1
0
mirror of https://github.com/systemd/systemd synced 2025-10-06 04:04:46 +02:00

Compare commits

...

7 Commits

Author SHA1 Message Date
Lennart Poettering
414f59dad7
Merge pull request #19131 from keszybz/resolvectl-warn-less
Suppress warnings in resolvectl about --type=
2021-03-30 13:29:55 +02:00
Zbigniew Jędrzejewski-Szmek
7960ba96d1 selinux: do not crash if policy becomes unavailable after reload
https://bugzilla.redhat.com/show_bug.cgi?id=1944171
This was in F33, systemd-246.13, but the logic in the code didn't change.

Thread 1 (Thread 0x7fb5f0341b80 (LWP 1974)):
№0  selabel_lookup_common (rec=0x0, translating=0, key=0x55f616ac4750 "/run/user/1000/systemd/units/invocation:systemd-tmpfiles-clean.service", type=40960) at label.c:167

'rec' is the handle that we passed.

№1  0x00007fb5f13ae87f in selabel_lookup_raw (rec=<optimized out>, con=con@entry=0x7fffef307380, key=key@entry=0x55f616ac4750 "/run/user/1000/systemd/units/invocation:systemd-tmpfiles-clean.service", type=type@entry=40960) at label.c:256
        lr = <optimized out>

'rec' is passed through as is to selabel_lookup_common().

№2  0x00007fb5f1561b2d in selinux_create_file_prepare_abspath (abspath=0x55f616ac4750 "/run/user/1000/systemd/units/invocation:systemd-tmpfiles-clean.service", mode=40960) at ../src/basic/selinux-util.c:368
        filecon = 0x0
        r = <optimized out>
        __PRETTY_FUNCTION__ = "selinux_create_file_prepare_abspath"
        __func__ = "selinux_create_file_prepare_abspath"

№3  0x00007fb5f1561ec3 in mac_selinux_create_file_prepare (path=<optimized out>, mode=40960) at ../src/basic/selinux-util.c:431
        r = 0
        abspath = 0x55f616ac4750 "/run/user/1000/systemd/units/invocation:systemd-tmpfiles-clean.service"
        __PRETTY_FUNCTION__ = "mac_selinux_create_file_prepare"

We checked label_hnd != NULL, but then we apparently called
avc_netlink_check_nb(), which reset label_hnd. Yay for global state!

№4  0x00007fb5f1549950 in symlink_atomic_label (from=0x55f6169d8b50 "69a8dcf7a7ac46b29306f2fddbed3edc", to=0x55f616ab8380 "/run/user/1000/systemd/units/invocation:systemd-tmpfiles-clean.service") at ../src/basic/label.c:55
        r = <optimized out>
        __PRETTY_FUNCTION__ = "symlink_atomic_label"

In the logs:

Mar 29 14:48:44 fedorapad.home systemd[1974]: selinux: avc:  received policyload notice (seqno=2)
Mar 29 14:48:44 fedorapad.home systemd[1974]: Failed to initialize SELinux labeling handle: No such file or directory
Mar 29 14:48:44 fedorapad.home systemd[1974]: selinux: avc:  received policyload notice (seqno=3)
Mar 29 14:48:44 fedorapad.home systemd[1974]: selinux: avc:  received setenforce notice (enforcing=0)
2021-03-30 13:24:12 +02:00
Luca Boccassi
063a43a1a7 Revert "fix wrong statement JOURNAL_FILE_FORMAT.md doc"
This reverts commit 119063d2b149667a91e0e08e4bdf82a0eb6a7efd.
2021-03-30 10:26:54 +02:00
Zbigniew Jędrzejewski-Szmek
200b4f3d80 resolvectl: suppress warning about --type for names with a dot
People don't generally type the trailing dot by mistake, so let's treat this as
indication that they want to resolve this particular hostname.
2021-03-26 21:24:36 +01:00
Zbigniew Jędrzejewski-Szmek
058946d1f9 resolvectl: do not warn about single hostnames for names we synthesize
https://github.com/systemd/systemd/pull/17535#discussion_r534005801
2021-03-26 14:19:05 +01:00
Zbigniew Jędrzejewski-Szmek
75c9d6b5cf resolved: split out function to determine the local llmnr hostname 2021-03-26 14:18:51 +01:00
Zbigniew Jędrzejewski-Szmek
20e994b392 resolvectl: reword note about "raw record types"
As noted in https://github.com/systemd/systemd/pull/17535#discussion_r534129256,
"raw" is misleading in this context. Let's use a more descriptive term.
2021-03-26 14:18:17 +01:00
7 changed files with 131 additions and 70 deletions

