riccardo Schirone +Date: Wed, 13 Nov 2019 17:37:15 +0100 +Subject: [PATCH] Be more specific in resolved.conf man page with regard to + DNSOverTLS + +DNSOverTLS in strict mode (value yes) does check the server, as it is said in +the first few lines of the option documentation. The check is not performed in +"opportunistic" mode, however, as that is allowed by RFC 7858, section "4.1. +Opportunistic Privacy Profile". + +> With such a discovered DNS server, the client might or might not validate the +> resolver. These choices maximize availability and performance, but they leave +> the client vulnerable to on-path attacks that remove privacy. +--- + man/resolved.conf.xml | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/man/resolved.conf.xml b/man/resolved.conf.xml +index 213be1d7b2..818000145b 100644 +--- a/man/resolved.conf.xml ++++ b/man/resolved.conf.xml +@@ -210,8 +210,9 @@ + send for setting up an encrypted connection, and thus results + in a small DNS look-up time penalty. + +- Note as the resolver is not capable of authenticating +- the server, it is vulnerable for "man-in-the-middle" attacks. ++ Note that in opportunistic mode the ++ resolver is not capable of authenticating the server, so it is ++ vulnerable to "man-in-the-middle" attacks. + + In addition to this global DNSOverTLS setting + systemd-networkd.service8 +-- +2.26.2 + diff --git a/backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch b/backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch new file mode 100644 index 0000000..a864bca --- /dev/null +++ b/backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch @@ -0,0 +1,330 @@ +From 2e22a54f4e085496088b77085f38b66532da59fb Mon Sep 17 00:00:00 2001 +From: Guilhem Lettron +Date: Sat, 30 Nov 2019 03:51:40 +0100 +Subject: [PATCH] Implement SNI when using DNS-over-TLS + +Some DNS providers need SNI to identify client. + +This can be used by adding #name to a DNS. +Example: +[Resolve] +DNS=192.168.1.1#example.com +--- + man/resolved.conf.xml | 3 +++ + src/resolve/meson.build | 8 ++++++ + src/resolve/resolved-conf.c | 6 +++-- + src/resolve/resolved-dns-server.c | 12 ++++++++- + src/resolve/resolved-dns-server.h | 5 +++- + src/resolve/resolved-dnstls-gnutls.c | 6 +++++ + src/resolve/resolved-dnstls-openssl.c | 11 ++++++++ + src/resolve/resolved-link-bus.c | 2 +- + src/resolve/resolved-link.c | 2 +- + src/resolve/resolved-util.c | 36 +++++++++++++++++++++++++++ + src/resolve/resolved-util.h | 6 +++++ + src/resolve/test-resolved-util.c | 32 ++++++++++++++++++++++++ + 12 files changed, 123 insertions(+), 6 deletions(-) + create mode 100644 src/resolve/resolved-util.c + create mode 100644 src/resolve/resolved-util.h + create mode 100644 src/resolve/test-resolved-util.c + +diff --git a/man/resolved.conf.xml b/man/resolved.conf.xml +index 818000145b..0f70ced5b5 100644 +--- a/man/resolved.conf.xml ++++ b/man/resolved.conf.xml +@@ -214,6 +214,9 @@ + resolver is not capable of authenticating the server, so it is + vulnerable to "man-in-the-middle" attacks. + ++ Server Name Indication (SNI) can be used when opening a TLS connection. ++ Entries in DNS= should be in format address#server_name. ++ + In addition to this global DNSOverTLS setting + systemd-networkd.service8 + also maintains per-link DNSOverTLS settings. For system DNS +diff --git a/src/resolve/meson.build b/src/resolve/meson.build +index 92b67b6333..c4d8d4e5d9 100644 +--- a/src/resolve/meson.build ++++ b/src/resolve/meson.build +@@ -64,6 +64,8 @@ systemd_resolved_sources = files(''' + resolved-etc-hosts.h + resolved-etc-hosts.c + resolved-dnstls.h ++ resolved-util.c ++ resolved-util.h + '''.split()) + + resolvectl_sources = files(''' +@@ -228,4 +230,10 @@ tests += [ + [], + [], + 'ENABLE_RESOLVE', 'manual'], ++ ++ [['src/resolve/test-resolved-util.c', ++ 'src/resolve/resolved-util.c', ++ 'src/resolve/resolved-util.h'], ++ [], ++ []], + ] +diff --git a/src/resolve/resolved-conf.c b/src/resolve/resolved-conf.c +index a46c45385b..ca5b8e7918 100644 +--- a/src/resolve/resolved-conf.c ++++ b/src/resolve/resolved-conf.c +@@ -8,6 +8,7 @@ + #include "parse-util.h" + #include "resolved-conf.h" + #include "resolved-dnssd.h" ++#include "resolved-util.h" + #include "specifier.h" + #include "string-table.h" + #include "string-util.h" +@@ -27,11 +28,12 @@ static int manager_add_dns_server_by_string(Manager *m, DnsServerType type, cons + union in_addr_union address; + int family, r, ifindex = 0; + DnsServer *s; ++ _cleanup_free_ char *server_name = NULL; + + assert(m); + assert(word); + +- r = in_addr_ifindex_from_string_auto(word, &family, &address, &ifindex); ++ r = in_addr_ifindex_name_from_string_auto(word, &family, &address, &ifindex, &server_name); + if (r < 0) + return r; + +@@ -52,7 +54,7 @@ static int manager_add_dns_server_by_string(Manager *m, DnsServerType type, cons + return 0; + } + +- return dns_server_new(m, NULL, type, NULL, family, &address, ifindex); ++ return dns_server_new(m, NULL, type, NULL, family, &address, ifindex, server_name); + } + + int manager_parse_dns_server_string_and_warn(Manager *m, DnsServerType type, const char *string) { +diff --git a/src/resolve/resolved-dns-server.c b/src/resolve/resolved-dns-server.c +index 9f2c97314f..4b0599ab9c 100644 +--- a/src/resolve/resolved-dns-server.c ++++ b/src/resolve/resolved-dns-server.c +@@ -25,8 +25,10 @@ int dns_server_new( + Link *l, + int family, + const union in_addr_union *in_addr, +- int ifindex) { ++ int ifindex, ++ const char *server_name) { + ++ _cleanup_free_ char *name = NULL; + DnsServer *s; + + assert(m); +@@ -44,6 +46,12 @@ int dns_server_new( + return -E2BIG; + } + ++ if (server_name) { ++ name = strdup(server_name); ++ if (!name) ++ return -ENOMEM; ++ } ++ + s = new(DnsServer, 1); + if (!s) + return -ENOMEM; +@@ -55,6 +63,7 @@ int dns_server_new( + .family = family, + .address = *in_addr, + .ifindex = ifindex, ++ .server_name = TAKE_PTR(name), + }; + + dns_server_reset_features(s); +@@ -107,6 +116,7 @@ static DnsServer* dns_server_free(DnsServer *s) { + #endif + + free(s->server_string); ++ free(s->server_name); + return mfree(s); + } + +diff --git a/src/resolve/resolved-dns-server.h b/src/resolve/resolved-dns-server.h +index 54339355aa..889c80a205 100644 +--- a/src/resolve/resolved-dns-server.h ++++ b/src/resolve/resolved-dns-server.h +@@ -53,6 +53,8 @@ struct DnsServer { + + char *server_string; + ++ char *server_name; ++ + /* The long-lived stream towards this server. */ + DnsStream *stream; + +@@ -94,7 +96,8 @@ int dns_server_new( + Link *link, + int family, + const union in_addr_union *address, +- int ifindex); ++ int ifindex, ++ const char *server_string); + + DnsServer* dns_server_ref(DnsServer *s); + DnsServer* dns_server_unref(DnsServer *s); +diff --git a/src/resolve/resolved-dnstls-gnutls.c b/src/resolve/resolved-dnstls-gnutls.c +index ed0a31e8bf..aad3bb4481 100644 +--- a/src/resolve/resolved-dnstls-gnutls.c ++++ b/src/resolve/resolved-dnstls-gnutls.c +@@ -67,6 +67,12 @@ int dnstls_stream_connect_tls(DnsStream *stream, DnsServer *server) { + gnutls_session_set_verify_cert2(gs, &stream->dnstls_data.validation, 1, 0); + } + ++ if (server->server_name) { ++ r = gnutls_server_name_set(gs, GNUTLS_NAME_DNS, server->server_name, strlen(server->server_name)); ++ if (r < 0) ++ return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to set server name: %s", gnutls_strerror(r)); ++ } ++ + gnutls_handshake_set_timeout(gs, GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT); + + gnutls_transport_set_ptr2(gs, (gnutls_transport_ptr_t) (long) stream->fd, stream); +diff --git a/src/resolve/resolved-dnstls-openssl.c b/src/resolve/resolved-dnstls-openssl.c +index 85e202ff74..ce0a437371 100644 +--- a/src/resolve/resolved-dnstls-openssl.c ++++ b/src/resolve/resolved-dnstls-openssl.c +@@ -87,6 +87,17 @@ int dnstls_stream_connect_tls(DnsStream *stream, DnsServer *server) { + return -ECONNREFUSED; + } + ++ if (server->server_name) { ++ r = SSL_set_tlsext_host_name(s, server->server_name); ++ if (r <= 0) { ++ char errbuf[256]; ++ ++ error = ERR_get_error(); ++ ERR_error_string_n(error, errbuf, sizeof(errbuf)); ++ return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to set server name: %s", errbuf); ++ } ++ } ++ + ERR_clear_error(); + stream->dnstls_data.handshake = SSL_do_handshake(s); + if (stream->dnstls_data.handshake <= 0) { +diff --git a/src/resolve/resolved-link-bus.c b/src/resolve/resolved-link-bus.c +index 8a2768b1e2..dae8435b45 100644 +--- a/src/resolve/resolved-link-bus.c ++++ b/src/resolve/resolved-link-bus.c +@@ -284,7 +284,7 @@ int bus_link_method_set_dns_servers(sd_bus_message *message, void *userdata, sd_ + if (s) + dns_server_move_back_and_unmark(s); + else { +- r = dns_server_new(l->manager, NULL, DNS_SERVER_LINK, l, dns[i].family, &dns[i].address, 0); ++ r = dns_server_new(l->manager, NULL, DNS_SERVER_LINK, l, dns[i].family, &dns[i].address, 0, NULL); + if (r < 0) + goto clear; + } +diff --git a/src/resolve/resolved-link.c b/src/resolve/resolved-link.c +index 96ebb4d23d..f19fc2f3aa 100644 +--- a/src/resolve/resolved-link.c ++++ b/src/resolve/resolved-link.c +@@ -269,7 +269,7 @@ static int link_update_dns_server_one(Link *l, const char *name) { + return 0; + } + +- return dns_server_new(l->manager, NULL, DNS_SERVER_LINK, l, family, &a, 0); ++ return dns_server_new(l->manager, NULL, DNS_SERVER_LINK, l, family, &a, 0, NULL); + } + + static int link_update_dns_servers(Link *l) { +diff --git a/src/resolve/resolved-util.c b/src/resolve/resolved-util.c +new file mode 100644 +index 0000000000..2f18f8c19d +--- /dev/null ++++ b/src/resolve/resolved-util.c +@@ -0,0 +1,36 @@ ++/* SPDX-License-Identifier: LGPL-2.1+ */ ++ ++#include "alloc-util.h" ++#include "in-addr-util.h" ++#include "macro.h" ++#include "resolved-util.h" ++ ++int in_addr_ifindex_name_from_string_auto(const char *s, int *family, union in_addr_union *ret, int *ifindex, char **server_name) { ++ _cleanup_free_ char *buf = NULL, *name = NULL; ++ const char *m; ++ int r; ++ ++ assert(s); ++ ++ m = strchr(s, '#'); ++ if (m) { ++ name = strdup(m+1); ++ if (!name) ++ return -ENOMEM; ++ ++ buf = strndup(s, m - s); ++ if (!buf) ++ return -ENOMEM; ++ ++ s = buf; ++ } ++ ++ r = in_addr_ifindex_from_string_auto(s, family, ret, ifindex); ++ if (r < 0) ++ return r; ++ ++ if (server_name) ++ *server_name = TAKE_PTR(name); ++ ++ return r; ++} +diff --git a/src/resolve/resolved-util.h b/src/resolve/resolved-util.h +new file mode 100644 +index 0000000000..10ebbc0874 +--- /dev/null ++++ b/src/resolve/resolved-util.h +@@ -0,0 +1,6 @@ ++/* SPDX-License-Identifier: LGPL-2.1+ */ ++#pragma once ++ ++#include "in-addr-util.h" ++ ++int in_addr_ifindex_name_from_string_auto(const char *s, int *family, union in_addr_union *ret, int *ifindex, char **server_name); +diff --git a/src/resolve/test-resolved-util.c b/src/resolve/test-resolved-util.c +new file mode 100644 +index 0000000000..35bd73c4f6 +--- /dev/null ++++ b/src/resolve/test-resolved-util.c +@@ -0,0 +1,32 @@ ++/* SPDX-License-Identifier: LGPL-2.1+ */ ++ ++#include "log.h" ++#include "resolved-util.h" ++#include "string-util.h" ++#include "tests.h" ++ ++ ++static void test_in_addr_ifindex_name_from_string_auto_one(const char *a, const char *expected) { ++ int family, ifindex; ++ union in_addr_union ua; ++ _cleanup_free_ char *server_name = NULL; ++ ++ assert_se(in_addr_ifindex_name_from_string_auto(a, &family, &ua, &ifindex, &server_name) >= 0); ++ assert_se(streq_ptr(server_name, expected)); ++} ++ ++static void test_in_addr_ifindex_name_from_string_auto(void) { ++ log_info("/* %s */", __func__); ++ ++ test_in_addr_ifindex_name_from_string_auto_one("192.168.0.1", NULL); ++ test_in_addr_ifindex_name_from_string_auto_one("192.168.0.1#test.com", "test.com"); ++ test_in_addr_ifindex_name_from_string_auto_one("fe80::18%19", NULL); ++ test_in_addr_ifindex_name_from_string_auto_one("fe80::18%19#another.test.com", "another.test.com"); ++} ++ ++int main(int argc, char **argv) { ++ test_setup_logging(LOG_DEBUG); ++ ++ test_in_addr_ifindex_name_from_string_auto(); ++ return 0; ++} +-- +2.26.2 + diff --git a/backport-CVE-2018-21029-resolve-error-handling-improvements.patch b/backport-CVE-2018-21029-resolve-error-handling-improvements.patch new file mode 100644 index 0000000..c04f6d6 --- /dev/null +++ b/backport-CVE-2018-21029-resolve-error-handling-improvements.patch @@ -0,0 +1,80 @@ +From df70539f9fe01a16d0f561ad9c6f5d7a955039c0 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Mon, 10 Feb 2020 14:50:03 +0900 +Subject: [PATCH] resolve: error handling improvements + +--- + src/resolve/resolved-dnstls-openssl.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/src/resolve/resolved-dnstls-openssl.c b/src/resolve/resolved-dnstls-openssl.c +index ce0a437371..8f58efacbd 100644 +--- a/src/resolve/resolved-dnstls-openssl.c ++++ b/src/resolve/resolved-dnstls-openssl.c +@@ -73,7 +73,9 @@ int dnstls_stream_connect_tls(DnsStream *stream, DnsServer *server) { + return -ENOMEM; + + SSL_set_connect_state(s); +- SSL_set_session(s, server->dnstls_data.session); ++ r = SSL_set_session(s, server->dnstls_data.session); ++ if (r == 0) ++ return -EIO; + SSL_set_bio(s, TAKE_PTR(rb), TAKE_PTR(wb)); + + if (server->manager->dns_over_tls_mode == DNS_OVER_TLS_YES) { +@@ -83,7 +85,7 @@ int dnstls_stream_connect_tls(DnsStream *stream, DnsServer *server) { + SSL_set_verify(s, SSL_VERIFY_PEER, NULL); + v = SSL_get0_param(s); + ip = server->family == AF_INET ? (const unsigned char*) &server->address.in.s_addr : server->address.in6.s6_addr; +- if (!X509_VERIFY_PARAM_set1_ip(v, ip, FAMILY_ADDRESS_SIZE(server->family))) ++ if (X509_VERIFY_PARAM_set1_ip(v, ip, FAMILY_ADDRESS_SIZE(server->family)) == 0) + return -ECONNREFUSED; + } + +@@ -106,8 +108,8 @@ int dnstls_stream_connect_tls(DnsStream *stream, DnsServer *server) { + char errbuf[256]; + + ERR_error_string_n(error, errbuf, sizeof(errbuf)); +- log_debug("Failed to invoke SSL_do_handshake: %s", errbuf); +- return -ECONNREFUSED; ++ return log_debug_errno(SYNTHETIC_ERRNO(ECONNREFUSED), ++ "Failed to invoke SSL_do_handshake: %s", errbuf); + } + } + +@@ -368,20 +370,27 @@ void dnstls_server_free(DnsServer *server) { + + int dnstls_manager_init(Manager *manager) { + int r; ++ + assert(manager); + + ERR_load_crypto_strings(); + SSL_load_error_strings(); +- manager->dnstls_data.ctx = SSL_CTX_new(TLS_client_method()); + ++ manager->dnstls_data.ctx = SSL_CTX_new(TLS_client_method()); + if (!manager->dnstls_data.ctx) + return -ENOMEM; + +- SSL_CTX_set_min_proto_version(manager->dnstls_data.ctx, TLS1_2_VERSION); +- SSL_CTX_set_options(manager->dnstls_data.ctx, SSL_OP_NO_COMPRESSION); ++ r = SSL_CTX_set_min_proto_version(manager->dnstls_data.ctx, TLS1_2_VERSION); ++ if (r == 0) ++ return -EIO; ++ ++ (void) SSL_CTX_set_options(manager->dnstls_data.ctx, SSL_OP_NO_COMPRESSION); ++ + r = SSL_CTX_set_default_verify_paths(manager->dnstls_data.ctx); +- if (r < 0) +- log_warning("Failed to load system trust store: %s", ERR_error_string(ERR_get_error(), NULL)); ++ if (r == 0) ++ return log_warning_errno(SYNTHETIC_ERRNO(EIO), ++ "Failed to load system trust store: %s", ++ ERR_error_string(ERR_get_error(), NULL)); + + return 0; + } +-- +2.26.2 + diff --git a/backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch b/backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch new file mode 100644 index 0000000..74b9b80 --- /dev/null +++ b/backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch @@ -0,0 +1,51 @@ +From 7f2f4faced3fda47e6b76ab73cde747cc20cf8b8 Mon Sep 17 00:00:00 2001 +From: Iwan Timmer +Date: Tue, 29 Oct 2019 20:32:18 +0100 +Subject: [PATCH] resolved: check for IP in certificate when using DoT with + GnuTLS + +Validate the IP address in the certificate for DNS-over-TLS in strict mode when GnuTLS is used. As this is not yet the case in contrast to the documentation. +--- + src/resolve/resolved-dnstls-gnutls.c | 13 +++++++++++-- + src/resolve/resolved-dnstls-gnutls.h | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/src/resolve/resolved-dnstls-gnutls.c b/src/resolve/resolved-dnstls-gnutls.c +index ea276d2c20..9e5e60fcce 100644 +--- a/src/resolve/resolved-dnstls-gnutls.c ++++ b/src/resolve/resolved-dnstls-gnutls.c +@@ -55,8 +55,17 @@ int dnstls_stream_connect_tls(DnsStream *stream, DnsServer *server) { + server->dnstls_data.session_data.size = 0; + } + +- if (server->manager->dns_over_tls_mode == DNS_OVER_TLS_YES) +- gnutls_session_set_verify_cert(gs, NULL, 0); ++ if (server->manager->dns_over_tls_mode == DNS_OVER_TLS_YES) { ++ stream->dnstls_data.validation.type = GNUTLS_DT_IP_ADDRESS; ++ if (server->family == AF_INET) { ++ stream->dnstls_data.validation.data = (unsigned char*) &server->address.in.s_addr; ++ stream->dnstls_data.validation.size = 4; ++ } else { ++ stream->dnstls_data.validation.data = server->address.in6.s6_addr; ++ stream->dnstls_data.validation.size = 16; ++ } ++ gnutls_session_set_verify_cert2(gs, &stream->dnstls_data.validation, 1, 0); ++ } + + gnutls_handshake_set_timeout(gs, GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT); + +diff --git a/src/resolve/resolved-dnstls-gnutls.h b/src/resolve/resolved-dnstls-gnutls.h +index af52f04fdf..d4da2017c3 100644 +--- a/src/resolve/resolved-dnstls-gnutls.h ++++ b/src/resolve/resolved-dnstls-gnutls.h +@@ -18,6 +18,7 @@ struct DnsTlsServerData { + + struct DnsTlsStreamData { + gnutls_session_t session; ++ gnutls_typed_vdata_st validation; + int handshake; + bool shutdown; + }; +-- +2.26.2 + diff --git a/backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch b/backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch new file mode 100644 index 0000000..38431f0 --- /dev/null +++ b/backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch @@ -0,0 +1,34 @@ +From 68805580209cfaa50b2400d1a2e6c66500001395 Mon Sep 17 00:00:00 2001 +From: Peter Wu +Date: Sun, 20 Oct 2019 18:10:31 +0100 +Subject: [PATCH] resolved: fix connection failures with TLS 1.3 and GnuTLS + +Prefer TLS 1.3 before TLS 1.2 for DNS-over-TLS support, otherwise +servers compliant with RFC 8446 might end up agreeing TLS 1.2 plus a +downgrade signal which is not expected by GnuTLS clients. This manifests +in the following error: + + Failed to invoke gnutls_handshake: An illegal parameter has been received. + +Fixes: #13528 +Fixes: v242-962-g9c0624dcdb ("resolved: support TLS 1.3 when using GnuTLS for DNS-over-TLS") +--- + src/resolve/resolved-dnstls-gnutls.