mirror of
https://github.com/systemd/systemd
synced 2025-11-13 13:54:45 +01:00
Compare commits
No commits in common. "98ca65c36aa970f8fbcf0bf50d8c2f03ffba299a" and "b131e8d3a478a793956ecd4ab2138e3c4ce5a284" have entirely different histories.
98ca65c36a
...
b131e8d3a4
105
po/de.po
105
po/de.po
@ -9,15 +9,14 @@
|
||||
# Christian Wehrli <christian@chw.onl>, 2021.
|
||||
# Christian Kirbach <christian.kirbach@gmail.com>, 2023.
|
||||
# Jarne Förster <fedora@mymailclient.de>, 2024.
|
||||
# Weblate Translation Memory <noreply-mt-weblate-translation-memory@weblate.org>, 2024, 2025.
|
||||
# Weblate Translation Memory <noreply-mt-weblate-translation-memory@weblate.org>, 2024.
|
||||
# Anselm Schueler <mail@anselmschueler.com>, 2024.
|
||||
# Marcel Leismann <tiixrigjekfv@use.startmail.com>, 2025.
|
||||
msgid ""
|
||||
msgstr ""
|
||||
"Report-Msgid-Bugs-To: \n"
|
||||
"POT-Creation-Date: 2025-07-23 15:38+0100\n"
|
||||
"PO-Revision-Date: 2025-11-11 11:42+0000\n"
|
||||
"Last-Translator: Marcel Leismann <tiixrigjekfv@use.startmail.com>\n"
|
||||
"PO-Revision-Date: 2024-12-30 22:38+0000\n"
|
||||
"Last-Translator: Ettore Atalan <atalanttore@googlemail.com>\n"
|
||||
"Language-Team: German <https://translate.fedoraproject.org/projects/systemd/"
|
||||
"main/de/>\n"
|
||||
"Language: de\n"
|
||||
@ -25,7 +24,7 @@ msgstr ""
|
||||
"Content-Type: text/plain; charset=UTF-8\n"
|
||||
"Content-Transfer-Encoding: 8bit\n"
|
||||
"Plural-Forms: nplurals=2; plural=n != 1;\n"
|
||||
"X-Generator: Weblate 5.14.3\n"
|
||||
"X-Generator: Weblate 5.9.2\n"
|
||||
|
||||
#: src/core/org.freedesktop.systemd1.policy.in:22
|
||||
msgid "Send passphrase back to system"
|
||||
@ -164,8 +163,9 @@ msgstr ""
|
||||
"Benutzers notwendig."
|
||||
|
||||
#: src/home/org.freedesktop.home1.policy:83
|
||||
#, fuzzy
|
||||
msgid "Activate a home area"
|
||||
msgstr "Einen persönlichen Bereich aktivieren"
|
||||
msgstr "Einen persönlichen Bereich anlegen"
|
||||
|
||||
#: src/home/org.freedesktop.home1.policy:84
|
||||
msgid "Authentication is required to activate a user's home area."
|
||||
@ -175,13 +175,15 @@ msgstr ""
|
||||
|
||||
#: src/home/org.freedesktop.home1.policy:93
|
||||
msgid "Manage Home Directory Signing Keys"
|
||||
msgstr "Die Signierschlüssel des Benutzerverzeichnisses verwalten"
|
||||
msgstr ""
|
||||
|
||||
#: src/home/org.freedesktop.home1.policy:94
|
||||
#, fuzzy
|
||||
#| msgid "Authentication is required to manage system services or other units."
|
||||
msgid "Authentication is required to manage signing keys for home directories."
|
||||
msgstr ""
|
||||
"Legitimierung ist notwendig für die Verwaltung von Signierschlüsseln von "
|
||||
"Benutzerverzeichnissen."
|
||||
"Legitimierung ist notwendig für die Verwaltung von Systemdiensten und "
|
||||
"anderen Einheiten."
|
||||
|
||||
#: src/home/pam_systemd_home.c:336
|
||||
#, c-format
|
||||
@ -189,7 +191,7 @@ msgid ""
|
||||
"Home of user %s is currently absent, please plug in the necessary storage "
|
||||
"device or backing file system."
