Peter A. Bigot [Sat, 22 Jun 2019 17:43:49 +0000 (12:43 -0500)]
man: fix references to VTABLE property flags
Lennart Poettering [Sat, 22 Jun 2019 18:12:44 +0000 (20:12 +0200)]
update TODO
Lennart Poettering [Sat, 22 Jun 2019 18:02:46 +0000 (20:02 +0200)]
Merge pull request #12836 from yuwata/tree-wide-replace-strjoin
tree-wide: replace strjoin() with path_join()
Anita Zhang [Mon, 20 May 2019 21:43:53 +0000 (14:43 -0700)]
bpf-firewall: optimization for IPAddressXYZ="any" (and unprivileged users)
This is a workaround to make IPAddressDeny=any/IPAddressAllow=any work
for non-root users that have CAP_NET_ADMIN. "any" was chosen since
all or nothing network access is one of the most common use cases for
isolation.
Allocating BPF LPM TRIE maps require CAP_SYS_ADMIN while BPF_PROG_TYPE_CGROUP_SKB
only needs CAP_NET_ADMIN. In the case of IPAddressXYZ="any" we can just
consistently return false/true to avoid allocating the map and limit the user
to having CAP_NET_ADMIN.
Topi Miettinen [Mon, 20 May 2019 09:20:58 +0000 (12:20 +0300)]
cgroup-util: kill also threads
It's possible for a zombie process to have live threads. These are not listed
in /sys in "cgroup.procs" for cgroupsv2, but they show up in
"cgroup.threads" (cgroupv2) or "tasks" (cgroupv1) nodes. When killing a
cgroup (v2 only) with SIGKILL, let's also kill threads after killing processes,
so the live threads of a zombie get killed too.
Closes #12262.
Evgeny Vereshchagin [Fri, 21 Jun 2019 00:21:09 +0000 (02:21 +0200)]
coverity: stop setting _Float*
Should address https://github.com/systemd/systemd/issues/12854
Jan Synacek [Fri, 21 Jun 2019 05:53:15 +0000 (07:53 +0200)]
man: drop my copyright
Lennart Poettering [Wed, 19 Jun 2019 13:20:13 +0000 (15:20 +0200)]
path-util: get rid of prefix_root()
prefix_root() is equivalent to path_join() in almost all ways, hence
let's remove it.
There are subtle differences though: prefix_root() will try shorten
multiple "/" before and after the prefix. path_join() doesn't do that.
This means prefix_root() might return a string shorter than both its
inputs combined, while path_join() never does that. I like the
path_join() semantics better, hence I think dropping prefix_root() is
totally OK. In the end the strings generated by both functon should
always be identical in terms of path_equal() if not streq().
This leaves prefix_roota() in place. Ideally we'd have path_joina(), but
I don't think we can reasonably implement that as a macro. or maybe we
can? (if so, sounds like something for a later PR)
Also add in a few missing OOM checks
Anita Zhang [Mon, 3 Jun 2019 23:25:43 +0000 (16:25 -0700)]
nspawn: don't hard fail when setting capabilities
The OCI changes in #9762 broke a use case in which we use nspawn from
inside a container that has dropped capabilities from the bounding set
that nspawn expected to retain. In an attempt to keep OCI compliance
and support our use case, I made hard failing on setting capabilities
not in the bounding set optional (hard fail if using OCI and log only
if using nspawn cmdline).
Fixes #12539
Yu Watanabe [Thu, 20 Jun 2019 18:31:49 +0000 (03:31 +0900)]
Merge pull request #12846 from poettering/cap-last-cap-fix
cap_last_cap() off by one fixes
Lennart Poettering [Thu, 20 Jun 2019 12:41:09 +0000 (14:41 +0200)]
bpf: use more TAKE_FD()
Yu Watanabe [Thu, 20 Jun 2019 18:14:05 +0000 (03:14 +0900)]
sd-path: use _cleanup_ attribute
Yu Watanabe [Thu, 20 Jun 2019 18:07:01 +0000 (03:07 +0900)]
tree-wide: replace strjoin() with path_join()
Lennart Poettering [Thu, 20 Jun 2019 12:54:40 +0000 (14:54 +0200)]
bus-creds: fix size calculation for storing caps data
This is a bit confusing, hence let's at an example comment.
Lennart Poettering [Thu, 20 Jun 2019 12:44:47 +0000 (14:44 +0200)]
capability: fix loops for cap_last_cap()
cap_last_cap() returns the last valid cap (instead of the number of
valid caps). to iterate through all known caps we hence need to use a <=
check, and not a < check like for all other cases. We got this right
usually, but in three cases we did not.
Topi Miettinen [Wed, 1 May 2019 12:28:36 +0000 (15:28 +0300)]
units: deny access to block devices
While the need for access to character devices can be tricky to determine for
the general case, it's obvious that most of our services have no need to access
block devices. For logind and timedated this can be tightened further.
Lennart Poettering [Thu, 20 Jun 2019 11:36:30 +0000 (13:36 +0200)]
Merge pull request #12762 from yuwata/network-introduce-carrier-and-network-state-12752
network: introduce carrier and address state to fix network_is_online()
Lennart Poettering [Thu, 20 Jun 2019 10:35:34 +0000 (12:35 +0200)]
Merge pull request #12837 from yuwata/tree-wide-lgtm-fixes
tree-wide: fix issues found by lgtm
Donald Buczek [Thu, 25 Apr 2019 07:39:41 +0000 (09:39 +0200)]
cgroup: Continue unit reset if cgroup is busy
When part of the cgroup hierarchy cannot be deleted (e.g. because there
are still processes in it), do not exit unit_prune_cgroup early, but
continue so that u->cgroup_realized is reset.
Log the known case of non-empty cgroups at debug level and other errors
at warning level.
Fixes https://github.com/systemd/systemd/issues/12386
Yu Watanabe [Wed, 19 Jun 2019 21:56:37 +0000 (06:56 +0900)]
Merge pull request #12806 from yuwata/networkctl-ethtool-12657
networkctl: show speed, duplex, auto negotiation, and port
Yu Watanabe [Wed, 19 Jun 2019 21:51:34 +0000 (06:51 +0900)]
util: use extract_first_word() instead of strsep()
Yu Watanabe [Wed, 19 Jun 2019 21:34:05 +0000 (06:34 +0900)]
tree-wide: use htobe{32,16}() instead of hton{l,s}()
Yu Watanabe [Wed, 19 Jun 2019 21:29:19 +0000 (06:29 +0900)]
tree-wide: drop alloca() in loop
Yu Watanabe [Mon, 17 Jun 2019 07:12:06 +0000 (16:12 +0900)]
networkctl: show link speed, duplex, auto negotiation, and port
Yu Watanabe [Wed, 19 Jun 2019 13:18:54 +0000 (22:18 +0900)]
network: change type of BitRates= bus property
Yu Watanabe [Wed, 19 Jun 2019 13:03:42 +0000 (22:03 +0900)]
table: introduce FORMAT_BPS type
Yu Watanabe [Wed, 19 Jun 2019 00:52:45 +0000 (09:52 +0900)]
test: add tests for format_bytes()
Yu Watanabe [Wed, 19 Jun 2019 01:05:30 +0000 (10:05 +0900)]
util: make format_bytes() support e.g. 3.0E
Yu Watanabe [Mon, 17 Jun 2019 07:08:24 +0000 (16:08 +0900)]
util: introduce format_bytes_full()
And move it into format-util.c.
Yu Watanabe [Mon, 17 Jun 2019 06:31:20 +0000 (15:31 +0900)]
ethtool-util: introduce ethtool_get_link_info()
Will be used in later commits.
Yu Watanabe [Wed, 19 Jun 2019 00:09:58 +0000 (09:09 +0900)]
ethtool-util: make ethtool_connect() warn on failure
Yu Watanabe [Mon, 17 Jun 2019 05:57:54 +0000 (14:57 +0900)]
ethtool-util: use structured initializers
Frantisek Sumsal [Wed, 19 Jun 2019 12:16:15 +0000 (21:16 +0900)]
sd-resolve: suppress false positive MSan warnings
MSan dislikes structured initializers for nested structures.
Zbigniew Jędrzejewski-Szmek [Wed, 19 Jun 2019 13:25:31 +0000 (15:25 +0200)]
Merge pull request #12828 from yuwata/network-routing-policy-rule-add-missing-entries
network: add missing entries in routing_policy_rule_{hash,compare}_func()
Lennart Poettering [Wed, 19 Jun 2019 12:56:36 +0000 (14:56 +0200)]
Merge pull request #12815 from irtimmer/dot-strict
resolved: strict mode for DNS-over-TLS
Yu Watanabe [Wed, 19 Jun 2019 04:04:24 +0000 (13:04 +0900)]
network: add missing entries in routing_policy_rule_{hash,compare}_func()
This also makes routing_policy_rule_get() or friends take
a RoutingPolicyRule object as an input.
Yu Watanabe [Wed, 19 Jun 2019 12:02:47 +0000 (21:02 +0900)]
util: introduce siphash24_compress_boolean()
Iwan Timmer [Mon, 17 Jun 2019 19:24:05 +0000 (21:24 +0200)]
resolved: support TLS 1.3 when using GnuTLS for DNS-over-TLS
Iwan Timmer [Mon, 18 Feb 2019 19:41:46 +0000 (20:41 +0100)]
resolved: add strict mode for DNS-over-TLS
Add strict mode for DNS-over-TLS, which will require TLS support from the server. Closes #10755
Iwan Timmer [Tue, 18 Jun 2019 16:54:55 +0000 (18:54 +0200)]
resolved: don't require check when importing resolved-dnstls.h
Lennart Poettering [Wed, 19 Jun 2019 07:00:52 +0000 (09:00 +0200)]
Merge pull request #12829 from yuwata/dhcp-memdup_suffix0
sd-bus,dhcp: use memdup_suffix0() instead of strndup()
Yu Watanabe [Wed, 19 Jun 2019 05:29:00 +0000 (14:29 +0900)]
sd-bus: use memdup_suffix0() instead of strndup()
Yu Watanabe [Wed, 19 Jun 2019 05:15:06 +0000 (14:15 +0900)]
dhcp: use memdup_suffix0() instead of strndup()
Yu Watanabe [Wed, 19 Jun 2019 02:11:06 +0000 (11:11 +0900)]
Merge pull request #12822 from poettering/tmpfiles-is-mount-point
tmpfiles: use common fd_is_mount_point() implementation
Yu Watanabe [Mon, 17 Jun 2019 05:52:55 +0000 (14:52 +0900)]
ethtool-util: move from src/udev/net/ to src/shared/
Lennart Poettering [Tue, 18 Jun 2019 13:56:07 +0000 (15:56 +0200)]
journald: use memdup_suffix0() when copying string from potentially binary data
Fixes: #12484
Iwan Timmer [Mon, 17 Jun 2019 20:33:50 +0000 (22:33 +0200)]
resolved: add missing error code check when initializing DNS-over-TLS
Iwan Timmer [Sat, 15 Jun 2019 20:54:41 +0000 (22:54 +0200)]
resolved: move TLS data shared by all servers to manager
Instead of having a context and/or trusted CA list per server this is now moved to the server. Ensures future TLS configuration options are global instead of per server.
Markus Felten [Tue, 18 Jun 2019 08:11:28 +0000 (10:11 +0200)]
fix(journal-gatewayd): use relative urls (not starting with '/')
if journal-gatewayd http is not mounted at '/' (proxy request)
the request lose their initial path component
Frantisek Sumsal [Tue, 18 Jun 2019 09:25:16 +0000 (11:25 +0200)]
hashmap: avoid using TLS in a destructor
Using C11 thread-local storage in destructors causes uninitialized
read. Let's avoid that using a direct comparison instead of using
the cached values. As this code path is taken only when compiled
with -DVALGRIND=1, the performance cost shouldn't matter too much.
Fixes #12814
Lennart Poettering [Tue, 18 Jun 2019 11:17:14 +0000 (13:17 +0200)]
Merge pull request #12758 from fbuihuu/nspawn-console-tty
Create nspawn console tty in the child
Lennart Poettering [Tue, 18 Jun 2019 10:42:30 +0000 (12:42 +0200)]
tmpfiles: use common fd_is_mount_point() implementation in tmpfiles.c
No need to have a private reimplementation here. Let's just use the
common one, which supports "fdinfo" as fallback.
Lennart Poettering [Tue, 18 Jun 2019 10:41:31 +0000 (12:41 +0200)]
tmpfiles: merge two nested if checks into one
Lennart Poettering [Tue, 18 Jun 2019 10:41:02 +0000 (12:41 +0200)]
tmpfiles: use path_join() where we can
Yu Watanabe [Tue, 18 Jun 2019 02:18:46 +0000 (11:18 +0900)]
dhcp: fix comparison with previous lease
Follow-up for
f8862395e8f802e4106a07ceaaf02b6a1faa5a6d.
Fixes #12816.
Franck Bui [Fri, 7 Jun 2019 08:27:18 +0000 (10:27 +0200)]
nspawn: make use of openpt_allocate()
Franck Bui [Fri, 7 Jun 2019 08:17:11 +0000 (10:17 +0200)]
terminal-util: introduce openpt_allocate()
Allocating a pty is done in a couple of places so let's introduce a new helper
which does the job.
Also the new function, as well as openpt_in_namespace(), returns both pty
master and slave so the callers don't need to know about the pty slave
allocation details.
For the same reasons machine_openpt() prototype has also been changed to return
both pty master and slave so callers don't need to allocate a pty slave which
might be in a different namespace.
Finally openpt_in_namespace() has been renamed into
openpt_allocate_in_namespace().
Zbigniew Jędrzejewski-Szmek [Tue, 18 Jun 2019 06:57:26 +0000 (08:57 +0200)]
Merge pull request #12805 from yuwata/test-network-cleanups
test: further test-network cleanups
Franck Bui [Thu, 6 Jun 2019 08:05:33 +0000 (10:05 +0200)]
nspawn: allocate the pty used for /dev/console within the container
The console tty is now allocated from within the container so it's not
necessary anymore to allocate it from the host and bind mount the pty slave
into the container. The pty master is sent to the host.
/dev/console is now a symlink pointing to the pty slave.
This might also be less confusing for applications running inside the container
and the overall result looks cleaner (we don't need to apply manually the
passed selinux context, if any, to the allocated pty for instance).
Franck Bui [Thu, 6 Jun 2019 13:58:14 +0000 (15:58 +0200)]
nspawn: use correct error variable when logging errors returned by send_one_fd()
Franck Bui [Fri, 7 Jun 2019 05:36:11 +0000 (07:36 +0200)]
namespace-util: make use of TAKE_FD()
No functional changes.
Franck Bui [Thu, 6 Jun 2019 12:05:27 +0000 (14:05 +0200)]
fs-util: no need for fchmod_and_chown() to access /proc/self/fd directly
fstat(2) is fine with O_PATH fds.
For changing owership of a file opened with O_PATH, there's fchownat(2).
Only changing permissions is problematic but we introduced fchmod_opath() for
that purpose.
Yu Watanabe [Mon, 17 Jun 2019 02:21:45 +0000 (11:21 +0900)]
test-network: change default sleep time of start_networkd()
Yu Watanabe [Mon, 17 Jun 2019 02:06:01 +0000 (11:06 +0900)]
test-network: use wait-online in NetworkdBridgeTests
Yu Watanabe [Tue, 18 Jun 2019 04:09:06 +0000 (13:09 +0900)]
network: do not configure routing policy rule if it is already configured
Yu Watanabe [Tue, 18 Jun 2019 04:08:20 +0000 (13:08 +0900)]
network: make routing_policy_rule_get() require Manager
Yu Watanabe [Mon, 17 Jun 2019 01:52:16 +0000 (10:52 +0900)]
test-network: use wait-online in NetworkdBondTests
Yu Watanabe [Mon, 17 Jun 2019 02:09:25 +0000 (11:09 +0900)]
test-network: use setUp() and tearDown() to clear routing policy rule tables
Yu Watanabe [Tue, 18 Jun 2019 03:02:41 +0000 (12:02 +0900)]
Merge pull request #12807 from keszybz/net-naming-scheme-yet-again
Extend naming scheme to mac address policy and introduce NAMING_STABLE_VIRTUAL_MACS
Yu Watanabe [Mon, 17 Jun 2019 02:11:30 +0000 (11:11 +0900)]
test-network: rename l2tp_tunnel_remove -> remove_l2tp_tunnels
Yu Watanabe [Mon, 17 Jun 2019 10:57:54 +0000 (19:57 +0900)]
test-network: remove all routing policy rules in specified table
Jan Pokorný [Mon, 17 Jun 2019 18:49:28 +0000 (20:49 +0200)]
docs: CGROUP_DELEGATION: fix a typo in "that"
Evgeny Vereshchagin [Mon, 17 Jun 2019 17:08:48 +0000 (19:08 +0200)]
travis: turn on all default UBSan checks except for pointer-overflow, object-size and float-cast-overflow
Lennart Poettering [Mon, 17 Jun 2019 08:51:25 +0000 (10:51 +0200)]
core: set fs.file-max sysctl to LONG_MAX rather than ULONG_MAX
Since kernel 5.2 the kernel thankfully returns proper errors when we
write a value out of range to the sysctl. Which however breaks writing
ULONG_MAX to request the maximum value. Hence let's write the new
maximum value instead, LONG_MAX.
/cc @brauner
Fixes: #12803
Lennart Poettering [Mon, 17 Jun 2019 12:54:18 +0000 (14:54 +0200)]
Merge pull request #12810 from evverx/nonnull-attribute
travis: turn on nonnull-attribute on Fuzzit
Zbigniew Jędrzejewski-Szmek [Mon, 17 Jun 2019 07:42:46 +0000 (09:42 +0200)]
udev: introduce NAMING_STABLE_VIRTUAL_MACS (retroactively)
This is for
6d3646406560. It turns out that this is causing more problems than
expected. Let's retroactively introduce naming scheme v241 to conditionalize
this change.
Follow-up for #12792 and
6d36464065601f7. See also
https://bugzilla.suse.com/show_bug.cgi?id=1136600.
$ SYSTEMD_LOG_LEVEL=debug NET_NAMING_SCHEME=v240 build/udevadm test-builtin net_setup_link /sys/class/net/br11
$ SYSTEMD_LOG_LEVEL=debug NET_NAMING_SCHEME=v241 build/udevadm test-builtin net_setup_link /sys/class/net/br11
...
@@ -20,11 +20,13 @@
link_config: could not set ethtool features for br11
Could not set offload features of br11: Operation not permitted
br11: Device has name_assign_type=3
-Using interface naming scheme 'v240'.
+Using interface naming scheme 'v241'.
br11: Policy *keep*: keeping existing userspace name
br11: Device has addr_assign_type=1
-br11: No stable identifying information found
-br11: Could not generate persistent MAC: No data available
+br11: Using "br11" as stable identifying information
+br11: Using generated persistent MAC address
+Could not set Alias=, MACAddress= or MTU= on br11: Operation not permitted
+br11: Could not apply link config, ignoring: Operation not permitted
Unload module index
Unloaded link configuration context.
ID_NET_DRIVER=bridge
Zbigniew Jędrzejewski-Szmek [Mon, 17 Jun 2019 11:38:40 +0000 (13:38 +0200)]
libsystemd-network: rename net_get_name() to net_get_name_persistent()
This reflect its role better.
(I didn't use …_persistent_name(), because which name is actually used
depends on the policy. So it's better not to make this sound like it returns
*the* persistent name.)
Zbigniew Jędrzejewski-Szmek [Mon, 17 Jun 2019 07:21:57 +0000 (09:21 +0200)]
man: clean up naming scheme description a bit
This is in preparation for later changes. Let's change the documentation of
net.naming-scheme= to also say that it applies to MAC addresses. This commit
doesn't actually implement that though.
Lennart Poettering [Mon, 17 Jun 2019 09:31:06 +0000 (11:31 +0200)]
sleep: properly pass verb to sleep script
Another fall-out from our rewriting of argv[] now.
