Yu Watanabe [Mon, 18 Nov 2019 09:29:29 +0000 (18:29 +0900)]
network: unify config_parse_dhcp_server_option_data() and config_parse_dhcp_send_option()
Yu Watanabe [Mon, 18 Nov 2019 09:14:18 +0000 (18:14 +0900)]
dhcp: remove struct sd_dhcp_raw_option
sd_dhcp_raw_option and sd_dhcp_option are essentially equivalent.
Yu Watanabe [Mon, 18 Nov 2019 08:33:58 +0000 (17:33 +0900)]
network: rename SendRawOption= to SendOption=
As DHCPv4.SendOption= and DHCPServer.SendRawOption= take the same
format.
Zbigniew Jędrzejewski-Szmek [Sun, 17 Nov 2019 18:17:38 +0000 (19:17 +0100)]
Merge pull request #14055 from yuwata/network-send-option-takes-type-field
network: make SendOption= also take type field
Serge [Sat, 16 Nov 2019 12:22:35 +0000 (15:22 +0300)]
sd-dhcp-client: anonymize DHCPDISCOVER (fixes #13992)
According to RFC7844 section 3 the DHCPDISCOVER message should not contain option 50 («Requested IP Address») when Anonymize is true
Yu Watanabe [Sun, 17 Nov 2019 14:09:53 +0000 (23:09 +0900)]
network: make SendOption= also take type field
This makes SendOption= and SendRawOption= takes values in the same
format.
Yu Watanabe [Sun, 17 Nov 2019 13:59:58 +0000 (22:59 +0900)]
network: rename DHCPRawOption to DHCPOptionDataType
And moves the definition from networkd-dhcp-server.[ch] to networkd-dhcp-common.[ch].
Yu Watanabe [Sun, 17 Nov 2019 13:51:06 +0000 (22:51 +0900)]
network: fix logged error value
Yu Watanabe [Sun, 17 Nov 2019 13:45:38 +0000 (22:45 +0900)]
network: fix indentation
Tom Fitzhenry [Sat, 16 Nov 2019 15:04:18 +0000 (02:04 +1100)]
Error, rather than warn, if failing to start DHCP server
This would have made diagnosing https://github.com/systemd/systemd/issues/14050 easier.
Cyprien Laplace [Thu, 14 Nov 2019 14:42:14 +0000 (09:42 -0500)]
basic: add vmware hypervisor detection from device-tree
Allow ConditionVirtualization=vmware to work on ESXi on arm VMs
using device-tree.
Lennart Poettering [Sat, 16 Nov 2019 12:49:01 +0000 (13:49 +0100)]
Merge pull request #14038 from keszybz/hwdb-update
hwdb update
Zbigniew Jędrzejewski-Szmek [Fri, 15 Nov 2019 13:16:06 +0000 (14:16 +0100)]
NEWS: more items
Also reorder some entries to restore the grouping by subject.
Lennart Poettering [Sat, 16 Nov 2019 12:48:25 +0000 (13:48 +0100)]
Merge pull request #14043 from poettering/shutdown-noswap-fix
shutdown: it's OK if /proc/swaps is missing
Lennart Poettering [Sat, 16 Nov 2019 12:47:59 +0000 (13:47 +0100)]
Merge pull request #14039 from keszybz/systemd-man
systemd(1) and journalctl(1) improvements
Lennart Poettering [Fri, 15 Nov 2019 13:23:53 +0000 (14:23 +0100)]
sd-bus: invalidate connection when Hello() fails
Fixes: #13969
Lennart Poettering [Fri, 15 Nov 2019 15:59:49 +0000 (16:59 +0100)]
Merge pull request #14037 from poettering/machinectl-pw-agent
spawn ask pw tty agent from "machinectl start"
Lennart Poettering [Fri, 15 Nov 2019 15:26:10 +0000 (16:26 +0100)]
Merge pull request #13940 from keur/protect_kernel_logs
Add ProtectKernelLogs to systemd.exec
Lennart Poettering [Fri, 15 Nov 2019 13:58:06 +0000 (14:58 +0100)]
umount: log on all errors
Lennart Poettering [Fri, 15 Nov 2019 13:57:27 +0000 (14:57 +0100)]
umount: be happy if /proc/swaps doesn't exist
Kernels work without swap just fine.
