From d4dffb8533a038fd42da8aae00ed2b09495dedb0 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 18 Dec 2019 12:22:40 +0100 Subject: [PATCH] dissect: introduce new recognizable partition types for /var and /var/tmp This has been requested many times before. Let's add it finally. GPT auto-discovery for /var is a bit more complex than for other partition types: the other partitions can to some degree be shared between multiple OS installations on the same disk (think: swap, /home, /srv). However, /var is inherently something bound to an installation, i.e. specific to its identity, or actually *is* its identity, and hence something that cannot be shared. To deal with this this new code is particularly careful when it comes to /var: it will not mount things blindly, but insist that the UUID of the partition matches a hashed version of the machine-id of the installation, so that each installation has a very specific /var associated with it, and would never use any other. (We actually use HMAC-SHA256 on the GPT partition type for /var, keyed by the machine-id, since machine-id is something we want to keep somewhat private). Setting the right UUID for installations takes extra care. To make things a bit simpler to set up, we avoid this safety check for nspawn and RootImage= in unit files, under the assumption that such container and service images unlikely will have multiple installations on them. The check is hence only required when booting full machines, i.e. in in systemd-gpt-auto-generator. To help with putting together images for full machines, PR #14368 introduces a repartition tool that can automatically fill in correctly calculated UUIDs on first boot if images have the var partition UUID initialized to all zeroes. With that in place systems can be put together in a way that on first boot the machine ID is determined and the partition table automatically adjusted to have the /var partition with the right UUID. --- src/core/execute.c | 2 +- src/dissect/dissect.c | 2 +- src/gpt-auto-generator/gpt-auto-generator.c | 12 +++++ src/nspawn/nspawn.c | 2 +- src/portable/portable.c | 2 +- src/shared/dissect-image.c | 50 ++++++++++++++++++++- src/shared/dissect-image.h | 3 ++ src/shared/gpt.h | 2 + src/shared/machine-image.c | 2 +- src/test/test-dissect-image.c | 2 +- 10 files changed, 72 insertions(+), 7 deletions(-) diff --git a/src/core/execute.c b/src/core/execute.c index 2cb2392d16b..4e75d864728 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -2581,7 +2581,7 @@ static int apply_mount_namespace( needs_sandboxing ? context->protect_home : PROTECT_HOME_NO, needs_sandboxing ? context->protect_system : PROTECT_SYSTEM_NO, context->mount_flags, - DISSECT_IMAGE_DISCARD_ON_LOOP, + DISSECT_IMAGE_DISCARD_ON_LOOP|DISSECT_IMAGE_RELAX_VAR_CHECK, error_path); /* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports diff --git a/src/dissect/dissect.c b/src/dissect/dissect.c index c1be6c034c5..2fef95aa027 100644 --- a/src/dissect/dissect.c +++ b/src/dissect/dissect.c @@ -22,7 +22,7 @@ static enum { } arg_action = ACTION_DISSECT; static const char *arg_image = NULL; static const char *arg_path = NULL; -static DissectImageFlags arg_flags = DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_DISCARD_ON_LOOP; +static DissectImageFlags arg_flags = DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_DISCARD_ON_LOOP|DISSECT_IMAGE_RELAX_VAR_CHECK; static void *arg_root_hash = NULL; static size_t arg_root_hash_size = 0; diff --git a/src/gpt-auto-generator/gpt-auto-generator.c b/src/gpt-auto-generator/gpt-auto-generator.c index 4aac903aa6c..04691a62c4f 