New versions of glibc have an lchmod function so we need to wrap it.
Identified through a reproducibility issue in initramfs-base where
/dev/console created by mknod from coreutils changed permissions
depending on the host distro (mknod used the gnulib wrapper on most
hosts but newer ones used the libc call).
[YOCTO #14162]
(From OE-Core rev: 20a645664977530e602e1ac97e8dc0962e730e6c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This also plugs a memory leak in pseudo_client_ignore_path_chroot().
(From OE-Core rev: d8dddd5054a1c4e20a3e32fa9ab31f5859d6fbb6)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Newer systems are using this currently unwrapped glibc function,
add it.
[YOCTO #14080]
(From OE-Core rev: cba4f51f0166e2c20e854ee0344be0c58769eaca)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is magic in the posts where specific variable names have specific
magic. For that magic to work, "path" needs to be used not "pathname" as
is currently there. Fix this, which fixes path issues on systems using
statx (Ubuntu 20.04 in particular).
(From OE-Core rev: f9ae80aee98a7bb59c83ac9ebf9d317302507cec)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a path to fix up handling of dirfd being passed as a full file
and with path="".
(From OE-Core rev: 3006bbe7768e4efe33d3d2d3f5786a561ecbe96f)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Mark files which are unlinked (nlink == 0) but open with fd's as
"may-unlink" to avoid problematic database entries.
(From OE-Core rev: e1e481f3608c05ab14c61bf45cd0837d7287b6a5)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix a NULL pointer dereference exposed by the path ignore code in
xattr handling.
(From OE-Core rev: 929a27bf6cbca94d1141d2094ae0c915d93bd3f4)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Where files are link()'d and one is unlink()'d, pseudo's fd mappings
can become confused. Add a patch to try and improve this for the common
usecases we see.
(From OE-Core rev: 9ce621fa2099608ca0ccbb8420b31d71cdd7b00e)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Rather than doing what turns out to be a rather dangerous "fixup" if
we see a file with a different path but the same inode as another file
we've previously seen, throw and abort. Direct the user to a wiki page
where we can maintain information about what this error means.
(From OE-Core rev: 2db491d97da08d44ebd257f98489550a82a7935c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add PSEUDO_IGNORE_PATHS, a comma separated list of path prefixes, where
any files underneath are not handled by pseudo. This allows files to
be left out of the pseudo datanase where we know we don't need the
fake root emulation. This is particularly useful if we know these files
can be deleted outside of pseudo context.
(From OE-Core rev: 8defb687a2c0ffac232c4d0d63a590871c453a2e)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently, where pseudo finds a database entry for an inode but the path
doesn't match, it reuses that database entry metadata. This is causing
real world "corruption" of file attributes.
See [YOCTO #14057] for an example of this.
This can happen when files are deleted outside of pseudo context and the
inode is reused by a new file which pseduo then "sees".
Its possible the opposite could happen, it needs to reuse attributes
but this change would prevent it. As far as I can tell, we don't want
pseuo to reuse these attributes though so this code should be safer
and avoid bugs like the above.
(From OE-Core rev: 1c13149b81e03a1ac48b27a208a139d5493c3ce7)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pseudo tests for an item being renamed to itself only after
information about it has been deleted. Move the test to before
we change the database.
Note that pseudo does not support renameat2(), but neither does
glibc.
(From OE-Core rev: 6b3d109f42385ad1cf1f297a6c06ea7eb6509f26)
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This adds in support for the OFC fcntl ioctl lock flags, removing
warnings on some more recent linux kernels.
(From OE-Core rev: 234168f803bee2e5b0955aabaddb1d967349fb82)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We have a significant number of outstanding patches to pseudo. Rather than
queue these up as patches, create a branch in the upstream repo and use that
until such times as we have someone with the time/skills to properly review
these for master in the pseudo repo.
(From OE-Core rev: f09088eaa803ce396726368626a35dee70168d91)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
On a tumbleweed system, "install X Y" was showing the error:
pseudo: ENOSYS for 'fsetxattr'.
which was being caused by dlsym() for that function returning NULL. This
appears to be due to it finding an unresolved symbol in libacl for this
symbol in libattr. It hasn't been resolved so its NULL. dlerror() returns
nothing since this is a valid symbol entry, its just not the one we want.
We can add the glibc version string for the symbol we actually want so we get
that version rather than the libattr/libacl one. The calls in libattr are just
wrappers around the libc version so our attaching to the libc versions should
intercept any accesses via these too.
[YOCTO #13952]
(From OE-Core rev: 82655cb26ad01de9587ef41eaef155c61c361f67)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
'pseudo_access_t' is a type, so use typedef.
Fixes building pseudo with gcc 10 where -fno-common is the default.
