Repository navigation
Merge release/0.6.3 (and 0.6.2) into next - #1566
Merged
Merged
Conversation
…dentials systemd-gpt-auto-generator reads the root disk's GPT and mounts or activates the partitions it finds. The partition table is host-controlled and outside the TDX/SEV measurements, so a partition the host appends (swap, /var, /home, ...) is acted on inside the guest. Reproduced on mkosi-os-v0.6.1: a host-appended swap partition is activated ~2s into boot under the generator's "Swap Partition" unit. Disable it with systemd.gpt_auto=0 on the measured kernel command line (parsed identically by every systemd since v252, unlike image_policy=) and remove the generator binary from the prod image, mirroring the deletion the Yocto backend did and the mkosi rewrite dropped. Reviewing the same class of mechanism, also set systemd.import_credentials=no so PID1 stops importing system credentials from SMBIOS and qemu fw_cfg (both host-controlled and unmeasured; consumed by sysusers, tmpfiles, udev rules, networkd, ...), and remove the hibernate-resume, bless-boot, system-update, sysv and rc-local generators, which are unreachable in this image or act on host-influenced input. Refs: GHSA-c79w-3x5w-gmm5 Signed-off-by: Kevin Wang <wy721@qq.com>
The Yocto parity spec was derived from the image recipe's package list, so it checked that required files exist but never that what Yocto stripped stays stripped: deletions in bbappends and PACKAGECONFIG removals were not covered, which is how gpt-auto survived the mkosi rewrite. The only inverse check was a hand-kept denylist that grew after each incident. - check-parity.py pins the exact set of system generators prod may ship, so a package upgrade that adds one fails the build. - acceptance.sh asserts the measured command line keeps systemd.gpt_auto=0 and systemd.import_credentials=no. - The kernel fragment states DMI_SYSFS, FW_CFG_SYSFS and PSTORE off, so check-kernel-config.sh guards them like the other hardening symbols; all three are already off, so the built kernel is unchanged. - Prod also drops the ssh generator (no sshd in prod) and the hibernate resume/clear binary and units the removed generator left behind. Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
Signed-off-by: Kevin Wang <wy721@qq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the guest OS hardening for GHSA-c79w-3x5w-gmm5 from the 0.6.2 and 0.6.3 releases into
next.release/0.6.3(c5df598f5b) already containsrelease/0.6.2(0a210869d7). Both commits are the exact revisions the published OS images were built from, so this must be merged with a merge commit (no squash/rebase) to keep them innext's history.