New upstream version 2022.7

src/libostree/libostree-devel.sym

@@ -20,7 +20,6 @@
    - uncomment the include in Makefile-libostree.am
 */
 
-
 /* Stub section for the stable release *after* this development one; don't
  * edit this other than to update the year.  This is just a copy/paste
  * source.  Replace $LASTSTABLE with the last stable version, and $NEWVERSION

src/libostree/libostree-released.sym

@@ -689,6 +689,13 @@ global:
   ostree_sysroot_deployment_set_kargs_in_place;
 } LIBOSTREE_2022.4;
 
+LIBOSTREE_2022.7 {
+global:
+  ostree_kernel_args_contains;
+  ostree_kernel_args_delete_if_present;
+  ostree_sysroot_initialize_with_mount_namespace;
+} LIBOSTREE_2022.5;
+
 /* NOTE: Only add more content here in release commits!  See the
  * comments at the top of this file.
  */

src/libostree/ostree-bootloader-zipl.c

@@ -273,7 +273,8 @@ _ostree_secure_execution_generate_initrd (const gchar *initrd,
     return glnx_prefix_error (error, "s390x SE: opening new ramdisk");
   {
     glnx_autofd int fd = -1;
-    glnx_openat_rdonly (AT_FDCWD, initrd, TRUE, &fd, error);
+    if (!glnx_openat_rdonly (AT_FDCWD, initrd, TRUE, &fd, error))
+      return glnx_prefix_error (error, "s390x SE: opening initrd");
     if (glnx_regfile_copy_bytes (fd, out_initrd->fd, (off_t) -1) < 0)
       return glnx_throw_errno_prefix (error, "s390x SE: copying ramdisk");
   }

src/libostree/ostree-fetcher-util.c

@@ -239,6 +239,7 @@ _ostree_fetcher_should_retry_request (const GError *error,
       g_error_matches (error, G_IO_ERROR, G_IO_ERROR_HOST_NOT_FOUND) ||
       g_error_matches (error, G_IO_ERROR, G_IO_ERROR_HOST_UNREACHABLE) ||
       g_error_matches (error, G_IO_ERROR, G_IO_ERROR_PARTIAL_INPUT) ||
+      g_error_matches (error, G_IO_ERROR, G_IO_ERROR_BUSY) ||
 #if !GLIB_CHECK_VERSION(2, 44, 0)
       g_error_matches (error, G_IO_ERROR, G_IO_ERROR_BROKEN_PIPE) ||
 #else
@@ -269,6 +270,8 @@ _ostree_fetcher_http_status_code_to_io_error (guint status_code)
       return G_IO_ERROR_NOT_FOUND;
     case 408:  /* SOUP_STATUS_REQUEST_TIMEOUT */
       return G_IO_ERROR_TIMED_OUT;
+    case 500:  /* SOUP_STATUS_INTERNAL_SERVER_ERROR */
+      return G_IO_ERROR_BUSY;
     default:
       return G_IO_ERROR_FAILED;
     }

src/libostree/ostree-kernel-args.c

@@ -820,12 +820,53 @@ void
 ostree_kernel_args_append_if_missing (OstreeKernelArgs  *kargs,
                                       const char *arg)
 {
-  g_autofree char *key = g_strdup (arg);
-  split_keyeq (key);
- 
   // Don't insert a duplicate key.
-  if (g_hash_table_contains (kargs->table, key))
+  if (ostree_kernel_args_contains (kargs, arg))
     return;
  