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/resolve/resolved-dnstls-gnutls.c b/src/resolve/resolved-dnstls-gnutls.c +index 06d635fcc4..7ad9662073 100644 +--- a/src/resolve/resolved-dnstls-gnutls.c ++++ b/src/resolve/resolved-dnstls-gnutls.c +@@ -10,7 +10,7 @@ + #include "resolved-dnstls.h" + + #if GNUTLS_VERSION_NUMBER >= 0x030600 +-#define PRIORTY_STRING "NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3" ++#define PRIORTY_STRING "NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2" + #else + #define PRIORTY_STRING "NORMAL:-VERS-ALL:+VERS-TLS1.2" + #endif +-- +2.26.2 + diff --git a/backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch b/backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch new file mode 100644 index 0000000..32124be --- /dev/null +++ b/backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch @@ -0,0 +1,58 @@ +From 38e053c58fa139e0f546f327b5d8ce3db7cf1647 Mon Sep 17 00:00:00 2001 +From: Iwan Timmer +Date: Tue, 29 Oct 2019 20:26:05 +0100 +Subject: [PATCH] resolved: require at least version 3.6.0 of GnuTLS for + DNS-over-TLS + +Increase the required version to ensure TLS 1.3 is always supported when using GnuTLS for DNS-over-TLS and allow further changes to use recent API additions. +--- + README | 2 +- + meson.build | 2 +- + src/resolve/resolved-dnstls-gnutls.c | 4 ---- + 3 files changed, 2 insertions(+), 6 deletions(-) + +diff --git a/README b/README +index 8aa16fe8c9..8dbf94b49c 100644 +--- a/README ++++ b/README +@@ -155,7 +155,7 @@ REQUIREMENTS: + libmicrohttpd (optional) + libpython (optional) + libidn2 or libidn (optional) +- gnutls >= 3.1.4 (optional, >= 3.5.3 is required to support DNS-over-TLS with gnutls) ++ gnutls >= 3.1.4 (optional, >= 3.6.0 is required to support DNS-over-TLS with gnutls) + openssl >= 1.1.0 (optional, required to support DNS-over-TLS with openssl) + elfutils >= 158 (optional) + polkit (optional) +diff --git a/meson.build b/meson.build +index 0001504d53..a7a9222582 100644 +--- a/meson.build ++++ b/meson.build +@@ -1199,7 +1199,7 @@ if dns_over_tls != 'false' + if dns_over_tls == 'openssl' + have_gnutls = false + else +- have_gnutls = (conf.get('HAVE_GNUTLS') == 1 and libgnutls.version().version_compare('>= 3.5.3')) ++ have_gnutls = (conf.get('HAVE_GNUTLS') == 1 and libgnutls.version().version_compare('>= 3.6.0')) + if dns_over_tls == 'gnutls' and not have_gnutls + error('DNS-over-TLS support was requested with gnutls, but dependencies are not available') + endif +diff --git a/src/resolve/resolved-dnstls-gnutls.c b/src/resolve/resolved-dnstls-gnutls.c +index 7ad9662073..ea276d2c20 100644 +--- a/src/resolve/resolved-dnstls-gnutls.c ++++ b/src/resolve/resolved-dnstls-gnutls.c +@@ -9,11 +9,7 @@ + #include "resolved-dns-stream.h" + #include "resolved-dnstls.h" + +-#if GNUTLS_VERSION_NUMBER >= 0x030600 + #define PRIORTY_STRING "NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2" +-#else +-#define PRIORTY_STRING "NORMAL:-VERS-ALL:+VERS-TLS1.2" +-#endif + DEFINE_TRIVIAL_CLEANUP_FUNC(gnutls_session_t, gnutls_deinit); + + static ssize_t dnstls_stream_writev(gnutls_transport_ptr_t p, const giovec_t *iov, int iovcnt) { +-- +2.26.2 + diff --git a/backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch b/backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch new file mode 100644 index 0000000..f69880f --- /dev/null +++ b/backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch @@ -0,0 +1,124 @@ +From eec394f10bbfcc3d2fc8504ad8ff5be44231abd5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= +Date: Tue, 3 Mar 2020 23:31:25 +0000 +Subject: [PATCH] systemd-resolved: use hostname for certificate validation in + DoT + +Widely accepted certificates for IP addresses are expensive and only +affordable for larger organizations. Therefore if the user provides +the hostname in the DNS= option, we should use it instead of the IP +address. +--- + man/resolved.conf.xml | 19 +++++++++++-------- + src/resolve/resolved-dnstls-gnutls.c | 20 ++++++++++++-------- + src/resolve/resolved-dnstls-openssl.c | 15 +++++++++++---- + 3 files changed, 34 insertions(+), 20 deletions(-) + +diff --git a/man/resolved.conf.xml b/man/resolved.conf.xml +index 0f70ced5b5..37161ebcbc 100644 +--- a/man/resolved.conf.xml ++++ b/man/resolved.conf.xml +@@ -193,11 +193,17 @@ + + DNSOverTLS= + +- Takes a boolean argument or opportunistic. +- If true all connections to the server will be encrypted. Note that +- this mode requires a DNS server that supports DNS-over-TLS and has +- a valid certificate for it's IP. If the DNS server does not support +- DNS-over-TLS all DNS requests will fail. When set to opportunistic ++ Takes a boolean argument or opportunistic. If ++ true all connections to the server will be encrypted. Note that this ++ mode requires a DNS server that supports DNS-over-TLS and has a valid ++ certificate. If the hostname was specified in DNS= ++ by using the format format address#server_name it ++ is used to validate its certificate and also to enable Server Name ++ Indication (SNI) when opening a TLS connection. Otherwise ++ the certificate is checked against the server's IP. ++ If the DNS server does not support DNS-over-TLS all DNS requests will fail. ++ ++ When set to opportunistic + DNS request are attempted to send encrypted with DNS-over-TLS. + If the DNS server does not support TLS, DNS-over-TLS is disabled. + Note that this mode makes DNS-over-TLS vulnerable to "downgrade" +@@ -214,9 +220,6 @@ + resolver is not capable of authenticating the server, so it is + vulnerable to "man-in-the-middle" attacks. + +- Server Name Indication (SNI) can be used when opening a TLS connection. +- Entries in DNS= should be in format address#server_name. +- + In addition to this global DNSOverTLS setting + systemd-networkd.service8 + also maintains per-link DNSOverTLS settings. For system DNS +diff --git a/src/resolve/resolved-dnstls-gnutls.c b/src/resolve/resolved-dnstls-gnutls.c +index aad3bb4481..ef90a7d5ae 100644 +--- a/src/resolve/resolved-dnstls-gnutls.c ++++ b/src/resolve/resolved-dnstls-gnutls.c +@@ -56,15 +56,19 @@ int dnstls_stream_connect_tls(DnsStream *stream, DnsServer *server) { + } + + if (server->manager->dns_over_tls_mode == DNS_OVER_TLS_YES) { +- stream->dnstls_data.validation.type = GNUTLS_DT_IP_ADDRESS; +- if (server->family == AF_INET) { +- stream->dnstls_data.validation.data = (unsigned char*) &server->address.in.s_addr; +- stream->dnstls_data.validation.size = 4; +- } else { +- stream->dnstls_data.validation.data = server->address.in6.s6_addr; +- stream->dnstls_data.validation.size = 16; ++ if (server->server_name) ++ gnutls_session_set_verify_cert(gs, server->server_name, 0); ++ else { ++ stream->dnstls_data.validation.type = GNUTLS_DT_IP_ADDRESS; ++ if (server->family == AF_INET) { ++ stream->dnstls_data.validation.data = (unsigned char*) &server->address.in.s_addr; ++ stream->dnstls_data.validation.size = 4; ++ } else { ++ stream->dnstls_data.validation.data = server->address.in6.s6_addr; ++ stream->dnstls_data.validation.size = 16; ++ } ++ gnutls_session_set_verify_cert2(gs, &stream->dnstls_data.validation, 1, 0); + } +- gnutls_session_set_verify_cert2(gs, &stream->dnstls_data.validation, 1, 0); + } + + if (server->server_name) { +diff --git a/src/resolve/resolved-dnstls-openssl.c b/src/resolve/resolved-dnstls-openssl.c +index 8f58efacbd..7763cbcb5a 100644 +--- a/src/resolve/resolved-dnstls-openssl.c ++++ b/src/resolve/resolved-dnstls-openssl.c +@@ -6,6 +6,7 @@ + + #include + #include ++#include + + #include "io-util.h" + #include "resolved-dns-stream.h" +@@ -80,13 +81,19 @@ int dnstls_stream_connect_tls(DnsStream *stream, DnsServer *server) { + + if (server->manager->dns_over_tls_mode == DNS_OVER_TLS_YES) { + X509_VERIFY_PARAM *v; +- const unsigned char *ip; + + SSL_set_verify(s, SSL_VERIFY_PEER, NULL); + v = SSL_get0_param(s); +- ip = server->family == AF_INET ? (const unsigned char*) &server->address.in.s_addr : server->address.in6.s6_addr; +- if (X509_VERIFY_PARAM_set1_ip(v, ip, FAMILY_ADDRESS_SIZE(server->family)) == 0) +- return -ECONNREFUSED; ++ if (server->server_name) { ++ X509_VERIFY_PARAM_set_hostflags(v, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); ++ if (X509_VERIFY_PARAM_set1_host(v, server->server_name, 0) == 0) ++ return -ECONNREFUSED; ++ } else { ++ const unsigned char *ip; ++ ip = server->family == AF_INET ? (const unsigned char*) &server->address.in.s_addr : server->address.in6.s6_addr; ++ if (X509_VERIFY_PARAM_set1_ip(v, ip, FAMILY_ADDRESS_SIZE(server->family)) == 0) ++ return -ECONNREFUSED; ++ } + } + + if (server->server_name) { +-- +2.26.2 + diff --git a/systemd.spec b/systemd.spec index 26cab8d..cf6808d 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 31 +Release: 32 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -114,6 +114,15 @@ Patch0064: core-fix-re-realization-of-cgroup-siblings.patch Patch0065: basic-string-table-avoid-crash-when-table-is-sparse.patch Patch0066: journal-fix-buffer-overrun-when-urlifying.patch +Patch0071: backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch +Patch0072: backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch +Patch0073: backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch +Patch0074: backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch +Patch0075: backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch +Patch0076: backport-CVE-2018-21029-resolve-error-handling-improvements.patch +Patch0077: backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch + + #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch Patch9003: 1602-activation-service-must-be-restarted-when-reactivated.patch @@ -1498,6 +1507,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Fri Jan 29 2021 overweight - 246-32 +- Type:cve +- ID:CVE-2018-21029 +- SUG:NA +- DESC:fix cve-2018-21029 + * Fri Dec 18 2020 overweight - 243-31 - Type:bugfix - ID:NA -- Gitee From cfafd16a87c931a4e182295e0a4c30097c3c96df Mon Sep 17 00:00:00 2001 From: fangxiuning Date: Fri, 2 Apr 2021 16:12:52 +0800 Subject: [PATCH 12/29] modify --- ...rdata-pointer-inheritance-from-varli.patch | 84 +++++++++++++++++++ systemd.spec | 10 ++- 2 files changed, 92 insertions(+), 2 deletions(-) create mode 100644 backport-varlink-make-userdata-pointer-inheritance-from-varli.patch diff --git a/backport-varlink-make-userdata-pointer-inheritance-from-varli.patch b/backport-varlink-make-userdata-pointer-inheritance-from-varli.patch new file mode 100644 index 0000000..fd3e27c --- /dev/null +++ b/backport-varlink-make-userdata-pointer-inheritance-from-varli.patch @@ -0,0 +1,84 @@ +From 9807fdc1da8e037ddedfa4e2c6d2728b6e60051e Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Wed, 20 Jan 2021 19:15:55 +0100 +Subject: [PATCH] varlink: make 'userdata' pointer inheritance from varlink + server to connection optional + +@keszybz's right on +https://github.com/systemd/systemd/pull/18248#issuecomment-760798473: +swapping out the userdata pointer of a live varlink connection is iffy. + +Let's fix this by making the userdata inheritance from VarlinkServer +object to the Varlink connection object optional: we want it for most +cases, but not all, i.e. all those cases where the calls implemented as +varlink methods are stateless and can be answered synchronously. For the +other cases (i.e. where we want per-connection objects that wrap the +asynchronous operation as it goes on) let's not do such inheritance but +initialize the userdata pointer only once we have it. THis means the +original manager object must be manually retrieved from the +VarlinkServer object, which in turn needs to be requested from the +Varlink connection object. + +The userdata inheritance is now controlled by the +VARLINK_INHERIT_USERDATA flag passed at VarlinkServer construction. + +Alternative-to: #18248 + +--- + src/journal/journald-server.c | 2 +- + src/shared/varlink.c | 4 +++- + src/shared/varlink.h | 9 +++++---- + 3 files changed, 9 insertions(+), 6 deletions(-) + +diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c +index a0c2dcd..7f3c7a9 100644 +--- a/src/journal/journald-server.c ++++ b/src/journal/journald-server.c +@@ -1968,7 +1968,7 @@ static int server_open_varlink(Server *s) { + + assert(s); + +- r = varlink_server_new(&s->varlink_server, VARLINK_SERVER_ROOT_ONLY); ++ r = varlink_server_new(&s->varlink_server, VARLINK_SERVER_ROOT_ONLY|VARLINK_SERVER_INHERIT_USERDATA); + if (r < 0) + return r; + +diff --git a/src/shared/varlink.c b/src/shared/varlink.c +index 9934316..06fb0ab 100644 +--- a/src/shared/varlink.c ++++ b/src/shared/varlink.c +@@ -2035,7 +2035,9 @@ int varlink_server_add_connection(VarlinkServer *server, int fd, Varlink **ret) + return r; + + v->fd = fd; +- v->userdata = server->userdata; ++ if (server->flags & VARLINK_SERVER_INHERIT_USERDATA) ++ v->userdata = server->userdata; ++ + if (ucred_acquired) { + v->ucred = ucred; + v->ucred_acquired = true; +diff --git a/src/shared/varlink.h b/src/shared/varlink.h +index d96fa93..1284bc8 100644 +--- a/src/shared/varlink.h ++++ b/src/shared/varlink.h +@@ -41,11 +41,12 @@ typedef enum VarlinkMethodFlags { + } VarlinkMethodFlags; + + typedef enum VarlinkServerFlags { +- VARLINK_SERVER_ROOT_ONLY = 1 << 0, /* Only accessible by root */ +- VARLINK_SERVER_MYSELF_ONLY = 1 << 1, /* Only accessible by our own UID */ +- VARLINK_SERVER_ACCOUNT_UID = 1 << 2, /* Do per user accounting */ ++ VARLINK_SERVER_ROOT_ONLY = 1 << 0, /* Only accessible by root */ ++ VARLINK_SERVER_MYSELF_ONLY = 1 << 1, /* Only accessible by our own UID */ ++ VARLINK_SERVER_ACCOUNT_UID = 1 << 2, /* Do per user accounting */ ++ VARLINK_SERVER_INHERIT_USERDATA = 1 << 3, /* Initialize Varlink connection userdata from VarlinkServer userdata */ + +- _VARLINK_SERVER_FLAGS_ALL = (1 << 3) - 1, ++ _VARLINK_SERVER_FLAGS_ALL = (1 << 4) - 1, + } VarlinkServerFlags; + + typedef int (*VarlinkMethod)(Varlink *link, JsonVariant *parameters, VarlinkMethodFlags flags, void *userdata); +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index cf6808d..3b634cf 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 32 +Release: 33 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -121,7 +121,7 @@ Patch0074: backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-pa Patch0075: backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch Patch0076: backport-CVE-2018-21029-resolve-error-handling-improvements.patch Patch0077: backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch - +Patch0078: backport-varlink-make-userdata-pointer-inheritance-from-varli.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1507,6 +1507,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Fri Apr 02 2021 fangxiuning - 246-33 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:fix userdate double free + * Fri Jan 29 2021 overweight - 246-32 - Type:cve - ID:CVE-2018-21029 -- Gitee From 5e7b151efd697fff3f1bb4435aebec4490ca7b92 Mon Sep 17 00:00:00 2001 From: Yangyang Shen Date: Mon, 10 May 2021 15:11:26 +0800 Subject: [PATCH 13/29] backport from upstream to solve the problem when devices claim the same slot --- ...t-generate-slot-based-names-if-multi.patch | 130 ++++++++++++++++++ ...e-_SUN-ACPI-index-as-a-signed-intege.patch | 46 +++++++ systemd.spec | 18 ++- 3 files changed, 189 insertions(+), 5 deletions(-) create mode 100644 backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch create mode 100644 backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch diff --git a/backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch b/backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch new file mode 100644 index 0000000..81d22f5 --- /dev/null +++ b/backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch @@ -0,0 +1,130 @@ +From 2c8ec0095e6fd2e72879d4915ff8a9e5c0664d0b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michal=20Sekleta=CC=81r?= +Date: Mon, 19 Oct 2020 11:10:31 +0200 +Subject: [PATCH] udev/net_id: don't generate slot based names if multiple + devices might claim the same slot + +--- + man/systemd.net-naming-scheme.xml | 14 ++++++++++++++ + src/udev/net/naming-scheme.c | 1 + + src/udev/net/naming-scheme.h | 2 ++ + src/udev/udev-builtin-net_id.c | 29 ++++++++++++++++++++++++++++- + 4 files changed, 45 insertions(+), 1 deletion(-) + +diff --git a/man/systemd.net-naming-scheme.xml b/man/systemd.net-naming-scheme.xml +index 91ad57d..40d7e58 100644 +--- a/man/systemd.net-naming-scheme.xml ++++ b/man/systemd.net-naming-scheme.xml +@@ -182,6 +182,9 @@ + SR-IOV virtual devices are named based on the name of the parent interface, with a suffix of + v and the virtual device number, with any leading zeros removed. The bus + number is ignored. This device type is found in IBM PowerVMs. ++ ++ In some configurations a parent PCI bridge of a given network controller may be associated ++ with a slot. In such case we don't generate this device property to avoid possible naming conflicts. + + + +@@ -329,6 +332,17 @@ + Previously two-letter interface type prefix was prepended to + ID_NET_LABEL_ONBOARD=. This is not done anymore. + ++ ++ ++ v246 ++ ++ If the PCI slot is assocated with PCI bridge and that has multiple child network ++ controllers then all of them might derive the same value of ID_NET_NAME_SLOT ++ property. That could cause naming conflict if the property is selected as a device name. Now, we detect the ++ situation, slot - bridge relation, and we don't produce the ID_NET_NAME_SLOT property to ++ avoid possible naming conflict. ++ ++ + + + Note that latest may be used to denote the latest scheme known (to this +diff --git a/src/udev/net/naming-scheme.c b/src/udev/net/naming-scheme.c +index 0d7f413..ebab2ff 100644 +--- a/src/udev/net/naming-scheme.c ++++ b/src/udev/net/naming-scheme.c +@@ -10,6 +10,7 @@ static const NamingScheme naming_schemes[] = { + { "v240", NAMING_V240 }, + { "v241", NAMING_V241 }, + { "v243", NAMING_V243 }, ++ { "v246", NAMING_V246 }, + /* … add more schemes here, as the logic to name devices is updated … */ + }; + +diff --git a/src/udev/net/naming-scheme.h b/src/udev/net/naming-scheme.h +index 38dfa75..d744f3e 100644 +--- a/src/udev/net/naming-scheme.h ++++ b/src/udev/net/naming-scheme.h +@@ -30,6 +30,7 @@ typedef enum NamingSchemeFlags { + NAMING_STABLE_VIRTUAL_MACS = 1 << 5, /* Use device name to generate MAC, see 6d3646406560 */ + NAMING_NETDEVSIM = 1 << 6, /* Generate names for netdevsim devices, see eaa9d507d855 */ + NAMING_LABEL_NOPREFIX = 1 << 7, /* Don't prepend ID_NET_LABEL_ONBOARD with interface type prefix */ ++ NAMING_BRIDGE_NO_SLOT = 1 << 9, /* Don't use PCI hotplug slot information if the corresponding device is a PCI bridge */ + + /* And now the masks that combine the features above */ + NAMING_V238 = 0, +@@ -37,6 +38,7 @@ typedef enum NamingSchemeFlags { + NAMING_V240 = NAMING_V239 | NAMING_INFINIBAND | NAMING_ZERO_ACPI_INDEX | NAMING_ALLOW_RERENAMES, + NAMING_V241 = NAMING_V240 | NAMING_STABLE_VIRTUAL_MACS, + NAMING_V243 = NAMING_V241 | NAMING_NETDEVSIM | NAMING_LABEL_NOPREFIX, ++ NAMING_V246 = NAMING_V243 | NAMING_BRIDGE_NO_SLOT, + + _NAMING_SCHEME_FLAGS_INVALID = -1, + } NamingSchemeFlags; +diff --git a/src/udev/udev-builtin-net_id.c b/src/udev/udev-builtin-net_id.c +index 99d44a2..af0d2a7 100644 +--- a/src/udev/udev-builtin-net_id.c ++++ b/src/udev/udev-builtin-net_id.c +@@ -244,6 +244,25 @@ static bool is_pci_ari_enabled(sd_device *dev) { + return streq(a, "1"); + } + ++static bool is_pci_bridge(sd_device *dev) { ++ const char *v, *p; ++ ++ if (sd_device_get_sysattr_value(dev, "modalias", &v) < 0) ++ return false; ++ ++ if (!startswith(v, "pci:")) ++ return false; ++ ++ p = strrchr(v, 's'); ++ if (!p) ++ return false; ++ if (p[1] != 'c') ++ return false; ++ ++ /* PCI device subclass 04 corresponds to PCI bridge */ ++ return strneq(p + 2, "04", 2); ++} ++ + static int dev_pci_slot(sd_device *dev, struct netnames *names) { + unsigned long dev_port = 0; + unsigned domain, bus, slot, func; +@@ -343,10 +362,18 @@ static int dev_pci_slot(sd_device *dev, struct netnames *names) { + read_one_line_file(str, &address) >= 0 && + startswith(sysname, address)) { + hotplug_slot = i; ++ ++ /* We found the match between PCI device and slot. However, we won't use the ++ * slot index if the device is a PCI bridge, because it can have other child ++ * devices that will try to claim the same index and that would create name ++ * collision. */ ++ if (naming_scheme_has(NAMING_BRIDGE_NO_SLOT) && is_pci_bridge(hotplug_slot_dev)) ++ hotplug_slot = 0; ++ + break; + } + } +- if (hotplug_slot > 0) ++ if (hotplug_slot >= 0) + break; + if (sd_device_get_parent_with_subsystem_devtype(hotplug_slot_dev, "pci", NULL, &hotplug_slot_dev) < 0) + break; +-- +2.23.0 + diff --git a/backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch b/backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch new file mode 100644 index 0000000..98ef693 --- /dev/null +++ b/backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch @@ -0,0 +1,46 @@ +From 3e545ae5abcf258791eacbee60c829c100a33274 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michal=20Sekleta=CC=81r?= +Date: Mon, 19 Oct 2020 10:56:11 +0200 +Subject: [PATCH] udev/net_id: parse _SUN ACPI index as a signed integer + +Negative value means there is no match between a PCI device and any of +the slots. In the following commit we will extend this and value of 0 +will indicate that there is a match between some slot and PCI device, +but that device is a PCI bridge. +--- + src/udev/udev-builtin-net_id.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/src/udev/udev-builtin-net_id.c b/src/udev/udev-builtin-net_id.c +index b82fd88..99d44a2 100644 +--- a/src/udev/udev-builtin-net_id.c ++++ b/src/udev/udev-builtin-net_id.c +@@ -246,7 +246,8 @@ static bool is_pci_ari_enabled(sd_device *dev) { + + static int dev_pci_slot(sd_device *dev, struct netnames *names) { + unsigned long dev_port = 0; +- unsigned domain, bus, slot, func, hotplug_slot = 0; ++ unsigned domain, bus, slot, func; ++ int hotplug_slot = -1; + size_t l; + char *s; + const char *sysname, *attr, *port_name = NULL, *syspath; +@@ -327,13 +328,13 @@ static int dev_pci_slot(sd_device *dev, struct netnames *names) { + continue; + + FOREACH_DIRENT_ALL(dent, dir, break) { +- unsigned i; ++ int i; + char str[PATH_MAX]; + _cleanup_free_ char *address = NULL; + + if (dent->d_name[0] == '.') + continue; +- r = safe_atou_full(dent->d_name, 10, &i); ++ r = safe_atoi(dent->d_name, &i); + if (r < 0 || i <= 0) + continue; + +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index 3b634cf..bf1dbd2 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 33 +Release: 34 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -122,6 +122,8 @@ Patch0075: backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.pa Patch0076: backport-CVE-2018-21029-resolve-error-handling-improvements.patch Patch0077: backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch Patch0078: backport-varlink-make-userdata-pointer-inheritance-from-varli.patch +Patch0079: backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch +Patch0080: backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -173,10 +175,10 @@ Provides: systemd-sysv = 206 Conflicts: initscripts < 9.56.1 Recommends: %{name}-help -Provides: %{name}-pam -Provides: %{name}-rpm-config -Obsoletes: %{name}-pam -Obsoletes: %{name}-rpm-config +Provides: %{name}-pam = %{version}-%{release} +Provides: %{name}-rpm-config = %{version}-%{release} +Obsoletes: %{name}-pam <= %{version}-%{release} +Obsoletes: %{name}-rpm-config <= %{version}-%{release} %description systemd is a system and service manager that runs as PID 1 and starts @@ -1507,6 +1509,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Mon May 10 2021 shenyangyang - 246-34 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:backport from upstream to solve the problem when devices claim the same slot + * Fri Apr 02 2021 fangxiuning - 246-33 - Type:bugfix - ID:NA -- Gitee From a56347b63c7e9b26fa0c1a4d266488ddc5df25c3 Mon Sep 17 00:00:00 2001 From: Yangyang Shen Date: Thu, 27 May 2021 12:26:32 +0800 Subject: [PATCH 14/29] change requires to openssl-libs as post scripts systemctl requires libssl.so.1.1 (cherry picked from commit 5f9878444222cdc9dd3e832fa198e3e7450e4bf8) --- systemd.spec | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/systemd.spec b/systemd.spec index bf1dbd2..a86c8d7 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 34 +Release: 35 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -157,7 +157,7 @@ Requires(post): coreutils Requires(post): sed Requires(post): acl Requires(post): grep -Requires(post): openssl +Requires(post): openssl-libs Requires(pre): coreutils Requires(pre): /usr/bin/getent Requires(pre): /usr/sbin/groupadd @@ -1509,6 +1509,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Thu May 27 2021 shenyangyang - 246-35 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:change requires to openssl-libs as post scripts systemctl requires libssl.so.1.1 + * Mon May 10 2021 shenyangyang - 246-34 - Type:bugfix - ID:NA -- Gitee From b95c118210e62e208c11d9a07e08b770d6ded2f7 Mon Sep 17 00:00:00 2001 From: overweight Date: Sun, 30 May 2021 22:02:17 -0400 Subject: [PATCH 15/29] fix patches name and patches num --- ...error-caused-by-device-disconnection.patch | 0 ...