Sylvain Plantefève [Wed, 18 Oct 2017 22:26:52 +0000 (00:26 +0200)]
po: update french translation
Sylvain Plantefève [Wed, 18 Oct 2017 22:26:27 +0000 (00:26 +0200)]
catalog: update french translation
Zbigniew Jędrzejewski-Szmek [Wed, 18 Oct 2017 16:47:34 +0000 (18:47 +0200)]
man: describe how machine-id should be initialized (#7051)
Lennart Poettering [Wed, 18 Oct 2017 13:15:29 +0000 (21:15 +0800)]
Merge pull request #7078 from keszybz/cryptsetup-netdev-fixes
Cryptsetup _netdev fixes
Zbigniew Jędrzejewski-Szmek [Wed, 18 Oct 2017 13:14:46 +0000 (15:14 +0200)]
units: make remote-cryptsetup.target also after cryptsetup-pre.target
This way people can order units before cryptsetup-pre.target and
have them run before any cryptsetup-related stuff.
Susant Sahani [Wed, 18 Oct 2017 10:38:56 +0000 (16:08 +0530)]
networkd: don't stop the dhcp server if it's not configured. (#7083)
we call sd_dhcp_server_stop even if it's not configured when link is
down resulting unwanted logs.
```
Oct 10 13:41:07 nena systemd-networkd[126]: eth0: Lost carrier
Oct 10 13:41:07 nena systemd-networkd[126]: DHCP CLIENT (0x560f2dc5): STOPPED
Oct 10 13:41:07 nena systemd-networkd[126]: eth0: DHCP lease lost
Oct 10 13:41:07 nena systemd-networkd[126]: NDISC: Stopping IPv6 Router Solicitation client
Oct 10 13:41:07 nena systemd-networkd[126]: Assertion 'server' failed at ../src/libsystemd-network/sd-dhcp-server.c:256, function sd_dhcp_server_stop(). Ignoring.
```
fixes #7047
Susant Sahani [Wed, 18 Oct 2017 09:12:59 +0000 (14:42 +0530)]
networkd: Consider linkLocalAddressing state while configuring ndisc. (#7012)
If linkLocalAddressing is disabled in for the interface still then
we look for ndisc configured or not in link_check_ready.
Link local is used automatic address configuration and neighbor discovery protocol.
If link local is disabled we should not configure ndisc.
Fixes #2713, #6441, #5841.
Lubomir Rintel [Wed, 18 Oct 2017 06:38:50 +0000 (08:38 +0200)]
core: fragments of masked units ought not be considered for NeedDaemonReload (#7060)
The units that are not loaded don't have dropin_paths set. This
currently results in units that have fragments to always have
NeedDaemonReload=true when masked:
$ find {/usr/lib,/run/user/8086}/systemd/user/meh.service* |xargs ls -ld
lrwxrwxrwx. 1 lkundrak lkundrak 9 Oct 11 11:19 /run/user/8086/systemd/user/meh.service -> /dev/null
-rw-rw-r--. 1 root root 49 Oct 11 10:16 /usr/lib/systemd/user/meh.service
drwxrwxr-x. 2 root root 4096 Oct 11 10:50 /usr/lib/systemd/user/meh.service.d
-rw-rw-r--. 1 root root 666 Oct 11 10:50 /usr/lib/systemd/user/meh.service.d/override.conf
$ systemctl --user daemon-reload
$ busctl --user get-property org.freedesktop.systemd1 \
/org/freedesktop/systemd1/unit/meh_2eservice \
org.freedesktop.systemd1.Unit NeedDaemonReload
b true
Zbigniew Jędrzejewski-Szmek [Wed, 18 Oct 2017 06:37:12 +0000 (08:37 +0200)]
Merge pull request #7059 from yuwata/dynamic-user-7013
dynamic-user: permit the case static uid and gid are different
Yu Watanabe [Wed, 18 Oct 2017 06:30:35 +0000 (15:30 +0900)]
man: add explanation about target's DefaultDependencies= (#7120)
Closes #7113.