   ostree_kernel_args_append (kargs, arg);
 }
+
+/**
+ * ostree_kernel_args_contains:
+ * @kargs: a OstreeKernelArgs instance
+ * @arg: key or key/value pair to check
+ *
+ * Search for @arg which is in the form of key=value pair at the hash table kargs->table
+ * and returns true if finds it.
+ *
+ *Returns: %TRUE if @arg is contained in @kargs, %FALSE otherwise.
+ *
+ * Since: 2022.7
+ **/
+gboolean
+ostree_kernel_args_contains (OstreeKernelArgs  *kargs,
+                             const char *arg)
+{
+  g_autofree char *key = g_strdup (arg);
+  split_keyeq (key);
+
+  return g_hash_table_contains (kargs->table, key);
+}
+
+/**
+ * ostree_kernel_args_delete_if_present:
+ * @kargs: a OstreeKernelArgs instance
+ * @arg: key or key/value pair to be deleted
+ * @error: an GError instance
+ *
+ * Deletes @arg which is in the form of key=value pair from the hash table kargs->table.
+ *
+ * Returns: %TRUE on success, %FALSE on failure
+ *
+ * Since: 2022.7
+ **/
+gboolean
+ostree_kernel_args_delete_if_present (OstreeKernelArgs  *kargs,
+                                      const char        *arg,
+                                      GError           **error)
+{
+  if (ostree_kernel_args_contains (kargs, arg))
+    return ostree_kernel_args_delete (kargs, arg, error);
+  return TRUE;
+}

src/libostree/ostree-kernel-args.h

@@ -134,4 +134,12 @@ _OSTREE_PUBLIC
 void ostree_kernel_args_append_if_missing (OstreeKernelArgs *kargs, 
                                            const char *arg);
 
+_OSTREE_PUBLIC
+gboolean ostree_kernel_args_contains (OstreeKernelArgs *kargs,
+                                      const char *arg);
+
+_OSTREE_PUBLIC
+gboolean ostree_kernel_args_delete_if_present (OstreeKernelArgs *kargs,
+                                               const char       *arg,
+                                               GError          **error);
 G_END_DECLS

src/libostree/ostree-repo-checkout.c

@@ -684,7 +684,7 @@ _checkout_overlayfs_whiteout_at (OstreeRepo                     *repo,
 
             if (uid != dest_stbuf.st_uid)
               return glnx_throw(error, "existing destination file %s does not match uid %d",
-                                destination_name, gid);
+                                destination_name, uid);
 
             if ((file_mode & ALLPERMS) != (dest_stbuf.st_mode & ALLPERMS))
               return glnx_throw(error, "existing destination file %s does not match mode %o",

src/libostree/ostree-repo-commit.c

@@ -4858,7 +4858,7 @@ _ostree_repo_import_object (OstreeRepo           *self,
 static OstreeRepoTransactionStats *
 ostree_repo_transaction_stats_copy (OstreeRepoTransactionStats *stats)
 {
-  return g_memdup (stats, sizeof (OstreeRepoTransactionStats));
+  return g_memdup2 (stats, sizeof (OstreeRepoTransactionStats));
 }
 
 static void

src/libostree/ostree-repo-pull.c

@@ -4712,6 +4712,7 @@ ostree_repo_pull_with_options (OstreeRepo             *self,
             !load_remote_repo_config (pull_data, &remote_config, cancellable, error))
           goto out;
 
+        g_clear_pointer (&remote_mode_str, g_free);
         if (!ot_keyfile_get_value_with_default (remote_config, "core", "mode", "bare",
                                                 &remote_mode_str, error))
           goto out;

src/libostree/ostree-repo-refs.c

@@ -36,7 +36,8 @@ add_ref_to_set (const char       *remote,
                 GCancellable     *cancellable,
                 GError          **error)
 {
-  g_return_val_if_fail (remote == NULL || collection_id == NULL, FALSE);
+  if (remote != NULL && collection_id != NULL)
+    return glnx_throw (error, "Cannot process both a remote and a collection ID");
 
   gsize len;
   char *contents = glnx_file_get_contents_utf8_at (base_fd, path, &len, cancellable, error);