-parameter-of-get_name_owner_handler.patch | 0 ...re-dont-check-potentially-NULL-error.patch | 0 ...=> 0005-0001-core-shorten-code-a-bit.patch | 0 ...06-0001-core-no-need-to-eat-up-error.patch | 0 ...-unit-bus-name-slots-always-together.patch | 0 ...initial-ListNames-bus-call-from-PID1.patch | 0 ...-rtc-with-system-clock-when-shutdown.patch | 0 ...dd-actions-while-rename-netif-failed.patch | 0 ...1712-1.patch => 0011-CVE-2020-1712-1.patch | 0 ...1712-2.patch => 0012-CVE-2020-1712-2.patch | 0 ...1712-3.patch => 0013-CVE-2020-1712-3.patch | 0 ...1712-4.patch => 0014-CVE-2020-1712-4.patch | 0 ...1712-5.patch => 0015-CVE-2020-1712-5.patch | 0 ...-journal-files-that-were-deleted-by-.patch | 0 ...tTasksMax-to-80-of-the-kernel-pid.ma.patch | 0 ...rtual-machines-have-same-mac-address.patch | 0 ...nd-set-RemoveIPC-to-false-by-default.patch | 0 ...or-naming-Dell-iDRAC-USB-Virtual-NIC.patch | 0 ...nit-don-t-add-Requires-for-tmp.mount.patch | 0 ...switch-net.ipv4.conf.all.rp_filter-f.patch | 0 ...evator-kernel-command-line-parameter.patch | 0 ...le-that-adds-elevator-kernel-command.patch | 0 ...its-add-Install-section-to-tmp.mount.patch | 0 ...vd.service-start-after-systemd-remou.patch | 0 ...patch => 0027-udev-virsh-shutdown-vm.patch | 0 ...8-fix-fd-leak-in-no-memory-condition.patch | 0 ...0029-dbus-execute-avoid-extra-strdup.patch | 0 ...mounted-as-tmpfs-without-the-user-s-.patch | 0 ...d-bus-properly-initialize-containers.patch | 0 ...step-back-again-for-nspawn-we-actual.patch | 0 ...able-systemd-journald-audit.socket-b.patch | 0 ...drop-unit-caches-only-based-on-mtime.patch | 0 ...dd-unit-files-to-dump-the-unit-fragm.patch | 0 ...id1-use-a-cache-for-all-unit-aliases.patch | 0 ...it-file-add-a-function-to-validate-u.patch | 0 ...tl-crash-on-aarch64-when-setting-out.patch | 0 ...prehensive-protection-against-libsec.patch | 0 ...le-free-in-macsec_receive_channel_fr.patch | 0 ...patch => 0041-network-L2TP-fix-crash.patch | 0 ...memleak-caused-by-wrong-cleanup-func.patch | 0 ...ch => 0043-analyze-fix-minor-memleak.patch | 0 ...k-add-one-more-section-validty-check.patch | 0 ...etwork-use-fix-invalid-free-function.patch | 0 ...ak.patch => 0046-network-fix-memleak.patch | 0 ...k-Add-support-to-advertie-ipv6-route.patch | 0 ...network-fix-invalid-cleanup-function.patch | 0 ...ork-fix-memleak-in-route_prefix_free.patch | 0 ...ak.patch => 0050-sd-radv-fix-memleak.patch | 0 ...validate-connection-when-Hello-fails.patch | 0 ...-bus-util-Don-t-replace-exsting-strv.patch | 0 ...systemctl-Add-with-dependencies-flag.patch | 0 ...t-systemctl-with-dependencies-switch.patch | 0 ...-priority-value-via-dbus-only-if-it-.patch | 0 ...we-forgot-to-destroy-some-bus-errors.patch | 0 ...spection-bug-in-signal-parameter-nam.patch | 0 ...pParseFlags-between-dbus-execute-and.patch | 0 ...9-core-swap-priority-can-be-negative.patch | 0 ...initialize-swap-structure-fields-if-.patch | 0 ...priority_set-when-parsing-swap-unit-.patch | 0 ...sed-logging-instead-of-generic-loggi.patch | 0 ... 0063-core-set-error-value-correctly.patch | 0 ...ix-re-realization-of-cgroup-siblings.patch | 0 ...ble-avoid-crash-when-table-is-sparse.patch | 0 ...al-fix-buffer-overrun-when-urlifying.patch | 0 ...or-IP-in-certificate-when-using-DoT-.patch | 0 ...nection-failures-with-TLS-1.3-and-Gn.patch | 0 ...-at-least-version-3.6.0-of-GnuTLS-fo.patch | 0 ...-in-resolved.conf-man-page-with-rega.patch | 0 ...mplement-SNI-when-using-DNS-over-TLS.patch | 0 ...-resolve-error-handling-improvements.patch | 0 ...-use-hostname-for-certificate-valida.patch | 0 ...rdata-pointer-inheritance-from-varli.patch | 0 ...e-_SUN-ACPI-index-as-a-signed-intege.patch | 0 ...t-generate-slot-based-names-if-multi.patch | 0 systemd.spec | 163 +++++++++--------- 76 files changed, 83 insertions(+), 80 deletions(-) rename 0001-udev-ignore-error-caused-by-device-disconnection.patch => 0002-0001-udev-ignore-error-caused-by-device-disconnection.patch (100%) rename 0001-core-dont-check-error-parameter-of-get_name_owner_handler.patch => 0003-0001-core-dont-check-error-parameter-of-get_name_owner_handler.patch (100%) rename 0001-core-dont-check-potentially-NULL-error.patch => 0004-0001-core-dont-check-potentially-NULL-error.patch (100%) rename 0001-core-shorten-code-a-bit.patch => 0005-0001-core-shorten-code-a-bit.patch (100%) rename 0001-core-no-need-to-eat-up-error.patch => 0006-0001-core-no-need-to-eat-up-error.patch (100%) rename 0001-core-create-or-remove-unit-bus-name-slots-always-together.patch => 0007-0001-core-create-or-remove-unit-bus-name-slots-always-together.patch (100%) rename 0001-core-drop-initial-ListNames-bus-call-from-PID1.patch => 0008-0001-core-drop-initial-ListNames-bus-call-from-PID1.patch (100%) rename 1605-update-rtc-with-system-clock-when-shutdown.patch => 0009-1605-update-rtc-with-system-clock-when-shutdown.patch (100%) rename 1603-udev-add-actions-while-rename-netif-failed.patch => 0010-1603-udev-add-actions-while-rename-netif-failed.patch (100%) rename CVE-2020-1712-1.patch => 0011-CVE-2020-1712-1.patch (100%) rename CVE-2020-1712-2.patch => 0012-CVE-2020-1712-2.patch (100%) rename CVE-2020-1712-3.patch => 0013-CVE-2020-1712-3.patch (100%) rename CVE-2020-1712-4.patch => 0014-CVE-2020-1712-4.patch (100%) rename CVE-2020-1712-5.patch => 0015-CVE-2020-1712-5.patch (100%) rename sd-journal-close-journal-files-that-were-deleted-by-.patch => 0016-sd-journal-close-journal-files-that-were-deleted-by-.patch (100%) rename pid1-bump-DefaultTasksMax-to-80-of-the-kernel-pid.ma.patch => 0017-pid1-bump-DefaultTasksMax-to-80-of-the-kernel-pid.ma.patch (100%) rename fix-two-VF-virtual-machines-have-same-mac-address.patch => 0018-fix-two-VF-virtual-machines-have-same-mac-address.patch (100%) rename logind-set-RemoveIPC-to-false-by-default.patch => 0019-logind-set-RemoveIPC-to-false-by-default.patch (100%) rename rules-add-rule-for-naming-Dell-iDRAC-USB-Virtual-NIC.patch => 0020-rules-add-rule-for-naming-Dell-iDRAC-USB-Virtual-NIC.patch (100%) rename unit-don-t-add-Requires-for-tmp.mount.patch => 0021-unit-don-t-add-Requires-for-tmp.mount.patch (100%) rename Revert-sysctl.d-switch-net.ipv4.conf.all.rp_filter-f.patch => 0022-Revert-sysctl.d-switch-net.ipv4.conf.all.rp_filter-f.patch (100%) rename rules-add-elevator-kernel-command-line-parameter.patch => 0023-rules-add-elevator-kernel-command-line-parameter.patch (100%) rename rules-add-the-rule-that-adds-elevator-kernel-command.patch => 0024-rules-add-the-rule-that-adds-elevator-kernel-command.patch (100%) rename units-add-Install-section-to-tmp.mount.patch => 0025-units-add-Install-section-to-tmp.mount.patch (100%) rename Make-systemd-udevd.service-start-after-systemd-remou.patch => 0026-Make-systemd-udevd.service-start-after-systemd-remou.patch (100%) rename udev-virsh-shutdown-vm.patch => 0027-udev-virsh-shutdown-vm.patch (100%) rename fix-fd-leak-in-no-memory-condition.patch => 0028-fix-fd-leak-in-no-memory-condition.patch (100%) rename dbus-execute-avoid-extra-strdup.patch => 0029-dbus-execute-avoid-extra-strdup.patch (100%) rename Avoid-tmp-being-mounted-as-tmpfs-without-the-user-s-.patch => 0030-Avoid-tmp-being-mounted-as-tmpfs-without-the-user-s-.patch (100%) rename sd-bus-properly-initialize-containers.patch => 0031-sd-bus-properly-initialize-containers.patch (100%) rename Revert-core-one-step-back-again-for-nspawn-we-actual.patch => 0032-Revert-core-one-step-back-again-for-nspawn-we-actual.patch (100%) rename journal-don-t-enable-systemd-journald-audit.socket-b.patch => 0033-journal-don-t-enable-systemd-journald-audit.socket-b.patch (100%) rename revert-pid1-drop-unit-caches-only-based-on-mtime.patch => 0034-revert-pid1-drop-unit-caches-only-based-on-mtime.patch (100%) rename revert-analyze-add-unit-files-to-dump-the-unit-fragm.patch => 0035-revert-analyze-add-unit-files-to-dump-the-unit-fragm.patch (100%) rename revert-pid1-use-a-cache-for-all-unit-aliases.patch => 0036-revert-pid1-use-a-cache-for-all-unit-aliases.patch (100%) rename revert-shared-unit-file-add-a-function-to-validate-u.patch => 0037-revert-shared-unit-file-add-a-function-to-validate-u.patch (100%) rename systemd-Fix-busctl-crash-on-aarch64-when-setting-out.patch => 0038-systemd-Fix-busctl-crash-on-aarch64-when-setting-out.patch (100%) rename seccomp-more-comprehensive-protection-against-libsec.patch => 0039-seccomp-more-comprehensive-protection-against-libsec.patch (100%) rename network-fix-double-free-in-macsec_receive_channel_fr.patch => 0040-network-fix-double-free-in-macsec_receive_channel_fr.patch (100%) rename network-L2TP-fix-crash.patch => 0041-network-L2TP-fix-crash.patch (100%) rename systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch => 0042-systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch (100%) rename analyze-fix-minor-memleak.patch => 0043-analyze-fix-minor-memleak.patch (100%) rename network-add-one-more-section-validty-check.patch => 0044-network-add-one-more-section-validty-check.patch (100%) rename network-use-fix-invalid-free-function.patch => 0045-network-use-fix-invalid-free-function.patch (100%) rename network-fix-memleak.patch => 0046-network-fix-memleak.patch (100%) rename network-Add-support-to-advertie-ipv6-route.patch => 0047-network-Add-support-to-advertie-ipv6-route.patch (100%) rename network-fix-invalid-cleanup-function.patch => 0048-network-fix-invalid-cleanup-function.patch (100%) rename network-fix-memleak-in-route_prefix_free.patch => 0049-network-fix-memleak-in-route_prefix_free.patch (100%) rename sd-radv-fix-memleak.patch => 0050-sd-radv-fix-memleak.patch (100%) rename sd-bus-invalidate-connection-when-Hello-fails.patch => 0051-sd-bus-invalidate-connection-when-Hello-fails.patch (100%) rename shared-bus-util-Don-t-replace-exsting-strv.patch => 0052-shared-bus-util-Don-t-replace-exsting-strv.patch (100%) rename systemctl-Add-with-dependencies-flag.patch => 0053-systemctl-Add-with-dependencies-flag.patch (100%) rename man-Document-systemctl-with-dependencies-switch.patch => 0054-man-Document-systemctl-with-dependencies-switch.patch (100%) rename core-expose-swap-priority-value-via-dbus-only-if-it-.patch => 0055-core-expose-swap-priority-value-via-dbus-only-if-it-.patch (100%) rename tree-wide-we-forgot-to-destroy-some-bus-errors.patch => 0056-tree-wide-we-forgot-to-destroy-some-bus-errors.patch (100%) rename sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch => 0057-sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch (100%) rename core-sync-SeccompParseFlags-between-dbus-execute-and.patch => 0058-core-sync-SeccompParseFlags-between-dbus-execute-and.patch (100%) rename core-swap-priority-can-be-negative.patch => 0059-core-swap-priority-can-be-negative.patch (100%) rename core-no-need-to-initialize-swap-structure-fields-if-.patch => 0060-core-no-need-to-initialize-swap-structure-fields-if-.patch (100%) rename core-initialize-priority_set-when-parsing-swap-unit-.patch => 0061-core-initialize-priority_set-when-parsing-swap-unit-.patch (100%) rename core-use-unit-based-logging-instead-of-generic-loggi.patch => 0062-core-use-unit-based-logging-instead-of-generic-loggi.patch (100%) rename core-set-error-value-correctly.patch => 0063-core-set-error-value-correctly.patch (100%) rename core-fix-re-realization-of-cgroup-siblings.patch => 0064-core-fix-re-realization-of-cgroup-siblings.patch (100%) rename basic-string-table-avoid-crash-when-table-is-sparse.patch => 0065-basic-string-table-avoid-crash-when-table-is-sparse.patch (100%) rename journal-fix-buffer-overrun-when-urlifying.patch => 0066-journal-fix-buffer-overrun-when-urlifying.patch (100%) rename backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch => 0071-backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch (100%) rename backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch => 0072-backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch (100%) rename backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch => 0073-backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch (100%) rename backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch => 0074-backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch (100%) rename backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch => 0075-backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch (100%) rename backport-CVE-2018-21029-resolve-error-handling-improvements.patch => 0076-backport-CVE-2018-21029-resolve-error-handling-improvements.patch (100%) rename backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch => 0077-backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch (100%) rename backport-varlink-make-userdata-pointer-inheritance-from-varli.patch => 0078-backport-varlink-make-userdata-pointer-inheritance-from-varli.patch (100%) rename backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch => 0079-backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch (100%) rename backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch => 0080-backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch (100%) diff --git a/0001-udev-ignore-error-caused-by-device-disconnection.patch b/0002-0001-udev-ignore-error-caused-by-device-disconnection.patch similarity index 100% rename from 0001-udev-ignore-error-caused-by-device-disconnection.patch rename to 0002-0001-udev-ignore-error-caused-by-device-disconnection.patch diff --git a/0001-core-dont-check-error-parameter-of-get_name_owner_handler.patch b/0003-0001-core-dont-check-error-parameter-of-get_name_owner_handler.patch similarity index 100% rename from 0001-core-dont-check-error-parameter-of-get_name_owner_handler.patch rename to 0003-0001-core-dont-check-error-parameter-of-get_name_owner_handler.patch diff --git a/0001-core-dont-check-potentially-NULL-error.patch b/0004-0001-core-dont-check-potentially-NULL-error.patch similarity index 100% rename from 0001-core-dont-check-potentially-NULL-error.patch rename to 0004-0001-core-dont-check-potentially-NULL-error.patch diff --git a/0001-core-shorten-code-a-bit.patch b/0005-0001-core-shorten-code-a-bit.patch similarity index 100% rename from 0001-core-shorten-code-a-bit.patch rename to 0005-0001-core-shorten-code-a-bit.patch diff --git a/0001-core-no-need-to-eat-up-error.patch b/0006-0001-core-no-need-to-eat-up-error.patch similarity index 100% rename from 0001-core-no-need-to-eat-up-error.patch rename to 0006-0001-core-no-need-to-eat-up-error.patch diff --git a/0001-core-create-or-remove-unit-bus-name-slots-always-together.patch b/0007-0001-core-create-or-remove-unit-bus-name-slots-always-together.patch similarity index 100% rename from 0001-core-create-or-remove-unit-bus-name-slots-always-together.patch rename to 0007-0001-core-create-or-remove-unit-bus-name-slots-always-together.patch diff --git a/0001-core-drop-initial-ListNames-bus-call-from-PID1.patch b/0008-0001-core-drop-initial-ListNames-bus-call-from-PID1.patch similarity index 100% rename from 0001-core-drop-initial-ListNames-bus-call-from-PID1.patch rename to 0008-0001-core-drop-initial-ListNames-bus-call-from-PID1.patch diff --git a/1605-update-rtc-with-system-clock-when-shutdown.patch b/0009-1605-update-rtc-with-system-clock-when-shutdown.patch similarity index 100% rename from 1605-update-rtc-with-system-clock-when-shutdown.patch rename to 0009-1605-update-rtc-with-system-clock-when-shutdown.patch diff --git a/1603-udev-add-actions-while-rename-netif-failed.patch b/0010-1603-udev-add-actions-while-rename-netif-failed.patch similarity index 100% rename from 1603-udev-add-actions-while-rename-netif-failed.patch rename to 0010-1603-udev-add-actions-while-rename-netif-failed.patch diff --git a/CVE-2020-1712-1.patch b/0011-CVE-2020-1712-1.patch similarity index 100% rename from CVE-2020-1712-1.patch rename to 0011-CVE-2020-1712-1.patch diff --git a/CVE-2020-1712-2.patch b/0012-CVE-2020-1712-2.patch similarity index 100% rename from CVE-2020-1712-2.patch rename to 0012-CVE-2020-1712-2.patch diff --git a/CVE-2020-1712-3.patch b/0013-CVE-2020-1712-3.patch similarity index 100% rename from CVE-2020-1712-3.patch rename to 0013-CVE-2020-1712-3.patch diff --git a/CVE-2020-1712-4.patch b/0014-CVE-2020-1712-4.patch similarity index 100% rename from CVE-2020-1712-4.patch rename to 0014-CVE-2020-1712-4.patch diff --git a/CVE-2020-1712-5.patch b/0015-CVE-2020-1712-5.patch similarity index 100% rename from CVE-2020-1712-5.patch rename to 0015-CVE-2020-1712-5.patch diff --git a/sd-journal-close-journal-files-that-were-deleted-by-.patch b/0016-sd-journal-close-journal-files-that-were-deleted-by-.patch similarity index 100% rename from sd-journal-close-journal-files-that-were-deleted-by-.patch rename to 0016-sd-journal-close-journal-files-that-were-deleted-by-.patch diff --git a/pid1-bump-DefaultTasksMax-to-80-of-the-kernel-pid.ma.patch b/0017-pid1-bump-DefaultTasksMax-to-80-of-the-kernel-pid.ma.patch similarity index 100% rename from pid1-bump-DefaultTasksMax-to-80-of-the-kernel-pid.ma.patch rename to 0017-pid1-bump-DefaultTasksMax-to-80-of-the-kernel-pid.ma.patch diff --git a/fix-two-VF-virtual-machines-have-same-mac-address.patch b/0018-fix-two-VF-virtual-machines-have-same-mac-address.patch similarity index 100% rename from fix-two-VF-virtual-machines-have-same-mac-address.patch rename to 0018-fix-two-VF-virtual-machines-have-same-mac-address.patch diff --git a/logind-set-RemoveIPC-to-false-by-default.patch b/0019-logind-set-RemoveIPC-to-false-by-default.patch similarity index 100% rename from logind-set-RemoveIPC-to-false-by-default.patch rename to 0019-logind-set-RemoveIPC-to-false-by-default.patch diff --git a/rules-add-rule-for-naming-Dell-iDRAC-USB-Virtual-NIC.patch b/0020-rules-add-rule-for-naming-Dell-iDRAC-USB-Virtual-NIC.patch similarity index 100% rename from rules-add-rule-for-naming-Dell-iDRAC-USB-Virtual-NIC.patch rename to 0020-rules-add-rule-for-naming-Dell-iDRAC-USB-Virtual-NIC.patch diff --git a/unit-don-t-add-Requires-for-tmp.mount.patch b/0021-unit-don-t-add-Requires-for-tmp.mount.patch similarity index 100% rename from unit-don-t-add-Requires-for-tmp.mount.patch rename to 0021-unit-don-t-add-Requires-for-tmp.mount.patch diff --git a/Revert-sysctl.d-switch-net.ipv4.conf.all.rp_filter-f.patch b/0022-Revert-sysctl.d-switch-net.ipv4.conf.all.rp_filter-f.patch similarity index 100% rename from Revert-sysctl.d-switch-net.ipv4.conf.all.rp_filter-f.patch rename to 0022-Revert-sysctl.d-switch-net.ipv4.conf.all.rp_filter-f.patch diff --git a/rules-add-elevator-kernel-command-line-parameter.patch b/0023-rules-add-elevator-kernel-command-line-parameter.patch similarity index 100% rename from rules-add-elevator-kernel-command-line-parameter.patch rename to 0023-rules-add-elevator-kernel-command-line-parameter.patch diff --git a/rules-add-the-rule-that-adds-elevator-kernel-command.patch b/0024-rules-add-the-rule-that-adds-elevator-kernel-command.patch similarity index 100% rename from rules-add-the-rule-that-adds-elevator-kernel-command.patch rename to 0024-rules-add-the-rule-that-adds-elevator-kernel-command.patch diff --git a/units-add-Install-section-to-tmp.mount.patch b/0025-units-add-Install-section-to-tmp.mount.patch similarity index 100% rename from units-add-Install-section-to-tmp.mount.patch rename to 0025-units-add-Install-section-to-tmp.mount.patch diff --git a/Make-systemd-udevd.service-start-after-systemd-remou.patch b/0026-Make-systemd-udevd.service-start-after-systemd-remou.patch similarity index 100% rename from Make-systemd-udevd.service-start-after-systemd-remou.patch rename to 0026-Make-systemd-udevd.service-start-after-systemd-remou.patch diff --git a/udev-virsh-shutdown-vm.patch b/0027-udev-virsh-shutdown-vm.patch similarity index 100% rename from udev-virsh-shutdown-vm.patch rename to 0027-udev-virsh-shutdown-vm.patch diff --git a/fix-fd-leak-in-no-memory-condition.patch b/0028-fix-fd-leak-in-no-memory-condition.patch similarity index 100% rename from