Fixes: #13993
Lennart Poettering [Fri, 15 Nov 2019 13:56:35 +0000 (14:56 +0100)]
shutdown: make logging more useful if NULL swap/mount table files are specified
Makes the error output seen in #13993 more readable.
Zbigniew Jędrzejewski-Szmek [Fri, 15 Nov 2019 12:30:02 +0000 (13:30 +0100)]
man: significantly downgrade the Options section in systemd(1)
This structure of the man page originates from the time when systemd was
installed on top of sysvinit systems, and users had an actual chance to
interact with the systemd binary directly. Nowadays it is almost never called
directly, so let's properly explain this in the overview.
The Options section is moved down below the kernel command line, those options
are only needed in special circumstances. Let's refer the reader to the
description of the kernel command line options, and not duplicate the
descriptions (which makes the text longer than necessary and increases chances
for discrepancies).
Systemd is also prominently used as the user manager, let's mention that in the
Overview.
While at it, use "=" only when an argument is required as we nowadays do.
Zbigniew Jędrzejewski-Szmek [Fri, 15 Nov 2019 10:59:34 +0000 (11:59 +0100)]
man: share description of $SYSTEMD_COLORS in other tools
It was only described in systemd(1), making it hard to discover.
Fixes #13561.
The same for $SYSTEMD_URLIFY.
I think all the tools whose man pages include less-variables.xml support
those variables.
Zbigniew Jędrzejewski-Szmek [Fri, 15 Nov 2019 10:35:27 +0000 (11:35 +0100)]
hwdb: update
As before, the net change seems to be almost only additions, with some
minor removals that seems to be corrections of incomplete entries.
Zbigniew Jędrzejewski-Szmek [Fri, 15 Nov 2019 10:32:24 +0000 (11:32 +0100)]
meson: add target to update the chromiumos rules
There is no change in the file right now, but the download seems to work
OK.
It's funny that the biggest company in the world cannot provide a
download link in plain text.
Lennart Poettering [Fri, 15 Nov 2019 10:12:34 +0000 (11:12 +0100)]
machinectl: spawn ask password agent on "start"
We start units in the background, hence it is wise to also have the
ask pasword agent around.
Fixes: #13587
Lennart Poettering [Fri, 15 Nov 2019 10:11:52 +0000 (11:11 +0100)]
ask-password-agent: introduce ask_password_agent_open_if_enabled()
This makes the ask-password agent handling more alike the polkit agent
handling again, and introduces ask_password_agent_open_if_enabled() that
works just like the already existing polkit_agent_open_if_enabled().
Lennart Poettering [Fri, 15 Nov 2019 10:11:10 +0000 (11:11 +0100)]
polkit-agent: don't use an inline function
This is long enough to just be a regular function, and is never called
in inner loops, let's hence just make this a plain function.
Torsten Hilbrich [Tue, 12 Nov 2019 07:36:06 +0000 (08:36 +0100)]
nspawn: Allow Capability= to overrule private network setting
The commit:
a3fc6b55ac nspawn: mask out CAP_NET_ADMIN again if settings file turns off private networking
turned off the CAP_NET_ADMIN capability whenever no private networking
feature was enabled. This broke configurations where the CAP_NET_ADMIN
capability was explicitly requested in the configuration.
Changing the order of evalution here to allow the Capability= setting
to overrule this implicit setting:
Order of evaluation:
1. if no private network setting is enabled, CAP_NET_ADMIN is removed
2. if a private network setting is enabled, CAP_NET_ADMIN is added
3. the settings of Capability= are added
4. the settings of DropCapability= are removed
This allows the fix for #11755 to be retained and to still allow the
admin to specify CAP_NET_ADMIN as additional capability.
