Lennart Poettering [Tue, 19 Mar 2019 18:05:19 +0000 (19:05 +0100)]
core: implement OOMPolicy= and watch cgroups for OOM killings
This adds a new per-service OOMPolicy= (along with a global
DefaultOOMPolicy=) that controls what to do if a process of the service
is killed by the kernel's OOM killer. It has three different values:
"continue" (old behaviour), "stop" (terminate the service), "kill" (let
the kernel kill all the service's processes).
On top of that, track OOM killer events per unit: generate a per-unit
structured, recognizable log message when we see an OOM killer event,
and put the service in a failure state if an OOM killer event was seen
and the selected policy was not "continue". A new "result" is defined
for this case: "oom-kill".
All of this relies on new cgroupv2 kernel functionality: the
"memory.events" notification interface and the "memory.oom.group"
attribute (which makes the kernel kill all cgroup processes
automatically).
Lennart Poettering [Tue, 19 Mar 2019 16:28:02 +0000 (17:28 +0100)]
service: beautify debug log message a bit
Lennart Poettering [Tue, 19 Mar 2019 16:17:31 +0000 (17:17 +0100)]
core: rename cgroup_inotify_wd → cgroup_control_inotify_wd
Let's rename the .cgroup_inotify_wd field of the Unit object to
.cgroup_control_inotify_wd. Let's similarly rename the hashmap
.cgroup_inotify_wd_unit of the Manager object to
.cgroup_control_inotify_wd_unit.
Why? As preparation for a later commit that allows us to watch the
"memory.events" cgroup attribute file in addition to the "cgroup.events"
file we already watch with the fields above. In that later commit we'll
add new fields "cgroup_memory_inotify_wd" to Unit and
"cgroup_memory_inotify_wd_unit" to Manager, that are used to watch these
other events file.
No change in behaviour. Just some renaming.
Lennart Poettering [Tue, 19 Mar 2019 12:01:12 +0000 (13:01 +0100)]
core: check for redundant operation before doing allocation
Lennart Poettering [Mon, 18 Mar 2019 19:21:11 +0000 (20:21 +0100)]
core: rearrange cgroup empty events a bit
So far the priorities for cgroup empty event handling were pretty weird.
The raw events (on cgroupsv2 from inotify, on cgroupsv1 from the agent
dgram socket) where scheduled at a lower priority than the cgroup empty
queue dispatcher. Let's swap that and ensure that we can coalesce events
more agressively: let's process the raw events at higher priority than
the cgroup empty event (which remains at the same prio).
Zbigniew Jędrzejewski-Szmek [Tue, 9 Apr 2019 08:52:52 +0000 (10:52 +0200)]
Merge pull request #12223 from yuwata/network-wireguard-preshared-key-file
network: add PresharedKeyFile= setting and make reading key file failure fatal
welaq [Mon, 8 Apr 2019 19:03:26 +0000 (22:03 +0300)]
l10n: Updated Lithuanian translation
Yu Watanabe [Mon, 8 Apr 2019 15:13:56 +0000 (00:13 +0900)]
NEWS: mention PresharedKeyFile=
Yu Watanabe [Fri, 5 Apr 2019 08:52:29 +0000 (17:52 +0900)]
test-network: add tests for WireGuardPeer.PresharedKey= and PresharedKeyFile=
Yu Watanabe [Mon, 8 Apr 2019 15:11:43 +0000 (00:11 +0900)]
network: make wireguard_decode_key_and_warn() take uint8_t buf[static WG_KEY_LEN]
Yu Watanabe [Sun, 7 Apr 2019 18:48:57 +0000 (03:48 +0900)]
network: warn when wireguard keys are stored in world readable files
Yu Watanabe [Fri, 5 Apr 2019 08:33:09 +0000 (17:33 +0900)]
network: add WireGuardPeer.PresharedKeyFile= setting
Yu Watanabe [Sun, 7 Apr 2019 17:48:02 +0000 (02:48 +0900)]
network: clear wireguard keys on failure or on exit
Yu Watanabe [Fri, 5 Apr 2019 08:28:46 +0000 (17:28 +0900)]
network: make reading PrivateKeyFile= failure always fatal
This also refactor wireguard_read_key_file().