src/libostree/ostree-repo-static-delta-compilation.c

@@ -1334,9 +1334,9 @@ get_fallback_headers (OstreeRepo               *self,
  *   - inline-parts: b: Put part data in header, to get a single file delta.  Default FALSE.
  *   - verbose: b: Print diagnostic messages.  Default FALSE.
  *   - endianness: b: Deltas use host byte order by default; this option allows choosing (G_BIG_ENDIAN or G_LITTLE_ENDIAN)
- *   - filename: ay: Save delta superblock to this filename, and parts in the same directory.  Default saves to repository.
- *   - sign-name: ay: Signature type to use.
- *   - sign-key-ids: as: Array of keys used to sign delta superblock.
+ *   - filename: ^ay: Save delta superblock to this filename (bytestring), and parts in the same directory.  Default saves to repository.
+ *   - sign-name: ^ay: Signature type to use (bytestring).
+ *   - sign-key-ids: ^as: NULL-terminated array of keys used to sign delta superblock.
  */
 gboolean
 ostree_repo_static_delta_generate (OstreeRepo                   *self,
@@ -1409,9 +1409,13 @@ ostree_repo_static_delta_generate (OstreeRepo                   *self,
 
   if (!g_variant_lookup (params, "filename", "^&ay", &opt_filename))
     opt_filename = NULL;
+  else if (opt_filename[0] == '\0')
+    return glnx_throw (error, "Invalid 'filename' parameter");
 
   if (!g_variant_lookup (params, "sign-name", "^&ay", &opt_sign_name))
     opt_sign_name = NULL;
+  else if (opt_sign_name[0] == '\0')
+    return glnx_throw (error, "Invalid 'sign-name' parameter");
 
   if (!g_variant_lookup (params, "sign-key-ids", "^a&s", &opt_key_ids))
     opt_key_ids = NULL;

src/libostree/ostree-sign-ed25519.c

@@ -124,7 +124,7 @@ gboolean ostree_sign_ed25519_data (OstreeSign *self,
                                    GError **error)
 {
 
-  g_return_val_if_fail (OSTREE_IS_SIGN (self), FALSE);
+  g_assert (OSTREE_IS_SIGN (self));
   OstreeSignEd25519 *sign = _ostree_sign_ed25519_get_instance_private(OSTREE_SIGN_ED25519(self));
 
 #ifdef HAVE_LIBSODIUM
@@ -170,8 +170,10 @@ gboolean ostree_sign_ed25519_data_verify (OstreeSign *self,
                                           char      **out_success_message,
                                           GError     **error)
 {
-  g_return_val_if_fail (OSTREE_IS_SIGN (self), FALSE);
-  g_return_val_if_fail (data != NULL, FALSE);
+  g_assert (OSTREE_IS_SIGN (self));
+
+  if (data == NULL)
+    return glnx_throw (error, "ed25519: unable to verify NULL data");
 
   OstreeSignEd25519 *sign = _ostree_sign_ed25519_get_instance_private(OSTREE_SIGN_ED25519(self));
 
@@ -274,7 +276,7 @@ gboolean ostree_sign_ed25519_data_verify (OstreeSign *self,
 
 const gchar * ostree_sign_ed25519_get_name (OstreeSign *self)
 {
-  g_return_val_if_fail (OSTREE_IS_SIGN (self), FALSE);
+  g_assert (OSTREE_IS_SIGN (self));
 
   return OSTREE_SIGN_ED25519_NAME;
 }
@@ -294,7 +296,7 @@ const gchar * ostree_sign_ed25519_metadata_format (OstreeSign *self)
 gboolean ostree_sign_ed25519_clear_keys (OstreeSign *self,
                                          GError **error)
 {
-  g_return_val_if_fail (OSTREE_IS_SIGN (self), FALSE);
+  g_assert (OSTREE_IS_SIGN (self));
 
   OstreeSignEd25519 *sign = _ostree_sign_ed25519_get_instance_private(OSTREE_SIGN_ED25519(self));
 
@@ -338,8 +340,7 @@ gboolean ostree_sign_ed25519_set_sk (OstreeSign *self,
                                      GVariant *secret_key,
                                      GError **error)
 {
-  g_return_val_if_fail (OSTREE_IS_SIGN (self), FALSE);
-
+  g_assert (OSTREE_IS_SIGN (self));
 
   if (!ostree_sign_ed25519_clear_keys (self, error))
     return FALSE;
@@ -380,7 +381,7 @@ gboolean ostree_sign_ed25519_set_pk (OstreeSign *self,
                                      GVariant *public_key,
                                      GError **error)
 {
-  g_return_val_if_fail (OSTREE_IS_SIGN (self), FALSE);
+  g_assert (OSTREE_IS_SIGN (self));
 
   if (!ostree_sign_ed25519_clear_keys (self, error))
     return FALSE;
@@ -396,7 +397,7 @@ gboolean ostree_sign_ed25519_add_pk (OstreeSign *self,
                                      GVariant *public_key,
                                      GError **error)
 {
-  g_return_val_if_fail (OSTREE_IS_SIGN (self), FALSE);
+  g_assert (OSTREE_IS_SIGN (self));
 