Yu Watanabe [Wed, 18 Oct 2017 06:30:00 +0000 (15:30 +0900)]
man: comment a requirement about the static user or group when DynamicUser=yes
John Lin [Wed, 18 Oct 2017 06:29:19 +0000 (14:29 +0800)]
man: mention /run in systemd.generator document (#7121)
Susant Sahani [Wed, 18 Oct 2017 06:25:57 +0000 (11:55 +0530)]
networkd: Don't stop networkd if CONFIG_FIB_RULES=n in kernel (#7030)
If FIB Rules are not supported by the kernel then networkd fails to
start as it retuns error=-EOPNOTSUPP.
In this case just ignore and let start networkd.
```
sendto(5, {{len=28, type=RTM_GETRULE, flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_DUMP, seq=8, pid=0}, {family=AF_UNSPEC, dst_len=0, src_len=0, tos=0, table=RT_TABLE_UNSPEC, action=FR_ACT_TO_TBL, flags=0}}, 28, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=
00000000}, 16) = 28
recvmsg(5, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=
00000000}, msg_namelen=128->12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_control=[{cmsg_len=20, cmsg_level=SOL_NETLINK, cmsg_type=0x3}], msg_controllen=24, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 48
recvmsg(5, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=
00000000}, msg_namelen=128->12, msg_iov=[{iov_base={{len=48, type=NLMSG_ERROR, flags=0, seq=8, pid=8856}, {error=-EOPNOTSUPP, msg={{len=28, type=RTM_GETRULE, flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_DUMP, seq=8, pid=0}, {family=AF_UNSPEC, dst_len=0, src_len=0, tos=0, table=RT_TABLE_UNSPEC, action=FR_ACT_TO_TBL, flags=0}}}}, iov_len=7416}], msg_iovlen=1, msg_control=[{cmsg_len=20, cmsg_level=SOL_NETLINK, cmsg_type=0x3}], msg_controllen=24, msg_flags=0}, MSG_TRUNC) = 48
```
```
Oct 08 10:22:24 naomi systemd[1]: Starting Network Service...
Oct 08 10:22:24 naomi systemd-networkd[983]: Could not enumerate rules: Operation not supported
Oct 08 10:22:24 naomi systemd[1]: systemd-networkd.service: Main process exited, code=exited, status=1/FAILURE
```
Fixes #7027
Yu Watanabe [Tue, 17 Oct 2017 23:57:54 +0000 (08:57 +0900)]
core: fix invalid error message
The error message corresponds to EILSEQ is "Invalid or incomplete
multibyte or wide character", and is not suitable in this case.
So, let's show a custom error message when the function
dynamic_creds_realize() returns -EILSEQ.
Zbigniew Jędrzejewski-Szmek [Thu, 12 Oct 2017 20:43:58 +0000 (22:43 +0200)]
man: add a note about _netdev usage
Zbigniew Jędrzejewski-Szmek [Thu, 12 Oct 2017 20:34:54 +0000 (22:34 +0200)]
units: replace remote-cryptsetup-pre.target with remote-fs-pre.target
remote-cryptsetup-pre.target was designed as an active unit (that pulls in
network-online.target), the opposite of remote-fs-pre.target (a passive unit,
with individual provider services ordering itself before it and pulling it in,
for example iscsi.service and nfs-client.target).
To make remote-cryptsetup-pre.target really work, those services should be
ordered before it too. But this would require updates to all those services,
not just changes from systemd side.
But the requirements for remote-fs-pre.target and remote-cryptset-pre.target
are fairly similar (e.g. iscsi devices can certainly be used for both), so
let's reuse remote-fs-pre.target also for remote cryptsetup units. This loses
a bit of flexibility, but does away with the requirement for various provider
services to know about remote-cryptsetup-pre.target.