Yu Watanabe [Mon, 8 Apr 2019 14:40:22 +0000 (23:40 +0900)]
fileio: add READ_FULL_FILE_UNBASE64 flag for read_full_file_full()
Yu Watanabe [Mon, 8 Apr 2019 05:15:10 +0000 (14:15 +0900)]
fileio: read_full_file_full() also warns when file is world readable and secure flag is set
Yu Watanabe [Sun, 7 Apr 2019 18:48:30 +0000 (03:48 +0900)]
fileio: introduce warn_file_is_world_accessible()
Yu Watanabe [Sun, 7 Apr 2019 17:22:40 +0000 (02:22 +0900)]
util: introduce READ_FULL_FILE_SECURE flag for reading secure data
Zbigniew Jędrzejewski-Szmek [Mon, 8 Apr 2019 19:58:11 +0000 (21:58 +0200)]
Merge pull request #12241 from keszybz/two-man-link-additions
Two man link additions
Lennart Poettering [Mon, 8 Apr 2019 12:55:41 +0000 (14:55 +0200)]
inhibit: fix argv[] usage
Another fix in style of
ed179fd71030ddd657500591dac37e7499fc7b2c and
bd169c2be0fbdaf6eb2ea7951e650d5e5983fbf6..
I hope we are soon complete with these.
Fixes: #12246
Zbigniew Jędrzejewski-Szmek [Mon, 8 Apr 2019 13:45:45 +0000 (15:45 +0200)]
NEWS: add mention of time-set.target
Zbigniew Jędrzejewski-Szmek [Mon, 8 Apr 2019 07:20:16 +0000 (09:20 +0200)]
man: add a lengthy example for NamePolicy= debugging
This is still rather opaque, and test-builtin is quite useful in this
case, let's advertise it a bit more.
Zbigniew Jędrzejewski-Szmek [Mon, 8 Apr 2019 06:59:45 +0000 (08:59 +0200)]
man: say that .link NamePolicy= should be empty for Name= to take effect
The description of NamePolicy= implied this, but didn't spell it out. It's a
very common use case, so let's add a bit of explanation and ehance the example
a bit.
Inspired by https://bugzilla.redhat.com/show_bug.cgi?id=1695894.
Lennart Poettering [Mon, 8 Apr 2019 13:31:31 +0000 (15:31 +0200)]
Merge pull request #12244 from poettering/242-news-final
final 242 NEWS tweaks + another hwdb update
Lennart Poettering [Mon, 8 Apr 2019 13:17:23 +0000 (15:17 +0200)]
man: add references from the .mount and .service man pages to systemd-{mount,run} pages
Fixes: #12235
Zbigniew Jędrzejewski-Szmek [Mon, 8 Apr 2019 13:22:44 +0000 (15:22 +0200)]
Merge pull request #12245 from poettering/empty-or-dash
introduce empty_or_dash() helper
Lennart Poettering [Mon, 8 Apr 2019 12:43:37 +0000 (14:43 +0200)]
man: elaborate on fd ownership in sd_event_add_io(3)
Replaces: #12239
Peter A. Bigot [Mon, 30 Apr 2018 12:05:29 +0000 (07:05 -0500)]
units: add time-set.target
time-sync.target is supposed to indicate system clock is synchronized
with a remote clock, but as used through 241 it only provided a system
clock that was updated based on a locally-maintained timestamp. Systems
that are powered off for extended periods would not come up with
accurate time.
Retain the existing behavior using a new time-set.target leaving
time-sync.target for cases where accuracy is required.
