Skip to content

Commit d04faa4

Browse files
poetteringpoettering
committed
tree-wide: make use of DISSECT_IMAGE_USR_NO_ROOT in various tools
Let's make use of the new dissection in all tools where this makes sense, which are all tools that dissect images, except for those which inherently operate on state/configuraiton and thus where an image without state nor configuration is useless (e.g. systemd-tmpfiles/systemd-firstboot/… --image= switch).
1 parent 7cf6603 commit d04faa4

File tree

7 files changed

+39
-11
lines changed

7 files changed

+39
-11
lines changed

‎src/core/execute.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3247,7 +3247,7 @@ static int apply_mount_namespace(
32473247
propagate_dir,
32483248
incoming_dir,
32493249
root_dir || root_image ? params->notify_socket : NULL,
3250-
DISSECT_IMAGE_DISCARD_ON_LOOP|DISSECT_IMAGE_RELAX_VAR_CHECK|DISSECT_IMAGE_FSCK,
3250+
DISSECT_IMAGE_DISCARD_ON_LOOP|DISSECT_IMAGE_RELAX_VAR_CHECK|DISSECT_IMAGE_FSCK|DISSECT_IMAGE_USR_NO_ROOT,
32513251
error_path);
32523252

32533253
/* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports

‎src/dissect/dissect.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ static const char *arg_image = NULL;
4444
static const char *arg_path = NULL;
4545
static const char *arg_source = NULL;
4646
static const char *arg_target = NULL;
47-
static DissectImageFlags arg_flags = DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_DISCARD_ON_LOOP|DISSECT_IMAGE_RELAX_VAR_CHECK|DISSECT_IMAGE_FSCK;
47+
static DissectImageFlags arg_flags = DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_DISCARD_ON_LOOP|DISSECT_IMAGE_RELAX_VAR_CHECK|DISSECT_IMAGE_FSCK|DISSECT_IMAGE_USR_NO_ROOT;
4848
static VeritySettings arg_verity_settings = VERITY_SETTINGS_DEFAULT;
4949
static JsonFormatFlags arg_json_format_flags = JSON_FORMAT_OFF;
5050
static PagerFlags arg_pager_flags = 0;

‎src/gpt-auto-generator/gpt-auto-generator.c‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -665,7 +665,13 @@ static int enumerate_partitions(dev_t devnum) {
665665
if (r <= 0)
666666
return r;
667667

668-
r = dissect_image(fd, NULL, NULL, DISSECT_IMAGE_GPT_ONLY|DISSECT_IMAGE_NO_UDEV, &m);
668+
r = dissect_image(
669+
fd,
670+
NULL, NULL,
671+
DISSECT_IMAGE_GPT_ONLY|
672+
DISSECT_IMAGE_NO_UDEV|
673+
DISSECT_IMAGE_USR_NO_ROOT,
674+
&m);
669675
if (r == -ENOPKG) {
670676
log_debug_errno(r, "No suitable partition table found, ignoring.");
671677
return 0;

‎src/nspawn/nspawn.c‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3581,8 +3581,12 @@ static int outer_child(
35813581
* makes sure ESP partitions and userns are compatible. */
35823582

35833583
r = dissected_image_mount_and_warn(
3584-
dissected_image, directory, arg_uid_shift,
3585-
DISSECT_IMAGE_MOUNT_ROOT_ONLY|DISSECT_IMAGE_DISCARD_ON_LOOP|
3584+
dissected_image,
3585+
directory,
3586+
arg_uid_shift,
3587+
DISSECT_IMAGE_MOUNT_ROOT_ONLY|
3588+
DISSECT_IMAGE_DISCARD_ON_LOOP|
3589+
DISSECT_IMAGE_USR_NO_ROOT|
35863590
(arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK)|
35873591
(arg_start_mode == START_BOOT ? DISSECT_IMAGE_VALIDATE_OS : 0));
35883592
if (r < 0)
@@ -3669,8 +3673,14 @@ static int outer_child(
36693673