View File

@ -295,7 +295,7 @@ If a file is opened for writing the **state** field should be set to
STATE_ONLINE. If a file is closed after writing the **state** field should be
set to STATE_OFFLINE. After a file has been rotated it should be set to
STATE_ARCHIVED. If a writer is asked to write to a file that is not in
STATE_ONLINE it should immediately rotate the file and start a new one,
STATE_OFFLINE it should immediately rotate the file and start a new one,
without changing the file.
After and before the state field is changed `fdatasync()` should be executed on

View File

@ -272,6 +272,8 @@ int mac_selinux_fix_container_fd(int fd, const char *path, const char *inside_pa
/* Check for policy reload so 'label_hnd' is kept up-to-date by callbacks */
mac_selinux_maybe_reload();
if (!label_hnd)
return 0;
if (selabel_lookup_raw(label_hnd, &fcon, inside_path, st.st_mode) < 0) {
/* If there's no label to set, then exit without warning */
@ -484,6 +486,8 @@ static int selinux_create_file_prepare_abspath(const char *abspath, mode_t mode)
/* Check for policy reload so 'label_hnd' is kept up-to-date by callbacks */
mac_selinux_maybe_reload();
if (!label_hnd)
return 0;
r = selabel_lookup_raw(label_hnd, &filecon, abspath, mode);
if (r < 0) {
@ -506,7 +510,6 @@ int mac_selinux_create_file_prepare_at(int dirfd, const char *path, mode_t mode)
_cleanup_free_ char *abspath = NULL;
int r;
assert(path);
if (!label_hnd)
@ -628,6 +631,8 @@ int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) {
/* Check for policy reload so 'label_hnd' is kept up-to-date by callbacks */
mac_selinux_maybe_reload();
if (!label_hnd)
goto skipped;
if (path_is_absolute(path))
r = selabel_lookup_raw(label_hnd, &fcon, path, S_IFSOCK);

View File

@ -13,6 +13,8 @@ basic_dns_sources = files('''
resolved-dns-answer.h
resolved-dns-question.c
resolved-dns-question.h
resolved-util.c
resolved-util.h
dns-type.c
dns-type.h
'''.split())