|
||||
msgstr ""
|
||||
"Das Benutzerverzeichnis von %s ist nicht verfügbar. Bitte hängen Sie das "
|
||||
"Der persönliche Ordner von %s ist nicht verfügbar. Bitte hängen Sie das "
|
||||
"benötigte Speichermedium oder Dateisystem ein."
|
||||
|
||||
#: src/home/pam_systemd_home.c:341
|
||||
@ -206,7 +208,7 @@ msgstr "Passwort: "
|
||||
#: src/home/pam_systemd_home.c:355
|
||||
#, c-format
|
||||
msgid "Password incorrect or not sufficient for authentication of user %s."
|
||||
msgstr "Falsches Passwort oder unzureichende Authentifizierung für Nutzer %s."
|
||||
msgstr "Passwort nicht korrekt oder unzureichend um %s zu authentifizieren."
|
||||
|
||||
#: src/home/pam_systemd_home.c:356
|
||||
msgid "Sorry, try again: "
|
||||
@ -227,16 +229,16 @@ msgstr ""
|
||||
|
||||
#: src/home/pam_systemd_home.c:381
|
||||
msgid "Sorry, reenter recovery key: "
|
||||
msgstr "Bitte Wiederherstellungsschlüssel erneut eingeben: "
|
||||
msgstr "Entschuldigung, bitte Wiederherstellungsschlüssel erneut eingeben: "
|
||||
|
||||
#: src/home/pam_systemd_home.c:401
|
||||
#, c-format
|
||||
msgid "Security token of user %s not inserted."
|
||||
msgstr "Sicherheitstoken für Benutzer %s nicht eingesteckt."
|
||||
msgstr "Sicherheitstoken für %s nicht eingesteckt."
|
||||
|
||||
#: src/home/pam_systemd_home.c:402 src/home/pam_systemd_home.c:405
|
||||
msgid "Try again with password: "
|
||||
msgstr "Bitte noch einmal mit Passwort versuchen: "
|
||||
msgstr "Erneut mit Passwort probieren: "
|
||||
|
||||
#: src/home/pam_systemd_home.c:404
|
||||
#, c-format
|
||||
@ -244,8 +246,8 @@ msgid ""
|
||||
"Password incorrect or not sufficient, and configured security token of user "
|
||||
"%s not inserted."
|
||||
msgstr ""
|
||||
"Passwort falsch oder unzureichend und konfigurierter Sicherheitstoken für "
|
||||
"Benutzer %s nicht eingesteckt."
|
||||
"Passwort falsch oder unzureichend und konfigurierter Sicherheitstoken für %s "
|
||||
"nicht eingesteckt."
|
||||
|
||||
#: src/home/pam_systemd_home.c:424
|
||||
msgid "Security token PIN: "
|
||||
@ -384,7 +386,7 @@ msgstr ""
|
||||
|
||||
#: src/hostname/org.freedesktop.hostname1.policy:51
|
||||
msgid "Get product UUID"
|
||||
msgstr "Produkt UUID erhalten"
|
||||
msgstr "Die Produkte-UUID erhalten"
|
||||
|
||||
#: src/hostname/org.freedesktop.hostname1.policy:52
|
||||
msgid "Authentication is required to get product UUID."
|
||||
@ -592,8 +594,8 @@ msgstr "Nicht angemeldetem Benutzer die Ausführung von Programmen erlauben"
|
||||
#: src/login/org.freedesktop.login1.policy:129
|
||||
msgid "Explicit request is required to run programs as a non-logged-in user."
|
||||
msgstr ""
|
||||
"Eine explizite Anfrage ist notwendig, um Programme als nicht angemeldeter "
|
||||
"Benutzer auszuführen."
|
||||
"Legitimierung ist erforderlich, damit nicht angemeldete Benutzer Programme "
|
||||
"ausführen dürfen."