(From OE-Core rev: a7d519f742aadc9110c2401f359254210a784f6b)
Signed-off-by: Jacob Kroon <jacob.kroon@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It fails to compile pseudo-native on centos 7:
| ports/linux/pseudo_wrappers.c: In function ‘prctl’:
| ports/linux/pseudo_wrappers.c:129:14: error: ‘SECCOMP_SET_MODE_FILTER’ undeclared (first use in this function)
| if (cmd == SECCOMP_SET_MODE_FILTER) {
| ^
Add macro guard for the definition to avoid the failure.
(From OE-Core rev: d1c4492cb9cf5a624bb996c94e9a1589133be014)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If a file does not exist, either because it has been removed outside
bitbake, or because only some of the files have been moved to a
different location, delete it from the pseudo-db is the user decides to
fix the database.
(From OE-Core rev: 79f7212ae71a4eb9e7abfe2c333b035ccc10e5c5)
Signed-off-by: Ricardo Ribalda Delgado <ricardo@ribalda.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pseudo changes the syscall access patterns which makes it incompatible with
seccomp. Therefore intercept the seccomp syscall and alter it, pretending that
seccomp was setup when in fact we do nothing. If we error as unsupported,
utilities like file will exit with errors so we can't just disable it.
This works around issues on platforms where seccomp is enabled in file
(e.g. archlinux).
(From OE-Core rev: bc895522eb940539a0e3cb6192c4a64f13ca8d6a)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
pseudo-native is special in that bitbake ends up executing it from the
sysroot-components directory before we have any workdirs for the bitbake
fakeroot worker. Since we switched to dynamically linking sqlite, it
means sqlite from the host system may be found, we really want the version
in sysroot-components. Trying to run tasks to create some special environment
for pseudo is hard and error prone. The simplest fix is to add an RPATH to
the binary so that it can correctly find the sqlite we want.
Unfortunately passing $ORIGIN into make doesn't work so well with shell
quoting so we have to fix that during do_install.
[YOCTO #13814]
(From OE-Core rev: 3937ca9e2dfabb1ce9bce1d536b60b1e2a43739b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Linux system's realpath() remove trailing slashes, but pseudo's doesn't, need
make them identical.
E.g., the following code (rel.c) prints '/tmp' with system's realpath, but
pseudo's realpath prints '/tmp/':
#include <stdio.h>
#include <limits.h>
#include <stdlib.h>
int main() {
char out[PATH_MAX];
printf("%s\n", realpath("/tmp/", out));
return 0;
}
$ bitbake base-passwd -cdevshell # For pseudo env
$ gcc rel.c
$ ./a.out
/tmp/ (but should be /tmp)
This patch fixes the problem.
(From OE-Core rev: 319bbf66e03377adf2db7efa93ef578e3460eb38)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Back in 2010[1] we made pseudo statically link against sqlite3. Since then
the world has changed, pseudo now has separate processes for the database
in the server and the client and they have separate linking commands.
Also, whilst there were concerns about needing specific versions of sqlite3,
in the OE environment, this is always the case.
[1] http://git.yoctoproject.org/cgit.cgi/poky/commit/?id=ad0ac0ecd38fc77daf42485489fccc10a5e1e3e7
The static sqlite3-native is causing us problems, in particular:
tmp/work/x86_64-linux/pseudo-native/1.9.0+gitAUTOINC+060058bb29-r0/recipe-sysroot-native/usr/lib/libsqlite3.a(sqlite3.o):(.data.rel+0xb0): undefined reference to `fcntl64'
which occurs if sqlite3-native was built on a machine with glibc 2.28 or later
and pseudo-native is being built on glibc before that. With dyanmical linking,
libc is backwards compatible and works but with static linking it does not.
There appears to be no easy way to avoid this other than adding a copy of
sqlite3 into the pseudo recipe. Given the static linking doesn't seem to
be required any longer due to the separate processes, drop that to fix
those issues.
(From OE-Core rev: a0c238d40a9cc1f87da0607fddaaef0c31d93720)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Modern distros (e.g. fedora30) are starting to use the new statx() syscall through
the newly exposed glibc wrapper function in software like coreutils (e.g. the ls
command). Add support to intercept this to pseudo.
(From OE-Core rev: 11694eb59bea347085d6e389df0b46826219c0d3)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Move still required entries as COMPATIBLE_HOST_libc-musl = 'null'
to individual recipes.
This also gives users a proper error message when trying to build
a known non-building package.
(From OE-Core rev: 8bbb17d2dcafa9b4e26941a55932f4be2782e1d1)
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
While working with ostree disk generation in conjunction with wic, I
found a problem with pseudo where it tried to resolve a symlink when
it shouldn't, based on openat() flags. A C program has been
constructed to test pseudo to show that it is working properly with
the correct behavior around openat().