fix-fd-leak-in-no-memory-condition.patch rename to 0028-fix-fd-leak-in-no-memory-condition.patch diff --git a/dbus-execute-avoid-extra-strdup.patch b/0029-dbus-execute-avoid-extra-strdup.patch similarity index 100% rename from dbus-execute-avoid-extra-strdup.patch rename to 0029-dbus-execute-avoid-extra-strdup.patch diff --git a/Avoid-tmp-being-mounted-as-tmpfs-without-the-user-s-.patch b/0030-Avoid-tmp-being-mounted-as-tmpfs-without-the-user-s-.patch similarity index 100% rename from Avoid-tmp-being-mounted-as-tmpfs-without-the-user-s-.patch rename to 0030-Avoid-tmp-being-mounted-as-tmpfs-without-the-user-s-.patch diff --git a/sd-bus-properly-initialize-containers.patch b/0031-sd-bus-properly-initialize-containers.patch similarity index 100% rename from sd-bus-properly-initialize-containers.patch rename to 0031-sd-bus-properly-initialize-containers.patch diff --git a/Revert-core-one-step-back-again-for-nspawn-we-actual.patch b/0032-Revert-core-one-step-back-again-for-nspawn-we-actual.patch similarity index 100% rename from Revert-core-one-step-back-again-for-nspawn-we-actual.patch rename to 0032-Revert-core-one-step-back-again-for-nspawn-we-actual.patch diff --git a/journal-don-t-enable-systemd-journald-audit.socket-b.patch b/0033-journal-don-t-enable-systemd-journald-audit.socket-b.patch similarity index 100% rename from journal-don-t-enable-systemd-journald-audit.socket-b.patch rename to 0033-journal-don-t-enable-systemd-journald-audit.socket-b.patch diff --git a/revert-pid1-drop-unit-caches-only-based-on-mtime.patch b/0034-revert-pid1-drop-unit-caches-only-based-on-mtime.patch similarity index 100% rename from revert-pid1-drop-unit-caches-only-based-on-mtime.patch rename to 0034-revert-pid1-drop-unit-caches-only-based-on-mtime.patch diff --git a/revert-analyze-add-unit-files-to-dump-the-unit-fragm.patch b/0035-revert-analyze-add-unit-files-to-dump-the-unit-fragm.patch similarity index 100% rename from revert-analyze-add-unit-files-to-dump-the-unit-fragm.patch rename to 0035-revert-analyze-add-unit-files-to-dump-the-unit-fragm.patch diff --git a/revert-pid1-use-a-cache-for-all-unit-aliases.patch b/0036-revert-pid1-use-a-cache-for-all-unit-aliases.patch similarity index 100% rename from revert-pid1-use-a-cache-for-all-unit-aliases.patch rename to 0036-revert-pid1-use-a-cache-for-all-unit-aliases.patch diff --git a/revert-shared-unit-file-add-a-function-to-validate-u.patch b/0037-revert-shared-unit-file-add-a-function-to-validate-u.patch similarity index 100% rename from revert-shared-unit-file-add-a-function-to-validate-u.patch rename to 0037-revert-shared-unit-file-add-a-function-to-validate-u.patch diff --git a/systemd-Fix-busctl-crash-on-aarch64-when-setting-out.patch b/0038-systemd-Fix-busctl-crash-on-aarch64-when-setting-out.patch similarity index 100% rename from systemd-Fix-busctl-crash-on-aarch64-when-setting-out.patch rename to 0038-systemd-Fix-busctl-crash-on-aarch64-when-setting-out.patch diff --git a/seccomp-more-comprehensive-protection-against-libsec.patch b/0039-seccomp-more-comprehensive-protection-against-libsec.patch similarity index 100% rename from seccomp-more-comprehensive-protection-against-libsec.patch rename to 0039-seccomp-more-comprehensive-protection-against-libsec.patch diff --git a/network-fix-double-free-in-macsec_receive_channel_fr.patch b/0040-network-fix-double-free-in-macsec_receive_channel_fr.patch similarity index 100% rename from network-fix-double-free-in-macsec_receive_channel_fr.patch rename to 0040-network-fix-double-free-in-macsec_receive_channel_fr.patch diff --git a/network-L2TP-fix-crash.patch b/0041-network-L2TP-fix-crash.patch similarity index 100% rename from network-L2TP-fix-crash.patch rename to 0041-network-L2TP-fix-crash.patch diff --git a/systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch b/0042-systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch similarity index 100% rename from systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch rename to 0042-systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch diff --git a/analyze-fix-minor-memleak.patch b/0043-analyze-fix-minor-memleak.patch similarity index 100% rename from analyze-fix-minor-memleak.patch rename to 0043-analyze-fix-minor-memleak.patch diff --git a/network-add-one-more-section-validty-check.patch b/0044-network-add-one-more-section-validty-check.patch similarity index 100% rename from network-add-one-more-section-validty-check.patch rename to 0044-network-add-one-more-section-validty-check.patch diff --git a/network-use-fix-invalid-free-function.patch b/0045-network-use-fix-invalid-free-function.patch similarity index 100% rename from network-use-fix-invalid-free-function.patch rename to 0045-network-use-fix-invalid-free-function.patch diff --git a/network-fix-memleak.patch b/0046-network-fix-memleak.patch similarity index 100% rename from network-fix-memleak.patch rename to 0046-network-fix-memleak.patch diff --git a/network-Add-support-to-advertie-ipv6-route.patch b/0047-network-Add-support-to-advertie-ipv6-route.patch similarity index 100% rename from network-Add-support-to-advertie-ipv6-route.patch rename to 0047-network-Add-support-to-advertie-ipv6-route.patch diff --git a/network-fix-invalid-cleanup-function.patch b/0048-network-fix-invalid-cleanup-function.patch similarity index 100% rename from network-fix-invalid-cleanup-function.patch rename to 0048-network-fix-invalid-cleanup-function.patch diff --git a/network-fix-memleak-in-route_prefix_free.patch b/0049-network-fix-memleak-in-route_prefix_free.patch similarity index 100% rename from network-fix-memleak-in-route_prefix_free.patch rename to 0049-network-fix-memleak-in-route_prefix_free.patch diff --git a/sd-radv-fix-memleak.patch b/0050-sd-radv-fix-memleak.patch similarity index 100% rename from sd-radv-fix-memleak.patch rename to 0050-sd-radv-fix-memleak.patch diff --git a/sd-bus-invalidate-connection-when-Hello-fails.patch b/0051-sd-bus-invalidate-connection-when-Hello-fails.patch similarity index 100% rename from sd-bus-invalidate-connection-when-Hello-fails.patch rename to 0051-sd-bus-invalidate-connection-when-Hello-fails.patch diff --git a/shared-bus-util-Don-t-replace-exsting-strv.patch b/0052-shared-bus-util-Don-t-replace-exsting-strv.patch similarity index 100% rename from shared-bus-util-Don-t-replace-exsting-strv.patch rename to 0052-shared-bus-util-Don-t-replace-exsting-strv.patch diff --git a/systemctl-Add-with-dependencies-flag.patch b/0053-systemctl-Add-with-dependencies-flag.patch similarity index 100% rename from systemctl-Add-with-dependencies-flag.patch rename to 0053-systemctl-Add-with-dependencies-flag.patch diff --git a/man-Document-systemctl-with-dependencies-switch.patch b/0054-man-Document-systemctl-with-dependencies-switch.patch similarity index 100% rename from man-Document-systemctl-with-dependencies-switch.patch rename to 0054-man-Document-systemctl-with-dependencies-switch.patch diff --git a/core-expose-swap-priority-value-via-dbus-only-if-it-.patch b/0055-core-expose-swap-priority-value-via-dbus-only-if-it-.patch similarity index 100% rename from core-expose-swap-priority-value-via-dbus-only-if-it-.patch rename to 0055-core-expose-swap-priority-value-via-dbus-only-if-it-.patch diff --git a/tree-wide-we-forgot-to-destroy-some-bus-errors.patch b/0056-tree-wide-we-forgot-to-destroy-some-bus-errors.patch similarity index 100% rename from tree-wide-we-forgot-to-destroy-some-bus-errors.patch rename to 0056-tree-wide-we-forgot-to-destroy-some-bus-errors.patch diff --git a/sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch b/0057-sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch similarity index 100% rename from sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch rename to 0057-sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch diff --git a/core-sync-SeccompParseFlags-between-dbus-execute-and.patch b/0058-core-sync-SeccompParseFlags-between-dbus-execute-and.patch similarity index 100% rename from core-sync-SeccompParseFlags-between-dbus-execute-and.patch rename to 0058-core-sync-SeccompParseFlags-between-dbus-execute-and.patch diff --git a/core-swap-priority-can-be-negative.patch b/0059-core-swap-priority-can-be-negative.patch similarity index 100% rename from core-swap-priority-can-be-negative.patch rename to 0059-core-swap-priority-can-be-negative.patch diff --git a/core-no-need-to-initialize-swap-structure-fields-if-.patch b/0060-core-no-need-to-initialize-swap-structure-fields-if-.patch similarity index 100% rename from core-no-need-to-initialize-swap-structure-fields-if-.patch rename to 0060-core-no-need-to-initialize-swap-structure-fields-if-.patch diff --git a/core-initialize-priority_set-when-parsing-swap-unit-.patch b/0061-core-initialize-priority_set-when-parsing-swap-unit-.patch similarity index 100% rename from core-initialize-priority_set-when-parsing-swap-unit-.patch rename to 0061-core-initialize-priority_set-when-parsing-swap-unit-.patch diff --git a/core-use-unit-based-logging-instead-of-generic-loggi.patch b/0062-core-use-unit-based-logging-instead-of-generic-loggi.patch similarity index 100% rename from core-use-unit-based-logging-instead-of-generic-loggi.patch rename to 0062-core-use-unit-based-logging-instead-of-generic-loggi.patch diff --git a/core-set-error-value-correctly.patch b/0063-core-set-error-value-correctly.patch similarity index 100% rename from core-set-error-value-correctly.patch rename to 0063-core-set-error-value-correctly.patch diff --git a/core-fix-re-realization-of-cgroup-siblings.patch b/0064-core-fix-re-realization-of-cgroup-siblings.patch similarity index 100% rename from core-fix-re-realization-of-cgroup-siblings.patch rename to 0064-core-fix-re-realization-of-cgroup-siblings.patch diff --git a/basic-string-table-avoid-crash-when-table-is-sparse.patch b/0065-basic-string-table-avoid-crash-when-table-is-sparse.patch similarity index 100% rename from basic-string-table-avoid-crash-when-table-is-sparse.patch rename to 0065-basic-string-table-avoid-crash-when-table-is-sparse.patch diff --git a/journal-fix-buffer-overrun-when-urlifying.patch b/0066-journal-fix-buffer-overrun-when-urlifying.patch similarity index 100% rename from journal-fix-buffer-overrun-when-urlifying.patch rename to 0066-journal-fix-buffer-overrun-when-urlifying.patch diff --git a/backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch b/0071-backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch similarity index 100% rename from backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch rename to 0071-backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch diff --git a/backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch b/0072-backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch similarity index 100% rename from backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch rename to 0072-backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch diff --git a/backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch b/0073-backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch similarity index 100% rename from backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch rename to 0073-backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch diff --git a/backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch b/0074-backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch similarity index 100% rename from backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch rename to 0074-backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch diff --git a/backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch b/0075-backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch similarity index 100% rename from backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch rename to 0075-backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch diff --git a/backport-CVE-2018-21029-resolve-error-handling-improvements.patch b/0076-backport-CVE-2018-21029-resolve-error-handling-improvements.patch similarity index 100% rename from backport-CVE-2018-21029-resolve-error-handling-improvements.patch rename to 0076-backport-CVE-2018-21029-resolve-error-handling-improvements.patch diff --git a/backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch b/0077-backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch similarity index 100% rename from backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch rename to 0077-backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch diff --git a/backport-varlink-make-userdata-pointer-inheritance-from-varli.patch b/0078-backport-varlink-make-userdata-pointer-inheritance-from-varli.patch similarity index 100% rename from backport-varlink-make-userdata-pointer-inheritance-from-varli.patch rename to 0078-backport-varlink-make-userdata-pointer-inheritance-from-varli.patch diff --git a/backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch b/0079-backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch similarity index 100% rename from backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch rename to 0079-backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch diff --git a/backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch b/0080-backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch similarity index 100% rename from backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch rename to 0080-backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch diff --git a/systemd.spec b/systemd.spec index a86c8d7..9d73db7 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 35 +Release: 36 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -44,86 +44,86 @@ Source105: rule_generator.functions Source106: write_net_rules Source107: detect_virt -Patch0002: 0001-udev-ignore-error-caused-by-device-disconnection.patch -Patch0003: 0001-core-dont-check-error-parameter-of-get_name_owner_handler.patch -Patch0004: 0001-core-dont-check-potentially-NULL-error.patch -Patch0005: 0001-core-shorten-code-a-bit.patch -Patch0006: 0001-core-no-need-to-eat-up-error.patch -Patch0007: 0001-core-create-or-remove-unit-bus-name-slots-always-together.patch -Patch0008: 0001-core-drop-initial-ListNames-bus-call-from-PID1.patch -Patch0009: 1605-update-rtc-with-system-clock-when-shutdown.patch -Patch0010: 1603-udev-add-actions-while-rename-netif-failed.patch -Patch0011: CVE-2020-1712-1.patch -Patch0012: CVE-2020-1712-2.patch -Patch0013: CVE-2020-1712-3.patch -Patch0014: CVE-2020-1712-4.patch -Patch0015: CVE-2020-1712-5.patch -Patch0016: sd-journal-close-journal-files-that-were-deleted-by-.patch -Patch0017: pid1-bump-DefaultTasksMax-to-80-of-the-kernel-pid.ma.patch -Patch0018: fix-two-VF-virtual-machines-have-same-mac-address.patch -Patch0019: logind-set-RemoveIPC-to-false-by-default.patch -Patch0020: rules-add-rule-for-naming-Dell-iDRAC-USB-Virtual-NIC.patch -Patch0021: unit-don-t-add-Requires-for-tmp.mount.patch -Patch0022: Revert-sysctl.d-switch-net.ipv4.conf.all.rp_filter-f.patch -Patch2023: rules-add-elevator-kernel-command-line-parameter.patch -Patch2024: rules-add-the-rule-that-adds-elevator-kernel-command.patch -Patch2025: units-add-Install-section-to-tmp.mount.patch -Patch0026: Make-systemd-udevd.service-start-after-systemd-remou.patch -Patch0027: udev-virsh-shutdown-vm.patch -Patch0028: fix-fd-leak-in-no-memory-condition.patch -Patch0029: dbus-execute-avoid-extra-strdup.patch -Patch0030: Avoid-tmp-being-mounted-as-tmpfs-without-the-user-s-.patch -Patch0031: sd-bus-properly-initialize-containers.patch -Patch0032: Revert-core-one-step-back-again-for-nspawn-we-actual.patch -Patch0033: journal-don-t-enable-systemd-journald-audit.socket-b.patch +Patch0002: 0002-0001-udev-ignore-error-caused-by-device-disconnection.patch +Patch0003: 0003-0001-core-dont-check-error-parameter-of-get_name_owner_handler.patch +Patch0004: 0004-0001-core-dont-check-potentially-NULL-error.patch +Patch0005: 0005-0001-core-shorten-code-a-bit.patch +Patch0006: 0006-0001-core-no-need-to-eat-up-error.patch +Patch0007: 0007-0001-core-create-or-remove-unit-bus-name-slots-always-together.patch +Patch0008: 0008-0001-core-drop-initial-ListNames-bus-call-from-PID1.patch +Patch0009: 0009-1605-update-rtc-with-system-clock-when-shutdown.patch +Patch0010: 0010-1603-udev-add-actions-while-rename-netif-failed.patch +Patch0011: 0011-CVE-2020-1712-1.patch +Patch0012: 0012-CVE-2020-1712-2.patch +Patch0013: 0013-CVE-2020-1712-3.patch +Patch0014: 0014-CVE-2020-1712-4.patch +Patch0015: 0015-CVE-2020-1712-5.patch +Patch0016: 0016-sd-journal-close-journal-files-that-were-deleted-by-.patch +Patch0017: 0017-pid1-bump-DefaultTasksMax-to-80-of-the-kernel-pid.ma.patch +Patch0018: 0018-fix-two-VF-virtual-machines-have-same-mac-address.patch +Patch0019: 0019-logind-set-RemoveIPC-to-false-by-default.patch +Patch0020: 0020-rules-add-rule-for-naming-Dell-iDRAC-USB-Virtual-NIC.patch +Patch0021: 0021-unit-don-t-add-Requires-for-tmp.mount.patch +Patch0022: 0022-Revert-sysctl.d-switch-net.ipv4.conf.all.rp_filter-f.patch +Patch0023: 0023-rules-add-elevator-kernel-command-line-parameter.patch +Patch0024: 0024-rules-add-the-rule-that-adds-elevator-kernel-command.patch +Patch0025: 0025-units-add-Install-section-to-tmp.mount.patch +Patch0026: 0026-Make-systemd-udevd.service-start-after-systemd-remou.patch +Patch0027: 0027-udev-virsh-shutdown-vm.patch +Patch0028: 0028-fix-fd-leak-in-no-memory-condition.patch +Patch0029: 0029-dbus-execute-avoid-extra-strdup.patch +Patch0030: 0030-Avoid-tmp-being-mounted-as-tmpfs-without-the-user-s-.patch +Patch0031: 0031-sd-bus-properly-initialize-containers.patch +Patch0032: 0032-Revert-core-one-step-back-again-for-nspawn-we-actual.patch +Patch0033: 0033-journal-don-t-enable-systemd-journald-audit.socket-b.patch # The patch of 0026~0029 resolve the pid1 memory leaks -Patch0034: revert-pid1-drop-unit-caches-only-based-on-mtime.patch -Patch0035: revert-analyze-add-unit-files-to-dump-the-unit-fragm.patch -Patch0036: revert-pid1-use-a-cache-for-all-unit-aliases.patch -Patch0037: revert-shared-unit-file-add-a-function-to-validate-u.patch - -Patch0038: systemd-Fix-busctl-crash-on-aarch64-when-setting-out.patch -Patch0039: seccomp-more-comprehensive-protection-against-libsec.patch -Patch0040: network-fix-double-free-in-macsec_receive_channel_fr.patch -Patch0041: network-L2TP-fix-crash.patch - -Patch0042: systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch -Patch0043: analyze-fix-minor-memleak.patch -Patch0044: network-add-one-more-section-validty-check.patch -Patch0045: network-use-fix-invalid-free-function.patch -Patch0046: network-fix-memleak.patch -Patch0047: network-Add-support-to-advertie-ipv6-route.patch -Patch0048: network-fix-invalid-cleanup-function.patch -Patch0049: network-fix-memleak-in-route_prefix_free.patch -Patch0050: sd-radv-fix-memleak.patch -Patch0051: sd-bus-invalidate-connection-when-Hello-fails.patch -Patch0052: shared-bus-util-Don-t-replace-exsting-strv.patch -Patch0053: systemctl-Add-with-dependencies-flag.patch -Patch0054: man-Document-systemctl-with-dependencies-switch.patch -Patch0055: core-expose-swap-priority-value-via-dbus-only-if-it-.patch -Patch0056: tree-wide-we-forgot-to-destroy-some-bus-errors.patch -Patch0057: sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch -Patch0058: core-sync-SeccompParseFlags-between-dbus-execute-and.patch -Patch0059: core-swap-priority-can-be-negative.patch -Patch0060: core-no-need-to-initialize-swap-structure-fields-if-.patch -Patch0061: core-initialize-priority_set-when-parsing-swap-unit-.patch -Patch0062: core-use-unit-based-logging-instead-of-generic-loggi.patch -Patch0063: core-set-error-value-correctly.patch -Patch0064: core-fix-re-realization-of-cgroup-siblings.patch -Patch0065: basic-string-table-avoid-crash-when-table-is-sparse.patch -Patch0066: journal-fix-buffer-overrun-when-urlifying.patch - -Patch0071: backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch -Patch0072: backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch -Patch0073: backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch -Patch0074: backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch -Patch0075: backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch -Patch0076: backport-CVE-2018-21029-resolve-error-handling-improvements.patch -Patch0077: backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch -Patch0078: backport-varlink-make-userdata-pointer-inheritance-from-varli.patch -Patch0079: backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch -Patch0080: backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch +Patch0034: 0034-revert-pid1-drop-unit-caches-only-based-on-mtime.patch +Patch0035: 0035-revert-analyze-add-unit-files-to-dump-the-unit-fragm.patch +Patch0036: 0036-revert-pid1-use-a-cache-for-all-unit-aliases.patch +Patch0037: 0037-revert-shared-unit-file-add-a-function-to-validate-u.patch + +Patch0038: 0038-systemd-Fix-busctl-crash-on-aarch64-when-setting-out.patch +Patch0039: 0039-seccomp-more-comprehensive-protection-against-libsec.patch +Patch0040: 0040-network-fix-double-free-in-macsec_receive_channel_fr.patch +Patch0041: 0041-network-L2TP-fix-crash.patch + +Patch0042: 0042-systemctl-fix-memleak-caused-by-wrong-cleanup-func.patch +Patch0043: 0043-analyze-fix-minor-memleak.patch +Patch0044: 0044-network-add-one-more-section-validty-check.patch +Patch0045: 0045-network-use-fix-invalid-free-function.patch +Patch0046: 0046-network-fix-memleak.patch +Patch0047: 0047-network-Add-support-to-advertie-ipv6-route.patch +Patch0048: 0048-network-fix-invalid-cleanup-function.patch +Patch0049: 0049-network-fix-memleak-in-route_prefix_free.patch +Patch0050: 0050-sd-radv-fix-memleak.patch +Patch0051: 0051-sd-bus-invalidate-connection-when-Hello-fails.patch +Patch0052: 0052-shared-bus-util-Don-t-replace-exsting-strv.patch +Patch0053: 0053-systemctl-Add-with-dependencies-flag.patch +Patch0054: 0054-man-Document-systemctl-with-dependencies-switch.patch +Patch0055: 0055-core-expose-swap-priority-value-via-dbus-only-if-it-.patch +Patch0056: 0056-tree-wide-we-forgot-to-destroy-some-bus-errors.patch +Patch0057: 0057-sd-bus-fix-introspection-bug-in-signal-parameter-nam.patch +Patch0058: 0058-core-sync-SeccompParseFlags-between-dbus-execute-and.patch +Patch0059: 0059-core-swap-priority-can-be-negative.patch +Patch0060: 0060-core-no-need-to-initialize-swap-structure-fields-if-.patch +Patch0061: 0061-core-initialize-priority_set-when-parsing-swap-unit-.patch +Patch0062: 0062-core-use-unit-based-logging-instead-of-generic-loggi.patch +Patch0063: 0063-core-set-error-value-correctly.patch +Patch0064: 0064-core-fix-re-realization-of-cgroup-siblings.patch +Patch0065: 0065-basic-string-table-avoid-crash-when-table-is-sparse.patch +Patch0066: 0066-journal-fix-buffer-overrun-when-urlifying.patch + +Patch0071: 0071-backport-CVE-2018-21029-resolved-check-for-IP-in-certificate-when-using-DoT-.patch +Patch0072: 0072-backport-CVE-2018-21029-resolved-fix-connection-failures-with-TLS-1.3-and-Gn.patch +Patch0073: 0073-backport-CVE-2018-21029-resolved-require-at-least-version-3.6.0-of-GnuTLS-fo.patch +Patch0074: 0074-backport-CVE-2018-21029-Be-more-specific-in-resolved.conf-man-page-with-rega.patch +Patch0075: 0075-backport-CVE-2018-21029-Implement-SNI-when-using-DNS-over-TLS.patch +Patch0076: 0076-backport-CVE-2018-21029-resolve-error-handling-improvements.patch +Patch0077: 0077-backport-CVE-2018-21029-systemd-resolved-use-hostname-for-certificate-valida.patch +Patch0078: 0078-backport-varlink-make-userdata-pointer-inheritance-from-varli.patch +Patch0079: 0079-backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch +Patch0080: 0080-backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1509,6 +1509,9 @@ fi %exclude /usr/share/man/man3/* %changelog +* Mon May 31 2021 overweight - 246-36 +- fix patches name and patches num + * Thu May 27 2021 shenyangyang - 246-35 - Type:bugfix - ID:NA @@ -1632,7 +1635,7 @@ fi - Type:enhancement - ID:NA - SUG:NA -- DESC:add 1603-udev-add-actions-while-rename-netif-failed.patch +- DESC:add 0010-1603-udev-add-actions-while-rename-netif-failed.patch * Sat Feb 29 2020 openEuler Buildteam - 243-15 - Type:enhancement -- Gitee From 14684d6cafe62c4593a1dc3ee3a10d0d6dd72d03 Mon Sep 17 00:00:00 2001 From: overweight Date: Mon, 31 May 2021 08:29:30 -0400 Subject: [PATCH 16/29] journald: enforce longer line length limit during "setup" phase of stream protocol --- ...cached-credentials-of-stdout-streams.patch | 148 +++++++++++ ...end-of-line-marker-handling-to-use-a.patch | 77 ++++++ ...-journald-rework-pid-change-handling.patch | 230 ++++++++++++++++++ ...-longer-line-length-limit-during-set.patch | 104 ++++++++ systemd.spec | 20 +- 5 files changed, 573 insertions(+), 6 deletions(-) create mode 100644 0081-journal-refresh-cached-credentials-of-stdout-streams.patch create mode 100644 0082-journald-rework-end-of-line-marker-handling-to-use-a.patch create mode 100644 0083-journald-rework-pid-change-handling.patch create mode 100644 0084-journald-enforce-longer-line-length-limit-during-set.patch diff --git a/0081-journal-refresh-cached-credentials-of-stdout-streams.patch b/0081-journal-refresh-cached-credentials-of-stdout-streams.patch new file mode 100644 index 0000000..195dda4 --- /dev/null +++ b/0081-journal-refresh-cached-credentials-of-stdout-streams.patch @@ -0,0 +1,148 @@ +From 09d0b46ab61bebafe5bdc1be95ee153dfb13d6bc Mon Sep 17 00:00:00 2001 +From: Lorenz Bauer +Date: Mon, 4 Nov 2019 16:35:46 +0000 +Subject: [PATCH] journal: refresh cached credentials of stdout streams + +journald assumes that getsockopt(SO_PEERCRED) correctly identifies the +process on the remote end of the socket. However, this is incorrect +according to man 7 socket: + +The returned credentials are those that were in effect at the + time of the call to connect(2) or socketpair(2). + +This becomes a problem when a new process inherits the stdout stream +from a parent. First, log messages from the child process will +be attributed to the parent. Second, the struct ucred used by journald +becomes invalid as soon as the parent exits. Further sendmsg calls then +fail with ENOENT. Logs for the child process then vanish from the journal. + +Fix this by using recvmsg on the stdout stream, and refreshing the cached +struct ucred if SCM_CREDENTIALS indicate a new process. + +Fixes #13708 +--- + src/journal/journald-stream.c | 49 ++++++++++++++++++++++++++++++++++-- + test/TEST-04-JOURNAL/test-journal.sh | 16 ++++++++++++ + 2 files changed, 63 insertions(+), 2 deletions(-) + +diff --git a/src/journal/journald-stream.c b/src/journal/journald-stream.c +index afebade..22a70ce 100644 +--- a/src/journal/journald-stream.c ++++ b/src/journal/journald-stream.c +@@ -487,11 +487,22 @@ static int stdout_stream_scan(StdoutStream *s, bool force_flush) { + } + + static int stdout_stream_process(sd_event_source *es, int fd, uint32_t revents, void *userdata) { ++ uint8_t buf[CMSG_SPACE(sizeof(struct ucred))]; + StdoutStream *s = userdata; ++ struct ucred *ucred = NULL; ++ struct cmsghdr *cmsg; ++ struct iovec iovec; + size_t limit; + ssize_t l; + int r; + ++ struct msghdr msghdr = { ++ .msg_iov = &iovec, ++ .msg_iovlen = 1, ++ .msg_control = buf, ++ .msg_controllen = sizeof(buf), ++ }; ++ + assert(s); + + if ((revents|EPOLLIN|EPOLLHUP) != (EPOLLIN|EPOLLHUP)) { +@@ -511,20 +522,50 @@ static int stdout_stream_process(sd_event_source *es, int fd, uint32_t revents, + * always leave room for a terminating NUL we might need to add. */ + limit = MIN(s->allocated - 1, s->server->line_max); + +- l = read(s->fd, s->buffer + s->length, limit - s->length); ++ iovec = IOVEC_MAKE(s->buffer + s->length, limit - s->length); ++ ++ l = recvmsg(s->fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC); + if (l < 0) { +- if (errno == EAGAIN) ++ if (IN_SET(errno, EINTR, EAGAIN)) + return 0; + + log_warning_errno(errno, "Failed to read from stream: %m"); + goto terminate; + } ++ cmsg_close_all(&msghdr); + + if (l == 0) { + stdout_stream_scan(s, true); + goto terminate; + } + ++ CMSG_FOREACH(cmsg, &msghdr) ++ if (cmsg->cmsg_level == SOL_SOCKET && ++ cmsg->cmsg_type == SCM_CREDENTIALS && ++ cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) { ++ ucred = (struct ucred *)CMSG_DATA(cmsg); ++ break; ++ } ++ ++ /* Invalidate the context if the pid of the sender changed. ++ * This happens when a forked process inherits stdout / stderr ++ * from a parent. In this case getpeercred returns the ucred ++ * of the parent, which can be invalid if the parent has exited ++ * in the meantime. ++ */ ++ if (ucred && ucred->pid != s->ucred.pid) { ++ /* force out any previously half-written lines from a ++ * different process, before we switch to the new ucred ++ * structure for everything we just added */ ++ r = stdout_stream_scan(s, true); ++ if (r < 0) ++ goto terminate; ++ ++ s->ucred = *ucred; ++ client_context_release(s->server, s->context); ++ s->context = NULL; ++ } ++ + s->length += l; + r = stdout_stream_scan(s, false); + if (r < 0) +@@ -562,6 +603,10 @@ int stdout_stream_install(Server *s, int fd, StdoutStream **ret) { + if (r < 0) + return log_error_errno(r, "Failed to determine peer credentials: %m"); + ++ r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true); ++ if (r < 0) ++ return log_error_errno(r, "SO_PASSCRED failed: %m"); ++ + if (mac_selinux_use()) { + r = getpeersec(fd, &stream->label); + if (r < 0 && r != -EOPNOTSUPP) +diff --git a/test/TEST-04-JOURNAL/test-journal.sh b/test/TEST-04-JOURNAL/test-journal.sh +index 4e539aa..de27eb0 100755 +--- a/test/TEST-04-JOURNAL/test-journal.sh ++++ b/test/TEST-04-JOURNAL/test-journal.sh +@@ -74,6 +74,22 @@ cmp /expected /output + { journalctl -ball -b -m 2>&1 || :; } | head -1 > /output + cmp /expected /output + ++# https://github.com/systemd/systemd/issues/13708 ++ID=$(systemd-id128 new) ++systemd-cat -t "$ID" bash -c 'echo parent; (echo child) & wait' & ++PID=$! ++wait %% ++journalctl --sync ++# We can drop this grep when https://github.com/systemd/systemd/issues/13937 ++# has a fix. ++journalctl -b -o export -t "$ID" --output-fields=_PID | grep '^_PID=' >/output ++[[ `grep -c . /output` -eq 2 ]] ++grep -q "^_PID=$PID" /output ++grep -vq "^_PID=$PID" /output ++ ++# Add new tests before here, the journald restarts below ++# may make tests flappy. ++ + # Don't lose streams on restart + systemctl start forever-print-hola + sleep 3 +-- +1.8.3.1 + diff --git a/0082-journald-rework-end-of-line-marker-handling-to-use-a.patch b/0082-journald-rework-end-of-line-marker-handling-to-use-a.patch new file mode 100644 index 0000000..c365959 --- /dev/null +++ b/0082-journald-rework-end-of-line-marker-handling-to-use-a.patch @@ -0,0 +1,77 @@ +From 549b7379ba404c33fd448d2bca46a57f6529b00b Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Tue, 12 May 2020 18:53:35 +0200 +Subject: [PATCH] journald: rework end of line marker handling to use a field + table + +--- + src/journal/journald-stream.c | 29 ++++++++++++++++++++--------- + 1 file changed, 20 insertions(+), 9 deletions(-) + +diff --git a/src/journal/journald-stream.c b/src/journal/journald-stream.c +index 22a70ce..b86ed78 100644 +--- a/src/journal/journald-stream.c ++++ b/src/journal/journald-stream.c +@@ -57,6 +57,8 @@ typedef enum LineBreak { + LINE_BREAK_NUL, + LINE_BREAK_LINE_MAX, + LINE_BREAK_EOF, ++ _LINE_BREAK_MAX, ++ _LINE_BREAK_INVALID = -1, + } LineBreak; + + struct StdoutStream { +@@ -236,7 +238,11 @@ fail: + return log_error_errno(r, "Failed to save stream data %s: %m", s->state_file); + } + +-static int stdout_stream_log(StdoutStream *s, const char *p, LineBreak line_break) { ++static int stdout_stream_log( ++ StdoutStream *s, ++ const char *p, ++ LineBreak line_break) { ++ + struct iovec *iovec; + int priority; + char syslog_priority[] = "PRIORITY=\0"; +@@ -248,6 +254,9 @@ static int stdout_stream_log(StdoutStream *s, const char *p, LineBreak line_brea + assert(s); + assert(p); + ++ assert(line_break >= 0); ++ assert(line_break < _LINE_BREAK_MAX); ++ + if (s->context) + (void) client_context_maybe_refresh(s->server, s->context, NULL, NULL, 0, NULL, USEC_INFINITY); + else if (pid_is_valid(s->ucred.pid)) { +@@ -299,17 +308,19 @@ static int stdout_stream_log(StdoutStream *s, const char *p, LineBreak line_brea + iovec[n++] = IOVEC_MAKE_STRING(syslog_identifier); + } + +- if (line_break != LINE_BREAK_NEWLINE) { +- const char *c; ++ static const char * const line_break_field_table[_LINE_BREAK_MAX] = { ++ [LINE_BREAK_NEWLINE] = NULL, /* Do not add field if traditional newline */ ++ [LINE_BREAK_NUL] = "_LINE_BREAK=nul", ++ [LINE_BREAK_LINE_MAX] = "_LINE_BREAK=line-max", ++ [LINE_BREAK_EOF] = "_LINE_BREAK=eof", ++ }; + +- /* If this log message was generated due to an uncommon line break then mention this in the log +- * entry */ ++ const char *c = line_break_field_table[line_break]; + +- c = line_break == LINE_BREAK_NUL ? "_LINE_BREAK=nul" : +- line_break == LINE_BREAK_LINE_MAX ? "_LINE_BREAK=line-max" : +- "_LINE_BREAK=eof"; ++ /* If this log message was generated due to an uncommon line break then mention this in the log ++ * entry */ ++ if (c) + iovec[n++] = IOVEC_MAKE_STRING(c); +- } + + message = strjoin("MESSAGE=", p); + if (message) +-- +1.8.3.1 + diff --git a/0083-journald-rework-pid-change-handling.patch b/0083-journald-rework-pid-change-handling.patch new file mode 100644 index 0000000..b8edce4 --- /dev/null +++ b/0083-journald-rework-pid-change-handling.patch @@ -0,0 +1,230 @@ +From 45ba1ea5e9264d385fa565328fe957ef1d78caa1 Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Tue, 12 May 2020 18:56:34 +0200 +Subject: [PATCH] journald: rework pid change handling + +Let's introduce an explicit line ending marker for line endings due to +pid change. + +Let's also make sure we don't get confused with buffer management. + +Fixes: #15654 +--- + src/journal/journald-stream.c | 108 +++++++++++++++++++++++++++--------------- + 1 file changed, 69 insertions(+), 39 deletions(-) + +diff --git a/src/journal/journald-stream.c b/src/journal/journald-stream.c +index b86ed78..3219b14 100644 +--- a/src/journal/journald-stream.c ++++ b/src/journal/journald-stream.c +@@ -57,6 +57,7 @@ typedef enum LineBreak { + LINE_BREAK_NUL, + LINE_BREAK_LINE_MAX, + LINE_BREAK_EOF, ++ LINE_BREAK_PID_CHANGE, + _LINE_BREAK_MAX, + _LINE_BREAK_INVALID = -1, + } LineBreak; +@@ -313,6 +314,7 @@ static int stdout_stream_log( + [LINE_BREAK_NUL] = "_LINE_BREAK=nul", + [LINE_BREAK_LINE_MAX] = "_LINE_BREAK=line-max", + [LINE_BREAK_EOF] = "_LINE_BREAK=eof", ++ [LINE_BREAK_PID_CHANGE] = "_LINE_BREAK=pid-change", + }; + + const char *c = line_break_field_table[line_break]; +@@ -434,21 +436,43 @@ static int stdout_stream_line(StdoutStream *s, char *p, LineBreak line_break) { + assert_not_reached("Unknown stream state"); + } + +-static int stdout_stream_scan(StdoutStream *s, bool force_flush) { +- char *p; +- size_t remaining; ++static int stdout_stream_found( ++ StdoutStream *s, ++ char *p, ++ size_t l, ++ LineBreak line_break) { ++ ++ char saved; + int r; + + assert(s); ++ assert(p); ++ ++ /* Let's NUL terminate the specified buffer for this call, and revert back afterwards */ ++ saved = p[l]; ++ p[l] = 0; ++ r = stdout_stream_line(s, p, line_break); ++ p[l] = saved; + +- p = s->buffer; +- remaining = s->length; ++ return r; ++} ++ ++static int stdout_stream_scan( ++ StdoutStream *s, ++ char *p, ++ size_t remaining, ++ LineBreak force_flush, ++ size_t *ret_consumed) { + +- /* XXX: This function does nothing if (s->length == 0) */ ++ size_t consumed = 0; ++ int r; ++ ++ assert(s); ++ assert(p); + + for (;;) { + LineBreak line_break; +- size_t skip; ++ size_t skip, found; + char *end1, *end2; + + end1 = memchr(p, '\n', remaining); +@@ -456,43 +480,40 @@ static int stdout_stream_scan(StdoutStream *s, bool force_flush) { + + if (end2) { + /* We found a NUL terminator */ +- skip = end2 - p + 1; ++ found = end2 - p; ++ skip = found + 1; + line_break = LINE_BREAK_NUL; + } else if (end1) { + /* We found a \n terminator */ +- *end1 = 0; +- skip = end1 - p + 1; ++ found = end1 - p; ++ skip = found + 1; + line_break = LINE_BREAK_NEWLINE; + } else if (remaining >= s->server->line_max) { + /* Force a line break after the maximum line length */ +- *(p + s->server->line_max) = 0; +- skip = remaining; ++ found = skip = s->server->line_max; + line_break = LINE_BREAK_LINE_MAX; + } else + break; + +- r = stdout_stream_line(s, p, line_break); ++ r = stdout_stream_found(s, p, found, line_break); + if (r < 0) + return r; + +- remaining -= skip; + p += skip; ++ consumed += skip; ++ remaining -= skip; + } + +- if (force_flush && remaining > 0) { +- p[remaining] = 0; +- r = stdout_stream_line(s, p, LINE_BREAK_EOF); ++ if (force_flush >= 0 && remaining > 0) { ++ r = stdout_stream_found(s, p, remaining, force_flush); + if (r < 0) + return r; + +- p += remaining; +- remaining = 0; ++ consumed += remaining; + } + +- if (p > s->buffer) { +- memmove(s->buffer, p, remaining); +- s->length = remaining; +- } ++ if (ret_consumed) ++ *ret_consumed = consumed; + + return 0; + } +@@ -500,11 +521,12 @@ static int stdout_stream_scan(StdoutStream *s, bool force_flush) { + static int stdout_stream_process(sd_event_source *es, int fd, uint32_t revents, void *userdata) { + uint8_t buf[CMSG_SPACE(sizeof(struct ucred))]; + StdoutStream *s = userdata; ++ size_t limit, consumed; + struct ucred *ucred = NULL; + struct cmsghdr *cmsg; + struct iovec iovec; +- size_t limit; + ssize_t l; ++ char *p; + int r; + + struct msghdr msghdr = { +@@ -532,7 +554,7 @@ static int stdout_stream_process(sd_event_source *es, int fd, uint32_t revents, + /* Try to make use of the allocated buffer in full, but never read more than the configured line size. Also, + * always leave room for a terminating NUL we might need to add. */ + limit = MIN(s->allocated - 1, s->server->line_max); +- ++ assert(s->length <= limit); + iovec = IOVEC_MAKE(s->buffer + s->length, limit - s->length); + + l = recvmsg(s->fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC); +@@ -546,7 +568,7 @@ static int stdout_stream_process(sd_event_source *es, int fd, uint32_t revents, + cmsg_close_all(&msghdr); + + if (l == 0) { +- stdout_stream_scan(s, true); ++ (void) stdout_stream_scan(s, s->buffer, s->length, /* force_flush = */ LINE_BREAK_EOF, NULL); + goto terminate; + } + +@@ -558,30 +580,38 @@ static int stdout_stream_process(sd_event_source *es, int fd, uint32_t revents, + break; + } + +- /* Invalidate the context if the pid of the sender changed. +- * This happens when a forked process inherits stdout / stderr +- * from a parent. In this case getpeercred returns the ucred +- * of the parent, which can be invalid if the parent has exited +- * in the meantime. +- */ ++ /* Invalidate the context if the PID of the sender changed. This happens when a forked process ++ * inherits stdout/stderr from a parent. In this case getpeercred() returns the ucred of the parent, ++ * which can be invalid if the parent has exited in the meantime. */ + if (ucred && ucred->pid != s->ucred.pid) { +- /* force out any previously half-written lines from a ++ /* Force out any previously half-written lines from a + * different process, before we switch to the new ucred + * structure for everything we just added */ +- r = stdout_stream_scan(s, true); ++ r = stdout_stream_scan(s, s->buffer, s->length, /* force_flush = */ LINE_BREAK_PID_CHANGE, NULL); + if (r < 0) + goto terminate; + +- s->ucred = *ucred; +- client_context_release(s->server, s->context); +- s->context = NULL; ++ s->context = client_context_release(s->server, s->context); ++ ++ p = s->buffer + s->length; ++ } else { ++ p = s->buffer; ++ l += s->length; + } + +- s->length += l; +- r = stdout_stream_scan(s, false); ++ /* Always copy in the new credentials */ ++ if (ucred) ++ s->ucred = *ucred; ++ ++ r = stdout_stream_scan(s, p, l, _LINE_BREAK_INVALID, &consumed); + if (r < 0) + goto terminate; + ++ /* Move what wasn't consumed to the front of the buffer */ ++ assert(consumed <= (size_t) l); ++ s->length = l - consumed; ++ memmove(s->buffer, p + consumed, s->length); ++ + return 1; + + terminate: +-- +1.8.3.1 + diff --git a/0084-journald-enforce-longer-line-length-limit-during-set.patch b/0084-journald-enforce-longer-line-length-limit-during-set.patch new file mode 100644 index 0000000..71aeae5 --- /dev/null +++ b/0084-journald-enforce-longer-line-length-limit-during-set.patch @@ -0,0 +1,104 @@ +From 4e071b5240a29842bc8acd0d7eb0b797f2812b8b Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Fri, 21 May 2021 17:55:38 +0800 +Subject: [PATCH] change + +--- + src/journal/journald-stream.c | 35 ++++++++++++++++++++++++++++------- + 1 file changed, 28 insertions(+), 7 deletions(-) + +diff --git a/src/journal/journald-stream.c b/src/journal/journald-stream.c +index 3219b14..fda75fb 100644 +--- a/src/journal/journald-stream.c ++++ b/src/journal/journald-stream.c +@@ -38,6 +38,12 @@ + + #define STDOUT_STREAMS_MAX 4096 + ++/* During the "setup" protocol phase of the stream logic let's define a different maximum line length than ++ * during the actual operational phase. We want to allow users to specify very short line lengths after all, ++ * but the unit name we embed in the setup protocol might be longer than that. Hence, during the setup phase ++ * let's enforce a line length matching the maximum unit name length (255) */ ++#define STDOUT_STREAM_SETUP_PROTOCOL_LINE_MAX (UNIT_NAME_MAX-1U) ++ + typedef enum StdoutStreamState { + STDOUT_STREAM_IDENTIFIER, + STDOUT_STREAM_UNIT_ID, +@@ -46,7 +52,7 @@ typedef enum StdoutStreamState { + STDOUT_STREAM_FORWARD_TO_SYSLOG, + STDOUT_STREAM_FORWARD_TO_KMSG, + STDOUT_STREAM_FORWARD_TO_CONSOLE, +- STDOUT_STREAM_RUNNING ++ STDOUT_STREAM_RUNNING, + } StdoutStreamState; + + /* The different types of log record terminators: a real \n was read, a NUL character was read, the maximum line length +@@ -457,6 +463,18 @@ static int stdout_stream_found( + return r; + } + ++static size_t stdout_stream_line_max(StdoutStream *s) { ++ assert(s); ++ ++ /* During the "setup" phase of our protocol, let's ensure we use a line length where a full unit name ++ * can fit in */ ++ if (s->state != STDOUT_STREAM_RUNNING) ++ return STDOUT_STREAM_SETUP_PROTOCOL_LINE_MAX; ++ ++ /* After the protocol's "setup" phase is complete, let's use whatever the user configured */ ++ return s->server->line_max; ++} ++ + static int stdout_stream_scan( + StdoutStream *s, + char *p, +@@ -464,19 +482,22 @@ static int stdout_stream_scan( + LineBreak force_flush, + size_t *ret_consumed) { + +- size_t consumed = 0; ++ size_t consumed = 0, line_max; + int r; + + assert(s); + assert(p); + ++ line_max = stdout_stream_line_max(s); ++ + for (;;) { + LineBreak line_break; + size_t skip, found; + char *end1, *end2; ++ size_t tmp_remaining = MIN(remaining, line_max); + +- end1 = memchr(p, '\n', remaining); +- end2 = memchr(p, 0, end1 ? (size_t) (end1 - p) : remaining); ++ end1 = memchr(p, '\n', tmp_remaining); ++ end2 = memchr(p, 0, end1 ? (size_t) (end1 - p) : tmp_remaining); + + if (end2) { + /* We found a NUL terminator */ +@@ -488,9 +509,9 @@ static int stdout_stream_scan( + found = end1 - p; + skip = found + 1; + line_break = LINE_BREAK_NEWLINE; +- } else if (remaining >= s->server->line_max) { ++ } else if (remaining >= line_max) { + /* Force a line break after the maximum line length */ +- found = skip = s->server->line_max; ++ found = skip = line_max; + line_break = LINE_BREAK_LINE_MAX; + } else + break; +@@ -553,7 +574,7 @@ static int stdout_stream_process(sd_event_source *es, int fd, uint32_t revents, + + /* Try to make use of the allocated buffer in full, but never read more than the configured line size. Also, + * always leave room for a terminating NUL we might need to add. */ +- limit = MIN(s->allocated - 1, s->server->line_max); ++ limit = MIN(s->allocated - 1, MAX(s->server->line_max, STDOUT_STREAM_SETUP_PROTOCOL_LINE_MAX)); + assert(s->length <= limit); + iovec = IOVEC_MAKE(s->buffer + s->length, limit - s->length); + +-- +1.8.3.1 + diff --git a/systemd.spec b/systemd.spec index 9d73db7..8b9db75 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 36 +Release: 37 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -125,6 +125,11 @@ Patch0078: 0078-backport-varlink-make-userdata-pointer-inheritance-from-var Patch0079: 0079-backport-udev-net_id-parse-_SUN-ACPI-index-as-a-signed-intege.patch Patch0080: 0080-backport-udev-net_id-don-t-generate-slot-based-names-if-multi.patch +Patch0081: 0081-journal-refresh-cached-credentials-of-stdout-streams.patch +Patch0082: 0082-journald-rework-end-of-line-marker-handling-to-use-a.patch +Patch0083: 0083-journald-rework-pid-change-handling.patch +Patch0084: 0084-journald-enforce-longer-line-length-limit-during-set.patch + #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch Patch9003: 1602-activation-service-must-be-restarted-when-reactivated.patch @@ -1509,28 +1514,31 @@ fi %exclude /usr/share/man/man3/* %changelog -* Mon May 31 2021 overweight - 246-36 +* Mon May 31 2021 overweight - 243-37 +- fix journald: enforce longer line length limit during "setup" phase of stream protocol + +* Mon May 31 2021 overweight - 243-36 - fix patches name and patches num -* Thu May 27 2021 shenyangyang - 246-35 +* Thu May 27 2021 shenyangyang - 243-35 - Type:bugfix - ID:NA - SUG:NA - DESC:change requires to openssl-libs as post scripts systemctl requires libssl.so.1.1 -* Mon May 10 2021 shenyangyang - 246-34 +* Mon May 10 2021 shenyangyang - 243-34 - Type:bugfix - ID:NA - SUG:NA - DESC:backport from upstream to solve the problem when devices claim the same slot -* Fri Apr 02 2021 fangxiuning - 246-33 +* Fri Apr 02 2021 fangxiuning - 243-33 - Type:bugfix - ID:NA - SUG:NA - DESC:fix userdate double free -* Fri Jan 29 2021 overweight - 246-32 +* Fri Jan 29 2021 overweight - 243-32 - Type:cve - ID:CVE-2018-21029 - SUG:NA -- Gitee From 230fd3539cc654c94f55cf2178a94e982641ac75 Mon Sep 17 00:00:00 2001 From: ExtinctFire Date: Thu, 3 Jun 2021 19:08:58 +0800 Subject: [PATCH 17/29] Fix migration from DynamicUser=yes to no. Signed-off-by: ExtinctFire --- ...migration-from-DynamicUser-yes-to-no.patch | 52 +++++++++++++++++++ systemd.spec | 6 ++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 backport-execute-Fix-migration-from-DynamicUser-yes-to-no.patch diff --git a/backport-execute-Fix-migration-from-DynamicUser-yes-to-no.patch b/backport-execute-Fix-migration-from-DynamicUser-yes-to-no.patch new file mode 100644 index 0000000..ac60fbc --- /dev/null +++ b/backport-execute-Fix-migration-from-DynamicUser-yes-to-no.patch @@ -0,0 +1,52 @@ +From 578dc69f2a60d6282acc2d06ce8a3bf8a9d8ada0 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Fri, 6 Mar 2020 15:56:28 +0900 +Subject: [PATCH 0007/6858] execute: Fix migration from DynamicUser=yes to no + +Closes #12131. +Reference: https://github.com/systemd/systemd/pull/15033/commits/578dc69f2a60d6282acc2d06ce8a3bf8a9d8ada0 +Conflict: remove the last arguement "NULL" of function "chase_symlinks" +--- + src/core/execute.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/src/core/execute.c b/src/core/execute.c +index 4595bb12dc..46b5c99ada 100644 +--- a/src/core/execute.c ++++ b/src/core/execute.c +@@ -2247,7 +2247,7 @@ static int setup_exec_directory( + + if (type != EXEC_DIRECTORY_CONFIGURATION && + readlink_and_make_absolute(p, &target) >= 0) { +- _cleanup_free_ char *q = NULL; ++ _cleanup_free_ char *q = NULL, *q_resolved = NULL, *target_resolved = NULL; + + /* This already exists and is a symlink? Interesting. Maybe it's one created + * by DynamicUser=1 (see above)? +@@ -2256,13 +2256,22 @@ static int setup_exec_directory( + * since they all support the private/ symlink logic at least in some + * configurations, see above. */ + ++ r = chase_symlinks(target, NULL, 0, &target_resolved); ++ if (r < 0) ++ goto fail; ++ + q = path_join(params->prefix[type], "private", *rt); + if (!q) { + r = -ENOMEM; + goto fail; + } + +- if (path_equal(q, target)) { ++ /* /var/lib or friends may be symlinks. So, let's chase them also. */ ++ r = chase_symlinks(q, NULL, CHASE_NONEXISTENT, &q_resolved); ++ if (r < 0) ++ goto fail; ++ ++ if (path_equal(q_resolved, target_resolved)) { + + /* Hmm, apparently DynamicUser= was once turned on for this service, + * but is no longer. Let's move the directory back up. */ +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index 8b9db75..d3b226c 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 37 +Release: 38 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -129,6 +129,7 @@ Patch0081: 0081-journal-refresh-cached-credentials-of-stdout-streams.patch Patch0082: 0082-journald-rework-end-of-line-marker-handling-to-use-a.patch Patch0083: 0083-journald-rework-pid-change-handling.patch Patch0084: 0084-journald-enforce-longer-line-length-limit-during-set.patch +Patch0085: backport-execute-Fix-migration-from-DynamicUser-yes-to-no.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1514,6 +1515,9 @@ fi %exclude /usr/share/man/man3/* %changelog +* Thu Jun 3 2021 extinctfire - 243-38 +- fix migration from DynamicUser=yes to no. + * Mon May 31 2021 overweight - 243-37 - fix journald: enforce longer line length limit during "setup" phase of stream protocol -- Gitee From a369ef8d566ef3184bc7527adc3438fbec7a01eb Mon Sep 17 00:00:00 2001 From: yangmingtaip Date: Thu, 22 Jul 2021 22:15:07 +0800 Subject: [PATCH 18/29] fix cve-2021-33910 --- 0086-fix-CVE-2021-33910.patch | 72 +++++++++++++++++++++++++++++++++++ systemd.spec | 6 ++- 2 files changed, 77 insertions(+), 1 deletion(-) create mode 100644 0086-fix-CVE-2021-33910.patch diff --git a/0086-fix-CVE-2021-33910.patch b/0086-fix-CVE-2021-33910.patch new file mode 100644 index 0000000..d4b7ed3 --- /dev/null +++ b/0086-fix-CVE-2021-33910.patch @@ -0,0 +1,72 @@ +From 441e0115646d54f080e5c3bb0ba477c892861ab9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Wed, 23 Jun 2021 11:46:41 +0200 +Subject: [PATCH] basic/unit-name: do not use strdupa() on a path + +The path may have unbounded length, for example through a fuse mount. + +CVE-2021-33910: attacked controlled alloca() leads to crash in systemd +and +ultimately a kernel panic. Systemd parses the content of +/proc/self/mountinfo +and each mountpoint is passed to mount_setup_unit(), which calls +unit_name_path_escape() underneath. A local attacker who is able to +mount a +filesystem with a very long path can crash systemd and the whole system. + +https://bugzilla.redhat.com/show_bug.cgi?id=1970887 + +The resulting string length is bounded by UNIT_NAME_MAX, which is 256. +But we +can't easily check the length after simplification before doing the +simplification, which in turns uses a copy of the string we can write +to. +So we can't reject paths that are too long before doing the duplication. +Hence the most obvious solution is to switch back to strdup(), as before +7410616cd9dbbec97cf98d75324da5cda2b2f7a2. + +https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9 + +--- + src/basic/unit-name.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/src/basic/unit-name.c b/src/basic/unit-name.c +index 4226f30..1b01af6 100644 +--- a/src/basic/unit-name.c ++++ b/src/basic/unit-name.c +@@ -370,12 +370,13 @@ int unit_name_unescape(const char *f, char **ret) { + } + + int unit_name_path_escape(const char *f, char **ret) { +- char *p, *s; ++ _cleanup_free_ char *p = NULL; ++ char *s; + + assert(f); + assert(ret); + +- p = strdupa(f); ++ p = strdup(f); + if (!p) + return -ENOMEM; + +@@ -387,13 +388,9 @@ int unit_name_path_escape(const char *f, char **ret) { + if (!path_is_normalized(p)) + return -EINVAL; + +- /* Truncate trailing slashes */ ++ /* Truncate trailing slashes and skip leading slashes */ + delete_trailing_chars(p, "/"); +- +- /* Truncate leading slashes */ +- p = skip_leading_chars(p, "/"); +- +- s = unit_name_escape(p); ++ s = unit_name_escape(skip_leading_chars(p, "/")); + } + if (!s) + return -ENOMEM; +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index d3b226c..03cb149 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 38 +Release: 39 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -130,6 +130,7 @@ Patch0082: 0082-journald-rework-end-of-line-marker-handling-to-use-a.patch Patch0083: 0083-journald-rework-pid-change-handling.patch Patch0084: 0084-journald-enforce-longer-line-length-limit-during-set.patch Patch0085: backport-execute-Fix-migration-from-DynamicUser-yes-to-no.patch +Patch0086: 0086-fix-CVE-2021-33910.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1515,6 +1516,9 @@ fi %exclude /usr/share/man/man3/* %changelog +* Thu Jul 22 2021 yangmingtai - 243-39 +- fix CVE-2021-33910 + * Thu Jun 3 2021 extinctfire - 243-38 - fix migration from DynamicUser=yes to no. -- Gitee From bb974e3a162d3da5af84dff1502556322276bb8f Mon Sep 17 00:00:00 2001 From: ExtinctFire Date: Mon, 26 Jul 2021 22:41:48 +0800 Subject: [PATCH 19/29] restore RemainAfterExit=yes in systemd-vconsole-setup.service Signed-off-by: ExtinctFire --- ...mainAfterExit-yes-in-systemd-vconsol.patch | 30 +++++++++++++++++++ systemd.spec | 6 +++- 2 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 backport-units-restore-RemainAfterExit-yes-in-systemd-vconsol.patch diff --git a/backport-units-restore-RemainAfterExit-yes-in-systemd-vconsol.patch b/backport-units-restore-RemainAfterExit-yes-in-systemd-vconsol.patch new file mode 100644 index 0000000..72db99f --- /dev/null +++ b/backport-units-restore-RemainAfterExit-yes-in-systemd-vconsol.patch @@ -0,0 +1,30 @@ +From 9fd32ff7d363945fbf8fdae0128702b995127558 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Thu, 5 Mar 2020 07:11:09 +0100 +Subject: [PATCH] units: restore RemainAfterExit=yes in + systemd-vconsole-setup.service + +This reverts the second part of 8125e8d38e3aa099c7dce8b0161997b8842aebdc. +The first part was reverted in 750e550eba362096d56a35104c6a32631aa67b8e. +The problem starts when s-v-s.s is pulled in by something that is then pulled +in by sysinit.target. Every time a unit is started, systemd recursively checks +all dependencies, and since sysinit.target is pull in by almost anything, we'll +start s-v-s.s over and over. In particular, plymouth-start.service currently +has Wants=s-v-s.s and After=s-v-s.s. +--- + units/systemd-vconsole-setup.service.in | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/units/systemd-vconsole-setup.service.in b/units/systemd-vconsole-setup.service.in +index f4178f495a..9042521c9d 100644 +--- a/units/systemd-vconsole-setup.service.in ++++ b/units/systemd-vconsole-setup.service.in +@@ -16,4 +16,5 @@ ConditionPathExists=/dev/tty0 + + [Service] + Type=oneshot ++RemainAfterExit=yes + ExecStart=@rootlibexecdir@/systemd-vconsole-setup +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index 03cb149..757b31e 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 39 +Release: 40 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -131,6 +131,7 @@ Patch0083: 0083-journald-rework-pid-change-handling.patch Patch0084: 0084-journald-enforce-longer-line-length-limit-during-set.patch Patch0085: backport-execute-Fix-migration-from-DynamicUser-yes-to-no.patch Patch0086: 0086-fix-CVE-2021-33910.patch +Patch0087: backport-units-restore-RemainAfterExit-yes-in-systemd-vconsol.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1516,6 +1517,9 @@ fi %exclude /usr/share/man/man3/* %changelog +* Mon Jul 26 2021 extinctfire - 243-40 +- restore RemainAfterExit=yes in systemd-vconsole-setup.service + * Thu Jul 22 2021 yangmingtai - 243-39 - fix CVE-2021-33910 -- Gitee From 32aee4e3bcf9eec1d03b47fa9eb7a051023fe3a2 Mon Sep 17 00:00:00 2001 From: jiazhenyuan Date: Mon, 2 Aug 2021 10:52:22 +0800 Subject: [PATCH 20/29] set kernel.core_pipe_limit=16 --- set-kernel-core_pipe_limit-to-16.patch | 33 ++++++++++++++++++++++++++ systemd.spec | 6 ++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 set-kernel-core_pipe_limit-to-16.patch diff --git a/set-kernel-core_pipe_limit-to-16.patch b/set-kernel-core_pipe_limit-to-16.patch new file mode 100644 index 0000000..e241504 --- /dev/null +++ b/set-kernel-core_pipe_limit-to-16.patch @@ -0,0 +1,33 @@ +From 283ff70372cddb8b06ca3b2c5e7b8287f81207a9 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Fri, 30 Jul 2021 12:38:27 +0800 +Subject: [PATCH] set kernel.core_pipe_limit=16 + +https://github.com/poettering/systemd/commit/8444f245b56d085cdcfa788e9b9c7799fc58a46b + +--- + sysctl.d/50-coredump.conf.in | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sysctl.d/50-coredump.conf.in b/sysctl.d/50-coredump.conf.in +index 47bf847..327863d 100644 +--- a/sysctl.d/50-coredump.conf.in ++++ b/sysctl.d/50-coredump.conf.in +@@ -10,3 +10,14 @@ + # setting below. + + kernel.core_pattern=|@rootlibexecdir@/systemd-coredump %P %u %g %s %t %c %h ++ ++# Allow that 16 coredumps are dispatched in parallel by the kernel. We want to ++# be able to collect process metadata from /proc/%P/ while processing ++# coredumps, and thus need to make sure the crashed processes are not reaped ++# until we finished collecting what we need. The kernel default for this sysctl ++# is "0" which means the kernel doesn't wait for userspace processes to finish ++# processing before reaping the crashed processes — by setting this higher the ++# kernel will delay reaping until we are done, but only for the specified ++# number of crashes in parallel. The value of 16 is chosen to match ++# systemd-coredump.socket's MaxConnections= value. ++kernel.core_pipe_limit=16 +-- +2.27.0 + diff --git a/systemd.spec b/systemd.spec index 757b31e..a66955f 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 40 +Release: 41 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -146,6 +146,7 @@ Patch9008: 1620-nop_job-of-a-unit-must-also-be-coldpluged-after-deserizatio Patch9009: systemd-change-time-log-level.patch Patch9010: fix-capsh-drop-but-ping-success.patch Patch9011: 0998-resolved-create-etc-resolv.conf-symlink-at-runtime.patch +Patch9012: set-kernel-core_pipe_limit-to-16.patch BuildRequires: gcc, gcc-c++ BuildRequires: libcap-devel, libmount-devel, pam-devel, libselinux-devel @@ -1517,6 +1518,9 @@ fi %exclude /usr/share/man/man3/* %changelog +* Mon Aug 02 2021 jiazhenyuan - 243-41 +- set kernel.core_pipe_limit=16 + * Mon Jul 26 2021 extinctfire - 243-40 - restore RemainAfterExit=yes in systemd-vconsole-setup.service -- Gitee From 44b338475f5881efb38850c5364477a836db2577 Mon Sep 17 00:00:00 2001 From: fangxiuning Date: Mon, 2 Aug 2021 16:19:56 +0800 Subject: [PATCH 21/29] modify --- ...-worker-in-manager_kill_workers-when.patch | 104 ++++++++++++++++++ systemd.spec | 9 +- 2 files changed, 112 insertions(+), 1 deletion(-) create mode 100644 backport-udevd-don-t-kill-worker-in-manager_kill_workers-when.patch diff --git a/backport-udevd-don-t-kill-worker-in-manager_kill_workers-when.patch b/backport-udevd-don-t-kill-worker-in-manager_kill_workers-when.patch new file mode 100644 index 0000000..518e870 --- /dev/null +++ b/backport-udevd-don-t-kill-worker-in-manager_kill_workers-when.patch @@ -0,0 +1,104 @@ +From f257a8fc13b2a617d845132eb61aefde47921198 Mon Sep 17 00:00:00 2001 +From: gaoyi +Date: Fri, 19 Mar 2021 15:16:56 +0800 +Subject: [PATCH] udevd: don't kill worker in manager_kill_workers when it's + running + +If worker is running, kill worker may lead uevent unprocessed. +--- + src/udev/udevd.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/src/udev/udevd.c b/src/udev/udevd.c +index cb51230..215f020 100644 +--- a/src/udev/udevd.c ++++ b/src/udev/udevd.c +@@ -134,6 +134,7 @@ enum worker_state { + WORKER_RUNNING, + WORKER_IDLE, + WORKER_KILLED, ++ WORKER_KILLING, + }; + + struct worker { +@@ -654,7 +655,7 @@ static int event_queue_insert(Manager *manager, sd_device *dev) { + return 0; + } + +-static void manager_kill_workers(Manager *manager) { ++static void manager_kill_workers(Manager *manager, bool force) { + struct worker *worker; + Iterator i; + +@@ -664,6 +665,11 @@ static void manager_kill_workers(Manager *manager) { + if (worker->state == WORKER_KILLED) + continue; + ++ if (worker->state == WORKER_RUNNING && !force) { ++ worker->state = WORKER_KILLING; ++ continue; ++ } ++ + worker->state = WORKER_KILLED; + (void) kill(worker->pid, SIGTERM); + } +@@ -810,7 +816,7 @@ static void manager_exit(Manager *manager) { + + /* discard queued events and kill workers */ + event_queue_cleanup(manager, EVENT_QUEUED); +- manager_kill_workers(manager); ++ manager_kill_workers(manager, true); + + assert_se(sd_event_now(manager->event, CLOCK_MONOTONIC, &usec) >= 0); + +@@ -829,7 +835,7 @@ static void manager_reload(Manager *manager) { + "RELOADING=1\n" + "STATUS=Flushing configuration..."); + +- manager_kill_workers(manager); ++ manager_kill_workers(manager, false); + manager->rules = udev_rules_free(manager->rules); + udev_builtin_exit(); + +@@ -844,7 +850,7 @@ static int on_kill_workers_event(sd_event_source *s, uint64_t usec, void *userda + assert(manager); + + log_debug("Cleanup idle workers"); +- manager_kill_workers(manager); ++ manager_kill_workers(manager, false); + + return 1; + } +@@ -966,7 +972,10 @@ static int on_worker(sd_event_source *s, int fd, uint32_t revents, void *userdat + continue; + } + +- if (worker->state != WORKER_KILLED) ++ if (worker->state == WORKER_KILLING) { ++ worker->state = WORKER_KILLED; ++ (void) kill(worker->pid, SIGTERM); ++ } else if (worker->state != WORKER_KILLED) + worker->state = WORKER_IDLE; + + /* worker returned */ +@@ -1012,7 +1021,7 @@ static int on_ctrl_msg(struct udev_ctrl *uctrl, enum udev_ctrl_msg_type type, co + log_debug("Received udev control message (SET_LOG_LEVEL), setting log_priority=%i", value->intval); + log_set_max_level_realm(LOG_REALM_UDEV, value->intval); + log_set_max_level_realm(LOG_REALM_SYSTEMD, value->intval); +- manager_kill_workers(manager); ++ manager_kill_workers(manager, false); + break; + case UDEV_CTRL_STOP_EXEC_QUEUE: + log_debug("Received udev control message (STOP_EXEC_QUEUE)"); +@@ -1077,7 +1086,7 @@ static int on_ctrl_msg(struct udev_ctrl *uctrl, enum udev_ctrl_msg_type type, co + } + + key = val = NULL; +- manager_kill_workers(manager); ++ manager_kill_workers(manager, false); + break; + } + case UDEV_CTRL_SET_CHILDREN_MAX: +-- +1.8.3.1 + diff --git a/systemd.spec b/systemd.spec index a66955f..630d2c5 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 41 +Release: 42 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -132,6 +132,7 @@ Patch0084: 0084-journald-enforce-longer-line-length-limit-during-set.patch Patch0085: backport-execute-Fix-migration-from-DynamicUser-yes-to-no.patch Patch0086: 0086-fix-CVE-2021-33910.patch Patch0087: backport-units-restore-RemainAfterExit-yes-in-systemd-vconsol.patch +Patch0088: backport-udevd-don-t-kill-worker-in-manager_kill_workers-when.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1518,6 +1519,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Mon Aug 02 2021 fangxiuning - 243-42 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:udevd: don't kill worker in manager_kill_worker when it's running + * Mon Aug 02 2021 jiazhenyuan - 243-41 - set kernel.core_pipe_limit=16 -- Gitee From af8c6703be628d4986e46e7d7a6d76ca875ccead Mon Sep 17 00:00:00 2001 From: yangmingtaip Date: Tue, 3 Aug 2021 10:33:31 +0800 Subject: [PATCH 22/29] fix broken symbolic links when same link for different devices --- ...make-mtime-check-stricter-and-use-en.patch | 34 ++++ ...at_inode_unmodified-helper-that-chec.patch | 53 ++++++ ...thm-that-selects-highest-priority-de.patch | 174 ++++++++++++++++++ systemd.spec | 11 +- 4 files changed, 271 insertions(+), 1 deletion(-) create mode 100644 backport-basic-stat-util-make-mtime-check-stricter-and-use-en.patch create mode 100644 backport-stat-util-add-stat_inode_unmodified-helper-that-chec.patch create mode 100644 backport-udev-make-algorithm-that-selects-highest-priority-de.patch diff --git a/backport-basic-stat-util-make-mtime-check-stricter-and-use-en.patch b/backport-basic-stat-util-make-mtime-check-stricter-and-use-en.patch new file mode 100644 index 0000000..b61423c --- /dev/null +++ b/backport-basic-stat-util-make-mtime-check-stricter-and-use-en.patch @@ -0,0 +1,34 @@ +From a59b0a9f768f6e27b25f4f1bab6de08842e78d74 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michal=20Sekleta=CC=81r?