|
||||
|
||||
#: src/login/org.freedesktop.login1.policy:138
|
||||
msgid "Allow non-logged-in users to run programs"
|
||||
@ -646,7 +648,7 @@ msgid ""
|
||||
"Authentication is required to power off the system while other users are "
|
||||
"logged in."
|
||||
msgstr ""
|
||||
"Legitimierung ist notwendig, um das System herunterzufahren, während andere "
|
||||
"Legitimierung ist zum Herunterfahren des Systems notwendig, während andere "
|
||||
"Benutzer angemeldet sind."
|
||||
|
||||
#: src/login/org.freedesktop.login1.policy:191
|
||||
@ -717,15 +719,17 @@ msgstr ""
|
||||
|
||||
#: src/login/org.freedesktop.login1.policy:257
|
||||
msgid "Halt the system while an application is inhibiting this"
|
||||
msgstr "Das System herunterfahren, während eine Anwendung dies verhindert"
|
||||
msgstr ""
|
||||
"Das System in den Ruhezustand versetzen, während eine Anwendung wünscht dies "
|
||||
"zu verhindern"
|
||||
|
||||
#: src/login/org.freedesktop.login1.policy:258
|
||||
msgid ""
|
||||
"Authentication is required to halt the system while an application is "
|
||||
"inhibiting this."
|
||||
msgstr ""
|
||||
"Legitimierung ist notwendig, um das System in den Ruhezustand zu versetzen, "
|
||||
"während eine Anwendung dies verhindert."
|
||||
"Legitimierung ist zum Versetzen des System in den Ruhezustand notwendig, "
|
||||
"während eine Anwendung wünscht dies zu verhindern."
|
||||
|
||||
#: src/login/org.freedesktop.login1.policy:268
|
||||
msgid "Suspend the system"
|
||||
@ -788,8 +792,8 @@ msgstr ""
|
||||
#: src/login/org.freedesktop.login1.policy:321
|
||||
msgid "Hibernate the system while an application is inhibiting this"
|
||||
msgstr ""
|
||||
"Das System in den Ruhezustand versetzen, während eine Anwendung dies "
|
||||
"verhindert"
|
||||
"Das System in den Ruhezustand versetzen, während eine Anwendung wünscht dies "
|
||||
"zu verhindern"
|
||||
|
||||
#: src/login/org.freedesktop.login1.policy:322
|
||||
msgid ""
|
||||
@ -869,6 +873,7 @@ msgid "Set a wall message"
|
||||
msgstr "Nachricht an alle einstellen"
|
||||
|
||||
#: src/login/org.freedesktop.login1.policy:397
|
||||
#, fuzzy
|
||||
msgid "Authentication is required to set a wall message."
|
||||
msgstr "Legitimierung ist zum Einstellen einer Nachricht an alle notwendig."
|
||||
|
||||
@ -959,15 +964,20 @@ msgstr ""
|
||||
"Containers erforderlich."
|
||||
|
||||
#: src/machine/org.freedesktop.machine1.policy:106
|
||||
#, fuzzy
|
||||
#| msgid "Create a local virtual machine or container"
|
||||
msgid "Register a local virtual machine or container"
|
||||
msgstr "Lokale virtuelle Maschinen oder Container registrieren"
|
||||
msgstr "Lokale virtuelle Maschinen oder Container erstellen"
|
||||
|
||||
#: src/machine/org.freedesktop.machine1.policy:107
|
||||
#, fuzzy
|
||||
#| msgid ""
|
||||
#| "Authentication is required to create a local virtual machine or container."
|
||||
msgid ""
|
||||
"Authentication is required to register a local virtual machine or container."
|
||||
msgstr ""
|
||||
"Legitimierung ist für die Registrierung einer lokalen virtuellen Maschine "
|
||||
"oder eines Containers erforderlich."
|
||||
"Legitimierung ist zum Erstellen einer lokalen virtuellen Maschine oder eines "
|
||||
"Containers erforderlich."