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <dirent.h>
#include <unistd.h>
#include <fcntl.h>
int main()
{
/*
* Tested with: gcc -Wall -o app app.c ; echo "no pseudo" ;
* ./app ; echo "pseudo"; pseudo ./app
*/
system("rm -rf tdir tlink");
system("mkdir tdir");
system("ln -s tdir tlink");
DIR *dir = opendir(".");
int dfd = dirfd(dir);
int target_dfd = openat (dfd, "tlink", O_RDONLY | O_NONBLOCK |
O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW);
if (target_dfd == -1) {
printf("Test 1 good\n");
} else {
printf("Test 1 failed\n");
close(target_dfd);
}
target_dfd = openat (dfd, "tlink", O_RDONLY | O_NONBLOCK |
O_DIRECTORY | O_CLOEXEC);
if (target_dfd == -1) {
printf("Test 2 failed\n");
} else {
printf("Test 2 good\n");
close(target_dfd);
}
/* Test 3 make sure the owner of the link is root */
struct stat sbuf;
if (!lstat("tlink", &sbuf) && sbuf.st_uid == 0) {
printf("Test 3 good\n");
} else {
printf("Test 3 failed\n");
}
/* Test 4 tests open with the "rb" flag, owner should not change */
int ofd = openat(dfd,"./tlink", O_RDONLY|O_CLOEXEC);
if (ofd >= 0) {
if (fstat(ofd, &sbuf) != 0)
printf("ERROR in fstat test 4\n");
else if (sbuf.st_uid == 0)
printf("Test 4 good\n");
close(ofd);
} else {
printf("Test 4 failed with openat()\n");
}
/* Test pseudo db to see the fstat() above did not delete the DB entry */
if (!lstat("tlink", &sbuf) && sbuf.st_uid == 0)
printf("Test 5 good\n");
else
printf("Test 5 failed... tlink is owned by %i and not 0\n", sbuf.st_uid);
return 0;
}
int main()
{
/* Tested with: gcc -Wall -o app app.c ; echo "no pseudo" ; ./app ; echo "pseudo"; pseudo ./app */
system("rm -rf tdir tlink");
system("mkdir tdir");
system("ln -s tdir tlink");
DIR *dir = opendir(".");
int dfd = dirfd(dir);
int target_dfd = openat (dfd, "tlink", O_RDONLY | O_NONBLOCK | O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW);
if (target_dfd == -1) {
printf("This is right\n");
} else {
printf("This is broken\n");
}
return 0;
}
Many thanks to Peter Seebach for fixing the problem in the pseudo code
to use the same logic which was already there for the
AT_SYMLINK_NOFOLLOW.
Also updated is the license MD5 checksum since the master branch of
pseudo has had the SPDX data updated.
(From OE-Core rev: a98ea4be5ce19ff380ca500ba1ef3da490ec4556)
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Newer distros are using new versions of glibc and coreutils which use the new glibc
renameat2 function. We need to intercept this for correct functioning of pseudo. This
is essential to ensure new distros continue to work with the project.
Also, this version has a fix for path/inode cross corruption problems which
may explain our mysterious locale permissions issues.
Many thanks to Otavio and Peter Seebach for the help in figuring this out and
fixing it.
(From OE-Core rev: 0fb257121b68f38b40c078150db8f7d0979b7ea5)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If sqlite3 is built with FTS5 it uses log() from libm, it sqlite3 is built
with READLINE it uses tgetent from a curses lib and readline from libreadline,
if it is built using deflate from libz ... , but all that linkage is lost
if we manually statically link so explicitely extract extra static linking
options from pkg-config and force them into pseudo as well.
This commit obsoletes (so include the implicit revert)
e39fec613d pseudo: fix link with new sqlite3
(From OE-Core rev: 042af406583acc091ef82c3d1dcedd41315046de)
Signed-off-by: Jens Rehsack <sno@netbsd.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If sqlite3 is built with FTS5 it uses log() from libm, but that linkage is lost
if we manually statically link so explicitly link to libm.
(From OE-Core rev: b24a67217d82f225e76fbc2dfb70dd8e1a6ea215)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This incorporates two fixes for large inodes, which hopefully solves some of the
rare mysterious behaviour.
(From OE-Core rev: 6921e7f91eb646a2b7b865eccd91552825a4ab78)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* the pseudo.log is significantly shorter with this revision
fddbe85 Fix symlink following errors
3a48dc4 Fix one more stray slash
691a230 Less chatty debugging
0c053e5 Change copyright default.
(From OE-Core rev: 935542f96c0706a6c5f9b0a77fce175733995f49)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This change includes several bug fixes and improvements, including better path
handling (the existance of . and .. for files), handling of the sticky bit, and
syscall renameat2 handling and interception through syscall() which was breaking
coreutils mv operations on fedora27.