Closes #8861
Lennart Poettering [Mon, 8 Apr 2019 12:31:15 +0000 (14:31 +0200)]
coccinelle: add coccinelle script for empty_or_dash() use
Paul Menzel [Mon, 8 Apr 2019 08:53:55 +0000 (10:53 +0200)]
man/systemd-sysusers: Fix typo in *from* to *form*
Lennart Poettering [Mon, 8 Apr 2019 10:11:11 +0000 (12:11 +0200)]
basic: add new helper call empty_or_dash_to_null()
We have a function like this at two places already. Let's unify it in
one generic location and let's port a number of users over.
Lennart Poettering [Mon, 8 Apr 2019 10:03:33 +0000 (12:03 +0200)]
tree-wide: introduce empty_or_dash() helper
At quite a few places we check isempty() || streq(…, "-"), let's add a
helper to simplify that, and replace that by a single function call.
Lennart Poettering [Mon, 8 Apr 2019 09:42:10 +0000 (11:42 +0200)]
hwdb: update hwdb
Lennart Poettering [Mon, 8 Apr 2019 09:35:45 +0000 (11:35 +0200)]
update NEWS for 242 final
Lennart Poettering [Mon, 8 Apr 2019 09:19:34 +0000 (11:19 +0200)]
Merge pull request #12238 from keszybz/one-genuine-bugfix+lots-of-line-wrapping
One genuine bugfix and lots of line wrapping
Lennart Poettering [Mon, 4 Feb 2019 09:23:43 +0000 (10:23 +0100)]
pam-systemd: use secure_getenv() rather than getenv()
And explain why in a comment.
Jonas DOREL [Mon, 8 Apr 2019 06:19:58 +0000 (08:19 +0200)]
man: correct units path usage according to FHS (#11388)
According to the Filesystem Hierarchy Standard, "The /usr/local hierarchy is for use by the system administrator when installing software locally. It needs to be safe from being overwritten when the system software is updated". So it should not be used by installed packages.
Zbigniew Jędrzejewski-Szmek [Sun, 7 Apr 2019 20:00:11 +0000 (22:00 +0200)]
sysusers: use return_error_errno() where possible
Zbigniew Jędrzejewski-Szmek [Sun, 7 Apr 2019 19:37:18 +0000 (21:37 +0200)]
sysusers: add missing initalizer
I assume that this is the error causing the invalid free in
https://bugzilla.redhat.com/show_bug.cgi?id=1670679.
Zbigniew Jędrzejewski-Szmek [Sun, 7 Apr 2019 18:51:44 +0000 (20:51 +0200)]
logind: linewrap some long lines and remove unnecessary conditional
Yu Watanabe [Sun, 7 Apr 2019 18:41:03 +0000 (03:41 +0900)]
util: extend unbase64mem() to accept secure flag
When the flag is set, buffer is cleared on failure.
Jussi Pakkanen [Sat, 6 Apr 2019 19:59:06 +0000 (21:59 +0200)]
meson: drop misplaced -Wl,--undefined argument
Ld's man page says the following:
-u symbol
--undefined=symbol
Force symbol to be entered in the output file as an undefined symbol. Doing
this may, for example, trigger linking of additional modules from standard
libraries. -u may be repeated with different option arguments to enter
additional undefined symbols. This option is equivalent to the "EXTERN"
linker script command.
If this option is being used to force additional modules to be pulled into
the link, and if it is an error for the symbol to remain undefined, then the
option --require-defined should be used instead.
This would imply that it always requires an argument, which this does not
pass. Thus it will grab the next argument on the command line as its
argument. Before it took one of the many -lrt args (presumably) and now it
grabs something other random linker argument and things break.
[zj: this line was added in the first version of the meson configuration back
in
5c23128daba7236a6080383b2a5649033cfef85c. AFAICT, this was a mistake. No
such flag appeared in Makefile.am at the time.]
https://github.com/mesonbuild/meson/issues/5113
Lennart Poettering [Sun, 7 Apr 2019 17:36:32 +0000 (19:36 +0200)]
Merge pull request #12234 from yuwata/calendarspec-fix-oss-fuzz-14108
Calendarspec cleanups and fixes integer overflow
Yu Watanabe [Fri, 5 Apr 2019 08:24:50 +0000 (17:24 +0900)]
network: re-indent conf parsers in wireguard.c
Yu Watanabe [Sun, 7 Apr 2019 15:37:31 +0000 (00:37 +0900)]
calendarspec: fix possible integer overflow
Fixes oss-fuzz#14108.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14108
Yu Watanabe [Sun, 7 Apr 2019 15:32:14 +0000 (00:32 +0900)]
calendarspec: use _cleanup_ attributes for CalendarComponent
Yu Watanabe [Sun, 7 Apr 2019 15:21:37 +0000 (00:21 +0900)]
calendarspec: rename free_chain() to chain_free()
Yu Watanabe [Sun, 7 Apr 2019 15:18:54 +0000 (00:18 +0900)]
calendarspec: use structured initializers
Lennart Poettering [Fri, 5 Apr 2019 16:14:43 +0000 (18:14 +0200)]
nspawn: create boot_id and kmsg files for overmounting in /run, not /tmp
/tmp might not be mounted at all yet (given that we support
SYSTEMD_NSPAWN_TMPFS_TMP=0 to turn this off), and /tmp is a dir systemd
usually tries to unmount during shutdown (unlike /run), and we shouldn't
keep it busy. Hence let's just move these deleted files to /run so that
we don't keep /tmp needlessly busy.
Lennart Poettering [Fri, 5 Apr 2019 13:31:34 +0000 (15:31 +0200)]
lgtm: warn about strerror() use
Lennart Poettering [Fri, 5 Apr 2019 14:22:47 +0000 (16:22 +0200)]
meson: sort source files again
Luís Ferreira [Wed, 3 Apr 2019 18:10:50 +0000 (19:10 +0100)]
hwdb: Add accelerometer orientation quirk for the Teclast F6 Pro
Lennart Poettering [Thu, 4 Apr 2019 08:04:26 +0000 (10:04 +0200)]
test-journal: move tests to /var/tmp/ and set FS_NOCOW_FL
The journal files might not be tiny hence let's write them to /var/tmp/
instead of /tmp. Also, let's turn on NOCOW on the files, as these tests
might apparently be slow on btrfs.
Fixes: #12210
Yu Watanabe [Thu, 4 Apr 2019 03:40:44 +0000 (12:40 +0900)]
ask-passwd: slightly optimize handling arguments
It is not necessary to copy arguments for each console.
Yu Watanabe [Thu, 4 Apr 2019 04:35:29 +0000 (13:35 +0900)]
bus-util: treat org.freedesktop.DBus.Error.ServiceUnknown nicely when polkit does not exist
Fixes #12209.
Yu Watanabe [Thu, 4 Apr 2019 04:05:12 +0000 (13:05 +0900)]
Merge pull request #12208 from poettering/base-file-system-tweaks
base-filesystem: be nicer to read-only fs images
Yu Watanabe [Thu, 4 Apr 2019 03:59:04 +0000 (12:59 +0900)]
Merge pull request #12207 from poettering/portable-bus-policy-fix
portabled dbus policy fix
Yu Watanabe [Fri, 29 Mar 2019 21:41:29 +0000 (06:41 +0900)]
udevadm: drop unused option
Lennart Poettering [Wed, 3 Apr 2019 18:10:19 +0000 (20:10 +0200)]
tty-ask-pw-agent: use right array
No point in copying the array if we are not going to use the copy.
Prompted by: https://github.com/systemd/systemd/pull/12183#issuecomment-
479591781
Lennart Poettering [Wed, 3 Apr 2019 14:12:41 +0000 (16:12 +0200)]
udev-util: allocate an event loop of our own for waiting
We can't use the per-thread default one here, as it might already be
running (for example, that's the case in portabled), and our event loops
are not recursive, hence running them a second time is not OK.
Lennart Poettering [Wed, 3 Apr 2019 14:55:01 +0000 (16:55 +0200)]
shared: be friendly to EROFS images
There are environments where /lib might not be necessary (think:
statically compiled portable service binary), hence don't insist on it
if the image is read-only.
Lennart Poettering [Wed, 3 Apr 2019 14:53:14 +0000 (16:53 +0200)]
shared: path_join() is your friend
Lennart Poettering [Wed, 3 Apr 2019 14:52:19 +0000 (16:52 +0200)]
shared: no need to initialize variable
Lennart Poettering [Wed, 3 Apr 2019 14:51:51 +0000 (16:51 +0200)]
portabled: fix method name
yikes.
Lennart Poettering [Wed, 3 Apr 2019 14:51:26 +0000 (16:51 +0200)]
portabled: reorder methods in vtable
Let's stick to the same order in the per-image vtable and the manager
vtable.
Lennart Poettering [Wed, 3 Apr 2019 14:50:49 +0000 (16:50 +0200)]
portabled: fix dbus policy
Let's whitelist the method calls actually defined, not some outdated old
names.
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 15:19:14 +0000 (17:19 +0200)]
Merge pull request #12198 from keszybz/seccomp-parsing-logging
Seccomp parsing logging cleanup
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 15:18:35 +0000 (17:18 +0200)]
Merge pull request #12205 from keszybz/update-release-docs
docs: let's not close the milestone early
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 14:43:17 +0000 (16:43 +0200)]
docs: also document updates to stable repo
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 14:23:43 +0000 (16:23 +0200)]
docs: let's not close the milestone early
Lennart Poettering [Wed, 3 Apr 2019 13:47:18 +0000 (15:47 +0200)]
Merge pull request #12202 from keszybz/seccomp-arm64
Fixes for S[GU]ID filter on arm64
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 11:11:00 +0000 (13:11 +0200)]
seccomp: rework how the S[UG]ID filter is installed
If we know that a syscall is undefined on the given architecture, don't
even try to add it.
Try to install the filter even if some syscalls fail. Also use a helper
function to make the whole a bit less magic.
This allows the S[UG]ID test to pass on arm64.
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 10:36:03 +0000 (12:36 +0200)]
test-seccomp: fix compilation on arm64
It has no open().
Zbigniew Jędrzejewski-Szmek [Tue, 2 Apr 2019 12:54:42 +0000 (14:54 +0200)]
kernel-install: add a check that the vmlinuz arg is sane
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 08:24:34 +0000 (10:24 +0200)]
docs: update release steps for meson
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 08:00:14 +0000 (10:00 +0200)]
build-sys: bump package version
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 07:48:10 +0000 (09:48 +0200)]
Merge pull request #12121 from poettering/contrib
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 07:17:42 +0000 (09:17 +0200)]
pid1: pass unit name to seccomp parser when we have no file location
Building on previous commit, let's pass the unit name when parsing
dbus message or builtin whitelist, which is better than nothing.
seccomp_parse_syscall_filter() is not needed anymore, so it is removed,
and seccomp_parse_syscall_filter_full() is renamed to take its place.
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 07:13:37 +0000 (09:13 +0200)]
basic/log: log any available location information in log_syntax()
We would log "(null):0: Failed to parse system call, ignoring: rseq" from
log_syntax_internal() from log_syntax() from seccomp_parse_syscall_filter_full()
from seccomp_parse_syscall_filter() from config_parse_syscall_filter(),
when generating the built-in @default whitelist. Since it was not based on the
unit file, we would not pass a file name.
So let's make sure that log_syntax() does not print "(null)" pointer (which is
iffy and ugly), and use the unit name as fallback or nothing if both are missing.
In principle, one of the two should be always available, since why use log_syntax()
otherwise, but let's make things more resilient by guarding against this case too.
log_syntax() is called from a thousand places, and often in error path, so it's
hard to verify all callers.
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 06:56:06 +0000 (08:56 +0200)]
core: use a temporary variable for calculation of seccomp flags
I think it is easier to read this way.
Zbigniew Jędrzejewski-Szmek [Wed, 3 Apr 2019 06:19:08 +0000 (08:19 +0200)]
test: use newer verb to set log levels
Lennart Poettering [Tue, 2 Apr 2019 19:05:54 +0000 (21:05 +0200)]
docs: fix path to unit files
Davide Cavalca [Wed, 3 Apr 2019 00:23:43 +0000 (17:23 -0700)]
core: fix build failure if seccomp is disabled
Lennart Poettering [Tue, 2 Apr 2019 15:05:15 +0000 (17:05 +0200)]
Revert "build: install /etc/systemd/{system,user}-generators"
This reverts commit
509276f2b7d44d472b66e79cbfa531c1de4c3801.
Yu Watanabe [Tue, 2 Apr 2019 16:46:54 +0000 (01:46 +0900)]
Merge pull request #12188 from poettering/coccinelle-fixlets
tree-wide: let's run coccinelle again
Lennart Poettering [Tue, 2 Apr 2019 09:25:26 +0000 (11:25 +0200)]
update NEWS
Lennart Poettering [Wed, 27 Mar 2019 13:23:57 +0000 (14:23 +0100)]
meson: bump so versions
Since we aren't quite ready for release v242 yet, let's not bump the
package version yet, but let's already bump the soversion.
Lennart Poettering [Wed, 27 Mar 2019 13:23:25 +0000 (14:23 +0100)]
NEWS: add preliminary contributor list
Lennart Poettering [Wed, 27 Mar 2019 13:22:31 +0000 (14:22 +0100)]
update .mailmap
Lennart Poettering [Tue, 2 Apr 2019 15:30:11 +0000 (17:30 +0200)]
Merge pull request #12056 from poettering/seccomp-suid-sgid
Introduce RestrictSUIDSGID= for disabling SUID/SGID file creation
Lennart Poettering [Wed, 20 Mar 2019 20:00:17 +0000 (21:00 +0100)]
update TODO
Lennart Poettering [Wed, 20 Mar 2019 19:19:38 +0000 (20:19 +0100)]
core: imply NNP and SUID/SGID restriction for DynamicUser=yes service
Let's be safe, rather than sorry. This way DynamicUser=yes services can
neither take benefit of, nor create SUID/SGID binaries.
Given that DynamicUser= is a recent addition only we should be able to
get away with turning this on, even though this is strictly speaking a
binary compatibility breakage.
Lennart Poettering [Wed, 20 Mar 2019 18:52:20 +0000 (19:52 +0100)]
units: turn on RestrictSUIDSGID= in most of our long-running daemons
Lennart Poettering [Wed, 20 Mar 2019 18:45:32 +0000 (19:45 +0100)]
man: document the new RestrictSUIDSGID= setting
Lennart Poettering [Wed, 20 Mar 2019 18:20:35 +0000 (19:20 +0100)]
analyze: check for RestrictSUIDSGID= in "systemd-analyze security"
And let's give it a heigh weight, since it pretty much can be used for
bad things only.
Lennart Poettering [Wed, 20 Mar 2019 18:09:09 +0000 (19:09 +0100)]
core: expose SUID/SGID restriction as new unit setting RestrictSUIDSGID=
Lennart Poettering [Wed, 20 Mar 2019 18:01:37 +0000 (19:01 +0100)]
test: add test case for restrict_suid_sgid()
Lennart Poettering [Wed, 20 Mar 2019 18:00:28 +0000 (19:00 +0100)]
seccomp: introduce seccomp_restrict_suid_sgid() for blocking chmod() for suid/sgid files
Lennart Poettering [Wed, 20 Mar 2019 17:59:59 +0000 (18:59 +0100)]
seccomp: add debug messages to seccomp_protect_hostname()
Lennart Poettering [Fri, 29 Mar 2019 19:34:45 +0000 (20:34 +0100)]
core: add a generic helper that forwards per-unit method calls from Manager
Quite often we have a method DoSomethingWithUnit() on the Manager object
that is the same as a function DoSomething() on a Unit object. Let's
shorten things by introducing a common function that forwards the
former to the latter, instead of writing this again and again.