mirror of
https://github.com/troglobit/finit.git
synced 2026-10-08 16:34:45 +07:00
Joachim Wiberg
61b0e0f3e6
Apply a PAM session to run/task/sysv/services Finit starts, pam_limits
above all, so a service running as a given user picks up that user's
limits the way a login does.
Add a new `pam` setting for the new block format (only), like the
per-service directories, naming a file in /etc/pam.d:
service weston {
user = "weston"
pam = "weston-autologin"
command = "/usr/bin/weston --continue-without-input"
}
pam_close_session() has to be called by a process still holding the
handle, and the handle does not survive exec(). Hence the keeper: it
holds the handle, drops to the service's credentials, and waits for a
parent-death signal before closing the session. Same shape as
systemd's (sd-pam), for the same reason, and one per fork, so the
script hooks open and close their own.
The keeper closes the descriptors it inherited from Finit and only
those. Closing everything would also take out what pam_open_session()
opened for itself, a keyring fd or a lock file, and leave the modules
to close a session with those pulled out from under them. Closing
nothing, as (sd-pam) does, would leave it holding the write end of the
notify pipe for the service's whole lifetime and starve notify = "s6"
services of their ready signal. So the fds open before pam_start()
are snapshotted and exactly those are closed, while the ones PAM opens
after are marked close-on-exec so the daemon does not inherit them
either.
A refused value, a denied account stack, an uninstalled pam.d file,
and a build without PAM support all keep the service from starting
rather than running it with the stacks skipped: one that quietly loses
pam_limits and its private /tmp, with nothing said. Capabilities a
module like pam_cap.so granted are merged into the IAB Finit applies
instead of being replaced by it, which only helps a service that also
sets capabilities, the other arm being a plain setuid() with nothing
left to restore once permitted is empty.
The test sysroot gains pam_permit.so, pam_deny.so and pam_limits.so,
which ldd cannot see, libpam dlopen()s them, and the test skips when
the host has none to stage. The negative cases pin the exit status
rather than only asserting crashed, which serv reports for any early
exit, so a bad command or an unwritable pidfile cannot pass for a
rejected session.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
190 lines
7.2 KiB
YAML
190 lines
7.2 KiB
YAML
name: Bob the Builder
|
|
|
|
# Run on all branches, including all pull requests, except the 'dev'
|
|
# branch since that's where we run Coverity Scan (limited tokens/day)
|
|
on:
|
|
push:
|
|
branches:
|
|
- '**'
|
|
- '!dev'
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, labeled]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
fuzz:
|
|
name: fuzz
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name != 'push' || github.ref == 'refs/heads/master'
|
|
steps:
|
|
- name: Install dependencies
|
|
run: |
|
|
sudo apt-get -y update
|
|
sudo apt-get -y install pkg-config libconfuse-dev clang libblkid-dev
|
|
# clang picks the newest gcc tree it finds and needs the
|
|
# matching libstdc++ headers to link the fuzzer runtime
|
|
sudo apt-get -y install libstdc++-14-dev || true
|
|
wget https://github.com/troglobit/libuev/releases/download/v2.4.1/libuev-2.4.1.tar.xz
|
|
wget https://github.com/troglobit/libite/releases/download/v2.6.2/libite-2.6.2.tar.gz
|
|
tar xf libuev-2.4.1.tar.xz
|
|
tar xf libite-2.6.2.tar.gz
|
|
(cd libuev-2.4.1 && ./configure && make -j9 && sudo make install-strip)
|
|
(cd libite-2.6.2 && ./configure && make -j9 && sudo make install-strip)