|
||||
|
||||
#: src/machine/org.freedesktop.machine1.policy:116
|
||||
msgid "Manage local virtual machine and container images"
|
||||
@ -1099,8 +1109,7 @@ msgstr "Der DHCP-Server sendet Nachricht zum erzwungenen Erneuern"
|
||||
|
||||
#: src/network/org.freedesktop.network1.policy:144
|
||||
msgid "Authentication is required to send force renew message."
|
||||
msgstr ""
|
||||
"Legitimierung ist zum Versenden einer Zwangserneuerungsnachricht notwendig."
|
||||
msgstr "Legitimierung ist zum Einstellen einer Nachricht an alle notwendig."
|
||||
|
||||
#: src/network/org.freedesktop.network1.policy:154
|
||||
msgid "Renew dynamic addresses"
|
||||
@ -1180,7 +1189,7 @@ msgstr "Einen DNS-SD-Dienst registrieren"
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:23
|
||||
msgid "Authentication is required to register a DNS-SD service."
|
||||
msgstr "Legitimierung ist zum Anmelden eines DNS-SD-Dienstes notwendig."
|
||||
msgstr "Legitimierung ist zum Anmelden eines DNS-SD-Dienstes notwendig"
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:33
|
||||
msgid "Unregister a DNS-SD service"
|
||||
@ -1188,7 +1197,7 @@ msgstr "Einen DNS-SD-Dienst deregistrieren"
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:34
|
||||
msgid "Authentication is required to unregister a DNS-SD service."
|
||||
msgstr "Legitimierung ist zum Abmelden eines DNS-SD-Dienstes erforderlich."
|
||||
msgstr "Legitimierung ist zum Deregistrieren eines DNS-SD-Dienstes notwendig."
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:132
|
||||
msgid "Revert name resolution settings"
|
||||
@ -1210,35 +1219,37 @@ msgstr "Legitimierung ist zum Abonnieren von Abfrageergebnissen erforderlich."
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:154
|
||||
msgid "Subscribe to DNS configuration"
|
||||
msgstr "DNS Konfiguration abonnieren"
|
||||
msgstr ""
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:155
|
||||
#, fuzzy
|
||||
#| msgid "Authentication is required to subscribe query results."
|
||||
msgid "Authentication is required to subscribe to DNS configuration."
|
||||
msgstr "Legitimierung ist zum Abonnieren der DNS-Konfiguration erforderlich."
|
||||
msgstr "Legitimierung ist zum Abonnieren von Abfrageergebnissen erforderlich."
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:165
|
||||
msgid "Dump cache"
|
||||
msgstr "Cache leeren"
|
||||
msgstr ""
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:166
|
||||
msgid "Authentication is required to dump cache."
|
||||
msgstr "Legitimierung ist zum Leeren des Caches notwendig."
|
||||
msgstr ""
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:176
|
||||
msgid "Dump server state"
|
||||
msgstr "Serverstatus verwerfen"
|
||||
msgstr ""
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:177
|
||||
msgid "Authentication is required to dump server state."
|
||||
msgstr "Legitimierung ist zum Verwerfen des Serverstatus erforderlich."
|
||||
msgstr ""
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:187
|
||||
msgid "Dump statistics"
|
||||
msgstr "Statistik verwerfen"
|
||||
msgstr ""
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:188
|
||||
msgid "Authentication is required to dump statistics."
|
||||
msgstr "Legitimierung ist zum Verwerfen der Statistiken notwendig."
|
||||
msgstr ""
|
||||
|
||||
#: src/resolve/org.freedesktop.resolve1.policy:198
|
||||
msgid "Reset statistics"
|
||||
@ -1254,7 +1265,7 @@ msgstr "Auf Systemaktualisierungen prüfen"
|
||||
|
||||
#: src/sysupdate/org.freedesktop.sysupdate1.policy:36
|
||||
msgid "Authentication is required to check for system updates."
|
||||
msgstr "Legitimierung ist zum Prüfen auf Systemaktualisierungen erforderlich."
|
||||
msgstr "Legitimierung ist zum Prüfen auf Systemaktualisierungen notwendig."
