From a6e6b6954c3b245894f50929190ac687eda9019b Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Fri, 15 Jul 2022 02:30:01 +0200 Subject: [PATCH 1/7] mkosi: Install xxd in images Came in handy while working on https://github.com/systemd/systemd/pull/24024 so let's install it in the image by default. --- mkosi.default.d/arch/10-mkosi.arch | 2 ++ mkosi.default.d/centos_epel/10-mkosi.centos_epel | 2 ++ mkosi.default.d/debian/10-mkosi.debian | 1 + mkosi.default.d/fedora/10-mkosi.fedora | 2 ++ mkosi.default.d/opensuse/10-mkosi.opensuse | 2 ++ mkosi.default.d/ubuntu/10-mkosi.ubuntu | 1 + 6 files changed, 10 insertions(+) diff --git a/mkosi.default.d/arch/10-mkosi.arch b/mkosi.default.d/arch/10-mkosi.arch index 55e8a206c8..822da035d8 100644 --- a/mkosi.default.d/arch/10-mkosi.arch +++ b/mkosi.default.d/arch/10-mkosi.arch @@ -63,6 +63,8 @@ Packages= # For testing systemd's zsh completion scripts # Run `autoload -Uz compinit; compinit` from a zsh shell in the booted image to enable completions. zsh + # xxd is provided by the vim package + vim # Required to run systemd-networkd-tests.py python iproute diff --git a/mkosi.default.d/centos_epel/10-mkosi.centos_epel b/mkosi.default.d/centos_epel/10-mkosi.centos_epel index cf6c74f01c..42b3c11629 100644 --- a/mkosi.default.d/centos_epel/10-mkosi.centos_epel +++ b/mkosi.default.d/centos_epel/10-mkosi.centos_epel @@ -76,6 +76,8 @@ Packages= less netcat e2fsprogs + # xxd is provided by the vim-common package + vim-common # Required to run systemd-networkd-tests.py python3 iproute diff --git a/mkosi.default.d/debian/10-mkosi.debian b/mkosi.default.d/debian/10-mkosi.debian index 7aa0194a60..44e8521d9a 100644 --- a/mkosi.default.d/debian/10-mkosi.debian +++ b/mkosi.default.d/debian/10-mkosi.debian @@ -73,6 +73,7 @@ Packages= locales nano strace + xxd # Required to run systemd-networkd-tests.py python3 iproute2 diff --git a/mkosi.default.d/fedora/10-mkosi.fedora b/mkosi.default.d/fedora/10-mkosi.fedora index 8859816483..a6b58c7589 100644 --- a/mkosi.default.d/fedora/10-mkosi.fedora +++ b/mkosi.default.d/fedora/10-mkosi.fedora @@ -75,6 +75,8 @@ Packages= netcat e2fsprogs compsize + # xxd is provided by the vim-common package + vim-common # Required to run systemd-networkd-tests.py python iproute diff --git a/mkosi.default.d/opensuse/10-mkosi.opensuse b/mkosi.default.d/opensuse/10-mkosi.opensuse index a2d35378f7..53fe2f3c93 100644 --- a/mkosi.default.d/opensuse/10-mkosi.opensuse +++ b/mkosi.default.d/opensuse/10-mkosi.opensuse @@ -73,3 +73,5 @@ Packages= nano strace util-linux + # xxd is provided by the vim package + vim diff --git a/mkosi.default.d/ubuntu/10-mkosi.ubuntu b/mkosi.default.d/ubuntu/10-mkosi.ubuntu index 109bd468dc..909703a60d 100644 --- a/mkosi.default.d/ubuntu/10-mkosi.ubuntu +++ b/mkosi.default.d/ubuntu/10-mkosi.ubuntu @@ -71,6 +71,7 @@ Packages= locales nano strace + xxd # Required to run systemd-networkd-tests.py python3 iproute2 From 2d2ac49787bb30c20a01e005f9e0aee7231d745c Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Fri, 15 Jul 2022 02:33:07 +0200 Subject: [PATCH 2/7] mkosi: Don't try to install systemd-boot in non-efi images When using mkosi's direct linux boot support, there's no EFI system partition so don't try to install systemd-boot in that case. --- mkosi.postinst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkosi.postinst b/mkosi.postinst index 1f43eec2cc..6eddadfea8 100755 --- a/mkosi.postinst +++ b/mkosi.postinst @@ -1,7 +1,7 @@ #!