13533485051

Committed 25 Feb 2025 10:20PM UTC coverage: 71.818% (+0.04%) from 71.774%

Build # 13533485051

Build Type

push

github

Committed by

web-flow

Commit Message

make integritysetup/veritysetup more alike cryptsetup when it comes to remote operation (#36501)

Let's address some asymmetries here.

Coverage Stats

0 of 12 new or added lines in 1 file covered. (0.0%)

96 existing lines in 30 files now uncovered.

294319 of 409813 relevant lines covered (71.82%)

716680.45 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/src/integritysetup/integritysetup-generator.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <errno.h>
#include <stdbool.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <unistd.h>

#include "alloc-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "fstab-util.h"
#include "generator.h"
#include "hexdecoct.h"
#include "id128-util.h"
#include "integrity-util.h"
#include "main-func.h"
#include "mkdir.h"
#include "parse-util.h"
#include "path-util.h"
#include "proc-cmdline.h"
#include "specifier.h"
#include "string-util.h"
#include "unit-name.h"

static const char *arg_dest = NULL;
static const char *arg_integritytab = NULL;
static char *arg_options = NULL;
STATIC_DESTRUCTOR_REGISTER(arg_options, freep);

static int create_disk(
                const char *name,
                const char *device,
                const char *key_file,
                const char *options) {

        _cleanup_free_ char *n = NULL, *dd = NULL, *e = NULL, *name_escaped = NULL, *key_file_escaped = NULL;
        _cleanup_fclose_ FILE *f = NULL;
        char *dmname = NULL;
        bool noauto, nofail, netdev;
        int r;

        assert(name);
        assert(device);

        noauto = fstab_test_yes_no_option(options, "noauto\0" "auto\0");
        nofail = fstab_test_yes_no_option(options, "nofail\0" "fail\0");
        netdev = fstab_test_option(options, "_netdev\0");

        name_escaped = specifier_escape(name);
        if (!name_escaped)
                return log_oom();

        e = unit_name_escape(name);
        if (!e)
                return log_oom();

        r = unit_name_build("systemd-integritysetup", e, ".service", &n);
        if (r < 0)
                return log_error_errno(r, "Failed to generate unit name: %m");

        r = unit_name_from_path(device, ".device", &dd);
        if (r < 0)
                return log_error_errno(r, "Failed to generate unit name: %m");

        r = generator_open_unit_file(arg_dest, NULL, n, &f);
        if (r < 0)
                return r;

        if (key_file) {
                if (!path_is_absolute(key_file))
                        return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "key file not absolute file path %s", key_file);

                key_file_escaped = specifier_escape(key_file);
                if (!key_file_escaped)
                        return log_oom();
        }

        if (options) {
                r = parse_integrity_options(options, NULL, NULL, NULL, NULL, NULL);
                if (r < 0)
                        return r;
        }

        fprintf(f,
                "[Unit]\n"
                "Description=Integrity Setup for %%I\n"
                "Documentation=man:integritytab(5) man:systemd-integritysetup-generator(8) man:systemd-integritysetup@.service(8)\n"
                "SourcePath=%s\n"
                "DefaultDependencies=no\n"
                "IgnoreOnIsolate=true\n"
                "After=integritysetup-pre.target systemd-udevd-kernel.socket\n"
                "Before=blockdev@dev-mapper-%%i.target\n"
                "Wants=blockdev@dev-mapper-%%i.target\n"
                "Conflicts=umount.target\n"
                "BindsTo=%s\n"
                "After=%s\n"
                "Before=umount.target\n",
                arg_integritytab,
                dd, dd);

        if (netdev)
                fprintf(f, "After=remote-fs-pre.target\n");

        if (!nofail)
                fprintf(f,
                        "Before=%s\n",
                        netdev ? "remote-integritysetup.target" : "integritysetup.target");

        fprintf(f,
                "\n"
                "[Service]\n"
                "Type=oneshot\n"
                "RemainAfterExit=yes\n"
                "TimeoutSec=infinity\n"
                "ExecStart=" LIBEXECDIR "/systemd-integritysetup attach '%s' '%s' '%s' '%s'\n"
                "ExecStop=" LIBEXECDIR "/systemd-integritysetup detach '%s'\n",
                name_escaped, device, empty_to_dash(key_file_escaped), empty_to_dash(options),
                name_escaped);

        r = fflush_and_check(f);
        if (r < 0)
                return log_error_errno(r, "Failed to write unit file %s: %m", n);

        if (!noauto) {
                r = generator_add_symlink(
                                arg_dest,
                                netdev ? "remote-integritysetup.target" : "integritysetup.target",
                                nofail ? "wants" : "requires",
                                n);
                if (r < 0)
                        return r;
        }