   OstreeSignEd25519 *sign = _ostree_sign_ed25519_get_instance_private(OSTREE_SIGN_ED25519(self));
 
@@ -429,7 +430,7 @@ gboolean ostree_sign_ed25519_add_pk (OstreeSign *self,
 
   if (g_list_find_custom (sign->public_keys, key, _compare_ed25519_keys) == NULL)
     {
-      gpointer newkey = g_memdup (key, n_elements);
+      gpointer newkey = g_memdup2 (key, n_elements);
       sign->public_keys = g_list_prepend (sign->public_keys, newkey);
     }
 
@@ -444,7 +445,7 @@ _ed25519_add_revoked (OstreeSign *self,
                       GVariant *revoked_key,
                       GError **error)
 {
-  g_return_val_if_fail (OSTREE_IS_SIGN (self), FALSE);
+  g_assert (OSTREE_IS_SIGN (self));
 
   if (!g_variant_is_of_type (revoked_key, G_VARIANT_TYPE_STRING))
     return glnx_throw (error, "Unknown ed25519 revoked key type");
@@ -465,7 +466,7 @@ _ed25519_add_revoked (OstreeSign *self,
 
   if (g_list_find_custom (sign->revoked_keys, key, _compare_ed25519_keys) == NULL)
     {
-      gpointer newkey = g_memdup (key, n_elements);
+      gpointer newkey = g_memdup2 (key, n_elements);
       sign->revoked_keys = g_list_prepend (sign->revoked_keys, newkey);
     }
 
@@ -480,7 +481,9 @@ _load_pk_from_stream (OstreeSign *self,
                       gboolean trusted,
                       GError **error)
 {
-  g_return_val_if_fail (key_data_in, FALSE);
+  if (key_data_in == NULL)
+    return glnx_throw (error, "ed25519: unable to read from NULL key-data input stream");
+
 #ifdef HAVE_LIBSODIUM
   gboolean ret = FALSE;
 

src/libostree/ostree-sysroot-deploy.c

@@ -2987,12 +2987,12 @@ sysroot_finalize_deployment (OstreeSysroot     *self,
       if (!merge_configuration_from (self, merge_deployment, deployment, deployment_dfd,
                                      cancellable, error))
         return FALSE;
-    }
 
 #ifdef HAVE_SELINUX
-  if (!sysroot_finalize_selinux_policy(deployment_dfd, error))
-    return FALSE;
+      if (!sysroot_finalize_selinux_policy (deployment_dfd, error))
+        return FALSE;
 #endif /* HAVE_SELINUX */
+    }
 
   const char *osdeploypath = glnx_strjoina ("ostree/deploy/", ostree_deployment_get_osname (deployment));
   glnx_autofd int os_deploy_dfd = -1;

src/libostree/ostree-sysroot.c

@@ -259,6 +259,63 @@ ostree_sysroot_set_mount_namespace_in_use (OstreeSysroot  *self)
   self->mount_namespace_in_use = TRUE;
 }
 
