morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-15 00:47:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

mountfsd: allow privileged users to mount bare unprotected filesystems (#39411)

Browse Source 
Split from https://github.com/systemd/systemd/pull/39394 as that
requires deeper rework that will take more time
This commit is contained in:
Yu Watanabe
2025-10-24 09:40:52 +09:00
committed by GitHub
parent f4072a9da2 e84aa21af8
commit fe5625cbba
3 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
test/units/TEST-50-DISSECT.mountfsd.sh
View File

@@ -93,6 +93,15 @@ if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then
mv /tmp/app0.roothash.p7s.bak /tmp/app0.roothash.p7s
fi
# Bare squashfs without any verity or signature also should be rejected, even if we ask to trust it
(! systemd-run -M testuser@ --user --pipe --wait \
--property ExtensionImages=/tmp/app1.raw \
true)
(! systemd-run -M testuser@ --user --pipe --wait \
--property ExtensionImages=/tmp/app1.raw \
--property ExtensionImagePolicy=root=verity+signed+unprotected+absent:usr=verity+signed+unprotected+absent \
true)
# Install key in keychain
mkdir -p /run/verity.d
cp /tmp/test-50-unpriv-cert.crt /run/verity.d/