Skip to contentSkip to conversation

systemd: fix /var/log/journal ownership

PATCH In review Jonathan Liu 3 participants 5 messages Mar 10, 2015 – Mar 12, 2015

lore
Share & tools
lore

Jonathan Liu

author
#0 lore raw

PATCH 1/1 systemd: fix /var/log/journal ownership

The ownership needs to be explicitly set otherwise it inherits the user and group id of the build user.

Signed-off-by Jonathan Liu <[email protected]>
---
 meta/recipes-core/systemd/systemd_219.bb | 2 ++
 1 file changed, 2 insertions(+)
meta/recipes-core/systemd/systemd_219.bb +2 -0
index 24486f1..6a4f4e8 100644
@@ -147,6 +147,8 @@ do_install() {
 		sed -i s%@UDEVD@%${rootlibexecdir}/systemd/systemd-udevd% ${D}${sysconfdir}/init.d/systemd-udevd
 	fi
 
+	chown root:root ${D}/${localstatedir}/log/journal
+
         # Delete journal README, as log can be symlinked inside volatile.
         rm -f ${D}/${localstatedir}/log/README
Signature · 1 line
2.3.1
#1 lore raw
Quoted 13 lines · Jonathan Liu

The ownership needs to be explicitly set otherwise it inherits the user and group id of the build user.

Signed-off-by Jonathan Liu <[email protected]>
---
  meta/recipes-core/systemd/systemd_219.bb | 2 ++
  1 file changed, 2 insertions(+)
meta/recipes-core/systemd/systemd_219.bb +0 -0
index 24486f1..6a4f4e8 100644

meta/recipes-core/systemd/systemd_219.bb do_install() { · line 154

Quoted 8 lines
meta/recipes-core/systemd/systemd_219.bb +2 -0
@@ -147,6 +147,8 @@ do_install() {
  		sed -i s%@UDEVD@%${rootlibexecdir}/systemd/systemd-udevd% ${D}${sysconfdir}/init.d/systemd-udevd
  	fi
 
+	chown root:root ${D}/${localstatedir}/log/journal
+
          # Delete journal README, as log can be symlinked inside volatile.
          rm -f ${D}/${localstatedir}/log/README

I think it should be root:systemd-journal.
What do you think?

And this patch would also fix the following bug.
https://bugzilla.yoctoproject.org/show_bug.cgi?id=7293

Regards,
Chen Qi

#2 lore raw
Quoted 28 lines · ChenQi
Quoted 13 lines · Jonathan Liu

The ownership needs to be explicitly set otherwise it inherits the user and group id of the build user.

Signed-off-by Jonathan Liu <[email protected]>
---
 meta/recipes-core/systemd/systemd_219.bb | 2 ++
 1 file changed, 2 insertions(+)
meta/recipes-core/systemd/systemd_219.bb +0 -0
index 24486f1..6a4f4e8 100644

meta/recipes-core/systemd/systemd_219.bb do_install() { · line 153

Quoted 7 lines
meta/recipes-core/systemd/systemd_219.bb +1 -0
@@ -147,6 +147,8 @@ do_install() {
 		sed -i s%@UDEVD@%${rootlibexecdir}/systemd/systemd-udevd% ${D}${sysconfdir}/init.d/systemd-udevd
 	fi
 +	chown root:root ${D}/${localstatedir}/log/journal
+
         # Delete journal README, as log can be symlinked inside volatile.
         rm -f ${D}/${localstatedir}/log/README

I think it should be root:systemd-journal.
What do you think?

Quoted 2 lines

And this patch would also fix the following bug.
https://bugzilla.yoctoproject.org/show_bug.cgi?id=7293

/var/log is symlinked (its not a copy-bind) into /var/volatile/log and /var/volatile is mounted as tmpfs on runtime as of now so how is this patch helping out with anything ?

