mirror of
https://github.com/systemd/systemd
synced 2025-10-03 18:54:45 +02:00
Compare commits
5 Commits
584e9ba962
...
8b2620ea8c
Author | SHA1 | Date | |
---|---|---|---|
![]() |
8b2620ea8c | ||
![]() |
0025868cc9 | ||
![]() |
67f63ee5ae | ||
![]() |
8794e6dbbd | ||
![]() |
06cd836342 |
@ -1540,7 +1540,6 @@ static int apply_mounts(
|
|||||||
|
|
||||||
_cleanup_fclose_ FILE *proc_self_mountinfo = NULL;
|
_cleanup_fclose_ FILE *proc_self_mountinfo = NULL;
|
||||||
_cleanup_free_ char **deny_list = NULL;
|
_cleanup_free_ char **deny_list = NULL;
|
||||||
size_t j;
|
|
||||||
int r;
|
int r;
|
||||||
|
|
||||||
if (n_mounts == 0) /* Shortcut: nothing to do */
|
if (n_mounts == 0) /* Shortcut: nothing to do */
|
||||||
@ -1607,9 +1606,9 @@ static int apply_mounts(
|
|||||||
deny_list = new(char*, (*n_mounts)+1);
|
deny_list = new(char*, (*n_mounts)+1);
|
||||||
if (!deny_list)
|
if (!deny_list)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
for (j = 0; j < *n_mounts; j++)
|
for (size_t j = 0; j < *n_mounts; j++)
|
||||||
deny_list[j] = (char*) mount_entry_path(mounts+j);
|
deny_list[j] = (char*) mount_entry_path(mounts+j);
|
||||||
deny_list[j] = NULL;
|
deny_list[*n_mounts] = NULL;
|
||||||
|
|
||||||
/* Second round, flip the ro bits if necessary. */
|
/* Second round, flip the ro bits if necessary. */
|
||||||
for (MountEntry *m = mounts; m < mounts + *n_mounts; ++m) {
|
for (MountEntry *m = mounts; m < mounts + *n_mounts; ++m) {
|
||||||
@ -1622,10 +1621,10 @@ static int apply_mounts(
|
|||||||
}
|
}
|
||||||
|
|
||||||
/* Third round, flip the noexec bits with a simplified deny list. */
|
/* Third round, flip the noexec bits with a simplified deny list. */
|
||||||
for (j = 0; j < *n_mounts; j++)
|
for (size_t j = 0; j < *n_mounts; j++)
|
||||||
if (IN_SET((mounts+j)->mode, EXEC, NOEXEC))
|
if (IN_SET((mounts+j)->mode, EXEC, NOEXEC))
|
||||||
deny_list[j] = (char*) mount_entry_path(mounts+j);
|
deny_list[j] = (char*) mount_entry_path(mounts+j);
|
||||||
deny_list[j] = NULL;
|
deny_list[*n_mounts] = NULL;
|
||||||
|
|
||||||
for (MountEntry *m = mounts; m < mounts + *n_mounts; ++m) {
|
for (MountEntry *m = mounts; m < mounts + *n_mounts; ++m) {
|
||||||
r = make_noexec(m, deny_list, proc_self_mountinfo);
|
r = make_noexec(m, deny_list, proc_self_mountinfo);
|
||||||
@ -1664,8 +1663,6 @@ static bool home_read_only(
|
|||||||
size_t n_temporary_filesystems,
|
size_t n_temporary_filesystems,
|
||||||
ProtectHome protect_home) {
|
ProtectHome protect_home) {
|
||||||
|
|
||||||
size_t i;
|
|
||||||
|
|
||||||
/* Determine whether the /home directory is going to be read-only given the configured settings. Yes,
|
/* Determine whether the /home directory is going to be read-only given the configured settings. Yes,
|
||||||
* this is a bit sloppy, since we don't bother checking for cases where / is affected by multiple
|
* this is a bit sloppy, since we don't bother checking for cases where / is affected by multiple
|
||||||
* settings. */
|
* settings. */
|
||||||
@ -1678,12 +1675,12 @@ static bool home_read_only(
|
|||||||
prefixed_path_strv_contains(empty_directories, "/home"))
|
prefixed_path_strv_contains(empty_directories, "/home"))
|
||||||
return true;
|
return true;
|
||||||
|
|
||||||