100644 --- a/src/gpt-auto-generator/gpt-auto-generator.c +++ b/src/gpt-auto-generator/gpt-auto-generator.c @@ -697,6 +697,18 @@ static int enumerate_partitions(dev_t devnum) { r = k; } + if (m->partitions[PARTITION_VAR].found) { + k = add_partition_mount(m->partitions + PARTITION_VAR, "var", "/var", "Variable Data Partition"); + if (k < 0) + r = k; + } + + if (m->partitions[PARTITION_TMP].found) { + k = add_partition_mount(m->partitions + PARTITION_TMP, "var-tmp", "/var/tmp", "Temporary Data Partition"); + if (k < 0) + r = k; + } + if (m->partitions[PARTITION_ROOT].found) { k = add_root_rw(m->partitions + PARTITION_ROOT); if (k < 0) diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 9113f6e323c..962b2d02099 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -5058,7 +5058,7 @@ static int run(int argc, char *argv[]) { loop->fd, arg_image, arg_root_hash, arg_root_hash_size, - DISSECT_IMAGE_REQUIRE_ROOT, + DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_RELAX_VAR_CHECK, &dissected_image); if (r == -ENOPKG) { /* dissected_image_and_warn() already printed a brief error message. Extend on that with more details */ diff --git a/src/portable/portable.c b/src/portable/portable.c index 7a86398a4b5..e18826ab268 100644 --- a/src/portable/portable.c +++ b/src/portable/portable.c @@ -387,7 +387,7 @@ static int portable_extract_by_path( if (r < 0) return log_debug_errno(r, "Failed to create temporary directory: %m"); - r = dissect_image(d->fd, NULL, 0, DISSECT_IMAGE_READ_ONLY|DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_DISCARD_ON_LOOP, &m); + r = dissect_image(d->fd, NULL, 0, DISSECT_IMAGE_READ_ONLY|DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_DISCARD_ON_LOOP|DISSECT_IMAGE_RELAX_VAR_CHECK, &m); if (r == -ENOPKG) sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Couldn't identify a suitable partition table or file system in '%s'.", path); else if (r == -EADDRNOTAVAIL) diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c index 11d21c3a4d1..087c3dc3452 100644 --- a/src/shared/dissect-image.c +++ b/src/shared/dissect-image.c @@ -598,6 +598,43 @@ int dissect_image( if (!generic_node) return -ENOMEM; } + + } else if (sd_id128_equal(type_id, GPT_TMP)) { + + if (pflags & GPT_FLAG_NO_AUTO) + continue; + + designator = PARTITION_TMP; + rw = !(pflags & GPT_FLAG_READ_ONLY); + + } else if (sd_id128_equal(type_id, GPT_VAR)) { + + if (pflags & GPT_FLAG_NO_AUTO) + continue; + + if (!FLAGS_SET(flags, DISSECT_IMAGE_RELAX_VAR_CHECK)) { + sd_id128_t var_uuid; + + /* For /var we insist that the uuid of the partition matches the + * HMAC-SHA256 of the /var GPT partition type uuid, keyed by machine + * ID. Why? Unlike the other partitions /var is inherently + * installation specific, hence we need to be careful not to mount it + * in the wrong installation. By hashing the partition UUID from + * /etc/machine-id we can securely bind the partition to the + * installation. */ + + r = sd_id128_get_machine_app_specific(GPT_VAR, &var_uuid); + if (r < 0) + return r; + + if (!sd_id128_equal(var_uuid, id)) { + log_debug("Found a /var/ partition, but its UUID didn't match our expectations, ignoring."); + continue; + } + } + + designator = PARTITION_VAR; + rw = !