|
|
sudo ldconfig
|
|
- uses: actions/checkout@v7
|
|
- name: Configure
|
|
run: |
|
|
./autogen.sh
|
|
./configure --prefix=/usr --exec-prefix= --sysconfdir=/etc --localstatedir=/var
|
|
- name: Build fuzz target
|
|
run: |
|
|
clang -fsanitize=fuzzer,address -DLINK_FUZZ_LIBFUZZER -D_GNU_SOURCE \
|
|
-I libink -I . -o fuzz-msg-parse \
|
|
test/src/fuzz-msg-parse.c libink/*.c
|
|
# Restores the newest corpus and saves a fresh one, since a cache
|
|
# entry is immutable once written. Caches made on a branch are
|
|
# private to it, so the corpus that accumulates on master is what
|
|
# pull requests start from, rather than nothing.
|
|
- name: Restore corpus
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: .fuzz-corpus
|
|
key: fuzz-corpus-${{ github.run_id }}
|
|
restore-keys: fuzz-corpus-
|
|
- name: Fuzz
|
|
run: |
|
|
mkdir -p .fuzz-corpus
|
|
./fuzz-msg-parse .fuzz-corpus -max_total_time=120 -max_len=4096 \
|
|
-print_final_stats=1
|
|
# Without this the corpus only ever grows, and most of what it
|
|
# accumulates reaches code some earlier input already reached.
|
|
- name: Minimise corpus
|
|
if: always()
|
|
run: |
|
|
mkdir -p .fuzz-corpus-min
|
|
./fuzz-msg-parse -merge=1 .fuzz-corpus-min .fuzz-corpus
|
|
rm -rf .fuzz-corpus
|
|
mv .fuzz-corpus-min .fuzz-corpus
|
|
echo "corpus: $(ls .fuzz-corpus | wc -l) inputs"
|
|
- name: Upload crashers
|
|
if: failure()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: fuzz-crashers
|
|
path: |
|
|
crash-*
|
|
leak-*
|
|
timeout-*
|
|
if-no-files-found: ignore
|
|
|
|
build:
|
|
# Verify we can build on latest Ubuntu with both gcc and clang
|
|
name: ${{ matrix.compiler }}
|
|
runs-on: ubuntu-latest
|
|
# Skip redundant builds for PRs - prefer PR builds over push builds
|
|
if: github.event_name != 'push' || github.ref == 'refs/heads/master'
|
|
strategy:
|
|
matrix:
|
|
compiler: [gcc, clang]
|
|
fail-fast: false
|
|
env:
|
|
CC: ${{ matrix.compiler }}
|
|
steps:
|
|
- name: Install dependencies
|
|
run: |
|
|
sudo apt-get -y update
|
|
sudo apt-get -y install pkg-config tree jq libcap-dev libconfuse-dev libblkid-dev libpam0g-dev
|
|
wget https://github.com/troglobit/libuev/releases/download/v2.4.1/libuev-2.4.1.tar.xz
|
|
wget https://github.com/troglobit/libite/releases/download/v2.6.2/libite-2.6.2.tar.gz
|
|
tar xf libuev-2.4.1.tar.xz
|
|
tar xf libite-2.6.2.tar.gz
|
|
(cd libuev-2.4.1 && ./configure && make -j9 && sudo make install-strip)
|
|
(cd libite-2.6.2 && ./configure && make -j9 && sudo make install-strip)
|
|
sudo ldconfig
|
|
- uses: actions/checkout@v7
|
|
- name: Static Finit
|
|
run: |
|
|
./autogen.sh
|
|
./configure --prefix= --enable-static
|
|
make -j9 V=1
|
|
- name: Regular Finit
|
|
run: |
|
|
./configure --prefix=/usr --exec-prefix= --sysconfdir=/etc --localstatedir=/var \
|
|
--enable-x11-common-plugin --enable-testserv-plugin \
|
|
CFLAGS="-fsanitize=address -ggdb"
|
|
make -j9 clean
|
|
make -j9 V=1
|
|
- name: Install to /tmp
|
|
run: |
|
|
DESTDIR=/tmp make install-strip
|
|
tree /tmp || true
|
|
- name: Check dependencies
|
|
run: |
|
|
ldd /tmp/sbin/finit
|
|
size /tmp/sbin/finit
|
|
ldd /tmp/sbin/initctl
|
|
size /tmp/sbin/initctl
|
|
ldd /tmp/sbin/reboot
|
|
size /tmp/sbin/reboot
|
|
- name: Verify starting and showing usage text
|
|
run: |
|
|
sudo /tmp/sbin/finit -h
|
|
sudo /tmp/sbin/initctl -h
|
|
- name: Enable unprivileged userns (unshare)
|
|
run: |
|
|
sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0
|
|
- name: Run Unit Tests
|
|
run: |
|
|
make -j1 check || (cat test/test-suite.log; false)
|
|
- name: Upload Test Results
|
|
if: always()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: finit-test-${{ matrix.compiler }}
|
|
path: test/*.log
|
|
|
|
no-dbus:
|
|
# The D-Bus support is default-enabled, so the HAVE_DBUS paths in
|
|
# initctl and finit only bit-rot silently without this leg.
|
|
name: no-dbus
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name != 'push' || github.ref == 'refs/heads/master'
|
|
steps:
|
|
- name: Install dependencies
|
|
run: |
|
|
sudo apt-get -y update
|
|
sudo apt-get -y install pkg-config tree jq libcap-dev libconfuse-dev libblkid-dev
|
|
wget https://github.com/troglobit/libuev/releases/download/v2.4.1/libuev-2.4.1.tar.xz
|
|
wget https://github.com/troglobit/libite/releases/download/v2.6.2/libite-2.6.2.tar.gz
|
|
tar xf libuev-2.4.1.tar.xz
|
|
tar xf libite-2.6.2.tar.gz
|
|
(cd libuev-2.4.1 && ./configure && make -j9 && sudo make install-strip)
|
|
(cd libite-2.6.2 && ./configure && make -j9 && sudo make install-strip)
|
|
sudo ldconfig
|
|
- uses: actions/checkout@v7
|
|
- name: Build without D-Bus
|
|
run: |
|
|
./autogen.sh
|
|
./configure --prefix=/usr --exec-prefix= --sysconfdir=/etc --localstatedir=/var \
|
|
--disable-dbus --enable-testserv-plugin
|
|
make -j9 V=1
|
|
- name: Verify no bus artifacts
|
|
run: |
|
|
DESTDIR=/tmp make install-strip
|
|
! strings /tmp/sbin/initctl | grep -q finit/bus
|
|
! strings /tmp/sbin/finit | grep -q org.finit
|
|
- name: Enable unprivileged userns (unshare)
|
|
run: |
|
|
sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0
|
|
- name: Smoke test
|
|
run: |
|
|
make -C test setup-chroot
|
|
make -j1 -C test check TESTS='start-stop-serv.sh' \
|
|
|| (cat test/test-suite.log; false)
|