shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-03-21 02:50:18 +03:00
Code
systemd/mkosi.conf.d/20-sanitizers.conf

24 lines
1.2 KiB
Plaintext
Raw Permalink Normal View History

mkosi: Sanitizer improvements - Let's set the environment on the kernel command line so it applies to initrd and main system. - Let's add the necessary wrappers that are also added in test-functions. Unlike test-functions we don't use gcc/clang to get the library path as that requires installing gcc/clang in the initrd. - Let's drop the hack to get journald writing to the console and have it write to kmsg instead. We'll get the output either way. - Stop removing libstdc++ and sanitizer libraries from Arch Linux initrds and other images as it's required by the sanitizer libraries. - Add a workaround for specifying extra meson options for opensuse - Add a leak sanitizer suppression file as a workaround for a false positive leak in verify_selinuxmnt() in libselinux. We do a soname match because the stacktrace can't be properly symbolized on Debian.
2024-05-16 17:18:38 +02:00
# SPDX-License-Identifier: LGPL-2.1-or-later
[Match]
Environment=SANITIZERS
mkosi: Introduce build image We want the exitrd image to be built with the latest systemd as well. As the exitrd image is built as part of mkosi.images, and all subimages are built before the main image, this implies the packages must be built as a subimage in mkosi.images/ as well. So we introduce the build image and move all logic related to building distribution packages there. This also has the nice side effect of slimming down the main image as the build dependencies are not installed into the main image anymore. It also makes sure the packages are built in a "clean" chroot without any of the other packages which we install in the main image available. (cherry picked from commit 7205fc7dc31eb2be3075ee6ba23ebe84324aa5cb)
2024-07-12 15:33:49 +02:00
Environment=!SANITIZERS=
mkosi: Sanitizer improvements - Let's set the environment on the kernel command line so it applies to initrd and main system. - Let's add the necessary wrappers that are also added in test-functions. Unlike test-functions we don't use gcc/clang to get the library path as that requires installing gcc/clang in the initrd. - Let's drop the hack to get journald writing to the console and have it write to kmsg instead. We'll get the output either way. - Stop removing libstdc++ and sanitizer libraries from Arch Linux initrds and other images as it's required by the sanitizer libraries. - Add a workaround for specifying extra meson options for opensuse - Add a leak sanitizer suppression file as a workaround for a false positive leak in verify_selinuxmnt() in libselinux. We do a soname match because the stacktrace can't be properly symbolized on Debian.
2024-05-16 17:18:38 +02:00
[Content]
# Set verify_asan_link_order=0 to prevent ASAN warnings when building the image and make sure the real ASAN
# options are set when booting the image.
# Set intercept_tls_get_addr=0 to work around leak sanitizer segmentation fault in test-dlopen-so on CentOS
# Stream 9.
# TODO: Drop intercept_tls_get_addr=0 when we remove CentOS Stream 9 builds.
Environment=ASAN_OPTIONS=verify_asan_link_order=0:intercept_tls_get_addr=0
KernelCommandLine=
ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1
systemd.setenv=ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1
UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1
systemd.setenv=UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1
LSAN_OPTIONS=suppressions=/usr/lib/systemd/leak-sanitizer-suppressions
systemd.setenv=LSAN_OPTIONS=suppressions=/usr/lib/systemd/leak-sanitizer-suppressions
mkosi: Introduce build image We want the exitrd image to be built with the latest systemd as well. As the exitrd image is built as part of mkosi.images, and all subimages are built before the main image, this implies the packages must be built as a subimage in mkosi.images/ as well. So we introduce the build image and move all logic related to building distribution packages there. This also has the nice side effect of slimming down the main image as the build dependencies are not installed into the main image anymore. It also makes sure the packages are built in a "clean" chroot without any of the other packages which we install in the main image available. (cherry picked from commit 7205fc7dc31eb2be3075ee6ba23ebe84324aa5cb)
2024-07-12 15:33:49 +02:00
[Config]
Include=%D/mkosi.sanitizers
Copy Permalink