(pflags & GPT_FLAG_READ_ONLY); } if (designator != _PARTITION_DESIGNATOR_INVALID) { @@ -910,6 +947,14 @@ int dissected_image_mount(DissectedImage *m, const char *where, uid_t uid_shift, if (r < 0) return r; + r = mount_partition(m->partitions + PARTITION_VAR, where, "/var", uid_shift, flags); + if (r < 0) + return r; + + r = mount_partition(m->partitions + PARTITION_TMP, where, "/var/tmp", uid_shift, flags); + if (r < 0) + return r; + boot_mounted = mount_partition(m->partitions + PARTITION_XBOOTLDR, where, "/boot", uid_shift, flags); if (boot_mounted < 0) return boot_mounted; @@ -1333,7 +1378,8 @@ int dissected_image_acquire_metadata(DissectedImage *m) { [META_HOSTNAME] = "/etc/hostname\0", [META_MACHINE_ID] = "/etc/machine-id\0", [META_MACHINE_INFO] = "/etc/machine-info\0", - [META_OS_RELEASE] = "/etc/os-release\0/usr/lib/os-release\0", + [META_OS_RELEASE] = "/etc/os-release\0" + "/usr/lib/os-release\0", }; _cleanup_strv_free_ char **machine_info = NULL, **os_release = NULL; @@ -1528,6 +1574,8 @@ static const char *const partition_designator_table[] = { [PARTITION_SWAP] = "swap", [PARTITION_ROOT_VERITY] = "root-verity", [PARTITION_ROOT_SECONDARY_VERITY] = "root-secondary-verity", + [PARTITION_TMP] = "tmp", + [PARTITION_VAR] = "var", }; DEFINE_STRING_TABLE_LOOKUP(partition_designator, int); diff --git a/src/shared/dissect-image.h b/src/shared/dissect-image.h index 40b8035ac7f..359dc877d58 100644 --- a/src/shared/dissect-image.h +++ b/src/shared/dissect-image.h @@ -33,6 +33,8 @@ enum { PARTITION_SWAP, PARTITION_ROOT_VERITY, /* verity data for the PARTITION_ROOT partition */ PARTITION_ROOT_SECONDARY_VERITY, /* verity data for the PARTITION_ROOT_SECONDARY partition */ + PARTITION_TMP, + PARTITION_VAR, _PARTITION_DESIGNATOR_MAX, _PARTITION_DESIGNATOR_INVALID = -1 }; @@ -59,6 +61,7 @@ typedef enum DissectImageFlags { DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY = 1 << 7, /* Mount only non-root partitions */ DISSECT_IMAGE_VALIDATE_OS = 1 << 8, /* Refuse mounting images that aren't identifiable as OS images */ DISSECT_IMAGE_NO_UDEV = 1 << 9, /* Don't wait for udev initializing things */ + DISSECT_IMAGE_RELAX_VAR_CHECK = 1 << 10, /* Don't insist that the UUID of /var is hashed from /etc/machine-id */ } DissectImageFlags; struct DissectedImage { diff --git a/src/shared/gpt.h b/src/shared/gpt.h index 31e01bd5a5c..8e9b111857c 100644 --- a/src/shared/gpt.h +++ b/src/shared/gpt.h @@ -19,6 +19,8 @@ #define GPT_SWAP SD_ID128_MAKE(06,57,fd,6d,a4,ab,43,c4,84,e5,09,33,c8,4b,4f,4f) #define GPT_HOME SD_ID128_MAKE(93,3a,c7,e1,2e,b4,4f,13,b8,44,0e,14,e2,ae,f9,15) #define GPT_SRV SD_ID128_MAKE(3b,8f,84,25,20,e0,4f,3b,90,7f,1a,25,a7,6f,98,e8) +#define GPT_VAR SD_ID128_MAKE(4d,21,b0,16,b5,34,45,c2,a9,fb,5c,16,e0,91,fd,2d) +#define GPT_TMP SD_ID128_MAKE(7e,c6,f5,57,3b,c5,4a,ca,b2,93,16,ef,5d,f6,39,d1) /* Verity partitions for the root partitions above (we only define them for the root partitions, because only they are * are commonly read-only and hence suitable for verity). */ diff --git a/src/shared/machine-image.c b/src/shared/machine-image.c index 15fd514353a..b45efcd1e66 100644 --- a/src/shared/machine-image.c +++ b/src/shared/machine-image.c @@ -1171,7 +1171,7 @@ int image_read_metadata(Image *i) { if (r < 0) return r; - r = dissect_image(d->fd, NULL, 0, DISSECT_IMAGE_REQUIRE_ROOT, &m); + r = dissect_image(d->fd, NULL, 0, DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_RELAX_VAR_CHECK, &m); if (r < 0) return r; diff --git a/src/test/test-dissect-image.c b/src/test/test-dissect-image.c index 12685dad137..a1ccf605b11 100644 --- a/src/test/test-dissect-image.c +++ b/src/test/test-dissect-image.c @@ -28,7 +28,7 @@ int main(int argc, char *argv[]) { return EXIT_FAILURE; } - r = dissect_image(d->fd, NULL, 0, DISSECT_IMAGE_REQUIRE_ROOT, &m); + r = dissect_image(d->fd, NULL, 0, DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_RELAX_VAR_CHECK, &m); if (r < 0) { log_error_errno(r, "Failed to dissect image: %m"); return EXIT_FAILURE;