Colin Walters [Tue, 20 Aug 2024 20:18:54 +0000 (16:18 -0400)]
lib/traverse: Fix minor memory leak
I was trying to check something with `-fsanitize=address`
and it warned about this memory leak. It's...subtle, basically
we were leaking when the same commit was added to the hash table.
But unfortunately fixing that then complicates ownership
over the return value; what we really want to use here is
`g_hash_table_steal_all_keys` but RHEL 9.4 is still rocking
`glib2-2.68.4` so we can't use it.
(Rust would mean we wouldn't have leaked anything here in the
first place...)
Dan Nicholson [Fri, 30 Aug 2024 00:19:30 +0000 (18:19 -0600)]
switchroot: Stop making /sysroot mount private
Back in 2b8d586c5, /sysroot was changed to be a private mount so that
submounts of /var do not propagate back to the stateroot /var. That's
laudible, but it makes /sysroot different than every other shared mount
in the root namespace. In particular, it means that submounts of
/sysroot do not propagate into separate mount namespaces.
Rather than make /sysroot private, make /var a slave+shared mount so
that it receives mount events from /sysroot but not vice versa. That
achieves the same effect of preventing /var submount events from
propagating back to /sysroot while allowing /sysroot mount events to
propagate forward like every other system mount. See
mount_namespaces(7)[1] and the linux shared subtrees[2] documentation
for details on slave+shared mount propagation.
When /var is mounted in the initramfs, this is accomplished with
mount(2) syscalls. When /var is mounted after switching to the real
root, the mount propagation flags are applied as options in the
generated var.mount unit. This depends on a mount(8) feature that has
been present since util-linux 2.23. That's available in RHEL 7 and every
non-EOL Debian and Ubuntu release. Applying the propagation from
var.mount fixes a small race, too. Previously, if a /var submount was
added before /sysroot was made private, it would have propagated back
into /sysroot. That was possible since ostree-remount.service orders
itself after var.mount but not before any /var submounts.
Dan Nicholson [Fri, 30 Aug 2024 11:53:10 +0000 (05:53 -0600)]
tests: Add mount propagation test
This tests the current behavior of making /sysroot a private mount so
that submounts on /var do not propagate back to /sysroot. It also shows
how submounts of /sysroot do not propagate into separate mount
namespaces for the same reason.
Colin Walters [Thu, 15 Aug 2024 16:14:33 +0000 (12:14 -0400)]
commit/payload-link: Ensure we don't overrun target_checksum size
This is another warning from recently changed code from Coverity:
```
1. Defect type: OVERRUN
16. libostree-2024.7/src/libostree/ostree-repo-commit.c:823:7: overrun-buffer-arg: Overrunning array "target_checksum" of 65 bytes by passing it to a function which accesses it at byte offset 258 using argument "size" (which evaluates to 259). [Note: The source code implementation of the function has been overridden by a builtin model.]
```
I think this can only happen if the repository is corrupt; the
data shouldn't be that long. But fix this by passing the max
length we expect; this will ignore the rest currently.
Colin Walters [Thu, 15 Aug 2024 15:28:45 +0000 (11:28 -0400)]
sysroot: Make coverity happy with dirname+strdup
Similar to d528083cae3492f9b9424f3c9830869af7b4cbd0 - I don't
believe we actually had a leak here because `dirname` always
returns the same start pointer, but this makes Coverity
happy.
libostree: Remove compatibility code with GLib < 2.44
As the build system has required GLib 2.44 since commit eb09207e1abd7499bd92866cce1de6148d659a4a, the manual expansion of
G_DECLARE_INTERFACE and G_DECLARE_FINAL_TYPE is no longer necessary.
Luke Yang [Thu, 13 Jun 2024 18:41:27 +0000 (14:41 -0400)]
prepare: Create global var for tmp_sysroot_etc
Coverity points out that ""/sysroot.tmp/etc"" could be a copy-paste
error. This is mistake from coverity, but to supress the warning,
we create a global var, tmp_sysroot_etc, which replaces all
instances of TMP_SYSROOT "/etc".
Luke Yang [Wed, 12 Jun 2024 19:55:37 +0000 (15:55 -0400)]
repo: Fix `dir_or_file_path` memory leak
Coverity points out that we have a memory leak from
`g_strdup(dir_or_file_path)`. Make the duplication of the string a
temporary variable that is freed using `g_autofree`.
Luke Yang [Wed, 12 Jun 2024 19:50:54 +0000 (15:50 -0400)]
tree: Fix `name` memory leak
Coverity points out that we have a memory leak from `g_strdup(name)`.
`insert_child_mtree()` takes a const char * and duplicates it.
`name` can be passed directly to `insert_child_mtree()`.
Eric Curtin [Tue, 18 Jun 2024 14:06:12 +0000 (15:06 +0100)]
remount: ignore ENOENT error during SELinux relabeling
Ignore ENOENT error in selinux_restorecon to avoid failures when
temporary files created by systemd-sysusers in /etc are missing during
relabeling. This prevents errors such as:
"Failed to relabel /etc/.#gshadowJzu4Rx: No such file or directory"
and allows the process to continue.