Zbigniew Jędrzejewski-Szmek [Tue, 17 Oct 2017 15:49:48 +0000 (17:49 +0200)]
test-path: fix inverted return value (#7050)
It must be <0 to indicate failure.
Fixes #7050.
Mantas Mikulėnas [Mon, 16 Oct 2017 15:17:47 +0000 (18:17 +0300)]
modprobe.d: expand drop-in to handle dummy0 as well (#7099)
Michal Sekletar [Mon, 16 Oct 2017 14:15:05 +0000 (16:15 +0200)]
mount: make sure we unmount tmpfs mounts before we deactivate swaps (#7076)
In the past we introduced this property just for tmp.mount. However on
todays systems usually there are many more tmpfs mounts. Most notably
mounts backing XDG_RUNTIME_DIR for each user.
Let's generalize what we already have for tmp.mount and implement the
ordering After=swap.target for all tmpfs based mounts.
Zbigniew Jędrzejewski-Szmek [Sun, 15 Oct 2017 10:47:30 +0000 (12:47 +0200)]
Merge pull request #7061 from lkundrak/lr/serialized-environment
Environment serialization/deserialization inconsistently validates the variables
Boucman [Sun, 15 Oct 2017 10:22:47 +0000 (12:22 +0200)]
Display the systemctl status in green if state is "running" (#7094)
Zbigniew Jędrzejewski-Szmek [Fri, 13 Oct 2017 08:19:55 +0000 (10:19 +0200)]
Merge pull request #7062 from yuwata/test-bind-paths
test: add test for BindPaths= and BindReadOnlyPaths=
John Lin [Fri, 13 Oct 2017 08:17:43 +0000 (16:17 +0800)]
gitignore: ignore output file of mkid (#7081)
mkid is from https://www.gnu.org/software/idutils/
Christian Hesse [Fri, 13 Oct 2017 07:10:26 +0000 (09:10 +0200)]
man: update changes about gateway -> _gateway (#7085)
Commit
5248e7e1f11aba6859de0b28f0dd3778b22842f2
(resolved,nss-myhostname: use _gateway for the gateway) changed how the
gateway is resolved. Reflect the change in documentation.
Close #7084.
Zbigniew Jędrzejewski-Szmek [Thu, 12 Oct 2017 20:13:03 +0000 (22:13 +0200)]
units: add [Install] section to remote-cryptsetup.target
This makes this target the same as remote-fs.target in this regard. In practice
it probably doesn't make that much difference, because all encrypted devices
that are part of remote-fs.target (marked with _netdev) will be used for mount
points, so they will be pulled in anyway individually, but with this change any
such device will be configured, even if it is not pulled by any other unit.
Lubomir Rintel [Thu, 12 Oct 2017 06:14:25 +0000 (08:14 +0200)]
systemctl: clarify --global, --root and --runtime options (#7071)
They're not only for enabling.
Vito Caputo [Thu, 12 Oct 2017 06:14:07 +0000 (23:14 -0700)]
shared: add vectorized parse_field() (#7056)
By vectorizing parse_field() the chain of parse_field() calls in
output_short() can be replaced with a single call receiving a description
of the desired fields and their targets.
While at it, eliminate the repeated strlen() calls performed on constant
field names by making parse_field() receive the field length, and storing
it in the ParseFieldVec at compile time.
Also sort the output_short() fields so the short ones are tried first, for
a minor efficiency gain.
In addition to making the code less repetitive, gcc in my tests now inlines
the parse_fieldv() call in output_short().
Yu Watanabe [Thu, 12 Oct 2017 06:10:25 +0000 (15:10 +0900)]
core: cleanup for enforce_groups() (#7064)
SupplementaryGroups= is preprocessed in get_supplementary_groups().
So, it is not necessary to input ExecContext to enforce_groups().