View File

@ -19,6 +19,7 @@
#include "format-table.h"
#include "format-util.h"
#include "gcrypt-util.h"
#include "hostname-util.h"
#include "main-func.h"
#include "missing_network.h"
#include "netlink-util.h"
@ -31,6 +32,7 @@
#include "resolvectl.h"
#include "resolved-def.h"
#include "resolved-dns-packet.h"
#include "resolved-util.h"
#include "socket-netlink.h"
#include "sort-util.h"
#include "stdio-util.h"
@ -441,6 +443,25 @@ static int idna_candidate(const char *name, char **ret) {
return false;
}
static bool single_label_nonsynthetic(const char *name) {
_cleanup_free_ char *first_label = NULL;
int r;
if (!dns_name_is_single_label(name))
return false;
if (is_localhost(name) || is_gateway_hostname(name))
return false;
r = resolve_system_hostname(NULL, &first_label);
if (r < 0) {
log_warning_errno(r, "Failed to determine the hostname: %m");
return false;
}
return !streq(name, first_label);
}
static int resolve_record(sd_bus *bus, const char *name, uint16_t class, uint16_t type, bool warn_missing) {
_cleanup_(sd_bus_message_unrefp) sd_bus_message *req = NULL, *reply = NULL;
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
@ -455,15 +476,15 @@ static int resolve_record(sd_bus *bus, const char *name, uint16_t class, uint16_
log_debug("Resolving %s %s %s (interface %s).", name, dns_class_to_string(class), dns_type_to_string(type), isempty(arg_ifname) ? "*" : arg_ifname);
if (dns_name_is_single_label(name))
log_notice("(Note that search domains are not appended when resolving raw record types. "
"Please specify fully qualified domain names when resolving raw records, or remove --type= switch from invocation in order to request regular hostname resolution.)");
if (dns_name_dot_suffixed(name) == 0 && single_label_nonsynthetic(name))
log_notice("(Note that search domains are not appended when --type= is specified. "
"Please specify fully qualified domain names, or remove --type= switch from invocation in order to request regular hostname resolution.)");
r = idna_candidate(name, &idnafied);
if (r < 0)
return r;
if (r > 0)
log_notice("(Note that IDNA translation is not applied when resolving raw record types. "
log_notice("(Note that IDNA translation is not applied when --type= is specified. "
"Please specify translated domain names — i.e. '%s' — when resolving raw records, or remove --type= switch from invocation in order to request regular hostname resolution.",
idnafied);

View File

@ -33,6 +33,7 @@
#include "resolved-manager.h"
#include "resolved-mdns.h"
#include "resolved-resolv-conf.h"
#include "resolved-util.h"
#include "resolved-varlink.h"
#include "socket-util.h"
#include "string-table.h"
@ -362,75 +363,17 @@ static int manager_clock_change_listen(Manager *m) {
return 0;
}
static int determine_hostname(char **full_hostname, char **llmnr_hostname, char **mdns_hostname) {
static int determine_hostnames(char **full_hostname, char **llmnr_hostname, char **mdns_hostname) {
_cleanup_free_ char *h = NULL, *n = NULL;
#if HAVE_LIBIDN2
_cleanup_free_ char *utf8 = NULL;
#elif HAVE_LIBIDN
int k;
#endif
char label[DNS_LABEL_MAX];
const char *p, *decoded;
int r;
assert(full_hostname);
assert(llmnr_hostname);
assert(mdns_hostname);
/* Extract and normalize the first label of the locally configured hostname, and check it's not "localhost". */
r = gethostname_strict(&h);
r = resolve_system_hostname(&h, &n);
if (r < 0)
return log_debug_errno(r, "Can't determine system hostname: %m");
p = h;
r = dns_label_unescape(&p, label, sizeof label, 0);
if (r < 0)
return log_error_errno(r, "Failed to unescape hostname: %m");
if (r == 0)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Couldn't find a single label in hostname.");
#if HAVE_LIBIDN || HAVE_LIBIDN2
r = dlopen_idn();
if (r < 0) {
log_debug_errno(r, "Failed to initialize IDN support, ignoring: %m");
decoded = label; /* no decoding */
} else
#endif
{
#if HAVE_LIBIDN2
r = sym_idn2_to_unicode_8z8z(label, &utf8, 0);
if (r != IDN2_OK)
return log_error_errno(SYNTHETIC_ERRNO(EUCLEAN),
"Failed to undo IDNA: %s", sym_idn2_strerror(r));
assert(utf8_is_valid(utf8));
r = strlen(utf8);
decoded = utf8;
#elif HAVE_LIBIDN
k = dns_label_undo_idna(label, r, label, sizeof label);
if (k < 0)
return log_error_errno(k, "Failed to undo IDNA: %m");
if (k > 0)
r = k;
if (!utf8_is_valid(label))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"System hostname is not UTF-8 clean.");
decoded = label;
#else
decoded = label; /* no decoding */
#endif
}
r = dns_label_escape_new(decoded, r, &n);
if (r < 0)
return log_error_errno(r, "Failed to escape hostname: %m");
if (is_localhost(n))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"System hostname is 'localhost', ignoring.");
return r;
r = dns_name_concat(n, "local", 0, mdns_hostname);
if (r < 0)
@ -501,9 +444,11 @@ static int on_hostname_change(sd_event_source *es, int fd, uint32_t revents, voi
assert(m);
r = determine_hostname(&full_hostname, &llmnr_hostname, &mdns_hostname);
if (r < 0)
r = determine_hostnames(&full_hostname, &llmnr_hostname, &mdns_hostname);
if (r < 0) {
log_warning_errno(r, "Failed to determine the local hostname and LLMNR/mDNS names, ignoring: %m");
return 0; /* ignore invalid hostnames */
}
llmnr_hostname_changed = !streq(llmnr_hostname, m->llmnr_hostname);
if (streq(full_hostname, m->full_hostname) &&
@ -546,7 +491,7 @@ static int manager_watch_hostname(Manager *m) {
(void) sd_event_source_set_description(m->hostname_event_source, "hostname");
r = determine_hostname(&m->full_hostname, &m->llmnr_hostname, &m->mdns_hostname);
r = determine_hostnames(&m->full_hostname, &m->llmnr_hostname, &m->mdns_hostname);
if (r < 0) {
_cleanup_free_ char *d = NULL;