Co-Authored-By: Alexander Larsson <alexl@redhat.com> Signed-off-by: Eric Curtin <ecurtin@redhat.com>
Colin Walters [Sat, 1 Jun 2024 15:29:13 +0000 (11:29 -0400)]
core: Validate that xattr names aren't empty
In the ostree-ext codebase the test fixture was generating xattrs
without the trailing NUL byte. This caused confusing errors
later. Change the dirmeta validator to catch this.
The way GVariant represents bytestrings, the trailing NUL is there
on wire/disk so it can be there in memory too, but `g_variant_get_bytestring()`
will just return an empty `""` string if actually the value
has a missing NUL.
Colin Walters [Wed, 22 May 2024 22:16:48 +0000 (18:16 -0400)]
checkout: Add API to directly checkout composefs
We were missing the simple, obvious API and CLI to go
from ostree commit -> composefs.
Internally, we had `ostree_repo_checkout_composefs`
with the right "shape" mostly, except it had more code
in the deploy path to turn that into a composefs.
Add a straightforward public API that does what
the deploy code did before, and then the old
API becomes an explicitly internal helper with an `_`
prefix.
Goals:
- Lead towards a composefs-oriented future
- This makes the composefs logic more testable directly
Eric Curtin [Tue, 21 May 2024 13:54:19 +0000 (14:54 +0100)]
docs: add webOS as users of libostree
Updated the README.md to include information about webOS, an OS for
smart devices such as smart TVs, which from version 2.0.0 supports
Firmware-Over-the-Air (FOTA) based on libostree. Added relevant links
for further details on webOS and FOTA setup.
Fix _ostree_ensure_fsverity reporting of supports in early exit
If supported_out is passed to _ostree_ensure_fsverity and we
successfully exit early, for example because the file is a symlink, then
*supported_out is not initialized.
This is problematic in the case of ostree_sysroot_update_post_copy(),
because it passes in an uninitialized supported, and on successfull
return of _ostree_ensure_fsverity() it assumes that it is iniialized.
In case supported happened to be initialized to non-zero it will take
this branch:
if (!supported)
break; /* If not supported, skip rest */
Which means *all* further objects will not get fs-verity enabled.
Colin Walters [Thu, 2 May 2024 00:32:33 +0000 (20:32 -0400)]
ci: Only run clang-format on ubuntu-stable GH runner
Previously we were running clang-format across multiple operating
system versions and hence clang versions, and it turns out
clang has changed the preferred formatting multiple times.
We could *probably* dig in and try to pin things more strongly
but eh...for now let's arbitrarily just use whatever's in
the default GH Action ubuntu-latest runner as that should
be equally painful for everyone.
Dan Nicholson [Thu, 25 Apr 2024 03:37:13 +0000 (21:37 -0600)]
repo: Make summary and signature mtime match
HTTP servers derive Last-Modified from the modification time of the
file. When used in combination with a Cache-Control max-age value,
having the modification times match means that caches will consider them
expired at the same time. This helps make it more likely that clients
won't receive a cached summary and fresh signature or vice versa.
This makes more sense to do now that the summary and signature are
created in a temporary directory and renamed into place. In the old days
where they were created directly in the repo root, it would be strange
to change the summary mtime when it wasn't actually modified.
Dan Nicholson [Thu, 25 Apr 2024 03:51:19 +0000 (21:51 -0600)]
tests: Correctly skip single fsverity test
The skip shell function is for skipping an entire test plan. To skip a
single test result, a directive is needed[1]. Without this change, the
test suite errors claiming that 2 test plans were provided when fsverity
isn't available.
otcore_get_ostree_target() should set is_aboot for android boot
systems, but currently it only does this on A/B boot systems, not
single-boot-partition systems. Fix this by setting it in the second
case.
Colin Walters [Fri, 12 Apr 2024 20:10:36 +0000 (16:10 -0400)]
init-fs: Add --epoch=2
We want to start switching things so that the toplevel `/ostree`
repository is mode 0700, to close off unprivileged code
from being able to access it. Previous deployment roots
may have setuid binaries, etc. The `/var/lib/containers/storage`
directory is mode 0700 for this reason I believe.
Colin Walters [Fri, 12 Apr 2024 12:56:13 +0000 (08:56 -0400)]
init-fs: Add --epoch
I want to add another variant here, and `--modern` is now old. Let's
acknowledge that we may want to make even more changes in the
future. So `--modern == --epoch=1` but I will add `--epoch=2` after
this.
_ostree_ensure_fsverity: Properly check for errors
If fs_verity_wanted == _OSTREE_FEATURE_YES we should fail if
!suported, but we were checking !supported where supported is a
pointer, not a boolean. This caused us to miss errors when the kernel
didn't support fs-verity that lead to lots of debugging.
Eric Curtin [Sat, 30 Mar 2024 13:15:34 +0000 (13:15 +0000)]
README & docs: Remove "RHIVOS" acronym
Remove the unofficial acronym RHIVOS from both the README and docs
files. The acronym is associated with Red Hat In-Vehicle Operating
System but isn't officially recognized.
Co-Authored-By: Felicia Kleinfelt <fkleinfe@redhat.com> Signed-off-by: Eric Curtin <ecurtin@redhat.com>
This is stronger than the default (`replace`) because it tells systemd
to *stop everything* and go to `emergency.target`. In other codebases,
this has definitely helped me with the problem of "systemd keeps going
even after a failure".
projects / ostree.git / log