Yu Watanabe [Thu, 12 Oct 2017 04:26:39 +0000 (13:26 +0900)]
test-execute: always use /bin/sh
Yu Watanabe [Thu, 12 Oct 2017 04:25:06 +0000 (13:25 +0900)]
test: add test for BindPaths= and BindReadOnlyPaths=
Follow-up for
a8cabc612b16834260831a8163ae4b479b5c33a5.
John Lin [Wed, 11 Oct 2017 18:22:51 +0000 (02:22 +0800)]
systemctl: supress enable/disable messages when -q is given (#7067)
Fixes: #7036
Lennart Poettering [Wed, 11 Oct 2017 18:21:29 +0000 (20:21 +0200)]
basic: split unit-name.[ch] into two (#7065)
It always bothered me a bit that unit-name.[ch] contains so many
definitions that aren't really have much to do with unit nameing, for
example all the unit state definitions.
With this patch unit-name.[ch] is split into two: the file now contains
only the unit naming related operations, and everything else is split
out into a new set of files unit-def.[ch]. That's mostly unit state
stuff as well as dbus path and interface name operations.
No functional changes. This just moves code around.
(Note as both .c files include each other's headers this doesn't make
the build simpler or anything. All it does is make the C files a bit
shorter, and medicate my pretend OCD)
Lubomir Rintel [Wed, 11 Oct 2017 13:05:38 +0000 (15:05 +0200)]
basic/env-util: don't relax unesaping of serialized environment strings
We wrote them ourselves -- they shouldn't contain invalid sequences.
Lubomir Rintel [Wed, 11 Oct 2017 07:29:30 +0000 (09:29 +0200)]
basic/env-util: drop the validation when deserializing environment
The environment variables we've serialized can quite possibly contain
characters outside the set allowed by env_assignment_is_valid(). In
fact, my environment seems to contain a couple of these:
* TERMCAP set by screen contains a '\x7f' character
* BASH_FUNC_module%% variable has a '%' character in name
Strict check of environment variables name and value certainly makes sense for
unit files, but not so much for deserialization of values we already had
in our environment.
Florian Klink [Wed, 11 Oct 2017 12:45:48 +0000 (14:45 +0200)]
test-dhcp-client: fix typos in comment (#7052)
Susant Sahani [Wed, 11 Oct 2017 07:08:05 +0000 (12:38 +0530)]
networkd: bridge allow AgeingTimeSec to be set 0 (#7021)
Closes #7019.
Yu Watanabe [Wed, 11 Oct 2017 05:41:13 +0000 (14:41 +0900)]
dynamic-user: permit the case static uid and gid are different
This makes systemd supports the case that DynamicUser=yes and
static user and group exist such that uid and gid of them are different.
We only refuse the operation when user does not exist but the group
with the same name exists.
Fixes #7013.
Vito Caputo [Wed, 11 Oct 2017 04:05:00 +0000 (21:05 -0700)]
Merge pull request #7058 from yuwata/fix-7055
core: fix segfault in compile_bind_mounts() when BindPaths= or BindReadOnlyPaths= is set
Yu Watanabe [Wed, 11 Oct 2017 03:46:27 +0000 (12:46 +0900)]
dynamic-user: label functions not necessary to export as static
Yu Watanabe [Wed, 11 Oct 2017 03:27:13 +0000 (12:27 +0900)]
core: fix segfault in compile_bind_mounts() when BindPaths= or BindReadOnlyPaths= is set
This fixes a bug introduced by
6c47cd7d3bf35c8158a0737f34fe2c5dc95e72d6.
Fixes #7055.