[YOCTO #12594]
[YOCTO #12379]
[YOCTO #11643]
(From OE-Core rev: ddbcb88849d5c07a4cbbdc90fa1ab4d369476f8a)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pseudo is using a custom configure script that detects if it shall build with
extended file attribute support or not. The check is done by simply calling
'getfattr' provided by attr-native which is not part of the dependency list.
Due to the recent changes (recipe specific sysroot & cleanup of $PATH) this
call fails now when the recipe is being build for the first time (at least
when being build for nativesdk case). Explicitly setting up a dependency to
attr-native just to satisfy configure would be wrong also since the real
dependency is to attr/nativesdk-attr which are already part of the dependency
list (see DEPENDS). Therefore bypass the test in the configure by explicitly
enabling xattr using a configure option available in any case.
(From OE-Core rev: a7381eb16ba2183ed990a009bb8e82b4702f3d98)
Signed-off-by: Andreas Kaufmann <andreas.kaufmann.79@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This changes the pseudo FASTOP functionality so that a reply to the
operation is required. This means we then cannot lose data if a connection
is closed. This in turn stops corruption if we run out of file handles
and have to close connections.
This tweaks the connection closure patch to update the comment there which
is now outdated.
(From OE-Core rev: eb49d50b4c342069087886f2aac546805647c066)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If we have large amounts of parallelism, pseudo can end up with too
many open connections and will no longer accept further connections,
hanging. This patch works around that by closing some clients, allowing
turnover of connections and unblocking the system. The downside is a small
but theoretical window of data loss. This is likely better than locking
up entirely though. Discussions with Peter are onging about how we could
better fix this.
(From OE-Core rev: f3589f154dad1c92e599737623d392508810ae7e)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport fixes from pseudo master for an acl issue and more importantly, a segfault
issue with bash which can be triggered by the recent useradd changes.
(From OE-Core rev: 949214761998a93fc6b8b009f1cdad0db3bfa5db)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently there are multiple issues with useradd:
* If base-passwd rebuilds, it wipes out recipe specific user/group additions
to sysroots and causes errors
* If recipe A adds a user and recipe B depends on A, it can't see any of the
users/groups A adds.
This patch changes base-passwd so it always works as a postinst script
within the sysroot and copies in the master files, then runs any
postinst-useradd-* scripts afterwards to add additional user/groups.
The postinst-useradd-* scripts are tweaked so that if /etc/passwd doesn't exist
they just exit, knowning they'll be executed later. We also add a dummy entry to
the dummy passwd file from pseudo so we can avoid this too.
There is a problem where if recipe A adds a user and recipe B depends on A but
doesn't care about users, it may not have a dependency on the useradd/groupadd
tools which would therefore not be available in B's sysroot. We therefore also
tweak postinst-useradd-* scripts so that if the tools aren't present we simply
don't add users. If you need the users, you add a dependency on the tools in the
recipe and they'll be added.
We add postinst-* to SSTATE_SCAN_FILES since almost any postinst script of this
kind is going to need relocation help.
We also ensure that the postinst-useradd script is written into the sstate
object as the current script was only being added in a recipe local way.
Thanks to Peter Kjellerstedt <pkj@axis.com> and Patrick Ohly for some pieces
of this patch.
[Yocto #11124]
(From OE-Core rev: 1b5afaf437f7a1107d4edca8eeb668b9618a5488)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update to the newly minted 1.8.2, dropping several patches we'd
backported since the last release.
(From OE-Core rev: 6437f14c9177fd7ec7a9b6bca873362b0c94abfb)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
pseudo_1.8.1.bb gets the backported patch and pseudo_git.bb gets
updated to include the commit.
(From OE-Core rev: 4e98f3a6e6f61d9d9037ac828b9c4869f7e11458)
Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
renameat calls under pseudo were losing extended attributes.
Backport the fix for this from pseudo upstream.
[YOCTO '10349]
(From OE-Core rev: 16f6b020ebea49f012f2e65997a8d464f94d6605)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When the client spawns a pseudo server, it starts out sending diagnostics
to stderr. This can be spammy in some cases with races during startup;
everything resolves, but we get scary-looking diagnostics. So shove
those into a log file.
(From OE-Core rev: efd0b0f604f9f498b9c20bc9a25708c493aa4f4a)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In a heavily loaded container, the child process might not started
before the parent process had terminated. The child process attempts to
signal the parent with SIGUSR1. If the parent had terminated, the
parent becomes PID 1, which is generally init. When it signaled pid 1,
it caused the docker mini-init to terminate.
This doesn't happen in a traditional system, as systemd/sysvinit is
protected to only root users can signal it.
[YOCTO #10324]
(From OE-Core rev: f6f13b049e8683d2a2af3e120ba979b58f9a7d9a)
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