+/**
+ * ostree_sysroot_initialize_with_mount_namespace:
+ *
+ * Prepare the current process for modifying a booted sysroot, if applicable.
+ * This function subsumes the functionality of `ostree_sysroot_initialize`
+ * and may be invoked wherever that function is.
+ *
+ * If the sysroot does not appear to be booted, or where the current process is not uid 0,
+ * this function returns successfully.
+ *
+ * Otherwise, if the process is in the same mount namespace as pid 1, create
+ * a new namespace.
+ *
+ * If you invoke this function, it must be before ostree_sysroot_load(); it may
+ * be invoked before or after ostree_sysroot_initialize().
+ *
+ * Since: 2022.7
+ */
+gboolean
+ostree_sysroot_initialize_with_mount_namespace (OstreeSysroot *self, GCancellable *cancellable, GError **error)
+{
+  GLNX_AUTO_PREFIX_ERROR ("Initializing with mountns", error);
+  /* Must be before we're loaded, as otherwise we'd have to close/reopen all our
+     fds, e.g. the repo */
+  g_assert (self->loadstate < OSTREE_SYSROOT_LOAD_STATE_LOADED);
+
+  if (!ostree_sysroot_initialize (self, error))
+    return FALSE;
+
+  /* Do nothing if we're not privileged */
+  if (getuid () != 0)
+    return TRUE;
+
+  /* We also assume operating on non-booted roots won't have a readonly sysroot */
+  if (!self->root_is_ostree_booted)
+    return TRUE;
+
+  g_autofree char *mntns_pid1 =
+    glnx_readlinkat_malloc (AT_FDCWD, "/proc/1/ns/mnt", cancellable, error);
+  if (!mntns_pid1)
+    return glnx_prefix_error (error, "Reading /proc/1/ns/mnt");
+  g_autofree char *mntns_self =
+    glnx_readlinkat_malloc (AT_FDCWD, "/proc/self/ns/mnt", cancellable, error);
+  if (!mntns_self)
+    return glnx_prefix_error (error, "Reading /proc/self/ns/mnt");
+
+  // If the mount namespaces are the same, we need to unshare().
+  if (strcmp (mntns_pid1, mntns_self) == 0)
+    { 
+      if (unshare (CLONE_NEWNS) < 0)
+        return glnx_throw_errno_prefix (error, "Failed to invoke unshare(CLONE_NEWNS)");
+    }
+
+  ostree_sysroot_set_mount_namespace_in_use (self);
+  return TRUE;
+}
+
 /**
  * ostree_sysroot_get_path:
  * @self: Sysroot

src/libostree/ostree-sysroot.h

@@ -50,6 +50,9 @@ OstreeSysroot* ostree_sysroot_new_default (void);
 _OSTREE_PUBLIC
 void ostree_sysroot_set_mount_namespace_in_use (OstreeSysroot  *self);
 
+_OSTREE_PUBLIC
+gboolean ostree_sysroot_initialize_with_mount_namespace (OstreeSysroot *self, GCancellable *cancellable, GError **error);
+
 _OSTREE_PUBLIC
 GFile *ostree_sysroot_get_path (OstreeSysroot *self);
 

src/libostree/ostree-version.h

@@ -41,7 +41,7 @@
  *
  * Since: 2017.4
  */
-#define OSTREE_RELEASE_VERSION (6)
+#define OSTREE_RELEASE_VERSION (7)
 
 /**
  * OSTREE_VERSION
@@ -50,7 +50,7 @@
  *
  * Since: 2017.4
  */
-#define OSTREE_VERSION (2022.6)
+#define OSTREE_VERSION (2022.7)
 
 /**
  * OSTREE_VERSION_S:
@@ -60,7 +60,7 @@
  *
  * Since: 2017.4
  */
-#define OSTREE_VERSION_S "2022.6"
+#define OSTREE_VERSION_S "2022.7"
 
 #define OSTREE_ENCODE_VERSION(year,release) \
         ((year) << 16 | (release))
@@ -99,5 +99,5 @@
  * Since: 2019.3
  */
 #ifndef __GI_SCANNER__
-#define OSTREE_BUILT_FEATURES "libsoup gpgme ex-fsverity libarchive selinux avahi libmount systemd release p2p"
+#define OSTREE_BUILT_FEATURES "libsoup gpgme ex-fsverity libarchive selinux libmount systemd release p2p"
 #endif

src/libotutil/ot-checksum-utils.c

@@ -249,7 +249,7 @@ ot_gio_splice_get_checksum (GOutputStream  *out,
   guint8 digest[_OSTREE_SHA256_DIGEST_LEN];
   ot_checksum_get_digest (&checksum, digest, sizeof (digest));
   if (out_csum)
-    *out_csum = g_memdup (digest, sizeof (digest));
+    *out_csum = g_memdup2 (digest, sizeof (digest));
   return TRUE;
 }
 