Jakub Wilk [Tue, 10 Oct 2017 19:59:03 +0000 (21:59 +0200)]
man: fix typos (#7029)
Zbigniew Jędrzejewski-Szmek [Tue, 10 Oct 2017 19:57:39 +0000 (21:57 +0200)]
Merge pull request #7044 from poettering/minidocfixes
tiny doc fixes
AsciiWolf [Tue, 10 Oct 2017 19:52:52 +0000 (21:52 +0200)]
l10n: update Czech Translation (#7049)
Zbigniew Jędrzejewski-Szmek [Tue, 10 Oct 2017 19:50:17 +0000 (21:50 +0200)]
Merge pull request #7045 from poettering/namespace-casing
some super-trivial fixes to namespace.c
Zbigniew Jędrzejewski-Szmek [Tue, 10 Oct 2017 18:55:20 +0000 (20:55 +0200)]
tests: skip tests when cg_pid_get_path fails (#7033)
v2:
- cast the fstype_t type to ull, because it varies between arches.
Making it long long should be on the safe side.
Lennart Poettering [Tue, 10 Oct 2017 08:05:43 +0000 (10:05 +0200)]
Merge pull request #7003 from yuwata/enable-dynamic-user
timesyncd, journal-upload: Enable DynamicUser=
gwendalcr [Tue, 10 Oct 2017 08:03:38 +0000 (01:03 -0700)]
rules: Add MODEL_ID for NVMe device (#7037)
To mimic MODEL_ID variable built for ATA and SCSI devices, add rules
to add MODEL_ID variable for NVMe devices.
TEST: Check on a system with NVMe device that MODEL_ID variable is
present:
udevadm info --query=all -n /dev/nvme0n1p1 | grep ID_MODEL
and
udevadm info --query=all -n /dev/nvme0n1p1 | grep ID_MODEL
return:
E: ID_MODEL=SAMSUNG...
Lennart Poettering [Tue, 10 Oct 2017 07:50:23 +0000 (09:50 +0200)]
namespace: make ns_type_supported() a tiny bit shorter
namespace_type_to_string() already validates the type paramater, we can
use that, and shorten the function a bit.
Lennart Poettering [Tue, 10 Oct 2017 07:49:20 +0000 (09:49 +0200)]
namespace: change NameSpace → Namespace
We generally use the casing "Namespace" for the word, and that's visible
in a number of user-facing interfaces, including "RestrictNamespace=" or
"JoinsNamespaceOf=". Let's make sure to use the same casing internally
too.
As discussed in #7024
Michal Sekletar [Tue, 10 Oct 2017 07:46:13 +0000 (09:46 +0200)]
namespace: fall back gracefully when kernel doesn't support network namespaces (#7024)
Sergey Ptashnick [Tue, 10 Oct 2017 07:44:52 +0000 (10:44 +0300)]
catalog,po: update Russian translation (#7041)
Lennart Poettering [Tue, 10 Oct 2017 07:43:37 +0000 (09:43 +0200)]
man: fix link to documentation of slice concept
Lennart Poettering [Tue, 10 Oct 2017 07:41:17 +0000 (09:41 +0200)]
man: symlinks are made onto "unit files", not "units"
We should be careful when talking about "units" and "unit files". The
latter should be the concept on disk, and the former, the loaded version
of it. However, as a single unit file can result in multiple loaded
units (think templates), and a units can also exist with no unit file at
all (think .device units), we should be precise.
As symlinks are created on unit files rather than units (as symlinks are
an fs object, and unit files are too, but units are not), let's say so
here.
Muhammet Kara [Mon, 9 Oct 2017 13:39:19 +0000 (15:39 +0200)]
Updated Turkish translation (#7017)
Lennart Poettering [Mon, 9 Oct 2017 13:38:30 +0000 (15:38 +0200)]
Merge pull request #7034 from keszybz/modules-load-downgrade-errors
Downgrade errors resulting from user configuration in modules-load
Lennart Poettering [Mon, 9 Oct 2017 13:22:22 +0000 (15:22 +0200)]
update TODO
Zbigniew Jędrzejewski-Szmek [Sun, 8 Oct 2017 14:21:06 +0000 (16:21 +0200)]
modules-load: downgrade error on ENODEV/ENOENT
Some kernel modules may be loaded if the hardware does not exist
(usually when the hardware is hot-pluggable), while others fail with
ENODEV. Let's make those two cases more similar, and simply log
modules which cannot be loaded because of missing hardware without
failing systemd-modules-load.service.