= +Date: Thu, 5 Nov 2020 17:55:25 +0100 +Subject: [PATCH] basic/stat-util: make mtime check stricter and use entire + timestamp + +Note that st_mtime member of struct stat is defined as follows, + + #define st_mtime st_mtim.tv_sec + +Hence we omitted checking nanosecond part of the timestamp (struct +timespec) and possibly would miss modifications that happened within the +same second. +--- + src/basic/stat-util.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/basic/stat-util.c b/src/basic/stat-util.c +index 4595ba7..b44d75c 100644 +--- a/src/basic/stat-util.c ++++ b/src/basic/stat-util.c +@@ -394,7 +394,8 @@ bool stat_inode_unmodified(const struct stat *a, const struct stat *b) { + return a && b && + (a->st_mode & S_IFMT) != 0 && /* We use the check for .st_mode if the structure was ever initialized */ + ((a->st_mode ^ b->st_mode) & S_IFMT) == 0 && /* same inode type */ +- a->st_mtime == b->st_mtime && ++ a->st_mtim.tv_sec == b->st_mtim.tv_sec && ++ a->st_mtim.tv_nsec == b->st_mtim.tv_nsec && + (!S_ISREG(a->st_mode) || a->st_size == b->st_size) && /* if regular file, compare file size */ + a->st_dev == b->st_dev && + a->st_ino == b->st_ino && +-- +2.23.0 + diff --git a/backport-stat-util-add-stat_inode_unmodified-helper-that-chec.patch b/backport-stat-util-add-stat_inode_unmodified-helper-that-chec.patch new file mode 100644 index 0000000..c901844 --- /dev/null +++ b/backport-stat-util-add-stat_inode_unmodified-helper-that-chec.patch @@ -0,0 +1,53 @@ +From fee5c52ac260d021466c1062499f0ebd5241db5f Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Tue, 28 Apr 2020 18:16:25 +0200 +Subject: [PATCH] stat-util: add stat_inode_unmodified() helper that checks if + an inode was modified + +--- + src/basic/stat-util.c | 21 +++++++++++++++++++++ + src/basic/stat-util.h | 2 ++ + 2 files changed, 23 insertions(+) + +diff --git a/src/basic/stat-util.c b/src/basic/stat-util.c +index 2cd722c..4595ba7 100644 +--- a/src/basic/stat-util.c ++++ b/src/basic/stat-util.c +@@ -379,3 +379,24 @@ int device_path_parse_major_minor(const char *path, mode_t *ret_mode, dev_t *ret + + return 0; + } ++ ++bool stat_inode_unmodified(const struct stat *a, const struct stat *b) { ++ ++ /* Returns if the specified stat structures reference the same, unmodified inode. This check tries to ++ * be reasonably careful when detecting changes: we check both inode and mtime, to cater for file ++ * systems where mtimes are fixed to 0 (think: ostree/nixos type installations). We also check file ++ * size, backing device, inode type and if this refers to a device not the major/minor. ++ * ++ * Note that we don't care if file attributes such as ownership or access mode change, this here is ++ * about contents of the file. The purpose here is to detect file contents changes, and nothing ++ * else. */ ++ ++ return a && b && ++ (a->st_mode & S_IFMT) != 0 && /* We use the check for .st_mode if the structure was ever initialized */ ++ ((a->st_mode ^ b->st_mode) & S_IFMT) == 0 && /* same inode type */ ++ a->st_mtime == b->st_mtime && ++ (!S_ISREG(a->st_mode) || a->st_size == b->st_size) && /* if regular file, compare file size */ ++ a->st_dev == b->st_dev && ++ a->st_ino == b->st_ino && ++ (!(S_ISCHR(a->st_mode) || S_ISBLK(a->st_mode)) || a->st_rdev == b->st_rdev); /* if device node, also compare major/minor, because we can */ ++} +diff --git a/src/basic/stat-util.h b/src/basic/stat-util.h +index 7824af3..3665059 100644 +--- a/src/basic/stat-util.h ++++ b/src/basic/stat-util.h +@@ -87,3 +87,5 @@ int fd_verify_directory(int fd); + int device_path_make_major_minor(mode_t mode, dev_t devno, char **ret); + int device_path_make_canonical(mode_t mode, dev_t devno, char **ret); + int device_path_parse_major_minor(const char *path, mode_t *ret_mode, dev_t *ret_devno); ++ ++bool stat_inode_unmodified(const struct stat *a, const struct stat *b); +-- +2.23.0 + diff --git a/backport-udev-make-algorithm-that-selects-highest-priority-de.patch b/backport-udev-make-algorithm-that-selects-highest-priority-de.patch new file mode 100644 index 0000000..139d3e3 --- /dev/null +++ b/backport-udev-make-algorithm-that-selects-highest-priority-de.patch @@ -0,0 +1,174 @@ +From 30f6dce62cb3a738b20253f2192270607c31b55b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michal=20Sekleta=CC=81r?= +Date: Fri, 23 Oct 2020 16:30:23 +0200 +Subject: [PATCH] udev: make algorithm that selects highest priority devlink + less susceptible to race conditions + +Previously it was very likely, when multiple contenders for the symlink +appear in parallel, that algorithm would select wrong symlink (i.e. one +with lower-priority). + +Now the algorithm is much more defensive and when we detect change in +set of contenders for the symlink we reevaluate the selection. Same +happens when new symlink replaces already existing symlink that points +to different device node. +--- + src/udev/udev-event.c | 7 ++++ + src/udev/udev-node.c | 75 ++++++++++++++++++++++++++++++++++--------- + 2 files changed, 67 insertions(+), 15 deletions(-) + +diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c +index ae78aef..1a8becb 100644 +--- a/src/udev/udev-event.c ++++ b/src/udev/udev-event.c +@@ -1017,6 +1017,13 @@ int udev_event_execute_rules(UdevEvent *event, + if (r < 0) + return log_device_debug_errno(dev, r, "Failed to update database under /run/udev/data/: %m"); + ++ /* Yes, we run update_devnode() twice, because in the first invocation, that is before update of udev database, ++ * it could happen that two contenders are replacing each other's symlink. Hence we run it again to make sure ++ * symlinks point to devices that claim them with the highest priority. */ ++ r = update_devnode(event); ++ if (r < 0) ++ return r; ++ + device_set_is_initialized(dev); + + event->dev_db_clone = sd_device_unref(event->dev_db_clone); +diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c +index ce95e20..2694185 100644 +--- a/src/udev/udev-node.c ++++ b/src/udev/udev-node.c +@@ -22,12 +22,15 @@ + #include "path-util.h" + #include "selinux-util.h" + #include "smack-util.h" ++#include "stat-util.h" + #include "stdio-util.h" + #include "string-util.h" + #include "strxcpyx.h" + #include "udev-node.h" + #include "user-util.h" + ++#define LINK_UPDATE_MAX_RETRIES 128 ++ + static int node_symlink(sd_device *dev, const char *node, const char *slink) { + _cleanup_free_ char *slink_dirname = NULL, *target = NULL; + const char *id_filename, *slink_tmp; +@@ -101,7 +104,9 @@ static int node_symlink(sd_device *dev, const char *node, const char *slink) { + if (rename(slink_tmp, slink) < 0) { + r = log_device_error_errno(dev, errno, "Failed to rename '%s' to '%s': %m", slink_tmp, slink); + (void) unlink(slink_tmp); +- } ++ } else ++ /* Tell caller that we replaced already existing symlink. */ ++ r = 1; + + return r; + } +@@ -194,7 +199,7 @@ static int link_update(sd_device *dev, const char *slink, bool add) { + _cleanup_free_ char *target = NULL, *filename = NULL, *dirname = NULL; + char name_enc[PATH_MAX]; + const char *id_filename; +- int r; ++ int i, r, retries; + + assert(dev); + assert(slink); +@@ -214,14 +219,6 @@ static int link_update(sd_device *dev, const char *slink, bool add) { + if (!add && unlink(filename) == 0) + (void) rmdir(dirname); + +- r = link_find_prioritized(dev, add, dirname, &target); +- if (r < 0) { +- log_device_debug(dev, "No reference left, removing '%s'", slink); +- if (unlink(slink) == 0) +- (void) rmdir_parents(slink, "/"); +- } else +- (void) node_symlink(dev, target, slink); +- + if (add) + do { + _cleanup_close_ int fd = -1; +@@ -234,7 +231,49 @@ static int link_update(sd_device *dev, const char *slink, bool add) { + r = -errno; + } while (r == -ENOENT); + +- return r; ++ /* If the database entry is not written yet we will just do one iteration and possibly wrong symlink ++ * will be fixed in the second invocation. */ ++ retries = sd_device_get_is_initialized(dev) > 0 ? LINK_UPDATE_MAX_RETRIES : 1; ++ ++ for (i = 0; i < retries; i++) { ++ struct stat st1 = {}, st2 = {}; ++ ++ r = stat(dirname, &st1); ++ if (r < 0 && errno != ENOENT) ++ return -errno; ++ ++ r = link_find_prioritized(dev, add, dirname, &target); ++ if (r == -ENOENT) { ++ log_device_debug(dev, "No reference left, removing '%s'", slink); ++ if (unlink(slink) == 0) ++ (void) rmdir_parents(slink, "/"); ++ ++ break; ++ } else if (r < 0) ++ return log_device_error_errno(dev, r, "Failed to determine highest priority symlink: %m"); ++ ++ r = node_symlink(dev, target, slink); ++ if (r < 0) { ++ (void) unlink(filename); ++ break; ++ } else if (r == 1) ++ /* We have replaced already existing symlink, possibly there is some other device trying ++ * to claim the same symlink. Let's do one more iteration to give us a chance to fix ++ * the error if other device actually claims the symlink with higher priority. */ ++ continue; ++ ++ /* Skip the second stat() if the first failed, stat_inode_unmodified() would return false regardless. */ ++ if ((st1.st_mode & S_IFMT) != 0) { ++ r = stat(dirname, &st2); ++ if (r < 0 && errno != ENOENT) ++ return -errno; ++ ++ if (stat_inode_unmodified(&st1, &st2)) ++ break; ++ } ++ } ++ ++ return i < LINK_UPDATE_MAX_RETRIES ? 0 : -ELOOP; + } + + int udev_node_update_old_links(sd_device *dev, sd_device *dev_old) { +@@ -442,8 +481,11 @@ int udev_node_add(sd_device *dev, bool apply, + (void) node_symlink(dev, devnode, filename); + + /* create/update symlinks, add symlinks to name index */ +- FOREACH_DEVICE_DEVLINK(dev, devlink) +- (void) link_update(dev, devlink, true); ++ FOREACH_DEVICE_DEVLINK(dev, devlink) { ++ r = link_update(dev, devlink, true); ++ if (r < 0) ++ log_device_info_errno(dev, r, "Failed to update device symlinks: %m"); ++ } + + return 0; + } +@@ -456,8 +498,11 @@ int udev_node_remove(sd_device *dev) { + assert(dev); + + /* remove/update symlinks, remove symlinks from name index */ +- FOREACH_DEVICE_DEVLINK(dev, devlink) +- (void) link_update(dev, devlink, false); ++ FOREACH_DEVICE_DEVLINK(dev, devlink) { ++ r = link_update(dev, devlink, false); ++ if (r < 0) ++ log_device_info_errno(dev, r, "Failed to update device symlinks: %m"); ++ } + + r = xsprintf_dev_num_path_from_sd_device(dev, &filename); + if (r < 0) +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index 630d2c5..539a230 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 42 +Release: 43 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -133,6 +133,9 @@ Patch0085: backport-execute-Fix-migration-from-DynamicUser-yes-to-no.patch Patch0086: 0086-fix-CVE-2021-33910.patch Patch0087: backport-units-restore-RemainAfterExit-yes-in-systemd-vconsol.patch Patch0088: backport-udevd-don-t-kill-worker-in-manager_kill_workers-when.patch +Patch0089: backport-stat-util-add-stat_inode_unmodified-helper-that-chec.patch +Patch0090: backport-basic-stat-util-make-mtime-check-stricter-and-use-en.patch +Patch0091: backport-udev-make-algorithm-that-selects-highest-priority-de.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1519,6 +1522,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Tue Aug 03 2021 yangmingtai - 243-43 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:udevd: fix broken symbolic links when same link for different devices + * Mon Aug 02 2021 fangxiuning - 243-42 - Type:bugfix - ID:NA -- Gitee From 3cbfcc30c238c034fd8747a693d1207fce32dbca Mon Sep 17 00:00:00 2001 From: yangmingtaip Date: Tue, 10 Aug 2021 13:28:37 +0000 Subject: [PATCH 23/29] udevd: exec daemon-reload after installation (cherry picked from commit 5cf60fed02e26f86792f443b3b6ed19241c64fe0) --- systemd.spec | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index 539a230..2ba0993 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 43 +Release: 44 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -712,6 +712,7 @@ grep -q -E '^KEYMAP="?fi-latin[19]"?' /etc/vconsole.conf 2>/dev/null && if [ -f "/usr/lib/udev/rules.d/50-udev-default.rules" ]; then sed -i 's/KERNEL=="kvm", GROUP="kvm", MODE="0666"/KERNEL=="kvm", GROUP="kvm", MODE="0660"/g' /usr/lib/udev/rules.d/50-udev-default.rules fi +%{_bindir}/systemctl daemon-reload &>/dev/null || : %preun udev %systemd_preun %udev_services @@ -1522,6 +1523,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Tue Aug 10 2021 yangmingtai - 243-44 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:udevd: exec daemon-reload after installation + * Tue Aug 03 2021 yangmingtai - 243-43 - Type:bugfix - ID:NA -- Gitee From e4e59fcdc88b7d0ec1323d1a6f15cbf28fa1adeb Mon Sep 17 00:00:00 2001 From: yangmingtaip Date: Mon, 16 Aug 2021 16:53:09 +0800 Subject: [PATCH 24/29] fix CVE-2020-13529 --- ...entatively-ignore-FORCERENEW-command.patch | 38 +++++++++++++++++++ systemd.spec | 9 ++++- 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 backport-tentatively-ignore-FORCERENEW-command.patch diff --git a/backport-tentatively-ignore-FORCERENEW-command.patch b/backport-tentatively-ignore-FORCERENEW-command.patch new file mode 100644 index 0000000..2623fa2 --- /dev/null +++ b/backport-tentatively-ignore-FORCERENEW-command.patch @@ -0,0 +1,38 @@ +From 38e980a6a5a3442c2f48b1f827284388096d8ca5 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Thu, 24 Jun 2021 01:22:07 +0900 +Subject: [PATCH] sd-dhcp-client: tentatively ignore FORCERENEW command + +This makes DHCP client ignore FORCERENEW requests, as unauthenticated +FORCERENEW requests causes a security issue (TALOS-2020-1142, CVE-2020-13529). + +Let's re-enable this after RFC3118 (Authentication for DHCP Messages) +and/or RFC6704 (Forcerenew Nonce Authentication) are implemented. + +Fixes #16774. +--- + src/libsystemd-network/sd-dhcp-client.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/src/libsystemd-network/sd-dhcp-client.c b/src/libsystemd-network/sd-dhcp-client.c +index 67a5a03eba6a..dc8ff19d1a24 100644 +--- a/src/libsystemd-network/sd-dhcp-client.c ++++ b/src/libsystemd-network/sd-dhcp-client.c +@@ -1380,9 +1380,17 @@ static int client_handle_forcerenew(sd_dhcp_client *client, DHCPMessage *force, + if (r != DHCP_FORCERENEW) + return -ENOMSG; + ++#if 0 + log_dhcp_client(client, "FORCERENEW"); + + return 0; ++#else ++ /* FIXME: Ignore FORCERENEW requests until we implement RFC3118 (Authentication for DHCP ++ * Messages) and/or RFC6704 (Forcerenew Nonce Authentication), as unauthenticated FORCERENEW ++ * requests causes a security issue (TALOS-2020-1142, CVE-2020-13529). */ ++ log_dhcp_client(client, "Received FORCERENEW, ignoring."); ++ return -ENOMSG; ++#endif + } + + static bool lease_equal(const sd_dhcp_lease *a, const sd_dhcp_lease *b) { diff --git a/systemd.spec b/systemd.spec index 2ba0993..6b26e74 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 44 +Release: 45 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -136,6 +136,7 @@ Patch0088: backport-udevd-don-t-kill-worker-in-manager_kill_workers-when.pa Patch0089: backport-stat-util-add-stat_inode_unmodified-helper-that-chec.patch Patch0090: backport-basic-stat-util-make-mtime-check-stricter-and-use-en.patch Patch0091: backport-udev-make-algorithm-that-selects-highest-priority-de.patch +Patch0092: backport-tentatively-ignore-FORCERENEW-command.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1523,6 +1524,12 @@ fi %exclude /usr/share/man/man3/* %changelog +* Mon Aug 16 2021 yangmingtai - 243-45 +- Type:CVE +- ID:CVE-2020-13529 +- SUG:NA +- DESC:fix CVE-2020-13529 + * Tue Aug 10 2021 yangmingtai - 243-44 - Type:bugfix - ID:NA -- Gitee From b3cd04939bcd53cc2e256929b8eda0b9ef9a9622 Mon Sep 17 00:00:00 2001 From: yangmingtaip Date: Thu, 9 Sep 2021 20:35:27 +0800 Subject: [PATCH 25/29] network:add missing link->network checks --- ...work-add-missing-link-network-checks.patch | 41 +++++++++++++++++++ systemd.spec | 6 ++- 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 backport-network-add-missing-link-network-checks.patch diff --git a/backport-network-add-missing-link-network-checks.patch b/backport-network-add-missing-link-network-checks.patch new file mode 100644 index 0000000..186596b --- /dev/null +++ b/backport-network-add-missing-link-network-checks.patch @@ -0,0 +1,41 @@ +From b1b0b42e48303134731e017a108c6c334ef5f4c8 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Tue, 17 Sep 2019 21:29:23 +0900 +Subject: [PATCH] network: add missing link->network checks + +When the function is called, no network file may be assigned to the +link. +--- + src/network/networkd-link.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c +index f1aeb7287e34..46d55f64dc5b 100644 +--- a/src/network/networkd-link.c ++++ b/src/network/networkd-link.c +@@ -2393,9 +2393,9 @@ static int link_drop_foreign_config(Link *link) { + continue; + + if (link_address_is_dynamic(link, address)) { +- if (FLAGS_SET(link->network->keep_configuration, KEEP_CONFIGURATION_DHCP)) ++ if (link->network && FLAGS_SET(link->network->keep_configuration, KEEP_CONFIGURATION_DHCP)) + continue; +- } else if (FLAGS_SET(link->network->keep_configuration, KEEP_CONFIGURATION_STATIC)) ++ } else if (link->network && FLAGS_SET(link->network->keep_configuration, KEEP_CONFIGURATION_STATIC)) + continue; + + if (link_is_static_address_configured(link, address)) { +@@ -2435,11 +2435,11 @@ static int link_drop_foreign_config(Link *link) { + in_addr_equal(AF_INET6, &route->dst, &(union in_addr_union) { .in6 = {{{ 0xff,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0 }}} })) + continue; + +- if (route->protocol == RTPROT_STATIC && ++ if (route->protocol == RTPROT_STATIC && link->network && + FLAGS_SET(link->network->keep_configuration, KEEP_CONFIGURATION_STATIC)) + continue; + +- if (route->protocol == RTPROT_DHCP && ++ if (route->protocol == RTPROT_DHCP && link->network && + FLAGS_SET(link->network->keep_configuration, KEEP_CONFIGURATION_DHCP)) + continue; + diff --git a/systemd.spec b/systemd.spec index 6b26e74..6422f3b 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 45 +Release: 46 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -137,6 +137,7 @@ Patch0089: backport-stat-util-add-stat_inode_unmodified-helper-that-chec.pa Patch0090: backport-basic-stat-util-make-mtime-check-stricter-and-use-en.patch Patch0091: backport-udev-make-algorithm-that-selects-highest-priority-de.patch Patch0092: backport-tentatively-ignore-FORCERENEW-command.patch +Patch0093: backport-network-add-missing-link-network-checks.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1524,6 +1525,9 @@ fi %exclude /usr/share/man/man3/* %changelog +* Thu Sep 9 2021 yangmingtai - 243-46 +- fix network coredump after install cloud-init + * Mon Aug 16 2021 yangmingtai - 243-45 - Type:CVE - ID:CVE-2020-13529 -- Gitee From f17dfea33771aa7ab1bc63f96f8b4457a385daf4 Mon Sep 17 00:00:00 2001 From: ExtinctFire Date: Thu, 16 Sep 2021 17:14:48 +0800 Subject: [PATCH 26/29] core: fix free undefined pointer when strdup failed in the first loop Signed-off-by: ExtinctFire --- ...defined-pointer-when-strdup-failed-i.patch | 33 +++++++++++++++++++ systemd.spec | 6 +++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 backport-core-fix-free-undefined-pointer-when-strdup-failed-i.patch diff --git a/backport-core-fix-free-undefined-pointer-when-strdup-failed-i.patch b/backport-core-fix-free-undefined-pointer-when-strdup-failed-i.patch new file mode 100644 index 0000000..17e0d0b --- /dev/null +++ b/backport-core-fix-free-undefined-pointer-when-strdup-failed-i.patch @@ -0,0 +1,33 @@ +From 1509274359979079e3e61899ce12fc8b0f0958d9 Mon Sep 17 00:00:00 2001 +From: xujing <17826839720@163.com> +Date: Wed, 8 Sep 2021 14:26:20 +0800 +Subject: [PATCH] core: fix free undefined pointer when strdup failed in the + first loop + +--- + src/core/load-fragment.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c +index 92815b1dbaea..1c8159a23550 100644 +--- a/src/core/load-fragment.c ++++ b/src/core/load-fragment.c +@@ -800,7 +800,7 @@ int config_parse_exec( + if (!separate_argv0) { + char *w = NULL; + +- if (!GREEDY_REALLOC(n, nbufsize, nlen + 2)) ++ if (!GREEDY_REALLOC0(n, nbufsize, nlen + 2)) + return log_oom(); + + w = strdup(path); +@@ -832,7 +832,7 @@ int config_parse_exec( + p += 2; + p += strspn(p, WHITESPACE); + +- if (!GREEDY_REALLOC(n, nbufsize, nlen + 2)) ++ if (!GREEDY_REALLOC0(n, nbufsize, nlen + 2)) + return log_oom(); + + w = strdup(";"); + diff --git a/systemd.spec b/systemd.spec index 6422f3b..551ea1e 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 46 +Release: 47 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -138,6 +138,7 @@ Patch0090: backport-basic-stat-util-make-mtime-check-stricter-and-use-en.pa Patch0091: backport-udev-make-algorithm-that-selects-highest-priority-de.patch Patch0092: backport-tentatively-ignore-FORCERENEW-command.patch Patch0093: backport-network-add-missing-link-network-checks.patch +Patch0094: backport-core-fix-free-undefined-pointer-when-strdup-failed-i.