dasharo/systemd
0
0
Fork 0
mirror of https://github.com/Dasharo/systemd.git synced 2026-03-06 15:02:31 -08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #32689 from YHNdnzj/cred-missing

Browse Source 
core/exec-credential: complain louder if inherited credential is missing
This commit is contained in:
Luca Boccassi
2024-05-09 13:21:44 +02:00
committed by GitHub
parent 0c65d4dbf7 6b34871f5d
commit 7e10dfae96
3 changed files with 22 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
man/systemd.exec.xml
View File

@@ -3385,6 +3385,9 @@ StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZX
a terse way to declare credentials to inherit from the service manager into a service. This option
may be used multiple times, each time defining an additional credential to pass to the unit.</para>
<para>Note that if the path is not specified or a valid credential identifier is given, i.e.
in the above two cases, a missing credential is not considered fatal.</para>
<para>If an absolute path referring to a directory is specified, every file in that directory
(recursively) will be loaded as a separate credential. The ID for each credential will be the
provided ID suffixed with <literal>_$FILENAME</literal> (e.g., <literal>Key_file1</literal>). When

9
src/core/exec-credential.c
View File

@@ -443,7 +443,7 @@ static int load_credential(
/* Pass some minimal info about the unit and the credential name we are looking to acquire
* via the source socket address in case we read off an AF_UNIX socket. */
if (asprintf(&bindname, "@%" PRIx64"/unit/%s/%s", random_u64(), unit, id) < 0)
if (asprintf(&bindname, "@%" PRIx64 "/unit/%s/%s", random_u64(), unit, id) < 0)
return -ENOMEM;
missing_ok = false;
@@ -467,7 +467,7 @@ static int load_credential(
maxsz = encrypted ? CREDENTIAL_ENCRYPTED_SIZE_MAX : CREDENTIAL_SIZE_MAX;
if (search_path) {
if (search_path)
STRV_FOREACH(d, search_path) {
_cleanup_free_ char *j = NULL;
@@ -485,7 +485,7 @@ static int load_credential(
if (r != -ENOENT)
break;
}
} else if (source)
else if (source)
r = read_full_file_full(
read_dfd, source,
UINT64_MAX,
@@ -504,7 +504,8 @@ static int load_credential(
*
* Also, if the source file doesn't exist, but a fallback is set via SetCredentials=
* we are fine, too. */
log_debug_errno(r, "Couldn't read inherited credential '%s', skipping: %m", path);
log_full_errno(hashmap_contains(context->set_credentials, id) ? LOG_DEBUG : LOG_WARNING,
r, "Couldn't read inherited credential '%s', skipping: %m", path);
return 0;
}
if (r < 0)

28
src/core/load-fragment.c
View File

@@ -4883,11 +4883,8 @@ int config_parse_load_credential(
void *data,
void *userdata) {
_cleanup_free_ char *word = NULL, *k = NULL, *q = NULL;
ExecContext *context = ASSERT_PTR(data);
bool encrypted = ltype;
Unit *u = userdata;
const char *p;
const Unit *u = ASSERT_PTR(userdata);
int r;
assert(filename);
@@ -4900,7 +4897,10 @@ int config_parse_load_credential(
return 0;
}
p = rvalue;
_cleanup_free_ char *word = NULL, *id = NULL, *path = NULL;
const char *p = rvalue;
bool encrypted = ltype;
r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
if (r == -ENOMEM)
return log_oom();
@@ -4909,35 +4909,35 @@ int config_parse_load_credential(
return 0;
}
r = unit_cred_printf(u, word, &k);
r = unit_cred_printf(u, word, &id);
if (r < 0) {
log_syntax(unit, LOG_WARNING, filename, line, r, "Failed to resolve unit specifiers in \"%s\", ignoring: %m", word);
return 0;
}
if (!credential_name_valid(k)) {
log_syntax(unit, LOG_WARNING, filename, line, 0, "Credential name \"%s\" not valid, ignoring.", k);
if (!credential_name_valid(id)) {
log_syntax(unit, LOG_WARNING, filename, line, 0, "Credential name \"%s\" not valid, ignoring.", id);
return 0;
}
if (isempty(p)) {
/* If only one field is specified take it as shortcut for inheriting a credential named
* the same way from our parent */
q = strdup(k);
if (!q)
path = strdup(id);
if (!path)
return log_oom();
} else {
r = unit_path_printf(u, p, &q);
r = unit_path_printf(u, p, &path);
if (r < 0) {
log_syntax(unit, LOG_WARNING, filename, line, r, "Failed to resolve unit specifiers in \"%s\", ignoring: %m", p);
return 0;
}
if (path_is_absolute(q) ? !path_is_normalized(q) : !credential_name_valid(q)) {
log_syntax(unit, LOG_WARNING, filename, line, 0, "Credential source \"%s\" not valid, ignoring.", q);
if (path_is_absolute(path) ? !path_is_normalized(path) : !credential_name_valid(path)) {
log_syntax(unit, LOG_WARNING, filename, line, 0, "Credential source \"%s\" not valid, ignoring.", path);
return 0;
}
}
r = hashmap_put_credential(&context->load_credentials, k, q, encrypted);
r = hashmap_put_credential(&context->load_credentials, id, path, encrypted);
if (r < 0)
return log_error_errno(r, "Failed to store load credential '%s': %m", rvalue);