For modules which don't exist, let's warn, but not fail the whole
service. I think a warning is appropriate because it's likely that
a typo was made.
Zbigniew Jędrzejewski-Szmek [Sun, 8 Oct 2017 14:18:57 +0000 (16:18 +0200)]
kmod_module_probe_insert_module returns 0 on success, != 0 on failure
More specifically, it should return > 0 only for conditions specified in
probe_flags. We only set KMOD_PROBE_APPLY_BLACKLIST in probe_flags, so the
code was correct, but add an assert to clarify this.
Mike Gilbert [Sun, 8 Oct 2017 20:14:45 +0000 (16:14 -0400)]
test: skip hwdb and sysv-generator if the features are disabled (#7026)
Zbigniew Jędrzejewski-Szmek [Sun, 8 Oct 2017 13:55:24 +0000 (15:55 +0200)]
util-lib: introdude _cleanup_ macros for kmod objects
bleep_blop [Sun, 8 Oct 2017 20:01:08 +0000 (01:31 +0530)]
man: fix typo for !! in systemd.service (#7031)
!! must be very similar to !, not itself.
Piotr Drąg [Fri, 6 Oct 2017 14:10:33 +0000 (16:10 +0200)]
po: update Polish translation (#7015)
Lennart Poettering [Fri, 6 Oct 2017 08:18:04 +0000 (10:18 +0200)]
NEWS: patch in today's date for the 235 release
Zbigniew Jędrzejewski-Szmek [Fri, 6 Oct 2017 08:04:49 +0000 (10:04 +0200)]
man: explain precedence for options which take a list (#7010)
Hopefully finally fixes #6639.
Yu Watanabe [Fri, 6 Oct 2017 07:33:21 +0000 (16:33 +0900)]
meson: fix feature list (#7011)
Yu Watanabe [Thu, 5 Oct 2017 01:21:50 +0000 (10:21 +0900)]
sysusers: do not create unneeded users
Yu Watanabe [Fri, 6 Oct 2017 07:06:21 +0000 (16:06 +0900)]
unit: enable DynamicUser= for journal-upload
Yu Watanabe [Fri, 6 Oct 2017 07:05:20 +0000 (16:05 +0900)]
timesyncd: enable DynamicUser=
Yu Watanabe [Fri, 6 Oct 2017 07:03:33 +0000 (16:03 +0900)]
mkdir: introduce follow_symlink flag to mkdir_safe{,_label}()
Frederic Crozat [Thu, 5 Oct 2017 23:28:19 +0000 (01:28 +0200)]
tmpfiles: remove old ICE and X11 sockets at boot (#6979)
tmpfiles: remove old ICE and X11 sockets at boot
When not using tmpfs based /tmp, leftover sockets
might prevent X startup. Ensure directory is clean at boot time.
g0tar [Thu, 5 Oct 2017 20:17:51 +0000 (22:17 +0200)]
pass currently completed word to systemctl list-unit-files/list-units (#6927)
This change noticeably increases completion performance at the expense
of preventing possible _correct, _approximate or any matcher-list rules.
Still, responsiveness increase so huge seems to make it worth the price.
Zbigniew Jędrzejewski-Szmek [Thu, 5 Oct 2017 20:06:39 +0000 (22:06 +0200)]
Merge pull request #6999 from poettering/seccomp-newgroups
add three new syscall groups, and port @privileged to make use of more existing ones
Zbigniew Jędrzejewski-Szmek [Thu, 5 Oct 2017 19:51:13 +0000 (21:51 +0200)]
Merge pull request #7008 from poettering/sorevision235
bump so revision for 235 and mailmap updates
Zbigniew Jędrzejewski-Szmek [Thu, 5 Oct 2017 19:24:36 +0000 (21:24 +0200)]
Merge pull request #6949 from poettering/restart-servers
Automatically forget learnt DNS server information when network config changes
Lennart Poettering [Thu, 5 Oct 2017 16:26:02 +0000 (18:26 +0200)]
Merge pull request #6909 from sourcejedi/units
Unit dependency fixes (and cleanups)
Lennart Poettering [Thu, 5 Oct 2017 15:38:40 +0000 (17:38 +0200)]
update .mailmap a bit more
Lennart Poettering [Thu, 5 Oct 2017 15:23:17 +0000 (17:23 +0200)]
NEWS: one more addition
Lennart Poettering [Thu, 5 Oct 2017 15:14:04 +0000 (17:14 +0200)]
build-sys: bump so revisions for prepation of 235
Lennart Poettering [Thu, 5 Oct 2017 14:53:32 +0000 (16:53 +0200)]
resolved: include DNS server feature level info in SIGUSR1 status dump
let's make the status dump more useful for tracking down server issues.
Lennart Poettering [Fri, 29 Sep 2017 19:19:54 +0000 (21:19 +0200)]
resolved: add support for explicitly forgetting everything we learnt about DNS server feature levels
This adds "systemd-resolve --reset-server-features" for explicitly
forgetting what we learnt. This might be useful for debugging
purposes, and to force systemd-resolved to restart its learning logic
for all DNS servers.
Lennart Poettering [Fri, 29 Sep 2017 19:18:29 +0000 (21:18 +0200)]
resolved: automatically forget all learnt DNS server information when the network configuration changes
When the network configuration changes we should relearn everything
there is to know about the configured DNS servers, because we might talk
to the same addresses, but there might be different servers behind them.
Lennart Poettering [Mon, 2 Oct 2017 07:16:50 +0000 (09:16 +0200)]
seccomp: port @privileged to use @reboot + @swap
Let's reuse two groups we already defined to make @privileged a bit
shorter.
Lennart Poettering [Wed, 4 Oct 2017 19:09:52 +0000 (21:09 +0200)]
seccomp: there is no "kexec" syscall
it's called "kexec_load".
Lennart Poettering [Sat, 30 Sep 2017 12:34:50 +0000 (14:34 +0200)]
seccomp: add three more seccomp groups
@aio → asynchronous IO calls
@sync → msync/fsync/... and friends
@chown → changing file ownership
(Also, change @privileged to reference @chown now, instead of the
individual syscalls it contains)
Zbigniew Jędrzejewski-Szmek [Thu, 5 Oct 2017 13:41:33 +0000 (15:41 +0200)]
Update mailmap and contributor list (#7006)
Also fix typo (by using a word that is a better git anyway.)
Lennart Poettering [Thu, 5 Oct 2017 13:05:02 +0000 (15:05 +0200)]
units: restore User=systemd-journal-gateway in systemd-journal-gatewayd.service (#7005)
After the discussions around #7003 I think we should restore the
User=systemd-journal-gateway line for systemd-journal-gatewayd.service,
too, so that we continue to use the state user if it exists, and create
it as dynamic user only when it does not.
Note that undoes part of a change made after 234, i.e. a never released
change.
Zbigniew Jędrzejewski-Szmek [Thu, 5 Oct 2017 13:04:19 +0000 (15:04 +0200)]
core: make gc_marker unsigned (#7004)
This matches the definition in unit.h.
Djalal Harouni [Thu, 5 Oct 2017 12:46:41 +0000 (14:46 +0200)]
seccomp: remove 'gettid' syscall from '@process' syscall set (#6989)
The gettid syscall is one of the most basic syscalls, it never fails and
it operates on current thread. Most applications are not suposed to use
it, however even if it is used there is no much justification on blocking
it. This patch removes it from '@process' set so if users blacklist this
set to block setns or clone syscalls, the gettid syscall will still be
available. Of course they can always block gettid explicitly.