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1525,6 +1526,9 @@ fi %exclude /usr/share/man/man3/* %changelog +* Thu Sep 16 2021 ExtinctFire - 243-47 +- core: fix free undefined pointer when strdup failed in the first loop + * Thu Sep 9 2021 yangmingtai - 243-46 - fix network coredump after install cloud-init -- Gitee From dd23ac6c032b583863a585f42d2eaa1437e8a66f Mon Sep 17 00:00:00 2001 From: Yangyang Shen Date: Tue, 28 Sep 2021 20:44:17 +0800 Subject: [PATCH 27/29] test adapt to the new capsh format --- ...t-test-adapt-to-the-new-capsh-format.patch | 107 ++++++++++++++++++ systemd.spec | 6 +- 2 files changed, 112 insertions(+), 1 deletion(-) create mode 100644 backport-test-adapt-to-the-new-capsh-format.patch diff --git a/backport-test-adapt-to-the-new-capsh-format.patch b/backport-test-adapt-to-the-new-capsh-format.patch new file mode 100644 index 0000000..d2726c0 --- /dev/null +++ b/backport-test-adapt-to-the-new-capsh-format.patch @@ -0,0 +1,107 @@ +From 9569e385036c05c0bf9fbccdbf3d131161398e2e Mon Sep 17 00:00:00 2001 +From: Frantisek Sumsal +Date: Tue, 4 Feb 2020 13:49:01 +0100 +Subject: [PATCH] test: adapt to the new capsh format + +Since libcap v2.29 the format of cap_to_text() has been changed which +makes certain `test-execute` subtest fail. Let's remove the offending +part of the output (dropped capabilities) to make it compatible with +both the old and the new libcap. +--- + test/test-execute/exec-capabilityboundingset-invert.service | 3 ++- + .../exec-privatedevices-no-capability-mknod.service | 3 ++- + .../exec-privatedevices-no-capability-sys-rawio.service | 3 ++- + .../exec-privatedevices-yes-capability-mknod.service | 3 ++- + .../exec-privatedevices-yes-capability-sys-rawio.service | 3 ++- + .../exec-protectkernelmodules-no-capabilities.service | 3 ++- + .../exec-protectkernelmodules-yes-capabilities.service | 3 ++- + 9 files changed, 18 insertions(+), 9 deletions(-) + +diff --git a/test/test-execute/exec-capabilityboundingset-invert.service b/test/test-execute/exec-capabilityboundingset-invert.service +index 1abe390601..5f37427603 100644 +--- a/test/test-execute/exec-capabilityboundingset-invert.service ++++ b/test/test-execute/exec-capabilityboundingset-invert.service +@@ -2,6 +2,7 @@ + Description=Test for CapabilityBoundingSet + + [Service] +-ExecStart=/bin/sh -x -c '! capsh --print | grep "^Bounding set .*cap_chown"' ++# sed: remove dropped capabilities (cap_xxx-[epi]) from the output ++ExecStart=/bin/sh -x -c '! capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep "^Bounding set .*cap_chown"' + Type=oneshot + CapabilityBoundingSet=~CAP_CHOWN +diff --git a/test/test-execute/exec-privatedevices-no-capability-mknod.service b/test/test-execute/exec-privatedevices-no-capability-mknod.service +index 6d39469da8..4d61d9ffaa 100644 +--- a/test/test-execute/exec-privatedevices-no-capability-mknod.service ++++ b/test/test-execute/exec-privatedevices-no-capability-mknod.service +@@ -3,5 +3,6 @@ Description=Test CAP_MKNOD capability for PrivateDevices=no + + [Service] + PrivateDevices=no +-ExecStart=/bin/sh -x -c 'capsh --print | grep cap_mknod' ++# sed: remove dropped capabilities (cap_xxx-[epi]) from the output ++ExecStart=/bin/sh -x -c 'capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_mknod' + Type=oneshot +diff --git a/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service b/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service +index e7f529c44c..f7f7a16736 100644 +--- a/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service ++++ b/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service +@@ -3,5 +3,6 @@ Description=Test CAP_SYS_RAWIO capability for PrivateDevices=no + + [Service] + PrivateDevices=no +-ExecStart=/bin/sh -x -c 'capsh --print | grep cap_sys_rawio' ++# sed: remove dropped capabilities (cap_xxx-[epi]) from the output ++ExecStart=/bin/sh -x -c 'capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_sys_rawio' + Type=oneshot +diff --git a/test/test-execute/exec-privatedevices-yes-capability-mknod.service b/test/test-execute/exec-privatedevices-yes-capability-mknod.service +index fb1fc2875a..5bcace0845 100644 +--- a/test/test-execute/exec-privatedevices-yes-capability-mknod.service ++++ b/test/test-execute/exec-privatedevices-yes-capability-mknod.service +@@ -3,5 +3,6 @@ Description=Test CAP_MKNOD capability for PrivateDevices=yes + + [Service] + PrivateDevices=yes +-ExecStart=/bin/sh -x -c '! capsh --print | grep cap_mknod' ++# sed: remove dropped capabilities (cap_xxx-[epi]) from the output ++ExecStart=/bin/sh -x -c '! capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_mknod' + Type=oneshot +diff --git a/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service b/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service +index cebc493a7a..a246f950c1 100644 +--- a/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service ++++ b/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service +@@ -3,5 +3,6 @@ Description=Test CAP_SYS_RAWIO capability for PrivateDevices=yes + + [Service] + PrivateDevices=yes +-ExecStart=/bin/sh -x -c '! capsh --print | grep cap_sys_rawio' ++# sed: remove dropped capabilities (cap_xxx-[epi]) from the output ++ExecStart=/bin/sh -x -c '! capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_sys_rawio' + Type=oneshot +diff --git a/test/test-execute/exec-protectkernelmodules-no-capabilities.service b/test/test-execute/exec-protectkernelmodules-no-capabilities.service +index b2f2cd6b8a..8d7e2b52d4 100644 +--- a/test/test-execute/exec-protectkernelmodules-no-capabilities.service ++++ b/test/test-execute/exec-protectkernelmodules-no-capabilities.service +@@ -3,5 +3,6 @@ Description=Test CAP_SYS_MODULE ProtectKernelModules=no + + [Service] + ProtectKernelModules=no +-ExecStart=/bin/sh -x -c 'capsh --print | grep cap_sys_module' ++# sed: remove dropped capabilities (cap_xxx-[epi]) from the output ++ExecStart=/bin/sh -x -c 'capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_sys_module' + Type=oneshot +diff --git a/test/test-execute/exec-protectkernelmodules-yes-capabilities.service b/test/test-execute/exec-protectkernelmodules-yes-capabilities.service +index 84bf39be56..fe2ae208dd 100644 +--- a/test/test-execute/exec-protectkernelmodules-yes-capabilities.service ++++ b/test/test-execute/exec-protectkernelmodules-yes-capabilities.service +@@ -3,5 +3,6 @@ Description=Test CAP_SYS_MODULE for ProtectKernelModules=yes + + [Service] + ProtectKernelModules=yes +-ExecStart=/bin/sh -x -c '! capsh --print | grep cap_sys_module' ++# sed: remove dropped capabilities (cap_xxx-[epi]) from the output ++ExecStart=/bin/sh -x -c '! capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_sys_module' + Type=oneshot +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index 551ea1e..35d47e5 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 47 +Release: 48 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -139,6 +139,7 @@ Patch0091: backport-udev-make-algorithm-that-selects-highest-priority-de.pa Patch0092: backport-tentatively-ignore-FORCERENEW-command.patch Patch0093: backport-network-add-missing-link-network-checks.patch Patch0094: backport-core-fix-free-undefined-pointer-when-strdup-failed-i.patch +Patch0095: backport-test-adapt-to-the-new-capsh-format.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1526,6 +1527,9 @@ fi %exclude /usr/share/man/man3/* %changelog +* Thu Sep 28 2021 shenyangyang - 243-48 +- adapt to the new capsh format for test + * Thu Sep 16 2021 ExtinctFire - 243-47 - core: fix free undefined pointer when strdup failed in the first loop -- Gitee From 664ea58be9a220402c4fa879f3a8d8b5863b3119 Mon Sep 17 00:00:00 2001 From: licunlong Date: Wed, 1 Dec 2021 17:15:57 +0800 Subject: [PATCH 28/29] disable systemd-{timesyncd, networkd, resolved} by default --- ...timesyncd-networkd-resolved-by-defau.patch | 33 +++++++++++++++++++ systemd.spec | 6 +++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 disable-systemd-timesyncd-networkd-resolved-by-defau.patch diff --git a/disable-systemd-timesyncd-networkd-resolved-by-defau.patch b/disable-systemd-timesyncd-networkd-resolved-by-defau.patch new file mode 100644 index 0000000..18e1f49 --- /dev/null +++ b/disable-systemd-timesyncd-networkd-resolved-by-defau.patch @@ -0,0 +1,33 @@ +From 8324f588b88566e077aae9b5814a4ee721f8368c Mon Sep 17 00:00:00 2001 +From: licunlong +Date: Wed, 1 Dec 2021 17:04:40 +0800 +Subject: [PATCH] disable systemd-{timesyncd, networkd, resolved} by default + +--- + presets/90-systemd.preset | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/presets/90-systemd.preset b/presets/90-systemd.preset +index 11960e5..b16164a 100644 +--- a/presets/90-systemd.preset ++++ b/presets/90-systemd.preset +@@ -15,9 +15,6 @@ enable remote-cryptsetup.target + enable machines.target + + enable getty@.service +-enable systemd-timesyncd.service +-enable systemd-networkd.service +-enable systemd-resolved.service + + disable console-getty.service + disable debug-shell.service +@@ -34,3 +31,6 @@ disable syslog.socket + disable systemd-journal-gatewayd.* + disable systemd-journal-remote.* + disable systemd-journal-upload.* ++disable systemd-timesyncd.service ++disable systemd-networkd.service ++disable systemd-resolved.service +-- +2.23.0 + diff --git a/systemd.spec b/systemd.spec index 35d47e5..13ae379 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 48 +Release: 49 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -155,6 +155,7 @@ Patch9009: systemd-change-time-log-level.patch Patch9010: fix-capsh-drop-but-ping-success.patch Patch9011: 0998-resolved-create-etc-resolv.conf-symlink-at-runtime.patch Patch9012: set-kernel-core_pipe_limit-to-16.patch +Patch9013: disable-systemd-timesyncd-networkd-resolved-by-defau.patch BuildRequires: gcc, gcc-c++ BuildRequires: libcap-devel, libmount-devel, pam-devel, libselinux-devel @@ -1527,6 +1528,9 @@ fi %exclude /usr/share/man/man3/* %changelog +* Wed Dec 01 2021 licunlong - 243-49 +- disable systemd-{timesyncd, networkd, resolved} by default + * Thu Sep 28 2021 shenyangyang - 243-48 - adapt to the new capsh format for test -- Gitee From a78b6e0ef5e19b5b1829a1b81c3b7934a05e1055 Mon Sep 17 00:00:00 2001 From: yangmingtaip Date: Fri, 3 Dec 2021 15:28:33 +0800 Subject: [PATCH 29/29] re-check new epoll events when a child event is queued --- ...k-new-epoll-events-when-a-child-even.patch | 317 ++++++++++++++++++ systemd.spec | 8 +- 2 files changed, 323 insertions(+), 2 deletions(-) create mode 100644 backport-sd-event-re-check-new-epoll-events-when-a-child-even.patch diff --git a/backport-sd-event-re-check-new-epoll-events-when-a-child-even.patch b/backport-sd-event-re-check-new-epoll-events-when-a-child-even.patch new file mode 100644 index 0000000..17d4325 --- /dev/null +++ b/backport-sd-event-re-check-new-epoll-events-when-a-child-even.patch @@ -0,0 +1,317 @@ +From efd3be9de1dc07ec743912f3c166bbf17dbb20f5 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Mon, 8 Mar 2021 15:39:53 +0900 +Subject: [PATCH] sd-event: re-check new epoll events when a child event is + queued + +Previously, when a process outputs something and exit just after +epoll_wait() but before process_child(), then the IO event is ignored +even if the IO event has higher priority. See #18190. + +This can be solved by checking epoll event again after process_child(). + +However, there exists a possibility that another process outputs and +exits just after process_child() but before the second epoll_wait(). +When the IO event has lower priority than the child event, still IO +event is processed. + +So, this makes new epoll events and child events are checked in a loop +until no new event is detected. To prevent an infinite loop, the number +of maximum trial is set to 10. + +Fixes #18190. +--- + src/libsystemd/sd-event/sd-event.c | 150 +++++++++++++++++++++++++++---------- + 1 file changed, 110 insertions(+), 40 deletions(-) + +diff --git a/src/libsystemd/sd-event/sd-event.c b/src/libsystemd/sd-event/sd-event.c +index 5d0e057..65db799 100644 +--- a/src/libsystemd/sd-event/sd-event.c ++++ b/src/libsystemd/sd-event/sd-event.c +@@ -850,7 +850,7 @@ static int source_set_pending(sd_event_source *s, bool b) { + } + } + +- return 0; ++ return 1; + } + + static sd_event_source *source_new(sd_event *e, bool floating, EventSourceType type) { +@@ -2502,12 +2502,20 @@ static int process_timer( + return 0; + } + +-static int process_child(sd_event *e) { ++static int process_child(sd_event *e, int64_t threshold, int64_t *ret_min_priority) { ++ int64_t min_priority = threshold; ++ bool something_new = false; + sd_event_source *s; + Iterator i; + int r; + + assert(e); ++ assert(ret_min_priority); ++ ++ if (!e->need_process_child) { ++ *ret_min_priority = min_priority; ++ return 0; ++ } + + e->need_process_child = false; + +@@ -2532,6 +2540,9 @@ static int process_child(sd_event *e) { + HASHMAP_FOREACH(s, e->child_sources, i) { + assert(s->type == SOURCE_CHILD); + ++ if (s->priority > threshold) ++ continue; ++ + if (s->pending) + continue; + +@@ -2560,19 +2571,24 @@ static int process_child(sd_event *e) { + r = source_set_pending(s, true); + if (r < 0) + return r; ++ if (r > 0) { ++ something_new = true; ++ min_priority = MIN(min_priority, s->priority); ++ } + } + } + +- return 0; ++ *ret_min_priority = min_priority; ++ return something_new; + } + +-static int process_signal(sd_event *e, struct signal_data *d, uint32_t events) { +- bool read_one = false; ++static int process_signal(sd_event *e, struct signal_data *d, uint32_t events, int64_t *min_priority) { + int r; + + assert(e); + assert(d); + assert_return(events == EPOLLIN, -EIO); ++ assert(min_priority); + + /* If there's a signal queued on this priority and SIGCHLD is + on this priority too, then make sure to recheck the +@@ -2598,7 +2614,7 @@ static int process_signal(sd_event *e, struct signal_data *d, uint32_t events) { + n = read(d->fd, &si, sizeof(si)); + if (n < 0) { + if (IN_SET(errno, EAGAIN, EINTR)) +- return read_one; ++ return 0; + + return -errno; + } +@@ -2608,8 +2624,6 @@ static int process_signal(sd_event *e, struct signal_data *d, uint32_t events) { + + assert(SIGNAL_VALID(si.ssi_signo)); + +- read_one = true; +- + if (e->signal_sources) + s = e->signal_sources[si.ssi_signo]; + if (!s) +@@ -2623,12 +2637,16 @@ static int process_signal(sd_event *e, struct signal_data *d, uint32_t events) { + r = source_set_pending(s, true); + if (r < 0) + return r; ++ if (r > 0 && *min_priority >= s->priority) { ++ *min_priority = s->priority; ++ return 1; /* an event source with smaller priority is queued. */ ++ } + +- return 1; ++ return 0; + } + } + +-static int event_inotify_data_read(sd_event *e, struct inotify_data *d, uint32_t revents) { ++static int event_inotify_data_read(sd_event *e, struct inotify_data *d, uint32_t revents, int64_t threshold) { + ssize_t n; + + assert(e); +@@ -2644,6 +2662,9 @@ static int event_inotify_data_read(sd_event *e, struct inotify_data *d, uint32_t + if (d->buffer_filled > 0) + return 0; + ++ if (d->priority > threshold) ++ return 0; ++ + n = read(d->fd, &d->buffer, sizeof(d->buffer)); + if (n < 0) { + if (IN_SET(errno, EAGAIN, EINTR)) +@@ -3101,21 +3122,15 @@ pending: + return r; + } + +-_public_ int sd_event_wait(sd_event *e, uint64_t timeout) { ++static int process_epoll(sd_event *e, usec_t timeout, int64_t threshold, int64_t *ret_min_priority) { ++ int64_t min_priority = threshold; ++ bool something_new = false; + struct epoll_event *ev_queue; + unsigned ev_queue_max; + int r, m, i; + +- assert_return(e, -EINVAL); +- assert_return(e = event_resolve(e), -ENOPKG); +- assert_return(!event_pid_changed(e), -ECHILD); +- assert_return(e->state != SD_EVENT_FINISHED, -ESTALE); +- assert_return(e->state == SD_EVENT_ARMED, -EBUSY); +- +- if (e->exit_requested) { +- e->state = SD_EVENT_PENDING; +- return 1; +- } ++ assert(e); ++ assert(ret_min_priority); + + ev_queue_max = MAX(e->n_sources, 1u); + ev_queue = newa(struct epoll_event, ev_queue_max); +@@ -3127,16 +3142,12 @@ _public_ int sd_event_wait(sd_event *e, uint64_t timeout) { + m = epoll_wait(e->epoll_fd, ev_queue, ev_queue_max, + timeout == (uint64_t) -1 ? -1 : (int) DIV_ROUND_UP(timeout, USEC_PER_MSEC)); + if (m < 0) { +- if (errno == EINTR) { +- e->state = SD_EVENT_PENDING; +- return 1; +- } +- +- r = -errno; +- goto finish; ++ return -errno; + } + +- triple_timestamp_get(&e->timestamp); ++ /* Set timestamp only when this is called first time. */ ++ if (threshold == INT64_MAX) ++ triple_timestamp_get(&e->timestamp); + + for (i = 0; i < m; i++) { + +@@ -3147,9 +3158,18 @@ _public_ int sd_event_wait(sd_event *e, uint64_t timeout) { + + switch (*t) { + +- case WAKEUP_EVENT_SOURCE: +- r = process_io(e, ev_queue[i].data.ptr, ev_queue[i].events); ++ case WAKEUP_EVENT_SOURCE: { ++ sd_event_source *s = ev_queue[i].data.ptr; ++ ++ if (s->priority > threshold) ++ continue; ++ ++ min_priority = MIN(min_priority, s->priority); ++ ++ r = process_io(e, s, ev_queue[i].events); ++ + break; ++ } + + case WAKEUP_CLOCK_DATA: { + struct clock_data *d = ev_queue[i].data.ptr; +@@ -3158,11 +3178,12 @@ _public_ int sd_event_wait(sd_event *e, uint64_t timeout) { + } + + case WAKEUP_SIGNAL_DATA: +- r = process_signal(e, ev_queue[i].data.ptr, ev_queue[i].events); ++ r = process_signal(e, ev_queue[i].data.ptr, ev_queue[i].events, &min_priority); + break; + + case WAKEUP_INOTIFY_DATA: +- r = event_inotify_data_read(e, ev_queue[i].data.ptr, ev_queue[i].events); ++ r = event_inotify_data_read(e, ev_queue[i].data.ptr, ev_queue[i].events, threshold); ++ + break; + + default: +@@ -3170,7 +3191,63 @@ _public_ int sd_event_wait(sd_event *e, uint64_t timeout) { + } + } + if (r < 0) ++ return r; ++ if (r > 0) ++ something_new = true; ++ } ++ ++ *ret_min_priority = min_priority; ++ return something_new; ++} ++ ++_public_ int sd_event_wait(sd_event *e, uint64_t timeout) { ++ int r; ++ ++ assert_return(e, -EINVAL); ++ assert_return(e = event_resolve(e), -ENOPKG); ++ assert_return(!event_pid_changed(e), -ECHILD); ++ assert_return(e->state != SD_EVENT_FINISHED, -ESTALE); ++ assert_return(e->state == SD_EVENT_ARMED, -EBUSY); ++ ++ if (e->exit_requested) { ++ e->state = SD_EVENT_PENDING; ++ return 1; ++ } ++ ++ for (int64_t threshold = INT64_MAX; ; threshold--) { ++ int64_t epoll_min_priority, child_min_priority; ++ ++ /* There may be a possibility that new epoll (especially IO) and child events are ++ * triggered just after process_epoll() call but before process_child(), and the new IO ++ * events may have higher priority than the child events. To salvage these events, ++ * let's call epoll_wait() again, but accepts only events with higher priority than the ++ * previous. See issue https://github.com/systemd/systemd/issues/18190 and comments ++ * https://github.com/systemd/systemd/pull/18750#issuecomment-785801085 ++ * https://github.com/systemd/systemd/pull/18922#issuecomment-792825226 */ ++ ++ r = process_epoll(e, timeout, threshold, &epoll_min_priority); ++ if (r == -EINTR) { ++ e->state = SD_EVENT_PENDING; ++ return 1; ++ } ++ if (r < 0) + goto finish; ++ if (r == 0 && threshold < INT64_MAX) ++ /* No new epoll event. */ ++ break; ++ ++ r = process_child(e, threshold, &child_min_priority); ++ if (r < 0) ++ goto finish; ++ if (r == 0) ++ /* No new child event. */ ++ break; ++ ++ threshold = MIN(epoll_min_priority, child_min_priority); ++ if (threshold == INT64_MIN) ++ break; ++ ++ timeout = 0; + } + + r = process_watchdog(e); +@@ -3197,19 +3274,12 @@ _public_ int sd_event_wait(sd_event *e, uint64_t timeout) { + if (r < 0) + goto finish; + +- if (e->need_process_child) { +- r = process_child(e); +- if (r < 0) +- goto finish; +- } +- + r = process_inotify(e); + if (r < 0) + goto finish; + + if (event_next_pending(e)) { + e->state = SD_EVENT_PENDING; +- + return 1; + } + +-- +1.8.3.1 + diff --git a/systemd.spec b/systemd.spec index 13ae379..65945d6 100644 --- a/systemd.spec +++ b/systemd.spec @@ -16,7 +16,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 243 -Release: 49 +Release: 50 License: MIT and LGPLv2+ and GPLv2+ Summary: System and Service Manager @@ -139,7 +139,8 @@ Patch0091: backport-udev-make-algorithm-that-selects-highest-priority-de.pa Patch0092: backport-tentatively-ignore-FORCERENEW-command.patch Patch0093: backport-network-add-missing-link-network-checks.patch Patch0094: backport-core-fix-free-undefined-pointer-when-strdup-failed-i.patch -Patch0095: backport-test-adapt-to-the-new-capsh-format.patch +Patch0095: backport-test-adapt-to-the-new-capsh-format.patch +Patch0096: backport-sd-event-re-check-new-epoll-events-when-a-child-even.patch #openEuler Patch9002: 1509-fix-journal-file-descriptors-leak-problems.patch @@ -1528,6 +1529,9 @@ fi %exclude /usr/share/man/man3/* %changelog +* Fri Dec 3 2021 yangmingtai - 243-50 +- re-check new epoll events when a child event is queued + * Wed Dec 01 2021 licunlong - 243-49 - disable systemd-{timesyncd, networkd, resolved} by default -- Gitee