Quoted 9 lines

Regards,
Chen Qi

Signature · 4 lines
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core
#3 lore raw
Quoted 26 lines · Khem Raj
Quoted 26 lines · ChenQi
Quoted 13 lines · Jonathan Liu

The ownership needs to be explicitly set otherwise it inherits the user and group id of the build user.

Signed-off-by Jonathan Liu <[email protected]>
---
  meta/recipes-core/systemd/systemd_219.bb | 2 ++
  1 file changed, 2 insertions(+)
meta/recipes-core/systemd/systemd_219.bb +0 -0
index 24486f1..6a4f4e8 100644

meta/recipes-core/systemd/systemd_219.bb do_install() { · line 153

Quoted 7 lines
meta/recipes-core/systemd/systemd_219.bb +1 -0
@@ -147,6 +147,8 @@ do_install() {
  		sed -i s%@UDEVD@%${rootlibexecdir}/systemd/systemd-udevd% ${D}${sysconfdir}/init.d/systemd-udevd
  	fi
  +	chown root:root ${D}/${localstatedir}/log/journal
+
          # Delete journal README, as log can be symlinked inside volatile.
          rm -f ${D}/${localstatedir}/log/README

I think it should be root:systemd-journal.
What do you think?

Quoted 4 lines
Quoted 2 lines

And this patch would also fix the following bug.
https://bugzilla.yoctoproject.org/show_bug.cgi?id=7293

/var/log is symlinked (its not a copy-bind) into /var/volatile/log and /var/volatile is mounted as tmpfs on runtime as of now so how is this patch helping out with anything ?

Hmm... You are right. I think we should just delete the directory.

//Chen Qi

Quoted 10 lines
Quoted 8 lines

Regards,
Chen Qi

Signature · 4 lines
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core
author
#4 lore raw
In reply to Khem Raj
Quoted 26 lines · Khem Raj
Quoted 26 lines · ChenQi
Quoted 13 lines · Jonathan Liu

The ownership needs to be explicitly set otherwise it inherits the user and group id of the build user.

Signed-off-by Jonathan Liu <[email protected]>
---
  meta/recipes-core/systemd/systemd_219.bb | 2 ++
  1 file changed, 2 insertions(+)
meta/recipes-core/systemd/systemd_219.bb +0 -0
index 24486f1..6a4f4e8 100644

meta/recipes-core/systemd/systemd_219.bb do_install() { · line 153

Quoted 7 lines
meta/recipes-core/systemd/systemd_219.bb +1 -0
@@ -147,6 +147,8 @@ do_install() {
  		sed -i s%@UDEVD@%${rootlibexecdir}/systemd/systemd-udevd% ${D}${sysconfdir}/init.d/systemd-udevd
  	fi
  +	chown root:root ${D}/${localstatedir}/log/journal
+
          # Delete journal README, as log can be symlinked inside volatile.
          rm -f ${D}/${localstatedir}/log/README

I think it should be root:systemd-journal.
What do you think?

Quoted 4 lines
Quoted 2 lines

And this patch would also fix the following bug.
https://bugzilla.yoctoproject.org/show_bug.cgi?id=7293

/var/log is symlinked (its not a copy-bind) into /var/volatile/log and /var/volatile is mounted as tmpfs on runtime as of now so how is this patch helping out with anything ?

It fixes uid/gid of build user leaking into the filesystem image even if the directory is hidden at runtime by tmpfs being mounted at /var/volatile.

I was considering removing /var/log/journal (actually /var/volatile/log/journal) from the rootfs but it would be a behavior change.
journald.conf by default tests for the presence of the /var/log/journal directory and if it exists it will write there (instead of /run/log/journal) assuming it is persistent.
An OpenEmbedded user could try making the journal persistent by removing the /var/volatile tmpfs entry from /etc/fstab (I remember seeing this mentioned somewhere on the web). This would make /var/volatile persistent...

I opted to keep /var/log/journal but fix the uid/gid to avoid surprises. You're right though, it should be root:systemd-journal.

Regards,
Jonathan