5428b6
From 0762f129c6a9c7bbdb5d575c486d5cf4f7fdae8d Mon Sep 17 00:00:00 2001
5428b6
From: Richard Purdie <richard.purdie@linuxfoundation.org>
5428b6
Date: Tue, 16 Feb 2021 12:17:36 +0000
5428b6
Subject: [PATCH] proc: dont trigger mount error with invalid options on old
5428b6
 kernels
5428b6
5428b6
As of commit 4e39995371738b04d98d27b0d34ea8fe09ec9fab ("core: introduce
5428b6
ProtectProc= and ProcSubset= to expose hidepid= and subset= procfs
5428b6
mount options") kernels older than v5.8 generate multple warnings at
5428b6
boot, as seen in this Yocto build from today:
5428b6
5428b6
     qemux86-64 login: root
5428b6
     [   65.829009] proc: Bad value for 'hidepid'
5428b6
     root@qemux86-64:~# dmesg|grep proc:
5428b6
     [   16.990706] proc: Bad value for 'hidepid'
5428b6
     [   28.060178] proc: Bad value for 'hidepid'
5428b6
     [   28.874229] proc: Bad value for 'hidepid'
5428b6
     [   32.685107] proc: Bad value for 'hidepid'
5428b6
     [   65.829009] proc: Bad value for 'hidepid'
5428b6
     root@qemux86-64:~#
5428b6
5428b6
We see reports of the issue as in general its hard to someone to tell
5428b6
the difference between an error in dmesg which they should worry about and
5428b6
one that is harmless. This adds support burden to developers so Yocto
5428b6
Project has added this patch.
5428b6
5428b6
The commit that triggers this is systemd v247-rc1~378^2~3 -- so any
5428b6
systemd 247 and above plus kernel v5.7 or older will need this.
5428b6
5428b6
As noted in https://github.com/systemd/systemd/issues/16896
5428b6
it is possible changes could be backported to different kernel versions
5428b6
so the test isn't 100% foolproof but does give better results than a
5428b6
continual stream of bug reports.
5428b6
5428b6
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
5428b6
5428b6
Changes from Anita Zhang <the.anitazha@gmail.com>
5428b6
- Use 5.6.13-0_fbk9 version comparison for FB build
5428b6
---
5428b6
 src/core/namespace.c | 22 ++++++++++++++++++++--
5428b6
 1 file changed, 20 insertions(+), 2 deletions(-)
5428b6
5428b6
diff --git a/src/core/namespace.c b/src/core/namespace.c
5428b6
index d47531408b..8be8352a8e 100644
5428b6
--- a/src/core/namespace.c
5428b6
+++ b/src/core/namespace.c
5428b6
@@ -4,7 +4,9 @@
5428b6
 #include <linux/loop.h>
5428b6
 #include <sched.h>
5428b6
 #include <stdio.h>
5428b6
+#include <stdlib.h>
5428b6
 #include <sys/mount.h>
5428b6
+#include <sys/utsname.h>
5428b6
 #include <unistd.h>
5428b6
 #include <linux/fs.h>
5428b6
 
5428b6
@@ -1018,12 +1020,28 @@ static int mount_procfs(const MountEntry *m, const NamespaceInfo *ns_info) {
5428b6
         _cleanup_free_ char *opts = NULL;
5428b6
         const char *entry_path;
5428b6
         int r, n;
5428b6
+        struct utsname uts;
5428b6
+        bool old = false;
5428b6
 
5428b6
         assert(m);
5428b6
         assert(ns_info);
5428b6
 
5428b6
-        if (ns_info->protect_proc != PROTECT_PROC_DEFAULT ||
5428b6
-            ns_info->proc_subset != PROC_SUBSET_ALL) {
5428b6
+        /* If uname says that the system is older than v5.6.13-0_fbk9, then the textual hidepid= stuff is not
5428b6
+         * supported by the kernel, and thus the per-instance hidepid= neither, which means we
5428b6
+         * really don't want to use it, since it would affect our host's /proc * mount. Hence let's
5428b6
+         * gracefully fallback to a classic, unrestricted version. */
5428b6
+
5428b6
+        r = uname(&uts;;
5428b6
+        if (r < 0)
5428b6
+               return -errno;
5428b6
+
5428b6
+        if (strverscmp(uts.release, "5.6.13-0_fbk9") < 0) {
5428b6
+                log_debug("Pre v5.6.13-0_fbk9 kernel detected [v%s] - skipping hidepid=", uts.release);
5428b6
+                old = true;
5428b6
+        }
5428b6
+
5428b6
+        if (!old && (ns_info->protect_proc != PROTECT_PROC_DEFAULT ||
5428b6
+            ns_info->proc_subset != PROC_SUBSET_ALL)) {
5428b6
 
5428b6
                 /* Starting with kernel 5.8 procfs' hidepid= logic is truly per-instance (previously it
5428b6
                  * pretended to be per-instance but actually was per-namespace), hence let's make use of it
5428b6
-- 
5428b6
2.30.2
5428b6