seccomp: also move munmap into @default syscall filter set

Follow-up for 5abede3247591248718026cb8be6cd231de7728b.
sd-device-enumerator: do not return error when a device is removed
2025-12-28 03:44:45 +01:00 · 2020-11-24 16:18:34 +01:00 · 2020-11-24 21:38:19 +09:00 · 2020-11-24 11:18:40 +01:00 · 2020-11-24 11:17:37 +01:00
4 changed files with 5 additions and 3 deletions
--- a/man/bootctl.xml
+++ b/man/bootctl.xml
@ -112,6 +112,7 @@
        These special IDs are primarily useful as a quick way to persistently make the currently booted boot loader
        entry the default choice, or to upgrade the default boot loader entry for the next boot to the default boot
        loader entry for all future boots, but may be used for other operations too.
+        When an emptry string ("") is specified as an ID, then the corresponding EFI variable will be unset.
        </para></listitem>
      </varlistentry>

--- a/src/kernel-install/90-loaderentry.install
+++ b/src/kernel-install/90-loaderentry.install
@ -20,7 +20,7 @@ MACHINE_ID=$KERNEL_INSTALL_MACHINE_ID

 BOOT_ROOT=${ENTRY_DIR_ABS%/$MACHINE_ID/$KERNEL_VERSION}
 BOOT_MNT=$(stat -c %m $BOOT_ROOT)
-ENTRY_DIR=/${ENTRY_DIR_ABS#$BOOT_MNT}
+ENTRY_DIR=${ENTRY_DIR_ABS#$BOOT_MNT}

 if [[ $COMMAND == remove ]]; then
    rm -f "$BOOT_ROOT/loader/entries/$MACHINE_ID-$KERNEL_VERSION.conf"
--- a/src/libsystemd/sd-device/device-enumerator.c
+++ b/src/libsystemd/sd-device/device-enumerator.c
@ -420,7 +420,8 @@ static int enumerator_scan_dir_and_add_devices(sd_device_enumerator *enumerator,

        dir = opendir(path);
        if (!dir)
-                return -errno;
+                /* this is necessarily racey, so ignore missing directories */
+                return (errno == ENOENT && (subdir1 || subdir2)) ? 0 : -errno;

        FOREACH_DIRENT_ALL(dent, dir, return -errno) {
                _cleanup_(sd_device_unrefp) sd_device *device = NULL;
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@ -322,6 +322,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                "membarrier\0"
                "mmap\0"
                "mmap2\0"
+                "munmap\0"
                "nanosleep\0"
                "pause\0"
                "prlimit64\0"
@ -471,7 +472,6 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                "mkdirat\0"
                "mknod\0"
                "mknodat\0"
-                "munmap\0"
                "newfstatat\0"
                "oldfstat\0"
                "oldlstat\0"
Author	SHA1	Message	Date
Yu Watanabe	11b9105dfd	seccomp: also move munmap into @default syscall filter set Follow-up for 5abede3247591248718026cb8be6cd231de7728b.	2020-11-24 16:18:34 +01:00
INSUN PYO	cfb6197bc3	sd-device-enumerator: do not return error when a device is removed If /sys/class/OOO node is created and destroyed during booting (kernle driver initialization fails), systemd-udev-trigger.service fails due to race condition. *** race condition ******************************************************************************* 1. kernel driver create /sys/class/OOO 2. systemd-udev-trigger.service execues "/usr/bin/udevadm trigger --type=devices --action=add" 3. device_enumerator_scan_devices() => enumerator_scan_devices_all() => enumerator_scan_dir("class") => opendir("/sys/class") and iterate all subdirs ==> enumerator_scan_dir_and_add_devices("/sys/class/OOO") 4. kernel driver fails and destroy /sys/class/OOO 5. enumerator_scan_dir_and_add_devices("/sys/class/OOO") fails in opendir("/sys/class/OOO") 6. "systemd-udev-trigger.service" fails 7. udev coldplug fails and some device units not ready 8. mount units asociated with device units fail 9. local-fs.target fails 10. enters emergency mode **************************************************************************************************** * status of systemd-udev-trigger.service unit ************************************************** $ systemctl status systemd-udev-trigger.service systemd-udev-trigger.service - udev Coldplug all Devices Loaded: loaded (/usr/lib/systemd/system/systemd-udev-trigger.service; static; vendor preset: enabled) Active: failed (Result: exit-code) since Thu 2020-01-02 13:16:54 KST; 22min ago Docs: man:udev(7) man:systemd-udevd.service(8) Process: 2162 ExecStart=/usr/bin/udevadm trigger --type=subsystems --action=add (code=exited, status=0/SUCCESS) Process: 2554 ExecStart=/usr/bin/udevadm trigger --type=devices --action=add (code=exited, status=1/FAILURE) Main PID: 2554 (code=exited, status=1/FAILURE) Jan 02 13:16:54 localhost udevadm[2554]: Failed to scan devices: No such file or directory Jan 02 13:16:54 localhost systemd[1]: systemd-udev-trigger.service: Main process exited, code=exited, status=1/FAILURE Jan 02 13:16:54 localhost systemd[1]: systemd-udev-trigger.service: Failed with result 'exit-code'. Jan 02 13:16:54 localhost systemd[1]: Failed to start udev Coldplug all Devices. *************************************************************************************************** * journal log with Environment=SYSTEMD_LOG_LEVEL=debug in systemd-udev-trigger.service ******* Jan 01 21:57:20 localhost udevadm[2039]: sd-device-enumerator: Scanning /sys/bus Jan 01 21:57:20 localhost udevadm[2522]: sd-device-enumerator: Scan all dirs Jan 01 21:57:20 localhost udevadm[2522]: sd-device-enumerator: Scanning /sys/bus Jan 01 21:57:21 localhost udevadm[2522]: sd-device-enumerator: Scanning /sys/class Jan 01 21:57:21 localhost udevadm[2522]: sd-device-enumerator: Failed to scan /sys/class: No such file or directory Jan 01 21:57:21 localhost udevadm[2522]: Failed to scan devices: No such file or directory *****************************************************************************************************	2020-11-24 21:38:19 +09:00
Yu Watanabe	cd0d230e7b	kernel-install: drop redundant "/" Follow-up for 1cdbff1c844ce46f1d84d8feeed426ebfd550988. After the commit 1cdbff1c844ce46f1d84d8feeed426ebfd550988, each entry .conf contains redundant slash like the following: ``` $ cat xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-5.9.8-200.fc33.x86_64.conf title Fedora 33 (Thirty Three) version 5.9.8-200.fc33.x86_64 machine-id xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx options root=/dev/nvme0n1p2 ro rootflags=subvol=system/fedora selinux=0 audit=0 linux //xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/5.9.8-200.fc33.x86_64/linux initrd //xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/5.9.8-200.fc33.x86_64/initrd ```	2020-11-24 11:18:40 +01:00
Yu Watanabe	ca91ce3a33	man: bootctl set-default/oneshot accept an empty string	2020-11-24 11:17:37 +01:00