morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 00:14:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

dissect-image: when autoprobing insist on vfat for XBOOTLDR

Browse Source 
Let's reduce our attack surface by insisting that XBOOTLDR is vfat when
auto-probing, just like we do for the ESP. Given neither can
realistically be integrity protected (because firmware needs to access
them) let's insist on a vfat which has a much smaller attack surface,
and one we have to accept (for now) anyway, given that the ESP must be
VFAT.

This only applies to auto-probing of course. If people mount things
explicitly via fstab none of this matters. But we really shouldn't
automount a btrfs/xfs/ext4 partition as XBOOTLDR just because it looks
like one, as that would really defeat our otherwise possibly very strict
image policies.

This also introduces a new env var $SYSTEMD_DISSECT_FSTYPE_<DESIGNATOR>
environment variable that may override this hardcoding. This is in
particular useful in our testcases, since various actually do use ext4
as XBOOTLDR case. The tests are updated to make use of the new env var,
both as a mechanism to test this and to keep the tests working.
This commit is contained in:
Lennart Poettering
2025-10-09 11:01:48 +02:00
parent 2fbfbfc5fa
commit aad0d11e7c
3 changed files with 35 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/ENVIRONMENT.md
View File

@@ -529,6 +529,15 @@ disk images with `--image=` or similar:
systems that may be mounted for automatically dissected disk images. If not
specified defaults to something like: `ext4:btrfs:xfs:vfat:erofs:squashfs`
* `$SYSTEMD_DISSECT_FSTYPE_<DESIGNATOR>=` – overrides the file system time to
use when mounting the partition of the indicated designator. The
`<DESIGNATOR>` string shall be one of `ROOT`, `USR`, `HOME`, `SRV`, `ESP`,
`XBOOTLDR`, `TMP`, `VAR` as per the [Discoverable Partitions
Specification](https://uapi-group.org/specifications/specs/discoverable_partitions_specification/). If
unspecified the image dissection logic will automatically probe the file
system type (subject to `$SYSTEMD_DISSECT_FILE_SYSTEMS`, see above), except
for ESP and XBOOTLDR where the file system type is set to VFAT.
* `$SYSTEMD_LOOP_DIRECT_IO` – takes a boolean, which controls whether to enable
`LO_FLAGS_DIRECT_IO` (i.e. direct IO + asynchronous IO) on loopback block
devices when opening them. Defaults to on, set this to "0" to disable this