/bin/sh # SPDX-License-Identifier: LGPL-2.1-or-later -if [ "$1" = "final" ] && command -v bootctl > /dev/null; then +if [ "$1" = "final" ] && command -v bootctl > /dev/null && [ -d "/efi" ]; then bootctl install fi From c0daae3ad885740bca56445e6510468134596523 Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Fri, 15 Jul 2022 14:59:03 +0200 Subject: [PATCH 3/7] mkosi: Enable meson developer mode --- mkosi.build | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mkosi.build b/mkosi.build index 5855868acc..2334559719 100755 --- a/mkosi.build +++ b/mkosi.build @@ -60,7 +60,8 @@ if [ ! -f "$BUILDDIR"/build.ninja ] ; then -D "rootprefix=$rootprefix" \ -D man=false \ -D translations=false \ - -D version-tag="${VERSION_TAG}" + -D version-tag="${VERSION_TAG}" \ + -D mode=developer fi cd "$BUILDDIR" From 2401c9ace6ab1a7e8c44ed5dbf20afd5be250f7d Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Sat, 16 Jul 2022 10:15:29 +0200 Subject: [PATCH 4/7] mkosi: Fix build script indentation --- mkosi.build | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/mkosi.build b/mkosi.build index 2334559719..2be8fdbda1 100755 --- a/mkosi.build +++ b/mkosi.build @@ -49,10 +49,10 @@ if [ ! -f "$BUILDDIR"/build.ninja ] ; then init_path=$(realpath /sbin/init 2>/dev/null) if [ -z "$init_path" ] ; then - rootprefix="" + rootprefix="" else - rootprefix=${init_path%/lib/systemd/systemd} - rootprefix=/${rootprefix#/} + rootprefix=${init_path%/lib/systemd/systemd} + rootprefix=/${rootprefix#/} fi meson "$BUILDDIR" \ @@ -91,32 +91,32 @@ Kernel \r on an \m (\l) EOF if [ -n "$IMAGE_ID" ] ; then - mkdir -p "$DESTDIR"/usr/lib - sed -n \ - -e '/^IMAGE_ID=/!p' \ - -e "\$aIMAGE_ID=$IMAGE_ID" <"/usr/lib/os-release" >"${DESTDIR}/usr/lib/os-release" + mkdir -p "$DESTDIR"/usr/lib + sed -n \ + -e '/^IMAGE_ID=/!p' \ + -e "\$aIMAGE_ID=$IMAGE_ID" <"/usr/lib/os-release" >"${DESTDIR}/usr/lib/os-release" - OSRELEASEFILE="$DESTDIR"/usr/lib/os-release + OSRELEASEFILE="$DESTDIR"/usr/lib/os-release else - OSRELEASEFILE=/usr/lib/os-release + OSRELEASEFILE=/usr/lib/os-release fi if [ -n "$IMAGE_VERSION" ] ; then - mkdir -p "$DESTDIR"/usr/lib - sed -n \ - -e '/^IMAGE_VERSION=/!p' \ - -e "\$aIMAGE_VERSION=$IMAGE_VERSION" <$OSRELEASEFILE >"/tmp/os-release.tmp" + mkdir -p "$DESTDIR"/usr/lib + sed -n \ + -e '/^IMAGE_VERSION=/!p' \ + -e "\$aIMAGE_VERSION=$IMAGE_VERSION" <$OSRELEASEFILE >"/tmp/os-release.tmp" - cat /tmp/os-release.tmp > "$DESTDIR"/usr/lib/os-release - rm /tmp/os-release.tmp + cat /tmp/os-release.tmp > "$DESTDIR"/usr/lib/os-release + rm /tmp/os-release.tmp fi # If $CI_BUILD is set, copy over the CI service which executes a service check # after boot and then shuts down the machine if [ -n "$CI_BUILD" ]; then - mkdir -p "$DESTDIR/usr/lib/systemd/system" - cp -v "$SRCDIR/test/mkosi-check-and-shutdown.service" "$DESTDIR/usr/lib/systemd/system/mkosi-check-and-shutdown.service" - cp -v "$SRCDIR/test/mkosi-check-and-shutdown.sh" "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh" - chmod +x "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh" + mkdir -p "$DESTDIR/usr/lib/systemd/system" + cp -v "$SRCDIR/test/mkosi-check-and-shutdown.service" "$DESTDIR/usr/lib/systemd/system/mkosi-check-and-shutdown.service" + cp -v "$SRCDIR/test/mkosi-check-and-shutdown.sh" "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh" + chmod +x "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh" fi From 111ff5d5115cb2f49aba59da5dbdf96a28d0974d Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Sun, 17 Jul 2022 23:52:23 +0200 Subject: [PATCH 5/7] mkosi: Update Ubuntu config to 22.04 --- mkosi.default.d/ubuntu/10-mkosi.ubuntu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkosi.default.d/ubuntu/10-mkosi.ubuntu b/mkosi.default.d/ubuntu/10-mkosi.ubuntu index 909703a60d..0a54547f87 100644 --- a/mkosi.default.d/ubuntu/10-mkosi.ubuntu +++ b/mkosi.default.d/ubuntu/10-mkosi.ubuntu @@ -5,7 +5,7 @@ [Distribution] Distribution=ubuntu -Release=focal +Release=jammy Repositories=main,universe [Packages] From 69d638e67e5bfc5fedcae4072f144a4f7d798c9a Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Fri, 15 Jul 2022 02:26:52 +0200 Subject: [PATCH 6/7] mkosi: Changes to allow booting with sanitizers in mkosi - Extra memory because ASAN needs it - The environment variables to make the sanitizers more useful - LD_PRELOAD because the ASAN DSO needs to be the first in the list - The sanitizer library packages - Disable syscall filters because they interfere with ASAN - Disable systemd-hwdb-update because it's super slow when systemd-hwdb is built with sanitizers - Take the value for meson's b_sanitize option from the SANITIZERS environment variable --- docs/HACKING.md | 5 ++ docs/TESTING_WITH_SANITIZERS.md | 16 ++++++ mkosi.build | 55 ++++++++++++++++++- mkosi.default.d/10-systemd.conf | 3 + .../centos_epel/10-mkosi.centos_epel | 2 + mkosi.default.d/debian/10-mkosi.debian | 2 + mkosi.default.d/fedora/10-mkosi.fedora | 3 + mkosi.default.d/opensuse/10-mkosi.opensuse | 2 + mkosi.default.d/ubuntu/10-mkosi.ubuntu | 2 + mkosi.postinst | 14 ++++- 10 files changed, 100 insertions(+), 4 deletions(-) diff --git a/docs/HACKING.md b/docs/HACKING.md index 9e5313e07a..a74d0468e5 100644 --- a/docs/HACKING.md +++ b/docs/HACKING.md @@ -140,6 +140,11 @@ enabled that are suitable when hacking on systemd (such as internal documentation consistency checks). Those are not useful when compiling for distribution and can be disabled by setting `-Dmode=release`. +## Sanitizers in mkosi + +See [Testing systemd using sanitizers](TESTING_WITH_SANITIZERS.md) for more information +on how to build with sanitizers enabled in mkosi. + ## Fuzzers systemd includes fuzzers in `src/fuzz/` that use libFuzzer and are automatically diff --git a/docs/TESTING_WITH_SANITIZERS.md b/docs/TESTING_WITH_SANITIZERS.md index 4f965c9617..642e1f19c9 100644 --- a/docs/TESTING_WITH_SANITIZERS.md +++ b/docs/TESTING_WITH_SANITIZERS.md @@ -13,6 +13,22 @@ This is mostly done automagically by various CI systems for each PR, but you may want to do it locally as well. The process slightly varies depending on the compiler you want to use and which part of the test suite you want to run. +## mkosi + +To build with sanitizers in mkosi, create a file 20-local.conf in mkosi.default.d/ and add the following +contents: + +``` +[Content] +Environment=SANITIZERS=address,undefined +``` + +The value of `SANITIZERS` is passed directly to meson's `b_sanitize` option, See +https://mesonbuild.com/Builtin-options.html#base-options for the format expected by the option. Currently, +only the sanitizers supported by gcc can be used, which are `address` and `undefined`. + +Note that this will only work with a recent version of mkosi (>= 14 or by running mkosi directly from source). + ## gcc gcc compiles in sanitizer libraries dynamically by default, so you need to get the shared libraries first - on Fedora these are shipped as a separate packages diff --git a/mkosi.build b/mkosi.build index 2be8fdbda1..27e5b1c65c 100755 --- a/mkosi.build +++ b/mkosi.build @@ -5,6 +5,9 @@ set -e # This is a build script for OS image generation using mkosi (https://github.com/systemd/mkosi). # Simply invoke "mkosi" in the project directory to build an OS image. +ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1 +UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1 + # On Fedora "ld" is (unfortunately — if you ask me) managed via # "alternatives". Since we'd like to support building images in environments # with only /usr/ around (e.g. mkosi's UsrOnly=1 option), we have the problem @@ -61,7 +64,8 @@ if [ ! -f "$BUILDDIR"/build.ninja ] ; then -D man=false \ -D translations=false \ -D version-tag="${VERSION_TAG}" \ - -D mode=developer + -D mode=developer \ + -D b_sanitize="${SANITIZERS:-none}" fi cd "$BUILDDIR" @@ -71,7 +75,15 @@ if [ "$WITH_TESTS" = 1 ] ; then getent group $id >/dev/null || groupadd -g $id testgroup$id done - ninja test + if [ -n "$SANITIZERS" ]; then + export ASAN_OPTIONS="$ASAN_OPTIONS" + export UBSAN_OPTIONS="$UBSAN_OPTIONS" + TIMEOUT_MULTIPLIER=3 + else + TIMEOUT_MULTIPLIER=1 + fi + + meson test --timeout-multiplier=$TIMEOUT_MULTIPLIER fi cd "$SRCDIR" @@ -120,3 +132,42 @@ if [ -n "$CI_BUILD" ]; then cp -v "$SRCDIR/test/mkosi-check-and-shutdown.sh" "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh" chmod +x "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh" fi + +if [ -n "$SANITIZERS" ]; then + LD_PRELOAD=$(ldd $BUILDDIR/systemd | grep libasan.so | awk '{print $3}') + + mkdir -p "$DESTDIR/etc/systemd/system.conf.d" + + cat > "$DESTDIR/etc/systemd/system.conf.d/10-asan.conf" < "$DESTDIR/etc/systemd/system/systemd-journald.service.d/10-stdout-tty.conf" < "$DESTDIR/etc/systemd/system/console-getty.service.d/10-no-vhangup.conf" < /dev/null && [ -d "/efi" ]; then - bootctl install +if [ "$1" = "final" ]; then + if command -v bootctl > /dev/null && [ -d "/efi" ]; then + bootctl install + fi + + if [ -n "$SANITIZERS" ]; then + # ASAN and syscall filters aren't compatible with each other. + find / -name '*.service' -type f -exec sed -i 's/^\(MemoryDeny\|SystemCall\)/# \1/' {} + + + # `systemd-hwdb update` takes > 50s when built with sanitizers so let's not run it by default. + systemctl mask systemd-hwdb-update.service + fi fi # Temporary workaround until https://github.com/openSUSE/suse-module-tools/commit/158643414ddb8d8208016a5f03a4484d58944d7a From 7ca9563ca18e0238d97f1b6eed8df62fdc2436aa Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Mon, 18 Jul 2022 12:43:37 +0200 Subject: [PATCH 7/7] mkosi: Remove usage of deprecated option names/sections --- docs/HACKING.md | 6 +++--- mkosi.default.d/10-systemd.conf | 4 ++-- mkosi.default.d/arch/10-mkosi.arch | 2 +- mkosi.default.d/centos_epel/10-mkosi.centos_epel | 2 +- mkosi.default.d/debian/10-mkosi.debian | 2 +- mkosi.default.d/fedora/10-mkosi.fedora | 2 +- mkosi.default.d/opensuse/10-mkosi.opensuse | 2 +- mkosi.default.d/ubuntu/10-mkosi.ubuntu | 2 +- test/mkosi.default.networkd-test | 2 +- 9 files changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/HACKING.md b/docs/HACKING.md index a74d0468e5..2015a40193 100644 --- a/docs/HACKING.md +++ b/docs/HACKING.md @@ -66,7 +66,7 @@ reuse the host's package cache. To do this, create a mkosi override file in mkosi.default.d/ (e.g 20-local.conf) and add the following contents: ``` -[Packages] +[Content] Cache= # (e.g. /var/cache/dnf) ``` @@ -229,7 +229,7 @@ mkosi's config. The easiest way to set the option is to create a file 20-local.c add the following contents: ``` -[Packages] +[Content] IncludeDirectory=mkosi.includedir ``` @@ -238,7 +238,7 @@ We already configured clangd to map any paths in /usr/include in the build image host in the mkosi-clangd.sh script. We also need to make sure clangd is installed in the build image. To have mkosi install clangd in the build -image, edit the 20-local.conf file we created earlier and add the following contents under the `[Packages]` +image, edit the 20-local.conf file we created earlier and add the following contents under the `[Content]` section: ``` diff --git a/mkosi.default.d/10-systemd.conf b/mkosi.default.d/10-systemd.conf index 24b85ddd0b..58b84cae98 100644 --- a/mkosi.default.d/10-systemd.conf +++ b/mkosi.default.d/10-systemd.conf @@ -9,7 +9,7 @@ HostonlyInitrd=yes # Prevent ASAN warnings when building the image Environment=ASAN_OPTIONS=verify_asan_link_order=false -[Packages] +[Content] BuildDirectory=mkosi.builddir Cache=mkosi.cache InstallDirectory=mkosi.installdir @@ -17,7 +17,7 @@ SourceFileTransferFinal=copy-git-others [Host] QemuHeadless=yes -NetworkVeth=yes +Netdev=yes QemuMem=2G [Validation] diff --git a/mkosi.default.d/arch/10-mkosi.arch b/mkosi.default.d/arch/10-mkosi.arch index 822da035d8..12f46c71c7 100644 --- a/mkosi.default.d/arch/10-mkosi.arch +++ b/mkosi.default.d/arch/10-mkosi.arch @@ -8,7 +8,7 @@ [Distribution] Distribution=arch -[Packages] +[Content] BuildPackages= acl bzip2 diff --git a/mkosi.default.d/centos_epel/10-mkosi.centos_epel b/mkosi.default.d/centos_epel/10-mkosi.centos_epel index 086fcdb555..5e726d4aef 100644 --- a/mkosi.default.d/centos_epel/10-mkosi.centos_epel +++ b/mkosi.default.d/centos_epel/10-mkosi.centos_epel @@ -10,7 +10,7 @@ Distribution=centos_epel Format=gpt_xfs HostonlyInitrd=no -[Packages] +[Content] BuildPackages= diffutils docbook-style-xsl diff --git a/mkosi.default.d/debian/10-mkosi.debian b/mkosi.default.d/debian/10-mkosi.debian index 9b77b5b832..2488eeb557 100644 --- a/mkosi.default.d/debian/10-mkosi.debian +++ b/mkosi.default.d/debian/10-mkosi.debian @@ -7,7 +7,7 @@ Distribution=debian Release=testing -[Packages] +[Content] BuildPackages= acl clang diff --git a/mkosi.default.d/fedora/10-mkosi.fedora b/mkosi.default.d/fedora/10-mkosi.fedora index 0314a2faab..c1d8a57557 100644 --- a/mkosi.default.d/fedora/10-mkosi.fedora +++ b/mkosi.default.d/fedora/10-mkosi.fedora @@ -7,7 +7,7 @@ Distribution=fedora Release=36 -[Packages] +[Content] BuildPackages= diffutils docbook-style-xsl diff --git a/mkosi.default.d/opensuse/10-mkosi.opensuse b/mkosi.default.d/opensuse/10-mkosi.opensuse index b1ca381759..16fdecdede 100644 --- a/mkosi.default.d/opensuse/10-mkosi.opensuse +++ b/mkosi.default.d/opensuse/10-mkosi.opensuse @@ -7,7 +7,7 @@ Distribution=opensuse Release=tumbleweed -[Packages] +[Content] BuildPackages= docbook-xsl-stylesheets fdupes diff --git a/mkosi.default.d/ubuntu/10-mkosi.ubuntu b/mkosi.default.d/ubuntu/10-mkosi.ubuntu index dfb0ec0fd5..9492e791cd 100644 --- a/mkosi.default.d/ubuntu/10-mkosi.ubuntu +++ b/mkosi.default.d/ubuntu/10-mkosi.ubuntu @@ -8,7 +8,7 @@ Distribution=ubuntu Release=jammy Repositories=main,universe -[Packages] +[Content] BuildPackages= acl docbook-xml diff --git a/test/mkosi.default.networkd-test b/test/mkosi.default.networkd-test index 6423417b81..ed3604ccdf 100644 --- a/test/mkosi.default.networkd-test +++ b/test/mkosi.default.networkd-test @@ -21,7 +21,7 @@ Output=networkd-test.raw [Partitions] RootSize=3G -[Packages] +[Content] BuildPackages= audit-libs-devel bzip2-devel