for (i = 0; i < n_temporary_filesystems; i++)
|
for (size_t i = 0; i < n_temporary_filesystems; i++)
|
||||||
if (path_equal(temporary_filesystems[i].path, "/home"))
|
if (path_equal(temporary_filesystems[i].path, "/home"))
|
||||||
return true;
|
return true;
|
||||||
|
|
||||||
/* If /home is overmounted with some dir from the host it's not writable. */
|
/* If /home is overmounted with some dir from the host it's not writable. */
|
||||||
for (i = 0; i < n_bind_mounts; i++)
|
for (size_t i = 0; i < n_bind_mounts; i++)
|
||||||
if (path_equal(bind_mounts[i].destination, "/home"))
|
if (path_equal(bind_mounts[i].destination, "/home"))
|
||||||
return true;
|
return true;
|
||||||
|
|
||||||
|
@ -351,7 +351,7 @@ _public_ struct udev_device *udev_device_new_from_subsystem_sysname(struct udev
|
|||||||
* @udev: udev library context
|
* @udev: udev library context
|
||||||
*
|
*
|
||||||
* Create new udev device, and fill in information from the
|
* Create new udev device, and fill in information from the
|
||||||
* current process environment. This only works reliable if
|
* current process environment. This only works reliably if
|
||||||
* the process is called from a udev rule. It is usually used
|
* the process is called from a udev rule. It is usually used
|
||||||
* for tools executed from IMPORT= rules.
|
* for tools executed from IMPORT= rules.
|
||||||
*
|
*
|
||||||
|
@ -89,15 +89,6 @@ DnsStubListenerExtra *dns_stub_listener_extra_free(DnsStubListenerExtra *p) {
|
|||||||
return mfree(p);
|
return mfree(p);
|
||||||
}
|
}
|
||||||
|
|
||||||
uint16_t dns_stub_listener_extra_port(DnsStubListenerExtra *p) {
|
|
||||||
assert(p);
|
|
||||||
|
|
||||||
if (p->port > 0)
|
|
||||||
return p->port;
|
|
||||||
|
|
||||||
return 53;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void stub_packet_hash_func(const DnsPacket *p, struct siphash *state) {
|
static void stub_packet_hash_func(const DnsPacket *p, struct siphash *state) {
|
||||||
assert(p);
|
assert(p);
|
||||||
|
|
||||||
|
@ -35,7 +35,11 @@ extern const struct hash_ops dns_stub_listener_extra_hash_ops;
|
|||||||
|
|
||||||
int dns_stub_listener_extra_new(Manager *m, DnsStubListenerExtra **ret);
|
int dns_stub_listener_extra_new(Manager *m, DnsStubListenerExtra **ret);
|
||||||
DnsStubListenerExtra *dns_stub_listener_extra_free(DnsStubListenerExtra *p);
|
DnsStubListenerExtra *dns_stub_listener_extra_free(DnsStubListenerExtra *p);
|
||||||
uint16_t dns_stub_listener_extra_port(DnsStubListenerExtra *p);
|
static inline uint16_t dns_stub_listener_extra_port(DnsStubListenerExtra *p) {
|
||||||
|
assert(p);
|
||||||
|
|
||||||
|
return p->port > 0 ? p->port : 53;
|
||||||
|
}
|
||||||
|
|
||||||
void manager_dns_stub_stop(Manager *m);
|
void manager_dns_stub_stop(Manager *m);
|
||||||
int manager_dns_stub_start(Manager *m);
|
int manager_dns_stub_start(Manager *m);
|
||||||
|
@ -1551,13 +1551,12 @@ struct DecryptedImage {
|
|||||||
|
|
||||||
DecryptedImage* decrypted_image_unref(DecryptedImage* d) {
|
DecryptedImage* decrypted_image_unref(DecryptedImage* d) {
|
||||||
#if HAVE_LIBCRYPTSETUP
|
#if HAVE_LIBCRYPTSETUP
|
||||||
size_t i;
|
|
||||||
int r;
|
int r;
|
||||||
|
|
||||||
if (!d)
|
if (!d)
|
||||||
return NULL;
|
return NULL;
|
||||||
|
|
||||||
for (i = 0; i < d->n_decrypted; i++) {