src/libotutil/ot-variant-utils.c

@@ -43,7 +43,7 @@ GVariant *
 ot_gvariant_new_bytearray (const guchar   *data,
                            gsize           len)
 {
-  gpointer data_copy = g_memdup (data, len);
+  gpointer data_copy = g_memdup2 (data, len);
   GVariant *ret = g_variant_new_from_data (G_VARIANT_TYPE ("ay"), data_copy,
                                  len, FALSE, g_free, data_copy);
   return ret;

src/ostree/ot-builtin-commit.c

@@ -105,7 +105,7 @@ static GOptionEntry options[] = {
   { "base", 0, 0, G_OPTION_ARG_STRING, &opt_base, "Start from the given commit as a base (no modifiers apply)", "REV" },
   { "tree", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_trees, "Overlay the given argument as a tree", "dir=PATH or tar=TARFILE or ref=COMMIT" },
   { "add-metadata-string", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_metadata_strings, "Add a key/value pair to metadata", "KEY=VALUE" },
-  { "add-metadata", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_metadata_variants, "Add a key/value pair to metadata, where the KEY is a string, an VALUE is g_variant_parse() formatted", "KEY=VALUE" },
+  { "add-metadata", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_metadata_variants, "Add a key/value pair to metadata, where the KEY is a string, and VALUE is in GVariant Text Format", "KEY=VALUE" },
   { "keep-metadata", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_metadata_keep, "Keep metadata KEY and its associated VALUE from parent", "KEY" },
   { "add-detached-metadata-string", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_detached_metadata_strings, "Add a key/value pair to detached metadata", "KEY=VALUE" },
   { "owner-uid", 0, 0, G_OPTION_ARG_INT, &opt_owner_uid, "Set file ownership user id", "UID" },

src/ostree/ot-builtin-pull-local.c

@@ -211,7 +211,7 @@ ostree_builtin_pull_local (int argc, char **argv, OstreeCommandInvocation *invoc
     if (!console.is_tty)
       {
         g_assert (progress);
-        const char *status = ostree_async_progress_get_status (progress);
+        g_autofree char *status = ostree_async_progress_get_status (progress);
         if (status)
           g_print ("%s\n", status);
       }

src/ostree/ot-builtin-pull.c

@@ -389,7 +389,7 @@ ostree_builtin_pull (int argc, char **argv, OstreeCommandInvocation *invocation,
     if (!console.is_tty && !opt_dry_run)
       {
         g_assert (progress);
-        const char *status = ostree_async_progress_get_status (progress);
+        g_autofree char *status = ostree_async_progress_get_status (progress);
         if (status)
           g_print ("%s\n", status);
       }

src/ostree/ot-main.c

@@ -586,23 +586,9 @@ ostree_admin_sysroot_load (OstreeSysroot            *sysroot,
 {
   if ((flags & OSTREE_ADMIN_BUILTIN_FLAG_UNLOCKED) == 0)
     {
-      /* If we're requested to lock the sysroot, first check if we're operating
-       * on a booted (not physical) sysroot.  Then find out if the /sysroot
-       * subdir is a read-only mount point, and if so, create a new mount
-       * namespace and tell the sysroot that we've done so. See the docs for
-       * ostree_sysroot_set_mount_namespace_in_use().
-       *
-       * This is a conservative approach; we could just always
-       * unshare() too.
-       */
-      if (ostree_sysroot_is_booted (sysroot))
-        {
-          gboolean setup_ns = FALSE;
-          if (!maybe_setup_mount_namespace (&setup_ns, error))
-            return FALSE;
-          if (setup_ns)
-            ostree_sysroot_set_mount_namespace_in_use (sysroot);
-        }
+      /* Set up the mount namespace, if applicable */
+      if (!ostree_sysroot_initialize_with_mount_namespace (sysroot, cancellable, error))
+        return FALSE;
 
       /* Released when sysroot is finalized, or on process exit */
       if (!ot_admin_sysroot_lock (sysroot, error))