Fixes:
a3fc6b55acd3f37e50915304d87bed100efa9d9d
Fixes: #13995
Kevin Kuehler [Thu, 14 Nov 2019 01:37:05 +0000 (17:37 -0800)]
systemd-analyze: Add ProtectKernelLogs to security
Kevin Kuehler [Thu, 14 Nov 2019 00:56:23 +0000 (16:56 -0800)]
units: set ProtectKernelLogs=yes on relevant units
We set ProtectKernelLogs=yes on all long running services except for
udevd, since it accesses /dev/kmsg, and journald, since it calls syslog
and accesses /dev/kmsg.
Kevin Kuehler [Thu, 14 Nov 2019 00:38:33 +0000 (16:38 -0800)]
test-namespace: Add test for ProtectKernelLogs=
Zbigniew Jędrzejewski-Szmek [Thu, 14 Nov 2019 13:28:05 +0000 (14:28 +0100)]
core: do not propagate polkit error to caller
If we fail to start polkit, we get a message like
"org.freedesktop.DBus.Error.NameHasNoOwner: Could not activate remote peer.",
which has no meaning for the caller of our StartUnit method. Let's just
return -EACCES.
$ systemctl start apache
Failed to start apache.service: Could not activate remote peer. (before)
Failed to start apache.service: Access denied (after)
Fixes #13865.
Lennart Poettering [Thu, 14 Nov 2019 16:51:30 +0000 (17:51 +0100)]
seccomp: more comprehensive protection against libseccomp's __NR_xyz namespace invasion
A follow-up for
59b657296a2fe104f112b91bbf9301724067cc81, adding the
same conditioning for all cases of our __NR_xyz use.
Fixes: #14031
Tommy J [Fri, 15 Nov 2019 01:25:17 +0000 (02:25 +0100)]
PrefixDelegationHint-section: typo
Kevin Kuehler [Mon, 11 Nov 2019 05:27:29 +0000 (21:27 -0800)]
man: Add description for ProtectKernelLogs=
Kevin Kuehler [Mon, 11 Nov 2019 04:37:20 +0000 (20:37 -0800)]
test/test-seccomp: add test_protect_syslog
Kevin Kuehler [Sun, 10 Nov 2019 09:17:01 +0000 (01:17 -0800)]
core: ProtectKernelLogs= mask kmsg in proc and sys
Block access to /dev/kmsg and /proc/kmsg when ProtectKernelLogs is set.
Zbigniew Jędrzejewski-Szmek [Thu, 14 Nov 2019 09:08:40 +0000 (10:08 +0100)]
Merge pull request #14003 from keszybz/user-path-configurable
meson: make user $PATH configurable
Lennart Poettering [Wed, 13 Nov 2019 19:07:31 +0000 (20:07 +0100)]
ask-password: don't hit assert() when we query pw which the user C-d and caching is enabled
Dimitri John Ledkov [Wed, 13 Nov 2019 01:20:44 +0000 (17:20 -0800)]
boot: Add ARM64 support to the EFI stub
Zbigniew Jędrzejewski-Szmek [Thu, 14 Nov 2019 09:02:20 +0000 (10:02 +0100)]
Merge pull request #14013 from keszybz/cryptsetup-keyfile-with-colons
Support cryptsetup keyfiles with colons agains
Dimitri John Ledkov [Wed, 13 Nov 2019 01:08:57 +0000 (17:08 -0800)]
boot: Load LoadOptions cmdline, if none is available.
Fixes #13694
Filipe Brandenburger [Wed, 13 Nov 2019 18:46:08 +0000 (10:46 -0800)]
test: Disable LUKS devices from initramfs in QEMU tests
We currently use the host's kernel and initramfs in our QEMU tests.
If the host is running on an encrypted LUKS partition, then the initramfs
will have a crypttab setup looking for the particular root disk it needs to
encrypt before booting into the system.
However, this disk obviously doesn't exist in our QEMU VM, so it turns out
our tests end up waiting for this device to become available, which will
never actually happen, and boot hangs for 90s until that service times out.
[*** ] A start job is running for /dev/disk/by-uuid/
01234567-abcd-1234-abcd-
0123456789ab (20s / 1min 30s)
In order to prevent this issue, let's pass "rd.luks=0" to disable LUKS in
the initramfs only as part of our default kernel command-line in our QEMU
tests.
This is enough to disable this behavior and prevent the timeout, while at
the same time doesn't conflict with our tests that actually check for LUKS
behavior in the systemd running under test (such as TEST-02-CRYPTSETUP).
Tested: `sudo make -C TEST-02-CRYPTSETUP/ clean setup run`
Riccardo Schirone [Wed, 13 Nov 2019 16:37:15 +0000 (17:37 +0100)]
Be more specific in resolved.conf man page with regard to DNSOverTLS
DNSOverTLS in strict mode (value yes) does check the server, as it is said in
the first few lines of the option documentation. The check is not performed in
"opportunistic" mode, however, as that is allowed by RFC 7858, section "4.1.
Opportunistic Privacy Profile".
> With such a discovered DNS server, the client might or might not validate the
> resolver. These choices maximize availability and performance, but they leave
> the client vulnerable to on-path attacks that remove privacy.
Zbigniew Jędrzejewski-Szmek [Wed, 13 Nov 2019 21:22:58 +0000 (22:22 +0100)]
meson: avoid ternary op in .format()
meson 0.49 can't parse that for some reason. I'm keeping this separate so it
can be reverted easily when we bump required meson version.
Zbigniew Jędrzejewski-Szmek [Tue, 12 Nov 2019 14:38:19 +0000 (15:38 +0100)]
meson: make user $PATH configurable
This partially reverts
db11487d1062655f17db54c4d710653f16c87313 (the logic to
calculate the correct value is removed, we always use the same setting as for
the system manager). Distributions have an easy mechanism to override this if
they wish.
I think making this configurable is better, because different distros clearly
want different defaults here, and making this configurable is nice and clean.
If we don't make it configurable, distros which either have to carry patches,
or what would be worse, rely on some other configuration mechanism, like
/etc/profile. Those other solutions do not apply everywhere (they usually
require the shell to be used at some point), so it is better if we provide
a nice way to override the default.
Fixes #13469.
HATAYAMA Daisuke [Wed, 13 Nov 2019 11:30:58 +0000 (06:30 -0500)]
verify: fix segmentation fault
systemd-analyze verify command now results in segmentation fault if two
consecutive non-existent unit file names are given:
# ./build/systemd-analyze a.service b.service
...<snip irrelevant part>...
Unit a.service not found.
Unit b.service not found.
Segmentation fault (core dumped)
The cause of this is a wrong handling of return value of
manager_load_startable_unit_or_warn() in verify_units() in failure case.
It looks that the current logic wants to assign the first error status
throughout verify_units() into variable r and count up variable count only when
a given unit file exists.
However, due to the wrong handling of the return value of
manager_load_startable_unit_or_warn() in verify_units(), the variable count is
unexpectedly incremented even when there is no such unit file because the
variable r already contains non-zero value in the 2nd failure, set by the 1st
failure, and then the condition k < 0 && r == 0 evaluates to false.
This commit fixes the wrong handling of return value of
manager_load_startable_unit_or_warn() in verify_units().
Zbigniew Jędrzejewski-Szmek [Wed, 13 Nov 2019 20:55:30 +0000 (21:55 +0100)]
man: mention $RUNTIME_DIRECTORY & friends in environment list
Zbigniew Jędrzejewski-Szmek [Wed, 13 Nov 2019 16:36:46 +0000 (17:36 +0100)]
Allow overriding /etc/fstab with $SYSTEMD_FSTAB
Zbigniew Jędrzejewski-Szmek [Wed, 13 Nov 2019 09:32:30 +0000 (10:32 +0100)]
cryptsetup-generator: guess whether the keyfile argument is two items or one
Fixes #13615.
See the inline comment for documentation.
Zbigniew Jędrzejewski-Szmek [Wed, 13 Nov 2019 11:06:58 +0000 (12:06 +0100)]
cryptsetup-generator: allow overriding /run/systemd/cryptsetup with $RUNTIME_DIRECTORY
I added a fairly vague entry to docs/ENVIRONMENT because I think it is worth
mentioning there (in case someone is looking for any environment variable that
might be relevant).
Lennart Poettering [Wed, 13 Nov 2019 19:20:10 +0000 (20:20 +0100)]
Merge pull request #14017 from poettering/analyze-calendar-tweaks
Add --base-time= for systemd-analyze calendar
Zbigniew Jędrzejewski-Szmek [Wed, 13 Nov 2019 09:31:44 +0000 (10:31 +0100)]
cryptsetup-generator: allow overriding crypttab path with $SYSTEMD_CRYPTAB
Lennart Poettering [Wed, 13 Nov 2019 15:38:41 +0000 (16:38 +0100)]
Merge pull request #14010 from poettering/localtime-symlink
tweaks to /etc/localtime management
Lennart Poettering [Wed, 13 Nov 2019 15:36:39 +0000 (16:36 +0100)]
Merge pull request #13994 from keszybz/bpf-refactor
Refactor the bpf devices code and fix some bugs
Lennart Poettering [Wed, 13 Nov 2019 15:36:11 +0000 (16:36 +0100)]
Merge pull request #13868 from keszybz/run-exit-code
run: propagate return code/status from the child
Lennart Poettering [Wed, 13 Nov 2019 11:56:08 +0000 (12:56 +0100)]
analyze: drop spurious newline
Lennart Poettering [Wed, 13 Nov 2019 11:55:59 +0000 (12:55 +0100)]
update TODO
Lennart Poettering [Wed, 13 Nov 2019 11:55:52 +0000 (12:55 +0100)]
man: document --base-time= for systemd-analyze
Lennart Poettering [Wed, 13 Nov 2019 11:55:39 +0000 (12:55 +0100)]
analyze: add --base-time= to specify base time for 'calendar' verb
Lennart Poettering [Tue, 12 Nov 2019 16:52:35 +0000 (17:52 +0100)]
tree-wide: fix how we set $TZ
According to tzset(3) we need to prefix timezone names with ":". Let's
do so hence, to avoid any ambiguities and follow documented behaviour.
Zbigniew Jędrzejewski-Szmek [Tue, 12 Nov 2019 20:10:48 +0000 (21:10 +0100)]
nspawn: do not emit any warning when $UNIFIED_CGROUP_HIERARCHY is used
Initially I thought this is a good idea, but when reviewing a different PR
(https://github.com/systemd/systemd/pull/13862#discussion_r340604313) I changed
my mind about this. At some point we probably should start warning about the
old option name, and yet later remove it. But it'll make it easier for people
to transition to the new option name if there's a period of support for both
names without any fuss. There's nothing particularly wrong about the old name,
and there is no support cost.
Fixes #13919 (by avoiding the issue completely).
Lennart Poettering [Wed, 13 Nov 2019 09:42:58 +0000 (09:42 +0000)]
update TODO
Lennart Poettering [Wed, 13 Nov 2019 09:39:09 +0000 (10:39 +0100)]
timedated: it might be that tzinfo files are just not installed
Lennart Poettering [Wed, 13 Nov 2019 09:32:44 +0000 (10:32 +0100)]
timedated: handle UTC specially, when generating /etc/localtime
Lennart Poettering [Wed, 13 Nov 2019 09:32:26 +0000 (10:32 +0100)]
time-util: treat /etc/localtime missing as UTC
Zbigniew Jędrzejewski-Szmek [Wed, 13 Nov 2019 07:56:49 +0000 (08:56 +0100)]
Merge pull request #13961 from mwilck/udev-no-exit-timeout
udevd: wait for workers to finish when exiting
Anita Zhang [Tue, 12 Nov 2019 18:59:55 +0000 (10:59 -0800)]
Merge pull request #14001 from keszybz/test-unit-name-more
Test unit name more
Zbigniew Jędrzejewski-Szmek [Tue, 12 Nov 2019 18:05:24 +0000 (19:05 +0100)]
Merge pull request #13984 from yuwata/udev-fix-13976
udev: fix issue #13976
Zbigniew Jędrzejewski-Szmek [Tue, 12 Nov 2019 18:03:50 +0000 (19:03 +0100)]
Merge pull request #13989 from keszybz/meson-warning
Adjust compiler option management to avoid warnings from meson
Martin Wilck [Tue, 12 Nov 2019 15:43:42 +0000 (16:43 +0100)]
udevd: fix crash when workers time out after exit is signal caught
If udevd receives an exit signal, it releases its reference on the udev
monitor in manager_exit(). If at this time a worker is hanging, and if
the event timeout for this worker expires before udevd exits, udevd
crashes in on_sigchld()->udev_monitor_send_device(), because the monitor
has already been freed.
Fix this by releasing the main process's monitor ref later, in
manager_free().
Lennart Poettering [Tue, 12 Nov 2019 14:30:01 +0000 (15:30 +0100)]
meson: order list of dependencies of libshared alphabetically
Let's make merging patches against this more stable.
Lennart Poettering [Tue, 12 Nov 2019 14:18:37 +0000 (15:18 +0100)]
update TODO
Franck Bui [Fri, 18 Oct 2019 10:44:51 +0000 (12:44 +0200)]
logind: fix (again) the race that might happen when logind restores VT
This patch is a new attempt to fix the race originally described in issue #9754.
The initial fix (commit
ad96887a1205bad9656d280c5681f482e6d04838) consisted in
spawning a sub process that became the controlling process of the VT and hence
kicked the old controlling process off to make sure that the VT wouldn't have
entered in HUP state while logind restored the VT.
But it introduced a regression (see issue #11269) and thus was reverted. But
unlike it was described in the revert commit message, commit
adb8688b3ff445d9c48ed0d72208c7844c2acc01 alone doen't fix the initial race.
This patch fixes the race in a simpler way by trying to restore the VT a second
time after making sure to re-open it if the first attempt fails.
Indeed if the old controlling process dies before or during the first attempt,
logind will fail to restore the VT. At this point the VT is in HUP state but
we're sure that it won't enter in a HUP state a second time. Therefore we will
retry by re-opening the VT to clear the HUP state and by restoring the VT a
second time, which should be safe this time.
Fixes: #9754
Fixes: #13241
Martin Wilck [Wed, 6 Nov 2019 11:24:41 +0000 (12:24 +0100)]
udevd: wait for workers to finish when exiting
On some systems with lots of devices, device probing for certain drivers can
take a very long time. If systemd-udevd detects a timeout and kills the worker
running modprobe using SIGKILL, some devices will not be probed, or end up in
unusable state. The --event-timeout option can be used to modify the maximum
time spent in an uevent handler. But if systemd-udevd exits, it uses a
different timeout, hard-coded to 30s, and exits when this timeout expires,
causing all workers to be KILLed by systemd afterwards. In practice, this may
lead to workers being killed after significantly less time than specified with
the event-timeout. This is particularly significant during initrd processing:
systemd-udevd will be stopped by systemd when initrd-switch-root.target is
about to be isolated, which usually happens quickly after finding and mounting
the root FS.
If systemd-udevd is started by PID 1 (i.e. basically always), systemd will
kill both udevd and the workers after expiry of TimeoutStopSec. This is
actually better than the built-in udevd timeout, because it's more transparent
and configurable for users. This way users can avoid the mentioned boot problem
by simply increasing StopTimeoutSec= in systemd-udevd.service.
If udevd is not started by systemd (standalone), this is still an
improvement. udevd will kill hanging workers when the event timeout is
reached, which is configurable via the udev.event_timeout= kernel
command line parameter. Before this patch, udevd would simply exit with
workers still running, which would then become zombie processes.
With the timeout removed, the sd_event_now() assertion in manager_exit() can be
dropped.
Zbigniew Jędrzejewski-Szmek [Tue, 12 Nov 2019 10:49:40 +0000 (11:49 +0100)]
test-unit-name: check that unexpanded specifiers not valid unit name make
Zbigniew Jędrzejewski-Szmek [Tue, 12 Nov 2019 10:47:20 +0000 (11:47 +0100)]
test-unit-name: add usual headers and add more verbose output
This makes it easier to see what unit_name_is_valid() returns at a glance.
The output is not whitespace clean, but I think it's good enough for a test.
Zbigniew Jędrzejewski-Szmek [Tue, 12 Nov 2019 09:28:59 +0000 (10:28 +0100)]
Merge pull request #13862 from zachsmith/systemd-tmpfiles-deprecate-for-force
systemd-tmpfiles: deprecate F for f+
Yu Watanabe [Sun, 10 Nov 2019 05:42:55 +0000 (14:42 +0900)]
udev: do not append newline when write attributes
Before
25de7aa7b90c23d33ea50ada1e50c5834a414237, the content is written
by `fprintf()` without new line. So WRITE_STRING_FILE_AVOID_NEWLINE flag
is necessary.
Fixes #13985.
Zbigniew Jędrzejewski-Szmek [Sun, 10 Nov 2019 11:16:41 +0000 (12:16 +0100)]
meson: apply our -Wno-* options also in c++ calls
We compile some c++ code for tests. We would simply use the default options for
those. When the previous commit raised the default warning level, we started
getting warnings from c++ code. Let's add the most important options to the c++
command, so that we get a compilation without any warnings again.
I don't think it makes sense to add *all* the options that we add for c to the
c++ flags, because testing them takes quite a while, and the c++ compilations
are for small amounts of code, mostly to check that the headers have compatible
syntax.
Zbigniew Jędrzejewski-Szmek [Sun, 10 Nov 2019 10:39:15 +0000 (11:39 +0100)]
meson: use warning_level=2 by default
Let's bump up the warning level, and not add by -Wextra by hand. This is the
approach recommended by meson. The idea is that all projects should be as
similar as possible to make it easier for users to switch between projects.
Zbigniew Jędrzejewski-Szmek [Thu, 7 Nov 2019 10:32:26 +0000 (11:32 +0100)]
meson: avoid bogus meson warning
With meson-0.52.0-1.module_f31+6771+
f5d842eb.noarch I get:
src/test/meson.build:19: WARNING: Overriding previous value of environment variable 'PATH' with a new one
When we're using *prepend*, the whole point is to modify an existing variable,
so meson shouldn't warn. But let's set avoid the warning and shorten things by
setting the final value immediately.
Yu Watanabe [Tue, 12 Nov 2019 05:58:25 +0000 (14:58 +0900)]
udev: ignore error caused by device disconnection
During an add or change event, the device may be disconnected.
Fixes #13976.
Yu Watanabe [Tue, 12 Nov 2019 05:58:19 +0000 (14:58 +0900)]
udev: fix error code in the log message
Yu Watanabe [Tue, 12 Nov 2019 05:57:48 +0000 (14:57 +0900)]
udev: ignore ENOENT when chmod_and_chown() device node
Anita Zhang [Tue, 12 Nov 2019 01:56:56 +0000 (17:56 -0800)]
Merge pull request #13997 from khfeng/hwdb-dell-vostro5581-ish
hwdb: Mark Intel Sensor Hub's accel sensor on Vostro 5581 as being in…
Anita Zhang [Tue, 12 Nov 2019 01:47:43 +0000 (17:47 -0800)]
Merge pull request #13996 from poettering/utc-fix
accept UTC timezone explicitly, even if timezone data is missing
Kevin Kuehler [Tue, 5 Nov 2019 01:20:47 +0000 (17:20 -0800)]
tests: Add capability tests for ProtectKernelLogs
Kevin Kuehler [Tue, 5 Nov 2019 01:18:42 +0000 (17:18 -0800)]
core: Add ProtectKernelLogs
If seccomp is enabled, load the SYSCALL_FILTER_SET_SYSLOG into the
seccomp filter set. Drop the CAP_SYSLOG capability.
Kevin Kuehler [Tue, 5 Nov 2019 01:17:01 +0000 (17:17 -0800)]
shared: Add ProtectKernelLogs property
Add seccomp_protect_syslog, which adds a filter rule for the syslog
system call.
Zbigniew Jędrzejewski-Szmek [Mon, 11 Nov 2019 20:04:25 +0000 (21:04 +0100)]
test-bpf-devices: skip test on !unified
The code in cgroup.c has support for all hierarchies, but the test,
as written, will only work on unified. Since the test is really about
bpf code, and not the legacy devices controller, let's just skip
the test.
Kai-Heng Feng [Mon, 11 Nov 2019 16:30:46 +0000 (00:30 +0800)]
hwdb: Mark Intel Sensor Hub's accel sensor on Vostro 5581 as being in the base
This laptop uses the accelerometer as a freefall sensor, so mark it as
in base to prevent screen rotation.
Lennart Poettering [Mon, 11 Nov 2019 15:56:31 +0000 (16:56 +0100)]
time-util: uniquify timezone list, in case UTC is listed in timezone1970.tab, too
Lennart Poettering [Mon, 11 Nov 2019 15:53:52 +0000 (16:53 +0100)]
time-util: always accept UTC as valid timezone
We already handle it specially in get_timezones(), hence we should OK it
here too, even if the timezone file doesn't actually exist.
Prompted by:
https://serverfault.com/questions/991172/invalid-time-zone-utc
(Yes, Ubuntu should install the UTC timezone data unconditionally: it
should not be an option, even if all other timezone data is excluded,
but since it's our business to validate user input but not out business
to validate distros, let's just accept "UTC" unconditionally, it's magic
after all)
Zbigniew Jędrzejewski-Szmek [Sun, 10 Nov 2019 22:08:21 +0000 (23:08 +0100)]
bpf: make sure the kernel do not submit an invalid program if no pattern matched
It turns out that the kernel verifier would reject a program we would build
if there was a whitelist, but no entries in the whitelist matched.
The program would approximately like this:
0: (61) r2 = *(u32 *)(r1 +0)
1: (54) w2 &= 65535
2: (61) r3 = *(u32 *)(r1 +0)
3: (74) w3 >>= 16
4: (61) r4 = *(u32 *)(r1 +4)
5: (61) r5 = *(u32 *)(r1 +8)
48: (b7) r0 = 0
49: (05) goto pc+1
50: (b7) r0 = 1
51: (95) exit
and insn 50 is unreachable, which is illegal. We would then either keep a
previous version of the program or allow everything. Make sure we build a
valid program that simply rejects everything.
Zbigniew Jędrzejewski-Szmek [Sun, 10 Nov 2019 12:19:51 +0000 (13:19 +0100)]
bpf: optimize device type access away most of the time
Most of the time, we specify the allowed access mode as "rwm", so the check
always trivially passes. In that case, skip the check.
The repeating part changes from:
5: (55) if r2 != 0x2 goto pc+6
6: (bc) w1 = w3
7: (54) w1 &= 7
8: (5d) if r1 != r3 goto pc+3
9: (55) if r4 != 0x1 goto pc+2
10: (55) if r5 != 0x3 goto pc+1
11: (05) goto pc+8
to
6: (55) if r2 != 0x2 goto pc+3
7: (55) if r4 != 0x1 goto pc+2
8: (55) if r5 != 0x3 goto pc+1
9: (05) goto pc+40
Zbigniew Jędrzejewski-Szmek [Sat, 9 Nov 2019 11:32:44 +0000 (12:32 +0100)]
bpf: convert 'c'/'b' to bpf_type at the very end
This makes the code a bit longer, but easier to read I think, because
the cgroup v1 and v2 code paths are more similar. And whent he type is
a char, any backtrace is easier to interpret.
Zbigniew Jędrzejewski-Szmek [Sat, 9 Nov 2019 10:50:25 +0000 (11:50 +0100)]
test-bpf-devices: new test for the devices bpf code
Zbigniew Jędrzejewski-Szmek [Sun, 10 Nov 2019 12:32:36 +0000 (13:32 +0100)]
bpf: fix off-by-one in class whitelisting
We would jump one insn too many, landing in the middle of the subsequent block.