|
||||
|
||||
#: src/sysupdate/org.freedesktop.sysupdate1.policy:45
|
||||
msgid "Install system updates"
|
||||
@ -1263,7 +1274,7 @@ msgstr "Systemaktualisierungen installieren"
|
||||
#: src/sysupdate/org.freedesktop.sysupdate1.policy:46
|
||||
msgid "Authentication is required to install system updates."
|
||||
msgstr ""
|
||||
"Legitimierung ist zum Installieren von Systemaktualisierungen erforderlich."
|
||||
"Legitimierung ist zum Installieren von Systemaktualisierungen notwendig."
|
||||
|
||||
#: src/sysupdate/org.freedesktop.sysupdate1.policy:55
|
||||
msgid "Install specific system version"
|
||||
@ -1360,18 +1371,22 @@ msgstr ""
|
||||
"(unit)« notwendig."
|
||||
|
||||
#: src/core/dbus-unit.c:620
|
||||
#, fuzzy
|
||||
#| msgid ""
|
||||
#| "Authentication is required to send a UNIX signal to the processes of '$"
|
||||
#| "(unit)'."
|
||||
msgid ""
|
||||
"Authentication is required to send a UNIX signal to the processes of "
|
||||
"subgroup of '$(unit)'."
|
||||
msgstr ""
|
||||
"Legitimierung ist zum Senden eines UNIX-Signals an die Prozesse der "
|
||||
"Untergruppe »$(unit)« notwendig."
|
||||
"Legitimierung ist zum Senden eines UNIX-Signals an die Prozesse von »$"
|
||||
"(unit)« notwendig."
|
||||
|
||||
#: src/core/dbus-unit.c:648
|
||||
msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
|
||||
msgstr ""
|
||||
"Legitimierung ist zum Zurücksetzen des Status »fehlgeschlagen« von »$(unit)« "
|
||||
"notwendig."
|
||||
"notwendig"
|
||||
|
||||
#: src/core/dbus-unit.c:678
|
||||
msgid "Authentication is required to set properties on '$(unit)'."
|
||||
|
||||
@ -568,83 +568,6 @@ static void dissected_partition_done(DissectedPartition *p) {
|
||||
*p = DISSECTED_PARTITION_NULL;
|
||||
}
|
||||
|
||||
static int acquire_sig_for_roothash(
|
||||
int fd,
|
||||
uint64_t partition_offset,
|
||||
uint64_t partition_size,
|
||||
void **ret_root_hash,
|
||||
size_t *ret_root_hash_size,
|
||||
void **ret_root_hash_sig,
|
||||
size_t *ret_root_hash_sig_size) {
|
||||
|
||||
int r;
|
||||
|
||||
assert(fd >= 0);
|
||||
assert(!!ret_root_hash == !!ret_root_hash_size);
|
||||
assert(!!ret_root_hash_sig == !!ret_root_hash_sig_size);
|
||||
|
||||
if (partition_offset == UINT64_MAX || partition_size == UINT64_MAX)
|
||||
return -EINVAL;
|
||||
|
||||
if (partition_size > 4*1024*1024) /* Signature data cannot possible be larger than 4M, refuse that */
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EFBIG), "Verity signature partition is larger than 4M, refusing.");
|
||||
|
||||
_cleanup_free_ char *buf = new(char, partition_size+1);
|
||||
if (!buf)
|
||||
return -ENOMEM;
|
||||
|
||||
ssize_t n = pread(fd, buf, partition_size, partition_offset);
|
||||
if (n < 0)
|
||||
return -ENOMEM;
|
||||
if ((uint64_t) n != partition_size)
|
||||
return -EIO;
|
||||
|
||||
const char *e = memchr(buf, 0, partition_size);
|
||||
if (e) {
|
||||
/* If we found a NUL byte then the rest of the data must be NUL too */
|
||||
if (!memeqzero(e, partition_size - (e - buf)))
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Signature data contains embedded NUL byte.");
|
||||
} else
|
||||
buf[partition_size] = 0;
|
||||
|
||||
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
|
||||
r = sd_json_parse(buf, 0, &v, /* reterr_line= */ NULL, /* reterr_column= */ NULL);
|