36703674
if (dissected_image) {
36713675
/* Now we know the uid shift, let's now mount everything else that might be in the image. */
3672-
r = dissected_image_mount(dissected_image, directory, arg_uid_shift,
3673-
DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|DISSECT_IMAGE_DISCARD_ON_LOOP|(arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK));
3676+
r = dissected_image_mount(
3677+
dissected_image,
3678+
directory,
3679+
arg_uid_shift,
3680+
DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|
3681+
DISSECT_IMAGE_DISCARD_ON_LOOP|
3682+
DISSECT_IMAGE_USR_NO_ROOT|
3683+
(arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK));
36743684
if (r == -EUCLEAN)
36753685
return log_error_errno(r, "File system check for image failed: %m");
36763686
if (r < 0)
@@ -5378,7 +5388,10 @@ static int run(int argc, char *argv[]) {
53785388
}
53795389

53805390
} else {
5381-
DissectImageFlags dissect_image_flags = DISSECT_IMAGE_REQUIRE_ROOT | DISSECT_IMAGE_RELAX_VAR_CHECK;
5391+
DissectImageFlags dissect_image_flags =
5392+
DISSECT_IMAGE_REQUIRE_ROOT |
5393+
DISSECT_IMAGE_RELAX_VAR_CHECK |
5394+
DISSECT_IMAGE_USR_NO_ROOT;
53825395
assert(arg_image);
53835396
assert(!arg_template);
53845397

‎src/portable/portable.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -380,7 +380,7 @@ static int portable_extract_by_path(
380380
if (r < 0)
381381
return log_debug_errno(r, "Failed to create temporary directory: %m");
382382

383-
r = dissect_image(d->fd, NULL, NULL, DISSECT_IMAGE_READ_ONLY|DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_DISCARD_ON_LOOP|DISSECT_IMAGE_RELAX_VAR_CHECK, &m);
383+
r = dissect_image(d->fd, NULL, NULL, DISSECT_IMAGE_READ_ONLY|DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_DISCARD_ON_LOOP|DISSECT_IMAGE_RELAX_VAR_CHECK|DISSECT_IMAGE_USR_NO_ROOT, &m);
384384
if (r == -ENOPKG)
385385
sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Couldn't identify a suitable partition table or file system in '%s'.", path);
386386
else if (r == -EADDRNOTAVAIL)

‎src/shared/discover-image.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1198,7 +1198,12 @@ int image_read_metadata(Image *i) {
11981198
if (r < 0)
11991199
return r;
12001200

1201-
r = dissect_image(d->fd, NULL, NULL, DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_RELAX_VAR_CHECK, &m);
1201+
r = dissect_image(
1202+
d->fd,
1203+
NULL, NULL,
1204+
DISSECT_IMAGE_REQUIRE_ROOT|
1205+
DISSECT_IMAGE_RELAX_VAR_CHECK|
1206+
DISSECT_IMAGE_USR_NO_ROOT, &m);
12021207
if (r < 0)
12031208
return r;
12041209

‎src/sysext/sysext.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -509,7 +509,11 @@ static int merge_subprocess(Hashmap *images, const char *workspace) {
509509
_cleanup_(loop_device_unrefp) LoopDevice *d = NULL;
510510
_cleanup_(decrypted_image_unrefp) DecryptedImage *di = NULL;
511511
_cleanup_(verity_settings_done) VeritySettings verity_settings = VERITY_SETTINGS_DEFAULT;
512-
DissectImageFlags flags = DISSECT_IMAGE_READ_ONLY|DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_MOUNT_ROOT_ONLY;
512+
DissectImageFlags flags =
513+
DISSECT_IMAGE_READ_ONLY|
514+
DISSECT_IMAGE_REQUIRE_ROOT|
515+
DISSECT_IMAGE_MOUNT_ROOT_ONLY|
516+
DISSECT_IMAGE_USR_NO_ROOT;
513517

514518
r = verity_settings_load(&verity_settings, img->path, NULL, NULL);
515519
if (r < 0)

0 commit comments

Comments
 (0)