SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mountpoint-util: assume MS_NOSYMFOLLOW is available

Browse Source 
Since our kernel baseline is v5.10 now.
This commit is contained in:
Mike Yuan
2026-01-19 13:33:26 +01:00
parent 58fb46ecd5
commit 6753bd8a2f
9 changed files with 7 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README
+1 -1
View File
@@ -52,7 +52,7 @@ REQUIREMENTS:
BPF links and the BPF LSM hook
≥ 5.8 for LOOP_CONFIGURE and STATX_ATTR_MOUNT_ROOT
≥ 5.9 for close_range()
≥ 5.10 for STATX_MNT_ID
≥ 5.10 for STATX_MNT_ID and MS_NOSYMFOLLOW mount option
⛔ Kernel versions below 5.10 ("minimum baseline") are not supported at all,
and are missing required functionality as listed above.
TODO
-2
View File
@@ -107,8 +107,6 @@ Deprecations and removals:
* drop support for LOOP_CONFIGURE-less loopback block devices, once kernel
baseline is 5.8.
* Once baseline is 5.10, remove support or MS_NOSYMFOLLOW-less kernels
* Remove /dev/mem ACPI FPDT parsing when /sys/firmware/acpi/fpdt is ubiquitous.
That requires distros to enable CONFIG_ACPI_FPDT, and have kernels v5.12 for
x86 and v6.2 for arm.
src/basic/mountpoint-util.c
-60
View File
@@ -529,66 +529,6 @@ bool mount_new_api_supported(void) {
return (cache = true);
}
unsigned long ms_nosymfollow_supported(void) {
_cleanup_close_ int fsfd = -EBADF, mntfd = -EBADF;
static int cache = -1;
/* Returns MS_NOSYMFOLLOW if it is supported, zero otherwise. */
if (cache >= 0)
return cache ? MS_NOSYMFOLLOW : 0;
if (!mount_new_api_supported())
goto not_supported;
/* Checks if MS_NOSYMFOLLOW is supported (which was added in 5.10). We use the new mount API's
* mount_setattr() call for that, which was added in 5.12, which is close enough. */
fsfd = fsopen("tmpfs", FSOPEN_CLOEXEC);
if (fsfd < 0) {
if (ERRNO_IS_NOT_SUPPORTED(errno))
goto not_supported;
log_debug_errno(errno, "Failed to open superblock context for tmpfs: %m");
return 0;
}
if (fsconfig(fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0) < 0) {
if (ERRNO_IS_NOT_SUPPORTED(errno))
goto not_supported;
log_debug_errno(errno, "Failed to create tmpfs superblock: %m");
return 0;
}
mntfd = fsmount(fsfd, FSMOUNT_CLOEXEC, 0);
if (mntfd < 0) {
if (ERRNO_IS_NOT_SUPPORTED(errno))
goto not_supported;
log_debug_errno(errno, "Failed to turn superblock fd into mount fd: %m");
return 0;
}
if (mount_setattr(mntfd, "", AT_EMPTY_PATH|AT_RECURSIVE,
&(struct mount_attr) {
.attr_set = MOUNT_ATTR_NOSYMFOLLOW,
}, sizeof(struct mount_attr)) < 0) {
if (ERRNO_IS_NOT_SUPPORTED(errno))
goto not_supported;
log_debug_errno(errno, "Failed to set MOUNT_ATTR_NOSYMFOLLOW mount attribute: %m");
return 0;
}
cache = true;
return MS_NOSYMFOLLOW;
not_supported:
cache = false;
return 0;
}
int mount_option_supported(const char *fstype, const char *key, const char *value) {
_cleanup_close_ int fd = -EBADF;
int r;
src/basic/mountpoint-util.h
-1
View File
@@ -75,7 +75,6 @@ int mount_propagation_flag_from_string(const char *name, unsigned long *ret);
bool mount_propagation_flag_is_valid(unsigned long flag);
bool mount_new_api_supported(void);
unsigned long ms_nosymfollow_supported(void);
int mount_option_supported(const char *fstype, const char *key, const char *value);
src/nspawn/nspawn.c
+3 -3
View File
@@ -3767,7 +3767,7 @@ static int setup_unix_export_dir_outside(char **ret) {
"tmpfs",
q,
"tmpfs",
MS_NODEV|MS_NOEXEC|MS_NOSUID|ms_nosymfollow_supported(),
MS_NODEV|MS_NOEXEC|MS_NOSUID|MS_NOSYMFOLLOW,
"size=4M,nr_inodes=64,mode=0755");
if (r < 0)
return r;
@@ -3781,7 +3781,7 @@ static int setup_unix_export_dir_outside(char **ret) {
/* what= */ NULL,
w,
/* fstype= */ NULL,
MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NODEV|MS_NOEXEC|MS_NOSUID|ms_nosymfollow_supported(),
MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NODEV|MS_NOEXEC|MS_NOSUID|MS_NOSYMFOLLOW,
/* options= */ NULL);
if (r < 0)
return r;
@@ -3826,7 +3826,7 @@ static int setup_unix_export_host_inside(const char *directory, const char *unix
/* what= */ NULL,
p,
/* fstype= */ NULL,
MS_BIND|MS_REMOUNT|MS_NODEV|MS_NOEXEC|MS_NOSUID|ms_nosymfollow_supported(),
MS_BIND|MS_REMOUNT|MS_NODEV|MS_NOEXEC|MS_NOSUID|MS_NOSYMFOLLOW,
/* options= */ NULL);
if (r < 0)
return r;
src/shared/dissect-image.c
+1 -1
View File
@@ -2383,7 +2383,7 @@ int partition_pick_mount_options(
case PARTITION_ESP:
case PARTITION_XBOOTLDR:
flags |= MS_NOSUID|MS_NOEXEC|ms_nosymfollow_supported();
flags |= MS_NOSUID|MS_NOEXEC|MS_NOSYMFOLLOW;
/* The ESP might contain a pre-boot random seed. Let's make this unaccessible to regular
* userspace. ESP/XBOOTLDR is almost certainly VFAT, hence if we don't know assume it is. */
src/shared/mount-util.c
+1 -1
View File
@@ -1951,7 +1951,7 @@ int trigger_automount_at(int dir_fd, const char *path) {
unsigned long credentials_fs_mount_flags(bool ro) {
/* A tight set of mount flags for credentials mounts */
return MS_NODEV|MS_NOEXEC|MS_NOSUID|ms_nosymfollow_supported()|(ro ? MS_RDONLY : 0);
return MS_NODEV|MS_NOEXEC|MS_NOSUID|MS_NOSYMFOLLOW|(ro ? MS_RDONLY : 0);
}
int fsmount_credentials_fs(int *ret_fsfd) {
src/shared/mount-util.h
+1 -1
View File
@@ -166,7 +166,7 @@ int make_mount_point_inode_from_path(const char *source, const char *dest, mode_
int trigger_automount_at(int dir_fd, const char *path);
unsigned long credentials_fs_mount_flags(bool ro);
unsigned long credentials_fs_mount_flags(bool ro) _const_;
int fsmount_credentials_fs(int *ret_fsfd);
int mount_credentials_fs(const char *path);
src/test/test-mountpoint-util.c
-4
View File
@@ -359,10 +359,6 @@ TEST(is_mount_point_at) {
ASSERT_OK(is_mount_point_at(fd, "regular", 0));
}
TEST(ms_nosymfollow_supported) {
log_info("MS_NOSYMFOLLOW supported: %s", yes_no(ms_nosymfollow_supported()));
}
TEST(mount_option_supported) {
int r;