View File

@ -0,0 +1,84 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "dns-def.h"
#include "dns-domain.h"
#include "hostname-util.h"
#include "idn-util.h"
#include "resolved-util.h"
#include "utf8.h"
int resolve_system_hostname(char **full_hostname, char **first_label) {
_cleanup_free_ char *h = NULL, *n = NULL;
#if HAVE_LIBIDN2
_cleanup_free_ char *utf8 = NULL;
#elif HAVE_LIBIDN
int k;
#endif
char label[DNS_LABEL_MAX];
const char *p, *decoded;
int r;
/* Return the full hostname in *full_hostname, if nonnull.
*
* Extract and normalize the first label of the locally configured hostname, check it's not
* "localhost", and return it in *first_label, if nonnull. */
r = gethostname_strict(&h);
if (r < 0)
return log_debug_errno(r, "Can't determine system hostname: %m");
p = h;
r = dns_label_unescape(&p, label, sizeof label, 0);
if (r < 0)
return log_debug_errno(r, "Failed to unescape hostname: %m");
if (r == 0)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Couldn't find a single label in hostname.");
#if HAVE_LIBIDN || HAVE_LIBIDN2
r = dlopen_idn();
if (r < 0) {
log_debug_errno(r, "Failed to initialize IDN support, ignoring: %m");
decoded = label; /* no decoding */
} else
#endif
{
#if HAVE_LIBIDN2
r = sym_idn2_to_unicode_8z8z(label, &utf8, 0);
if (r != IDN2_OK)
return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN),
"Failed to undo IDNA: %s", sym_idn2_strerror(r));
assert(utf8_is_valid(utf8));
r = strlen(utf8);
decoded = utf8;
#elif HAVE_LIBIDN
k = dns_label_undo_idna(label, r, label, sizeof label);
if (k < 0)
return log_debug_errno(k, "Failed to undo IDNA: %m");
if (k > 0)
r = k;
if (!utf8_is_valid(label))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"System hostname is not UTF-8 clean.");
decoded = label;
#else
decoded = label; /* no decoding */
#endif
}
r = dns_label_escape_new(decoded, r, &n);
if (r < 0)
return log_debug_errno(r, "Failed to escape hostname: %m");
if (is_localhost(n))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"System hostname is 'localhost', ignoring.");
if (full_hostname)
*full_hostname = TAKE_PTR(h);
if (first_label)
*first_label = TAKE_PTR(n);
return 0;
}

View File

@ -0,0 +1,4 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once
int resolve_system_hostname(char **full_hostname, char **first_label);