mirror of
https://github.com/morgan9e/systemd
synced 2026-04-14 00:14:32 +09:00
490aa05ca1
Sincec5de7b14aefile searching implies a new mount api syscall by default, to trigger automounts. This is problematic in NSS plugins, as they are dlopen'ed inside processes by glibc, for two reasons. First of all, potentially searching on a networked filesystem automount could lead to nasty surprises, such as the process responsible for setting up the network filesystem trying to search on that same filesystem. More importantly, the new mount api syscall was never part of the filesystem seccomp filter that we provide by default, and given mounting/remounting/bind mounting is one of the possible ways to bypass sandboxing it is very likely not allowed when custom filters are used in sandboxed processes, if they don't need to do these operations otherwise. The filesystem seccomp mask we provide has been updated, however this only takes effect on the next restart of a service. When systemd is upgraded via a package upgrade, the new nss plugin is installed and will be immediately dlopen'ed by glibc when needed, without waiting for the process to restart, which means the existing seccomp filter applies, causing the filter to trigger. Given it's not really possible for any arbitrary program to predict which NSS modules glibc will load, given programs do not configure that and instead nsswitch is set up by the sysadmin, it's impossible to handle at each process level. It's also not possible to know when it will be triggered, given the plugin is not linked in each binary tools like need-restart cannot even pre-emptively restart services that may be affected. This means in practice, upgrading from systemd << v258 to >= v258 requires a reboot to avoid either subtle or catastrophic system failures. By avoiding to trigger automounts in nss-systemd we can avoid both issues. userdb drop-ins are searched for in: /etc/userdb/ /run/userdb/ /run/host/userdb/ /usr/local/lib/userdb/ /usr/lib/userdb/ none of which are supported as automounts anyway. Note that this happens only when the userdbd service is not running, as otherwise nss-systemd will go through the varlink IPC, rather than doing the searches in-process. So invert CHASE_NO_AUTOFS to CHASE_AUTOFS and set it in the places where we do want to trigger automounts, like looking for the ESP. Follow-up forc5de7b14aeFixes https://github.com/systemd/systemd/issues/38565