Fixes: #12782
Evgeny Vereshchagin [Mon, 17 Jun 2019 10:49:07 +0000 (12:49 +0200)]
fuzzit: sort UBSan checks alphabetically
to make it easier to make sense of them
Yu Watanabe [Mon, 17 Jun 2019 01:22:54 +0000 (10:22 +0900)]
meson: fix error message
Yu Watanabe [Mon, 17 Jun 2019 01:19:50 +0000 (10:19 +0900)]
Merge pull request #12802 from irtimmer/fix-openssl
resolved: fix DNS-over-TLS when using OpenSSL
Yu Watanabe [Sun, 9 Jun 2019 20:36:32 +0000 (05:36 +0900)]
timesync: judging if network is online by networkd's address state
Closes #12752.
Yu Watanabe [Sun, 9 Jun 2019 19:56:03 +0000 (04:56 +0900)]
sd-network: introduce functions for new link and manager states
Yu Watanabe [Sun, 16 Jun 2019 00:27:19 +0000 (09:27 +0900)]
network: drop unused manager_send_changed()
Yu Watanabe [Sun, 9 Jun 2019 20:22:25 +0000 (05:22 +0900)]
network: also introduce two new manager states
Yu Watanabe [Sun, 16 Jun 2019 00:03:25 +0000 (09:03 +0900)]
network: expose carrier and address states over dbus
Previously, when a bridge or bonding interface is in degraded-carrier
state, then we cannot judge the interface has addresses or not.
By using the new states, dbus clients can distinguish such situation.
Yu Watanabe [Sat, 15 Jun 2019 23:58:39 +0000 (08:58 +0900)]
network: split operational states into carrier and address states
This should not change any behavior. The new states will be exposed by
later commits.
Yu Watanabe [Sun, 9 Jun 2019 20:15:53 +0000 (05:15 +0900)]
network: introduce manager_send_changed_strv()
Yu Watanabe [Sun, 16 Jun 2019 00:14:36 +0000 (09:14 +0900)]
network: introduce link_send_changed_strv()
It will be used in later commits.
Yu Watanabe [Sun, 26 May 2019 20:35:02 +0000 (05:35 +0900)]
network: split out DBus related prototypes to networkd-link-bus.h
Evgeny Vereshchagin [Sat, 15 Jun 2019 21:12:24 +0000 (23:12 +0200)]
travis: turn on nonnull-attribute on Fuzzit
Iwan Timmer [Sat, 15 Jun 2019 20:05:00 +0000 (22:05 +0200)]
resolved: make no changes to OpenSSL BUF_MEM struct
Fix crash when using OpenSSL 1.1.1c
Fixes: #12763
Iwan Timmer [Sat, 15 Jun 2019 19:56:45 +0000 (21:56 +0200)]
Revert "resolved: Fix incorrect use of OpenSSL BUF_MEM"
This reverts commit
18bddeaaf225d5becfc10cd2c6a1d037c90574a2.
Revert this because it does not take the OpenSSL internal read pointer
into considoration. Resulting in padding in packetdata and therefore
broken SSL connections.
Zbigniew Jędrzejewski-Szmek [Sat, 15 Jun 2019 15:50:37 +0000 (17:50 +0200)]
Merge pull request #12753 from jrouleau/fix/hibernate-resume-timeout
hibernate-resume: fix resume device timeout
Yu Watanabe [Fri, 14 Jun 2019 00:42:51 +0000 (09:42 +0900)]
network: read link specific sysctl value
This introduce link_sysctl_ipv6_enabled() and replaces
manager_sysctl_ipv6_enabled() with it.
Zbigniew Jędrzejewski-Szmek [Sat, 15 Jun 2019 12:53:04 +0000 (14:53 +0200)]
Merge pull request #12796 from yuwata/test-network-use-wait-online
test-network: several cleanups
Zbigniew Jędrzejewski-Szmek [Sat, 15 Jun 2019 12:50:41 +0000 (14:50 +0200)]
Merge pull request #12794 from yuwata/network-configure-without-carrier
network: skip to check dynamic addresses when ConfigureWithoutCarrier=yes
Evgeny Vereshchagin [Sat, 15 Jun 2019 03:46:38 +0000 (06:46 +0300)]
Merge pull request #12761 from evverx/try-fuzzit
Turn on UBSan on Fuzzit
Evgeny Vereshchagin [Sat, 15 Jun 2019 00:07:17 +0000 (02:07 +0200)]
travis: add more ASan options