        dmname = strjoina("dev-mapper-", e, ".device");
        return generator_add_symlink(arg_dest, dmname, "requires", n);
}

static int add_integritytab_devices(void) {
        _cleanup_fclose_ FILE *f = NULL;
        unsigned integritytab_line = 0;
        int r;

        r = fopen_unlocked(arg_integritytab, "re", &f);
        if (r < 0) {
                if (errno != ENOENT)
                        log_error_errno(errno, "Failed to open %s: %m", arg_integritytab);
                return 0;
        }

        for (;;) {
                _cleanup_free_ char *line = NULL, *name = NULL, *device_id = NULL, *device_path = NULL, *key_file = NULL, *options = NULL;

                r = read_stripped_line(f, LONG_LINE_MAX, &line);
                if (r < 0)
                        return log_error_errno(r, "Failed to read %s: %m", arg_integritytab);
                if (r == 0)
                        break;

                integritytab_line++;

                if (IN_SET(line[0], 0, '#'))
                        continue;

                /* The key file and the options are optional */
                r = sscanf(line, "%ms %ms %ms %ms", &name, &device_id, &key_file, &options);
                if (!IN_SET(r, 2, 3, 4)) {
                        log_error("Failed to parse %s:%u, ignoring.", arg_integritytab, integritytab_line);
                        continue;
                }

                device_path = fstab_node_to_udev_node(device_id);
                if (!device_path) {
                        log_error("Failed to find device %s:%u, ignoring.", device_id, integritytab_line);
                        continue;
                }

                r = create_disk(name, device_path, empty_or_dash_to_null(key_file), empty_or_dash_to_null(options));
                if (r < 0)
                        return r;
        }

        return 0;
}

static int run(const char *dest, const char *dest_early, const char *dest_late) {
        assert_se(arg_dest = dest);

        arg_integritytab = getenv("SYSTEMD_INTEGRITYTAB") ?: "/etc/integritytab";

        return add_integritytab_devices();
}

DEFINE_MAIN_GENERATOR_FUNCTION(run);