Note that the gettid is already in the '@default' set.
Zbigniew Jędrzejewski-Szmek [Thu, 5 Oct 2017 12:42:29 +0000 (14:42 +0200)]
Merge pull request #6931 from poettering/job-timeout-sec
Zbigniew Jędrzejewski-Szmek [Thu, 5 Oct 2017 11:16:31 +0000 (13:16 +0200)]
NEWS: some nitpicking and bike-shedding
Zbigniew Jędrzejewski-Szmek [Thu, 5 Oct 2017 11:22:03 +0000 (13:22 +0200)]
Merge pull request #6952 from poettering/seccomp-getrlimit
a seccomp fix regarding ugetrlimit/prlimit64
Lennart Poettering [Wed, 27 Sep 2017 15:33:09 +0000 (17:33 +0200)]
generator: when we insert a '\n', actually place a proper newline, too
Lennart Poettering [Wed, 27 Sep 2017 15:30:50 +0000 (17:30 +0200)]
unit: when JobTimeoutSec= is turned off, implicitly turn off JobRunningTimeoutSec= too
We added JobRunningTimeoutSec= late, and Dracut configured only
JobTimeoutSec= to turn of root device timeouts before. With this change
we'll propagate a reset of JobTimeoutSec= into JobRunningTimeoutSec=,
but only if the latter wasn't set explicitly.
This should restore compatibility with older systemd versions.
Fixes: #6402
Andrew Jeddeloh [Thu, 5 Oct 2017 10:58:02 +0000 (03:58 -0700)]
Revert "networkd: change UseMTU default to true. (#6837)" (#6950)
This reverts commit
22043e4317ecd2bc7834b48a6d364de76bb26d91.
UseMTU is broken on real hardware and should not be enabled by default.
Zbigniew Jędrzejewski-Szmek [Thu, 5 Oct 2017 10:35:24 +0000 (12:35 +0200)]
Merge pull request #6988 from poettering/dns-stub-truncate
rework how resolved's dns stub deals with truncation
Lennart Poettering [Wed, 4 Oct 2017 10:35:48 +0000 (12:35 +0200)]
resolved: rework how we handle truncation in the stub resolver
When we a reply message gets longer than the client supports we need to
truncate the response and set the TC bit, and we already do that.
However, we are not supposed to send incomplete RRs in that case, but
instead truncate right at a record boundary. Do that.
This fixes the "Message parser reports malformed message packet."
warning the venerable "host" tool outputs when a very large response is
requested.
See: #6520
Lennart Poettering [Wed, 4 Oct 2017 09:57:10 +0000 (11:57 +0200)]
resolved: take benefit of log_xyz_errno() returning the negative error code
Just some modernizations.
Lennart Poettering [Thu, 5 Oct 2017 09:26:09 +0000 (11:26 +0200)]
seccomp: ignore (and debug log) errors by all invocations of seccomp_rule_add_exact()
System calls might exist on some archs but not on others, or might be
multiplexed but not on others. Ignore such errors when putting together
a filter at this location like we already do it on all others.
Lennart Poettering [Thu, 5 Oct 2017 09:24:51 +0000 (11:24 +0200)]
seccomp: always handle seccomp_load() failing the same way
Unfortunately libseccomp doesn't return (nor document) clean error
codes, hence until then only check for specific error codes that we
propagate, but ignore (but debug log) all others. Do this at one more
place, we are already doing that at all others.
Lennart Poettering [Thu, 5 Oct 2017 09:23:07 +0000 (11:23 +0200)]
seccomp: react gracefully if we can't translate a syscall name
When a libseccomp implementation doesn't know a syscall yet, that's no
reason for us to fail completely. Instead, debug log, and proceed.
This hopefully fixes the preadv2/pwritev2 issues pointed out here:
https://github.com/systemd/systemd/pull/6952#issuecomment-
334302923