||||
if (r < 0)
|
||||
return log_debug_errno(r, "Failed to parse signature JSON data: %m");
|
||||
|
||||
sd_json_variant *rh = sd_json_variant_by_key(v, "rootHash");
|
||||
if (!rh)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Signature JSON object lacks 'rootHash' field.");
|
||||
|
||||
_cleanup_free_ void *root_hash = NULL;
|
||||
size_t root_hash_size;
|
||||
r = sd_json_variant_unhex(rh, &root_hash, &root_hash_size);
|
||||
if (r < 0)
|
||||
return log_debug_errno(r, "Failed to parse root hash field: %m");
|
||||
|
||||
sd_json_variant *sig = sd_json_variant_by_key(v, "signature");
|
||||
if (!sig)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Signature JSON object lacks 'signature' field.");
|
||||
|
||||
_cleanup_free_ void *root_hash_sig = NULL;
|
||||
size_t root_hash_sig_size;
|
||||
r = sd_json_variant_unbase64(sig, &root_hash_sig, &root_hash_sig_size);
|
||||
if (r < 0)
|
||||
return log_debug_errno(r, "Failed to parse signature field: %m");
|
||||
|
||||
if (ret_root_hash) {
|
||||
*ret_root_hash = TAKE_PTR(root_hash);
|
||||
*ret_root_hash_size = root_hash_size;
|
||||
}
|
||||
|
||||
if (ret_root_hash_sig) {
|
||||
*ret_root_hash_sig = TAKE_PTR(root_hash_sig);
|
||||
*ret_root_hash_sig_size = root_hash_sig_size;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#if HAVE_BLKID
|
||||
static int diskseq_should_be_used(
|
||||
const char *whole_devname,
|
||||
@ -1236,32 +1159,6 @@ static int dissect_image(
|
||||
rw = false;
|
||||
|
||||
} else if (type.designator == PARTITION_ROOT_VERITY_SIG) {
|
||||
if (verity && verity->root_hash) {
|
||||
_cleanup_free_ void *root_hash = NULL;
|
||||
size_t root_hash_size;
|
||||
|
||||
r = acquire_sig_for_roothash(
|
||||
fd,
|
||||
start * 512,
|
||||
size * 512,
|
||||
&root_hash,
|
||||
&root_hash_size,
|
||||
/* ret_root_hash_sig= */ NULL,
|
||||
/* ret_root_hash_sig_size= */ NULL);
|
||||
if (r < 0)
|
||||
return r;
|
||||
if (memcmp_nn(verity->root_hash, verity->root_hash_size, root_hash, root_hash_size) != 0) {
|
||||
if (DEBUG_LOGGING) {
|
||||
_cleanup_free_ char *found = NULL, *expected = NULL;
|
||||
|
||||
found = hexmem(root_hash, root_hash_size);
|
||||
expected = hexmem(verity->root_hash, verity->root_hash_size);
|
||||
|
||||
log_debug("Root hash in signature JSON data (%s) doesn't match configured hash (%s).", strna(found), strna(expected));
|
||||
}
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
check_partition_flags(node, pflags,
|
||||
SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY);
|
||||
@ -1305,32 +1202,6 @@ static int dissect_image(
|
||||
rw = false;
|
||||
|
||||
} else if (type.designator == PARTITION_USR_VERITY_SIG) {
|
||||
if (verity && verity->root_hash) {
|
||||
_cleanup_free_ void *root_hash = NULL;
|
||||
size_t root_hash_size;
|
||||
|
||||
r = acquire_sig_for_roothash(
|
||||
fd,
|
||||
start * 512,
|
||||
size * 512,
|
||||
&root_hash,
|
||||
&root_hash_size,
|
||||
/* ret_root_hash_sig= */ NULL,
|
||||
/* ret_root_hash_sig_size= */ NULL);
|
||||
if (r < 0)
|
||||
return r;
|
||||
if (memcmp_nn(verity->root_hash, verity->root_hash_size, root_hash, root_hash_size) != 0) {
|
||||
if (DEBUG_LOGGING) {
|
||||
_cleanup_free_ char *found = NULL, *expected = NULL;
|
||||
|
||||
found = hexmem(root_hash, root_hash_size);
|
||||