1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3	#include <errno.h>
4	#include <stdbool.h>
5	#include <stdlib.h>
6	#include <sys/stat.h>
7	#include <unistd.h>
8
9	#include "alloc-util.h"
10	#include "fd-util.h"
11	#include "fileio.h"
12	#include "fstab-util.h"
13	#include "generator.h"
14	#include "hexdecoct.h"
15	#include "id128-util.h"
16	#include "integrity-util.h"
17	#include "main-func.h"
18	#include "mkdir.h"
19	#include "parse-util.h"
20	#include "path-util.h"
21	#include "proc-cmdline.h"
22	#include "specifier.h"
23	#include "string-util.h"
24	#include "unit-name.h"
25
26	static const char *arg_dest = NULL;
27	static const char *arg_integritytab = NULL;
28	static char *arg_options = NULL;
29	STATIC_DESTRUCTOR_REGISTER(arg_options, freep);	×
30
31	static int create_disk(	×
32	const char *name,
33	const char *device,
34	const char *key_file,
35	const char *options) {
36
37	_cleanup_free_ char n = NULL, dd = NULL, e = NULL, name_escaped = NULL, *key_file_escaped = NULL;	×
38	_cleanup_fclose_ FILE *f = NULL;	×
39	char *dmname = NULL;	×
NEW 40	bool noauto, nofail, netdev;	×
NEW 41	int r;	×
42
43	assert(name);	×
44	assert(device);	×
45
NEW 46	noauto = fstab_test_yes_no_option(options, "noauto\0" "auto\0");	×
NEW 47	nofail = fstab_test_yes_no_option(options, "nofail\0" "fail\0");	×
NEW 48	netdev = fstab_test_option(options, "_netdev\0");	×
49
50	name_escaped = specifier_escape(name);	×
51	if (!name_escaped)	×
52	return log_oom();	×
53
54	e = unit_name_escape(name);	×
55	if (!e)	×
56	return log_oom();	×
57
58	r = unit_name_build("systemd-integritysetup", e, ".service", &n);	×
59	if (r < 0)	×
60	return log_error_errno(r, "Failed to generate unit name: %m");	×
61
62	r = unit_name_from_path(device, ".device", &dd);	×
63	if (r < 0)	×
64	return log_error_errno(r, "Failed to generate unit name: %m");	×
65
66	r = generator_open_unit_file(arg_dest, NULL, n, &f);	×
67	if (r < 0)	×
68	return r;
69
70	if (key_file) {	×
71	if (!path_is_absolute(key_file))	×
72	return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "key file not absolute file path %s", key_file);	×
73
74	key_file_escaped = specifier_escape(key_file);	×
75	if (!key_file_escaped)	×
76	return log_oom();	×
77	}
78
79	if (options) {	×
80	r = parse_integrity_options(options, NULL, NULL, NULL, NULL, NULL);	×
81	if (r < 0)	×
82	return r;
83	}
84
85	fprintf(f,	×
86	"[Unit]\n"
87	"Description=Integrity Setup for %%I\n"
88	"Documentation=man:integritytab(5) man:systemd-integritysetup-generator(8) man:systemd-integritysetup@.service(8)\n"
89	"SourcePath=%s\n"
90	"DefaultDependencies=no\n"
91	"IgnoreOnIsolate=true\n"
92	"After=integritysetup-pre.target systemd-udevd-kernel.socket\n"
93	"Before=blockdev@dev-mapper-%%i.target\n"
94	"Wants=blockdev@dev-mapper-%%i.target\n"
95	"Conflicts=umount.target\n"
96	"BindsTo=%s\n"
97	"After=%s\n"
98	"Before=umount.target\n",
99	arg_integritytab,
100	dd, dd);
101
NEW 102	if (netdev)	×
NEW 103	fprintf(f, "After=remote-fs-pre.target\n");	×
104
NEW 105	if (!nofail)	×
NEW 106	fprintf(f,	×
107	"Before=%s\n",
108	netdev ? "remote-integritysetup.target" : "integritysetup.target");
109
UNCOV 110	fprintf(f,	×
111	"\n"
112	"[Service]\n"
113	"Type=oneshot\n"
114	"RemainAfterExit=yes\n"
115	"TimeoutSec=infinity\n"
116	"ExecStart=" LIBEXECDIR "/systemd-integritysetup attach '%s' '%s' '%s' '%s'\n"
117	"ExecStop=" LIBEXECDIR "/systemd-integritysetup detach '%s'\n",
118	name_escaped, device, empty_to_dash(key_file_escaped), empty_to_dash(options),
119	name_escaped);
120
121	r = fflush_and_check(f);	×
122	if (r < 0)	×
123	return log_error_errno(r, "Failed to write unit file %s: %m", n);	×
124
NEW 125	if (!noauto) {	×
NEW 126	r = generator_add_symlink(	×
127	arg_dest,
128	netdev ? "remote-integritysetup.target" : "integritysetup.target",
129	nofail ? "wants" : "requires",
130	n);
NEW 131	if (r < 0)	×
132	return r;
133	}
134
135	dmname = strjoina("dev-mapper-", e, ".device");	×
136	return generator_add_symlink(arg_dest, dmname, "requires", n);	×
137	}
138
139	static int add_integritytab_devices(void) {	×
140	_cleanup_fclose_ FILE *f = NULL;	×
141	unsigned integritytab_line = 0;	×
142	int r;	×
143
144	r = fopen_unlocked(arg_integritytab, "re", &f);	×
145	if (r < 0) {	×
146	if (errno != ENOENT)	×
147	log_error_errno(errno, "Failed to open %s: %m", arg_integritytab);	×
148	return 0;	×
149	}
150
151	for (;;) {	×
152	_cleanup_free_ char line = NULL, name = NULL, device_id = NULL, device_path = NULL, key_file = NULL, options = NULL;	×
153
154	r = read_stripped_line(f, LONG_LINE_MAX, &line);	×
155	if (r < 0)	×
156	return log_error_errno(r, "Failed to read %s: %m", arg_integritytab);	×
157	if (r == 0)	×
158	break;
159
160	integritytab_line++;	×
161
162	if (IN_SET(line[0], 0, '#'))	×
163	continue;	×
164
165	/* The key file and the options are optional */
166	r = sscanf(line, "%ms %ms %ms %ms", &name, &device_id, &key_file, &options);	×
167	if (!IN_SET(r, 2, 3, 4)) {	×
168	log_error("Failed to parse %s:%u, ignoring.", arg_integritytab, integritytab_line);	×
169	continue;	×
170	}
171
172	device_path = fstab_node_to_udev_node(device_id);	×
173	if (!device_path) {	×
174	log_error("Failed to find device %s:%u, ignoring.", device_id, integritytab_line);	×
175	continue;	×
176	}
177
178	r = create_disk(name, device_path, empty_or_dash_to_null(key_file), empty_or_dash_to_null(options));	×
179	if (r < 0)	×
180	return r;
181	}
182
183	return 0;	×
184	}
185
186	static int run(const char dest, const char dest_early, const char *dest_late) {	×
187	assert_se(arg_dest = dest);	×
188
189	arg_integritytab = getenv("SYSTEMD_INTEGRITYTAB") ?: "/etc/integritytab";	×
190
191	return add_integritytab_devices();	×
192	}
193
194	DEFINE_MAIN_GENERATOR_FUNCTION(run);	×

systemd / systemd / 13533485051

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous