Lennart Poettering [Fri, 21 Oct 2016 18:12:33 +0000 (20:12 +0200)]
core: rework apply_protect_kernel_modules() to use seccomp_add_syscall_filter_set()
Let's simplify this call, by making use of the new infrastructure.
This is actually more in line with Djalal's original patch but instead of
search the filter set in the array by its name we can now use the set index and
jump directly to it.
Lennart Poettering [Fri, 21 Oct 2016 19:50:05 +0000 (21:50 +0200)]
core: rework syscall filter set handling
A variety of fixes:
- rename the SystemCallFilterSet structure to SyscallFilterSet. So far the main
instance of it (the syscall_filter_sets[] array) used to abbreviate
"SystemCall" as "Syscall". Let's stick to one of the two syntaxes, and not
mix and match too wildly. Let's pick the shorter name in this case, as it is
sufficiently well established to not confuse hackers reading this.
- Export explicit indexes into the syscall_filter_sets[] array via an enum.
This way, code that wants to make use of a specific filter set, can index it
directly via the enum, instead of having to search for it. This makes
apply_private_devices() in particular a lot simpler.
- Provide two new helper calls in seccomp-util.c: syscall_filter_set_find() to
find a set by its name, seccomp_add_syscall_filter_set() to add a set to a
seccomp object.
- Update SystemCallFilter= parser to use extract_first_word(). Let's work on
deprecating FOREACH_WORD_QUOTED().
- Simplify apply_private_devices() using this functionality
Lennart Poettering [Fri, 21 Oct 2016 18:05:49 +0000 (20:05 +0200)]
core: move misplaced comment to the right place
Lennart Poettering [Fri, 21 Oct 2016 18:03:51 +0000 (20:03 +0200)]
core: simplify skip_seccomp_unavailable() a bit
Let's prefer early-exit over deep-indented if blocks. Not behavioural change.
Lennart Poettering [Fri, 21 Oct 2016 16:26:30 +0000 (18:26 +0200)]
update-done: minor clean-ups
This is a follow-up for
fb8b0869a7bc30e23be175cf978df23192d59118, and makes a
couple of minor clean-up changes:
- The field name in the timestamp file is changed from "TimestampNSec=" to
"TIMESTAMP_NSEC=". This is done simply to reflect the fact that we parse the
file with the env var file parser, and hence the contents should better
follow the usual capitalization of env vars, i.e. be all uppercase.
- Needless negation of the errno parameter log_error_errno() and friends has
been removed.
- Instead of manually calculating the nsec remainder of the timestamp, use
timespec_store().
- We now check whether we were able to write the timestamp file in full with
fflush_and_check() the way we usually do it.
Lennart Poettering [Mon, 24 Oct 2016 15:20:37 +0000 (17:20 +0200)]
Merge pull request #4459 from keszybz/commandline-parsing
Commandline parsing simplification and udev fix
Djalal Harouni [Mon, 24 Oct 2016 13:46:36 +0000 (15:46 +0200)]
Merge pull request #4469 from endocode/djalal/groups-test
test: lets add more tests to cover SupplementaryGroups= cases.
Lennart Poettering [Mon, 24 Oct 2016 12:19:18 +0000 (14:19 +0200)]
Merge pull request #4406 from jsynacek/jsynacek-is-enabled
shared, systemctl: teach is-enabled to show install targets
Patrik Flykt [Mon, 24 Oct 2016 11:44:01 +0000 (14:44 +0300)]
networkd-ndisc: Don't add NDisc route for local address (#4467)
When systemd-networkd is run on the same IPv6 enabled interface where
radvd is announcing prefixes, a route is being set up pointing to the
interface address. As this will fail with an invalid argument error,
the link is marked as failed and the following message like the
following will appear in in the logs:
systemd-networkd[21459]: eth1: Could not set NDisc route or address: Invalid argument
systemd-networkd[21459]: eth1: Failed
Should the interface be required by systemd-networkd-wait-online,
network-online.target will wait until its timeout hits thereby
significantly delaying system startup.
The fix is to check whether the gateway address obtained from NDisc
messages is equal to any of the interface addresses on the same link
and not set the NDisc route in that case.
Djalal Harouni [Mon, 24 Oct 2016 11:13:06 +0000 (13:13 +0200)]
core: do not assert when sysconf(_SC_NGROUPS_MAX) fails (#4466)
Remove the assert and check the return code of sysconf(_SC_NGROUPS_MAX).
_SC_NGROUPS_MAX maps to NGROUPS_MAX which is defined in <limits.h> to
65536 these days. The value is a sysctl read-only
/proc/sys/kernel/ngroups_max and the kernel assumes that it is always
positive otherwise things may break. Follow this and support only
positive values for all other case return either -errno or -EOPNOTSUPP.
Now if there are systems that want to re-write NGROUPS_MAX then they
should not pass SupplementaryGroups= in units even if it is empty, in
this case nothing fails and we just ignore supplementary groups. However
if SupplementaryGroups= is passed even if it is empty we have to assume
that there will be groups manipulation from our side or the kernel and
since the kernel always assumes that NGROUPS_MAX is positive, then
follow that and support only positive values.
Djalal Harouni [Mon, 24 Oct 2016 10:38:53 +0000 (12:38 +0200)]
test: lets add more tests to cover SupplementaryGroups= cases.
Jan Synacek [Thu, 20 Oct 2016 13:20:11 +0000 (15:20 +0200)]
shared, systemctl: teach is-enabled to show installation targets
It may be desired by users to know what targets a particular service is
installed into. Improve user friendliness by teaching the is-enabled
command to show such information when used with --full.
This patch makes use of the newly added UnitFileFlags and adds
UNIT_FILE_DRY_RUN flag into it. Since the API had already been modified,
it's now easy to add the new dry-run feature for other commands as
well. As a next step, --dry-run could be added to systemctl, which in
turn might pave the way for a long requested dry-run feature when
running systemctl start.
Jan Synacek [Thu, 20 Oct 2016 12:48:33 +0000 (14:48 +0200)]
install: introduce UnitFileFlags
Introduce a new enum to get rid of some boolean arguments of unit_file_*
functions. It unifies the code, makes it a bit cleaner and extensible.
Zbigniew Jędrzejewski-Szmek [Mon, 24 Oct 2016 03:25:57 +0000 (23:25 -0400)]
Merge pull request #4372 from evverx/fix-synced-cgroup-hierarchy-perms
Evgeny Vereshchagin [Thu, 20 Oct 2016 09:16:23 +0000 (09:16 +0000)]
tests/TEST-13-NSPAWN-SMOKE: remove an expected failure check
https://github.com/systemd/systemd/issues/4352 has been fixed
So, we don't need this workaround anymore
Evgeny Vereshchagin [Thu, 20 Oct 2016 09:05:46 +0000 (09:05 +0000)]
nspawn: become a new root early
https://github.com/torvalds/linux/commit/
036d523641c66bef713042894a17f4335f199e49
> vfs: Don't create inodes with a uid or gid unknown to the vfs
It is expected that filesystems can not represent uids and gids from
outside of their user namespace. Keep things simple by not even
trying to create filesystem nodes with non-sense uids and gids.
So, we actually should `reset_uid_gid` early to prevent https://github.com/systemd/systemd/pull/4223#issuecomment-
252522955
$ sudo UNIFIED_CGROUP_HIERARCHY=no LD_LIBRARY_PATH=.libs .libs/systemd-nspawn -D /var/lib/machines/fedora-rawhide -U -b systemd.unit=multi-user.target
Spawning container fedora-rawhide on /var/lib/machines/fedora-rawhide.
Press ^] three times within 1s to kill container.
Child died too early.
Selected user namespace base
1073283072 and range 65536.
Failed to mount to /sys/fs/cgroup/systemd: No such file or directory
Details: https://github.com/systemd/systemd/pull/4223#issuecomment-
253046519
Fixes: #4352
Evgeny Vereshchagin [Thu, 20 Oct 2016 09:03:40 +0000 (09:03 +0000)]
nspawn: really lchown(uid/gid)
https://github.com/systemd/systemd/pull/4372#issuecomment-
253723849:
* `mount_all (outer_child)` creates `container_dir/sys/fs/selinux`
* `mount_all (outer_child)` doesn't patch `container_dir/sys/fs` and so on.
* `mount_sysfs (inner_child)` tries to create `/sys/fs/cgroup`
* This fails
370 stat("/sys/fs", {st_dev=makedev(0, 28), st_ino=13880, st_mode=S_IFDIR|0755, st_nlink=3, st_uid=65534, st_gid=65534, st_blksize=4096, st_blocks=0, st_size=60, st_atime=2016/10/14-05:16:43.
398665943, st_mtime=2016/10/14-05:16:43.
399665943, st_ctime=2016/10/14-05:16:43.
399665943}) = 0
370 mkdir("/sys/fs/cgroup", 0755) = -1 EACCES (Permission denied)
* `mount_syfs (inner_child)` ignores that error and
mount(NULL, "/sys", NULL, MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_BIND, NULL) = 0
* `mount_cgroups` finally fails
Evgeny Vereshchagin [Thu, 20 Oct 2016 09:01:45 +0000 (09:01 +0000)]
basic: fallback to the fstat if we don't have access to the /proc/self/fdinfo
https://github.com/systemd/systemd/pull/4372#discussion_r83354107:
I get `open("/proc/self/fdinfo/13", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)`
327 mkdir("/proc", 0755 <unfinished ...>
327 <... mkdir resumed> ) = -1 EEXIST (File exists)
327 stat("/proc", <unfinished ...>
327 <... stat resumed> {st_dev=makedev(8, 1), st_ino=28585, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=4, st_size=1024, st_atime=2016/10/14-02:55:32, st_mtime=2016/
327 mount("proc", "/proc", "proc", MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL <unfinished ...>
327 <... mount resumed> ) = 0
327 lstat("/proc", <unfinished ...>
327 <... lstat resumed> {st_dev=makedev(0, 34), st_ino=1, st_mode=S_IFDIR|0555, st_nlink=75, st_uid=65534, st_gid=65534, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2016/10/14-03:13:35.
971031263,
327 lstat("/proc/sys", {st_dev=makedev(0, 34), st_ino=
4026531855, st_mode=S_IFDIR|0555, st_nlink=1, st_uid=65534, st_gid=65534, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2016/10/14-03:13:39.1630
327 openat(AT_FDCWD, "/proc", O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_PATH) = 11</proc>
327 name_to_handle_at(11</proc>, "sys", {handle_bytes=128}, 0x7ffe3a238604, AT_SYMLINK_FOLLOW) = -1 EOPNOTSUPP (Operation not supported)
327 name_to_handle_at(11</proc>, "", {handle_bytes=128}, 0x7ffe3a238608, AT_EMPTY_PATH) = -1 EOPNOTSUPP (Operation not supported)
327 openat(11</proc>, "sys", O_RDONLY|O_CLOEXEC|O_PATH) = 13</proc/sys>
327 open("/proc/self/fdinfo/13", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
327 close(13</proc/sys> <unfinished ...>
327 <... close resumed> ) = 0
327 close(11</proc> <unfinished ...>
327 <... close resumed> ) = 0
-bash-4.3# ls -ld /proc/
dr-xr-xr-x 76 65534 65534 0 Oct 14 02:57 /proc/
-bash-4.3# ls -ld /proc/1
dr-xr-xr-x 9 root root 0 Oct 14 02:57 /proc/1
-bash-4.3# ls -ld /proc/1/fdinfo
dr-x------ 2 65534 65534 0 Oct 14 03:00 /proc/1/fdinfo
Zbigniew Jędrzejewski-Szmek [Sun, 23 Oct 2016 22:54:20 +0000 (18:54 -0400)]
Merge pull request #4373 from endocode/djalal/fix-mountflags
Djalal Harouni [Fri, 21 Oct 2016 20:22:56 +0000 (22:22 +0200)]
core: lets move the setup of working directory before group enforce
This is minor but lets try to split and move bit by bit cgroups and
portable environment setup before applying the security context.
Djalal Harouni [Mon, 17 Oct 2016 08:06:18 +0000 (10:06 +0200)]
test: add more tests for SupplementaryGroups=
Djalal Harouni [Fri, 14 Oct 2016 08:32:27 +0000 (10:32 +0200)]
test: Add simple test for supplementary groups
Djalal Harouni [Sun, 23 Oct 2016 21:24:14 +0000 (23:24 +0200)]
core: first lookup and cache creds then apply them after namespace setup
This fixes: https://github.com/systemd/systemd/issues/4357
Let's lookup and cache creds then apply them. We also switch from
getgroups() to getgrouplist().
Zbigniew Jędrzejewski-Szmek [Sun, 23 Oct 2016 03:16:11 +0000 (23:16 -0400)]
Merge pull request #4428 from lnykryn/ctrl_v2
rename failure-action to emergency-action and use it for ctrl+alt+del burst
Zbigniew Jędrzejewski-Szmek [Sat, 22 Oct 2016 19:31:14 +0000 (15:31 -0400)]
tree-wide: make parse_proc_cmdline() strip "rd." prefix automatically
This stripping is contolled by a new boolean parameter. When the parameter
is true, it means that the caller does not care about the distinction between
initrd and real root, and wants to act on both rd-dot-prefixed and unprefixed
parameters in the initramfs, and only on the unprefixed parameters in real
root. If the parameter is false, behaviour is the same as before.
Changes by caller:
log.c (systemd.log_*): changed to accept rd-dot-prefix params
pid1: no change, custom logic
cryptsetup-generator: no change, still accepts rd-dot-prefix params
debug-generator: no change, does not accept rd-dot-prefix params
fsck: changed to accept rd-dot-prefix params
fstab-generator: no change, custom logic
gpt-auto-generator: no change, custom logic
hibernate-resume-generator: no change, does not accept rd-dot-prefix params
journald: changed to accept rd-dot-prefix params
modules-load: no change, still accepts rd-dot-prefix params
quote-check: no change, does not accept rd-dot-prefix params
udevd: no change, still accepts rd-dot-prefix params
I added support for "rd." params in the three cases where I think it's
useful: logging, fsck options, journald forwarding options.
Zbigniew Jędrzejewski-Szmek [Sat, 22 Oct 2016 18:38:49 +0000 (14:38 -0400)]
udev: change kernel commandline option parsing
- do not crash if an option without value is specified on the kernel command
line, e.g. "udev.log-priority" :P
- simplify the code a bit
- warn about unknown "udev.*" options — this should make it easier to spot
typos and reduce user confusion
Zbigniew Jędrzejewski-Szmek [Sat, 22 Oct 2016 18:25:30 +0000 (14:25 -0400)]
journald: convert journald to use parse_proc_cmdline
This makes journald use the common option parsing functionality.
One behavioural change is implemented:
"systemd.journald.forward_to_syslog" is now equivalent to
"systemd.journald.forward_to_syslog=1".
I think it's nicer to use this way.
Zbigniew Jędrzejewski-Szmek [Sat, 22 Oct 2016 18:24:52 +0000 (14:24 -0400)]
tree-wide: allow state to be passed through to parse_proc_cmdline_item
No functional change.
Daniel Mack [Sat, 22 Oct 2016 18:01:02 +0000 (20:01 +0200)]
Merge pull request #4455 from endocode/dongsu/l10n-catalog-korean
catalog: add more Korean translations
Dongsu Park [Sat, 22 Oct 2016 15:29:38 +0000 (17:29 +0200)]
catalog: add more Korean translations
Add more Korean translations of journal and DNSSEC log messages.
Dongsu Park [Sat, 22 Oct 2016 15:29:33 +0000 (17:29 +0200)]
catalog: fix typo and make a clear sentence
Fix typo: s/ournald.conf/journald.conf/
Change also "시스템의 다음 위치에" to "시스템을 별도 위치에" to make
a clear sentence.
Thomas Hindoe Paaboel Andersen [Sat, 22 Oct 2016 12:01:20 +0000 (14:01 +0200)]
journal: remove unused variable
Michael Biebl [Sat, 22 Oct 2016 13:31:58 +0000 (15:31 +0200)]
Merge pull request #4452 from jwilk/spelling
NEWS: fix typos
Jakub Wilk [Sat, 22 Oct 2016 11:18:17 +0000 (13:18 +0200)]
NEWS: fix typos
Umut Tezduyar Lindskog [Fri, 21 Oct 2016 23:40:55 +0000 (01:40 +0200)]
journald: systemd.journald.max_level_* kernel command line options (#4427)
The log forward levels can be configured through kernel command line.
Djalal Harouni [Fri, 21 Oct 2016 22:43:36 +0000 (00:43 +0200)]
NEWS: option is ProtectKernelTunables not ProtectedKernelTunables (#4451)
Daniel Mack [Fri, 21 Oct 2016 14:22:15 +0000 (16:22 +0200)]
Merge pull request #4447 from poettering/oneshotassertfix
core: if the start command vanishes during runtime don't hit an assert
Lukas Nykryn [Tue, 18 Oct 2016 10:16:32 +0000 (12:16 +0200)]
core: use emergency_action for ctr+alt+del burst
Fixes #4306
Lukas Nykryn [Thu, 20 Oct 2016 13:27:37 +0000 (15:27 +0200)]
failure-action: generalize failure action to emergency action
Djalal Harouni [Fri, 21 Oct 2016 11:25:23 +0000 (13:25 +0200)]
NEWS: update NEWS about ProtectKernelModules= option (#4445)
Lennart Poettering [Fri, 21 Oct 2016 11:24:09 +0000 (13:24 +0200)]
Merge pull request #4419 from keszybz/install-specifiers
Fix expansion of %i, %u, %N, %n install specifiers
Peter Hutterer [Fri, 21 Oct 2016 10:31:32 +0000 (20:31 +1000)]
hwdb: add MOUSE_WHEEL_CLICK_COUNT for non-integer click angles (#4440)
MOUSE_WHEEL_CLICK_ANGLE has been an integer, and at least libinput (probably
the only user) parses it as strict integer. For backwards compatibility, we
cannot change it to a decimal number now.
Add a new property to list the number of clicks for a full 360 degree
rotation, to be specified in addition to the old click angle property. Clients
can prefer the new one where available and calculate the decimal value to
whatever precision they want.
Evgeny Vereshchagin [Fri, 21 Oct 2016 10:30:45 +0000 (13:30 +0300)]
sysusers: fix memleak (#4443)
Fixes:
Oct 20 09:10:49 systemd-sysusers[144]: Direct leak of 20 byte(s) in 1 object(s) allocated from:
Oct 20 09:10:49 systemd-sysusers[144]: #0 0x7f3565a13e60 in malloc (/lib64/libasan.so.3+0xc6e60)
Oct 20 09:10:49 systemd-sysusers[144]: #1 0x7f3565526bd0 in malloc_multiply src/basic/alloc-util.h:70
Oct 20 09:10:49 systemd-sysusers[144]: #2 0x7f356552cb55 in tempfn_xxxxxx src/basic/fileio.c:1116
Oct 20 09:10:49 systemd-sysusers[144]: #3 0x7f356552c4f0 in fopen_temporary src/basic/fileio.c:1042
Oct 20 09:10:49 systemd-sysusers[144]: #4 0x7f356555e00e in fopen_temporary_label src/basic/fileio-label.c:63
Oct 20 09:10:49 systemd-sysusers[144]: #5 0x56197c4a1766 in make_backup src/sysusers/sysusers.c:209
Oct 20 09:10:49 systemd-sysusers[144]: #6 0x56197c4a6335 in write_files src/sysusers/sysusers.c:710
Oct 20 09:10:49 systemd-sysusers[144]: #7 0x56197c4ae571 in main src/sysusers/sysusers.c:1817
Oct 20 09:10:49 systemd-sysusers[144]: #8 0x7f3564dee730 in __libc_start_main (/lib64/libc.so.6+0x20730)
Lennart Poettering [Fri, 21 Oct 2016 10:27:46 +0000 (12:27 +0200)]
core: if the start command vanishes during runtime don't hit an assert
This can happen when the configuration is changed and reloaded while we are
executing a service. Let's not hit an assert in this case.
Fixes: #4444
Zbigniew Jędrzejewski-Szmek [Fri, 21 Oct 2016 06:17:16 +0000 (02:17 -0400)]
Revert "add networkd dbus lease info" (#4435)
Zbigniew Jędrzejewski-Szmek [Fri, 21 Oct 2016 03:03:26 +0000 (23:03 -0400)]
nspawn, NEWS: add missing "s" in --private-users-chown (#4438)
Evgeny Vereshchagin [Thu, 20 Oct 2016 18:23:32 +0000 (21:23 +0300)]
sysusers: fix memleak (#4430)
Fixes:
```
==28075== 64 bytes in 1 blocks are definitely lost in loss record 2 of 3
==28075== at 0x4C2BAEE: malloc (vg_replace_malloc.c:298)
==28075== by 0x4C2DCA1: realloc (vg_replace_malloc.c:785)
==28075== by 0x4ED40A2: greedy_realloc (alloc-util.c:57)
==28075== by 0x4E90F87: extract_first_word (extract-word.c:78)
==28075== by 0x4E91813: extract_many_words (extract-word.c:270)
==28075== by 0x10FE93: parse_line (sysusers.c:1325)
==28075== by 0x11198B: read_config_file (sysusers.c:1640)
==28075== by 0x111EB8: main (sysusers.c:1773)
==28075==
```
Lennart Poettering [Thu, 20 Oct 2016 17:20:22 +0000 (19:20 +0200)]
update-utmp: let's use STR_IN_SET() where it is pretty
Lennart Poettering [Thu, 20 Oct 2016 17:19:46 +0000 (19:19 +0200)]
logind: don't hit assert when we try to free NULL manager object
Fixes: #4431
Lennart Poettering [Thu, 20 Oct 2016 17:19:34 +0000 (19:19 +0200)]
update TODO
Lennart Poettering [Thu, 20 Oct 2016 17:36:28 +0000 (19:36 +0200)]
sysctl: run sysctl service if /proc/sys/net is writable (#4425)
This simply changes this line:
ConditionPathIsReadWrite=/proc/sys/
to this:
ConditionPathIsReadWrite=/proc/sys/net/
The background for this is that the latter is namespaced through network
namespacing usually and hence frequently set as writable in containers, even
though the former is kept read-only. If /proc/sys is read-only but
/proc/sys/net is writable we should run the sysctl service, as useful settings
may be made in this case.
Fixes: #4370
Lennart Poettering [Thu, 20 Oct 2016 15:45:27 +0000 (17:45 +0200)]
units: extend stop timeout for user@.service to 120s (#4426)
By default all user and all system services get stop timeouts for 90s. This is
problematic as the user manager of course is run as system service. Thus, if
the default time-out is hit for any user service, then it will also be hit for
user@.service as a whole, thus making the whole concept useless for user
services.
This patch extends the stop timeout to 120s for user@.service hence, so that
that the user service manager has ample time to process user services timing
out.
(The other option would have been to shorten the default user service timeout,
but I think a user service should get the same timeout by default as a system
service)
Fixes: #4206
Evgeny Vereshchagin [Thu, 20 Oct 2016 15:44:30 +0000 (18:44 +0300)]
tests: fix memleak in test-calendarspec (#4424)
Fixes:
```
==10750==
==10750== HEAP SUMMARY:
==10750== in use at exit: 96 bytes in 3 blocks
==10750== total heap usage: 1,711 allocs, 1,708 frees, 854,545 bytes
allocated
==10750==
==10750== 96 (64 direct, 32 indirect) bytes in 1 blocks are definitely
lost in loss record 3 of 3
==10750== at 0x4C2DA60: calloc (vg_replace_malloc.c:711)
==10750== by 0x4EB3BDA: calendar_spec_from_string
(calendarspec.c:771)
==10750== by 0x109675: test_hourly_bug_4031 (test-calendarspec.c:118)
==10750== by 0x10A00E: main (test-calendarspec.c:202)
==10750==
==10750== LEAK SUMMARY:
==10750== definitely lost: 64 bytes in 1 blocks
==10750== indirectly lost: 32 bytes in 2 blocks
==10750== possibly lost: 0 bytes in 0 blocks
==10750== still reachable: 0 bytes in 0 blocks
==10750== suppressed: 0 bytes in 0 blocks
==10750==
==10750== For counts of detected and suppressed errors, rerun with: -v
==10750== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
```
Martin Pitt [Thu, 20 Oct 2016 15:43:42 +0000 (17:43 +0200)]
Merge pull request #4418 from keszybz/autogen-params
Allow ./autogen.sh to take parameters for configure
Zbigniew Jędrzejewski-Szmek [Thu, 20 Oct 2016 13:35:40 +0000 (09:35 -0400)]
Merge pull request #4414 from poettering/consolesakcomment
three minor fixes: document /dev/console/SAK handling + another cgroups wording fix + document User= default
Zbigniew Jędrzejewski-Szmek [Thu, 20 Oct 2016 04:27:46 +0000 (00:27 -0400)]
shared/install: fix %u expansion when running under sudo
Test case:
[Install]
DefaultInstance=bond1
WantedBy= foobar-U-%U.device
WantedBy= foobar-u-%u.device
$ sudo systemctl --root=/ enable testing4@.service
(before)
Created symlink /etc/systemd/system/foobar-U-0.device.wants/testing4@bond1.service → /etc/systemd/system/testing4@.service.
Created symlink /etc/systemd/system/foobar-u-zbyszek.device.wants/testing4@bond1.service → /etc/systemd/system/testing4@.service.
(after)
Created symlink /etc/systemd/system/foobar-U-0.device.wants/testing4@bond1.service → /etc/systemd/system/testing4@.service.
Created symlink /etc/systemd/system/foobar-u-root.device.wants/testing4@bond1.service → /etc/systemd/system/testing4@.service.
It doesn't make much sense to use a different user for %U and %u.
Zbigniew Jędrzejewski-Szmek [Thu, 20 Oct 2016 04:27:46 +0000 (00:27 -0400)]
shared/install: fix DefaultInstance expansion in %n, %N
We should substitute DefaultInstance if the instance is not specified.
Test case:
[Install]
DefaultInstance=bond1
WantedBy= foobar-n-%n.device
WantedBy= foobar-N-%N.device
$ systemctl --root=/ enable testing4@.service
Created symlink /etc/systemd/system/foobar-n-testing4@bond1.service.device.wants/testing4@bond1.service → /etc/systemd/system/testing4@.service.
Created symlink /etc/systemd/system/foobar-N-testing4@bond1.device.wants/testing4@bond1.service → /etc/systemd/system/testing4@.service.
(before, the symlink would be created with empty %n, %N parts).
Zbigniew Jędrzejewski-Szmek [Thu, 20 Oct 2016 04:27:46 +0000 (00:27 -0400)]
shared/install: fix DefaultInstance expansion in %i
We should substitute DefaultInstance if the instance is not specified.
Test case:
[Install]
DefaultInstance=bond1
WantedBy= foobar-i-%i.device
$ systemctl --root=/ enable testing4@.service
Created symlink /etc/systemd/system/foobar-i-bond1.device.wants/testing4@bond1.service
→ /etc/systemd/system/testing4@.service.
(before, the symlink would be created as
/etc/systemd/system/foobar-i-.device.wants/testing4@bond1.service)
Fixes #4411.
Lennart Poettering [Wed, 19 Oct 2016 21:40:31 +0000 (23:40 +0200)]
man: document default for User=
Replaces: #4375
Lennart Poettering [Wed, 19 Oct 2016 21:30:50 +0000 (23:30 +0200)]
journald,core: add short comments we we keep reopening /dev/console all the time
Just to make sure the next one reading this isn't surprised that the fd isn't
kept open. SAK and stuff...
Fix suggested:
https://github.com/systemd/systemd/pull/4366#issuecomment-
253659162
Lennart Poettering [Tue, 18 Oct 2016 14:18:08 +0000 (16:18 +0200)]
man: one more cgroup wording fix
Lennart Poettering [Thu, 20 Oct 2016 11:10:37 +0000 (13:10 +0200)]
Merge pull request #4417 from keszybz/man-and-rlimit
Two unrelated patches: man page tweaks and rlimit log levels
Marcel Holtmann [Thu, 20 Oct 2016 08:24:18 +0000 (10:24 +0200)]
hwdb: Update database of Bluetooth company identifiers
Zbigniew Jędrzejewski-Szmek [Thu, 20 Oct 2016 02:57:02 +0000 (22:57 -0400)]
build-sys: show configure and make commands
And also hide make clean output which is very verbose and not particularly
interesting.
Zbigniew Jędrzejewski-Szmek [Thu, 20 Oct 2016 02:49:22 +0000 (22:49 -0400)]
build-sys: allow autogen.sh to take configure params
It is sometimes nice to run autogen with some configure parameters.
For example:
./autogen.sh c --disable-manpages
So pass any extra args after the [cgals] verb to the configure command.
Also, check that the verb is correct (empty or one of the known letters)
before doing any non-trivial work.
Zbigniew Jędrzejewski-Szmek [Tue, 18 Oct 2016 17:38:41 +0000 (13:38 -0400)]
pid1: downgrade some rlimit warnings
Since we ignore the result anyway, downgrade errors to warning.
log_oom() will still emit an error, but that's mostly theoretical, so it
is not worth complicating the code to avoid the small inconsistency
Lennart Poettering [Wed, 19 Oct 2016 23:48:35 +0000 (01:48 +0200)]
core: let's upgrade the log level for service processes dying of signal (#4415)
As suggested in
https://github.com/systemd/systemd/pull/4367#issuecomment-
253670328
Lennart Poettering [Wed, 19 Oct 2016 22:10:08 +0000 (00:10 +0200)]
Merge pull request #4360 from fbuihuu/journald-fix-flush-when-restarting
Journald fix flush when restarting (#4190)
Lucas Werkmeister [Wed, 19 Oct 2016 21:21:26 +0000 (23:21 +0200)]
man: document dependencies implied by Sockets= (#4412)
Fixes #4410. Also includes two minor improvements to the previous
sentence.
Lennart Poettering [Wed, 19 Oct 2016 19:35:39 +0000 (21:35 +0200)]
Merge pull request #4378 from evverx/nspawn-smoke-test
tests: add smoke test for systemd-nspawn
Lennart Poettering [Wed, 19 Oct 2016 19:33:32 +0000 (21:33 +0200)]
Merge pull request #4390 from keszybz/install-specifiers
Various install-related tweaks
Evgeny Vereshchagin [Wed, 19 Oct 2016 19:15:20 +0000 (22:15 +0300)]
bootctl: don't try to remove esp_path (#4407)
This is a follow-up for
9ee051b9c7623
Yu Watanabe [Wed, 19 Oct 2016 11:50:47 +0000 (20:50 +0900)]
boot: fix `bootctl install` segfault (#4404)
Franck Bui [Wed, 12 Oct 2016 08:09:45 +0000 (10:09 +0200)]
journal: rename determine_space_for() into cache_space_refresh()
Now that determine_space_for() only deals with storage space (cached) values,
rename it so it reflects the fact that only the cached storage space values are
updated.
Franck Bui [Wed, 12 Oct 2016 07:58:10 +0000 (09:58 +0200)]
journal: introduce patch_min_use() helper
Updating min_use is rather an unusual operation that is limited when we first
open the journal files, therefore extracts it from determine_space_for() and
create a function of its own and call this new function when needed.
determine_space_for() is now dealing with storage space (cached) values only.
There should be no functional changes.
Franck Bui [Wed, 12 Oct 2016 07:05:55 +0000 (09:05 +0200)]
journal: introduce cache_space_invalidate()
Introduce a dedicated helper in order to reset the storage space cache.
Franck Bui [Wed, 12 Oct 2016 06:58:04 +0000 (08:58 +0200)]
journal: cache used vfs stats as well
The set of storage space values we cache are calculated according to a couple
of filesystem statistics (free blocks, block size).
This patch caches the vfs stats we're interested in so these values are
available later and coherent with the rest of the space cached values.
Franck Bui [Tue, 11 Oct 2016 14:51:37 +0000 (16:51 +0200)]
journal: don't emit space usage message when opening the journal (#4190)
This patch makes system_journal_open() stop emitting the space usage
message. The caller is now free to emit this message when appropriate.
When restarting the journal, we can now emit the message *after*
flushing the journal (if required) so that all flushed log entries are
written in the persistent journal *before* the status message.
This is required since the status message is always younger than the
flushed entries.
Fixes #4190.
Franck Bui [Tue, 11 Oct 2016 14:46:16 +0000 (16:46 +0200)]
journal: introduce server_space_usage_message()
This commit simply extracts from determine_space_for() the code which emits the
storage usage message and put it into a function of its own so it can be reused
by others paths later.
No functional changes.
Franck Bui [Tue, 4 Oct 2016 15:13:21 +0000 (17:13 +0200)]
journal: introduce JournalStorage and JournalStorageSpace structures
This structure keeps track of specificities for a given journal type
(persistent or volatile) such as metrics, name, etc...
The cached space values are now moved in this structure so that each
journal has its own set of cached values.
Previously only one set existed and we didn't know if the cached
values were for the runtime journal or the persistent one.
When doing:
determine_space_for(s, runtime_metrics, ...);
determine_space_for(s, system_metrics, ...);
the second call returned the cached values for the runtime metrics.
Franck Bui [Mon, 3 Oct 2016 16:12:41 +0000 (18:12 +0200)]
journal: introduce determine_path_usage()
This commit simply extracts from determine_space_for() the code which
determines the FS usage where the passed path lives (statvfs(3)) and put it
into a function of its own so it can be reused by others paths later.
No functional changes.
Zbigniew Jędrzejewski-Szmek [Mon, 17 Oct 2016 02:57:38 +0000 (22:57 -0400)]
shared/install: report invalid unit files slightly better
When a unit file is invalid, we'd return an error without any details:
$ systemctl --root=/ enable testing@instance.service
Failed to enable: Invalid argument.
Fix things to at least print the offending file name:
$ systemctl enable testing@instance.service
Failed to enable unit: File testing@instance.service: Invalid argument
$ systemctl --root=/ enable testing@instance.service
Failed to enable unit, file testing@instance.service: Invalid argument.
A real fix would be to pass back a proper error message from conf-parser.
But this would require major surgery, since conf-parser functions now
simply print log errors, but we would need to return them over the bus.
So let's just print the file name, to indicate where the error is.
(Incomplete) fix for #4210.
Zbigniew Jędrzejewski-Szmek [Mon, 17 Oct 2016 01:40:41 +0000 (21:40 -0400)]
shared/install: resolve specifiers in Also=
Test case:
[Install]
WantedBy= default.target
Also=getty@%p.service
$ ./systemctl --root=/ enable testing@instance.service
Created symlink /etc/systemd/system/default.target.wants/testing@instance.service → /etc/systemd/system/testing@.service.
Created symlink /etc/systemd/system/getty.target.wants/getty@testing.service → /usr/lib/systemd/system/getty@.service.
$ ./systemctl --root=/ disable testing@instance.service
Removed /etc/systemd/system/getty.target.wants/getty@testing.service.
Removed /etc/systemd/system/default.target.wants/testing@instance.service.
Fixes part of #4210.
Resolving specifiers in DefaultInstance seems to work too:
[Install]
WantedBy= default.target
DefaultInstance=%u
$ systemctl --root=/ enable testing3@instance.service
Created symlink /etc/systemd/system/default.target.wants/testing3@instance.service → /etc/systemd/system/testing3@.service.
$ systemctl --root=/ enable testing3@.service
Created symlink /etc/systemd/system/default.target.wants/testing3@zbyszek.service → /etc/systemd/system/testing3@.service.
Zbigniew Jędrzejewski-Szmek [Mon, 17 Oct 2016 01:27:57 +0000 (21:27 -0400)]
shared/install: provide more info if install_info_traverse_fails
Test case:
[Install]
WantedBy= default.target
Also=foobar-unknown.service
Before:
$ systemctl --root=/ enable testing2@instance.service
Failed to enable: No such file or directory.
After
$ ./systemctl --root=/ enable testing2@instance.service
Failed to enable unit, file foobar-unknown.service: No such file or directory.
Zbigniew Jędrzejewski-Szmek [Mon, 17 Oct 2016 00:56:31 +0000 (20:56 -0400)]
shared/install: in install_context_mark_for_removal ignore not found units
With the following test case:
[Install]
WantedBy= default.target
Also=foobar-unknown.service
disabling would fail with:
$ ./systemctl --root=/ disable testing.service
Cannot find unit foobar-unknown.service. # this is level debug
Failed to disable: No such file or directory. # this is the error
After the change we proceed:
$ ./systemctl --root=/ disable testing.service
Cannot find unit foobar-unknown.service.
Removed /etc/systemd/system/default.target.wants/testing.service.
This does not affect specifying a missing unit directly:
$ ./systemctl --root=/ disable nosuch.service
Failed to disable: No such file or directory.
Lennart Poettering [Tue, 18 Oct 2016 15:03:40 +0000 (17:03 +0200)]
Merge pull request #4382 from keszybz/unit-type-underline
systemctl: use underlines to seperate unit types in listing
Susant Sahani [Tue, 18 Oct 2016 03:19:08 +0000 (08:49 +0530)]
networkd: use proper cast to access VTI6 (#4399)
Fixes #4371.
Luca Bruno [Tue, 18 Oct 2016 00:05:49 +0000 (00:05 +0000)]
core/exec: add a named-descriptor option ("fd") for streams (#4179)
This commit adds a `fd` option to `StandardInput=`,
`StandardOutput=` and `StandardError=` properties in order to
connect standard streams to externally named descriptors provided
by some socket units.
This option looks for a file descriptor named as the corresponding
stream. Custom names can be specified, separated by a colon.
If multiple name-matches exist, the first matching fd will be used.
Zbigniew Jędrzejewski-Szmek [Sun, 16 Oct 2016 00:51:19 +0000 (20:51 -0400)]
README: list dependencies for testing
Fixes #4365.
Evgeny Vereshchagin [Fri, 14 Oct 2016 18:42:46 +0000 (18:42 +0000)]
tests: add smoke test for systemd-nspawn
Basically, this test runs:
```
systemd-nspawn --register=no -D "$_root" -b
systemd-nspawn --register=no -D "$_root" --private-network -b
systemd-nspawn --register=no -D "$_root" -U -b
systemd-nspawn --register=no -D "$_root" --private-network -U -b
```
and exports the `UNIFIED_CGROUP_HIERARCHY=[yes|no]`, `SYSTEMD_NSPAWN_USE_CGNS=[yes|no]`
Inspired by
* systemd#3589 (comment)
* systemd#4372 (comment)
* systemd#4223 (comment)
* systemd#1555
and so on :-)
Zbigniew Jędrzejewski-Szmek [Mon, 17 Oct 2016 16:22:44 +0000 (12:22 -0400)]
man: add a note that NULL "s" arg for sd_bus_message_append
Zbigniew Jędrzejewski-Szmek [Mon, 17 Oct 2016 15:48:12 +0000 (11:48 -0400)]
terminal-util: helper macro for highlighting functions
Zbigniew Jędrzejewski-Szmek [Mon, 17 Oct 2016 15:37:55 +0000 (11:37 -0400)]
systemctl: ditto for list-unit-files
Zbigniew Jędrzejewski-Szmek [Mon, 17 Oct 2016 15:37:41 +0000 (11:37 -0400)]
systemctl: use underlines to seperate unit types in listing
(printf("%.*s", -1, "…") is the same as not specifying the precision at all.)
v2: also underline highlighted (failing) units
Fixes #4137.
Lennart Poettering [Mon, 17 Oct 2016 13:50:26 +0000 (15:50 +0200)]
man: avoid abbreviated "cgroups" terminology (#4396)
Let's avoid the overly abbreviated "cgroups" terminology. Let's instead write:
"Linux Control Groups (cgroups)" is the long form wherever the term is
introduced in prose. Use "control groups" in the short form wherever the term
is used within brief explanations.
Follow-up to: #4381
llua [Mon, 17 Oct 2016 12:35:26 +0000 (08:35 -0400)]
zsh-completion: fix for #4318 (#4394)
Escape unit names for the eval call in _call_program
The value of the Id property is transformed back into a unit name
usable by systemctl.
system-systemd\x5cx2dcryptsetup.slice -> system-systemd\x2dcryptsetup.slice
Also filter units by property via parameter expansion, not a for loop
Lennart Poettering [Mon, 17 Oct 2016 10:58:55 +0000 (12:58 +0200)]
Merge pull request #4392 from keszybz/running-timers
Fix for display of elapsed timers
Lennart Poettering [Mon, 17 Oct 2016 09:36:25 +0000 (11:36 +0200)]
Merge pull request #4387 from keszybz/loginctl-tty
loginctl: print TTY field in the session listing
Zbigniew Jędrzejewski-Szmek [Mon, 17 Oct 2016 01:20:08 +0000 (21:20 -0400)]
shared/install: do not break loop when we enounter a dangling symlink
We should ignore that unit, but otherwise continue.
Zbigniew Jędrzejewski-Szmek [Sun, 16 Oct 2016 23:44:40 +0000 (19:44 -0400)]
man: mention that systemctl --root=/ operates on the fs directly