expected = hexmem(verity->root_hash, verity->root_hash_size);
|
||||
|
||||
log_debug("Root hash in signature JSON data (%s) doesn't match configured hash (%s).", strna(found), strna(expected));
|
||||
}
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
check_partition_flags(node, pflags,
|
||||
SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY);
|
||||
@ -3790,13 +3661,44 @@ int dissected_image_load_verity_sig_partition(
|
||||
DissectedPartition *p = m->partitions + ds;
|
||||
if (!p->found)
|
||||
return 0;
|
||||
if (p->offset == UINT64_MAX || p->size == UINT64_MAX)
|
||||
return -EINVAL;
|
||||
|
||||
_cleanup_free_ void *root_hash = NULL, *root_hash_sig = NULL;
|
||||
size_t root_hash_size, root_hash_sig_size;
|
||||
if (p->size > 4*1024*1024) /* Signature data cannot possible be larger than 4M, refuse that */
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EFBIG), "Verity signature partition is larger than 4M, refusing.");
|
||||
|
||||
r = acquire_sig_for_roothash(fd, p->offset, p->size, &root_hash, &root_hash_size, &root_hash_sig, &root_hash_sig_size);
|
||||
_cleanup_free_ char *buf = new(char, p->size+1);
|
||||
if (!buf)
|
||||
return -ENOMEM;
|
||||
|
||||
ssize_t n = pread(fd, buf, p->size, p->offset);
|
||||
if (n < 0)
|
||||
return -ENOMEM;
|
||||
if ((uint64_t) n != p->size)
|
||||
return -EIO;
|
||||
|
||||
const char *e = memchr(buf, 0, p->size);
|
||||
if (e) {
|
||||
/* If we found a NUL byte then the rest of the data must be NUL too */
|
||||
if (!memeqzero(e, p->size - (e - buf)))
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Signature data contains embedded NUL byte.");
|
||||
} else
|
||||
buf[p->size] = 0;
|
||||
|
||||
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
|
||||
r = sd_json_parse(buf, 0, &v, /* reterr_line= */ NULL, /* reterr_column= */ NULL);
|
||||
if (r < 0)
|
||||
return r;
|
||||
return log_debug_errno(r, "Failed to parse signature JSON data: %m");
|
||||
|
||||
sd_json_variant *rh = sd_json_variant_by_key(v, "rootHash");
|
||||
if (!rh)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Signature JSON object lacks 'rootHash' field.");
|
||||
|
||||
_cleanup_free_ void *root_hash = NULL;
|
||||
size_t root_hash_size;
|
||||
r = sd_json_variant_unhex(rh, &root_hash, &root_hash_size);
|
||||
if (r < 0)
|
||||
return log_debug_errno(r, "Failed to parse root hash field: %m");
|
||||
|
||||
/* Check if specified root hash matches if it is specified */
|
||||
if (verity->root_hash &&
|
||||
@ -3809,6 +3711,16 @@ int dissected_image_load_verity_sig_partition(
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Root hash in signature JSON data (%s) doesn't match configured hash (%s).", strna(a), strna(b));
|
||||
}
|
||||
|
||||
sd_json_variant *sig = sd_json_variant_by_key(v, "signature");
|
||||
if (!sig)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Signature JSON object lacks 'signature' field.");
|
||||
|
||||
_cleanup_free_ void *root_hash_sig = NULL;
|
||||
size_t root_hash_sig_size;
|
||||
r = sd_json_variant_unbase64(sig, &root_hash_sig, &root_hash_sig_size);
|
||||
if (r < 0)
|
||||
return log_debug_errno(r, "Failed to parse signature field: %m");
|
||||
|
||||
free_and_replace(verity->root_hash, root_hash);
|
||||
verity->root_hash_size = root_hash_size;
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user