|
for (size_t i = 0; i < d->n_decrypted; i++) {
|
||||||
DecryptedPartition *p = d->decrypted + i;
|
DecryptedPartition *p = d->decrypted + i;
|
||||||
|
|
||||||
if (p->device && p->name && !p->relinquished) {
|
if (p->device && p->name && !p->relinquished) {
|
||||||
@ -2003,19 +2002,15 @@ int dissected_image_decrypt_interactively(
|
|||||||
}
|
}
|
||||||
|
|
||||||
int decrypted_image_relinquish(DecryptedImage *d) {
|
int decrypted_image_relinquish(DecryptedImage *d) {
|
||||||
|
|
||||||
#if HAVE_LIBCRYPTSETUP
|
|
||||||
size_t i;
|
|
||||||
int r;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
assert(d);
|
assert(d);
|
||||||
|
|
||||||
/* Turns on automatic removal after the last use ended for all DM devices of this image, and sets a boolean so
|
/* Turns on automatic removal after the last use ended for all DM devices of this image, and sets a
|
||||||
* that we don't clean it up ourselves either anymore */
|
* boolean so that we don't clean it up ourselves either anymore */
|
||||||
|
|
||||||
#if HAVE_LIBCRYPTSETUP
|
#if HAVE_LIBCRYPTSETUP
|
||||||
for (i = 0; i < d->n_decrypted; i++) {
|
int r;
|
||||||
|
|
||||||
|
for (size_t i = 0; i < d->n_decrypted; i++) {
|
||||||
DecryptedPartition *p = d->decrypted + i;
|
DecryptedPartition *p = d->decrypted + i;
|
||||||
|
|
||||||
if (p->relinquished)
|
if (p->relinquished)
|
||||||
@ -2265,7 +2260,7 @@ int dissected_image_acquire_metadata(DissectedImage *m) {
|
|||||||
_cleanup_(sigkill_waitp) pid_t child = 0;
|
_cleanup_(sigkill_waitp) pid_t child = 0;
|
||||||
sd_id128_t machine_id = SD_ID128_NULL;
|
sd_id128_t machine_id = SD_ID128_NULL;
|
||||||
_cleanup_free_ char *hostname = NULL;
|
_cleanup_free_ char *hostname = NULL;
|
||||||
unsigned n_meta_initialized = 0, k;
|
unsigned n_meta_initialized = 0;
|
||||||
int fds[2 * _META_MAX], r, v;
|
int fds[2 * _META_MAX], r, v;
|
||||||
ssize_t n;
|
ssize_t n;
|
||||||
|
|
||||||
@ -2316,7 +2311,7 @@ int dissected_image_acquire_metadata(DissectedImage *m) {
|
|||||||
_exit(EXIT_FAILURE);
|
_exit(EXIT_FAILURE);
|
||||||
}
|
}
|
||||||
|
|
||||||
for (k = 0; k < _META_MAX; k++) {
|
for (unsigned k = 0; k < _META_MAX; k++) {
|
||||||
_cleanup_close_ int fd = -ENOENT;
|
_cleanup_close_ int fd = -ENOENT;
|
||||||
const char *p;
|
const char *p;
|
||||||
|
|
||||||
@ -2350,7 +2345,7 @@ int dissected_image_acquire_metadata(DissectedImage *m) {
|
|||||||
|
|
||||||
error_pipe[1] = safe_close(error_pipe[1]);
|
error_pipe[1] = safe_close(error_pipe[1]);
|
||||||
|
|
||||||
for (k = 0; k < _META_MAX; k++) {
|
for (unsigned k = 0; k < _META_MAX; k++) {
|
||||||
_cleanup_fclose_ FILE *f = NULL;
|
_cleanup_fclose_ FILE *f = NULL;
|
||||||
|
|
||||||
if (!paths[k])
|
if (!paths[k])
|
||||||
@ -2439,7 +2434,7 @@ int dissected_image_acquire_metadata(DissectedImage *m) {
|
|||||||
strv_free_and_replace(m->extension_release, extension_release);
|
strv_free_and_replace(m->extension_release, extension_release);
|
||||||
|
|
||||||
finish:
|
finish:
|
||||||
for (k = 0; k < n_meta_initialized; k++)
|
for (unsigned k = 0; k < n_meta_initialized; k++)
|
||||||
safe_close_pair(fds + 2*k);
|
safe_close_pair(fds + 2*k);
|
||||||
|
|
||||||
return r;
|
return r;
|
||||||
|
Loading…
x
Reference in New Issue
Block a user