Djalal Harouni [Tue, 14 Feb 2017 20:45:23 +0000 (21:45 +0100)]
Merge pull request #5343 from eworm-de/virt-kvm
virt: detect qemu/kvm as 'kvm'
Lennart Poettering [Tue, 14 Feb 2017 18:14:11 +0000 (19:14 +0100)]
Merge pull request #5346 from namhyung/coredump-reverse
Update for coredumpctl -r option
Christian Hesse [Tue, 14 Feb 2017 13:51:12 +0000 (14:51 +0100)]
virt: detect qemu/kvm as 'kvm'
In commit 050e65a we swapped order of detect_vm_{cpuid,dmi}(). That
fixed Virtualbox but broke qemu with kvm, which is expected to return
'kvm'. So check for qemu/kvm first, then DMI, CPUID last.
This fixes #5318.
Signed-off-by: Christian Hesse <mail@eworm.de>
Namhyung Kim [Tue, 14 Feb 2017 14:08:46 +0000 (23:08 +0900)]
shell_completion: Add -r option for coredumpctl
Namhyung Kim [Tue, 14 Feb 2017 13:59:10 +0000 (22:59 +0900)]
man: coredumpctl: Add description of -r option
Lennart Poettering [Tue, 14 Feb 2017 14:09:43 +0000 (15:09 +0100)]
Merge pull request #5335 from poettering/resolved-some-fixes
some post-mdns fixes for resolved
Zbigniew Jędrzejewski-Szmek [Tue, 14 Feb 2017 10:27:40 +0000 (05:27 -0500)]
Define clone order on ppc (#5325)
This was tested on ppc64le. Assume the same is true for ppc64.
Lennart Poettering [Tue, 14 Feb 2017 10:12:08 +0000 (11:12 +0100)]
resolved: restore ANY reply behaviour for mDNS
This restores behaviour of
53fda2bb933694c9bdb1bbf1f5583e39673b74b2: for
mDNS (and mDNS only) we'll match replies to transactions honouring ANY
matches.
Lennart Poettering [Mon, 13 Feb 2017 19:45:40 +0000 (20:45 +0100)]
resolved: size the mdns announce answer array properly
The array doesn't grow dynamically, hence pick the right size at the
moment of allocation. Let's simply multiply the number of addresses of
this link by 2, as that's how many RRs we maintain for it.
Marc-Andre Lureau [Tue, 14 Feb 2017 09:18:27 +0000 (13:18 +0400)]
rules: add persistent by-path drm rules (#5337)
Create persistent symlinks for DRM devices, ex:
/dev/dri/by-path/pci-0000:00:02.0-card -> /dev/dri/card1
/dev/dri/by-path/pci-0000:00:02.0-render -> /dev/dri/renderD129
etc...
This allows to configure DRM device usage with stable paths.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Zbigniew Jędrzejewski-Szmek [Tue, 14 Feb 2017 02:13:50 +0000 (21:13 -0500)]
Merge pull request #5298 from martinpitt/relocatable-tests
test: make unit tests relocatable and add an "install-tests" make target
Martin Pitt [Tue, 14 Feb 2017 01:58:22 +0000 (02:58 +0100)]
fstab-generator: quiesce false-positive -Werror=format-nonliteral (#5336)
Commit
ae3251851 changed the fprintf() format argument into a variable
which triggers a gcc 6.3 warning/error:
src/fstab-generator/fstab-generator.c:243:17: error: format not a string literal,
argument types not checked [-Werror=format-nonliteral]
fprintf(f, format, res);
This is a false positive, as the function is only being called with
constant (not user-definable) arguments which are valid format strings.
Martin Pitt [Sun, 12 Feb 2017 22:53:53 +0000 (23:53 +0100)]
buildsys: add "install-tests" target
Add a new "install-tests" make target that installs our unit test-*
executables and their test data files into /usr/lib/systemd/tests/.
This is useful for packaging the tests to run them with root privileges
or in CI.
Fixes #5257
Martin Pitt [Sun, 12 Feb 2017 22:14:43 +0000 (23:14 +0100)]
test: make unit tests relocatable
It is useful to package test-* binaries and run them as root under
autopkgtest or manually on particular machines. They currently have a
built-in hardcoded absolute path to their test data, which does not work
when running the test programs from any other path than the original
build directory.
By default, make the tests look for their data in
<test_exe_directory>/testdata/ so that they can be called from any
directory (provided that the corresponding test data is installed
correctly). As we don't have a fixed static path in the build tree (as
build and source tree are independent), set $TEST_DIR with "make check"
to point to <srcdir>/test/, as we previously did with an automake
variable.
Martin Pitt [Sun, 12 Feb 2017 21:39:21 +0000 (22:39 +0100)]
test: move resolved test data into test/
Moe test-resolve's test data from src/resolve/test-data to
test/test-resolve/ to be consistent with test/test-{execute,path}/. This
will make it easier to make the tests relocatable.
Ruslan Bilovol [Mon, 13 Feb 2017 19:50:22 +0000 (21:50 +0200)]
fstab-generator: add x-systemd.before and x-systemd.after fstab options (#5330)
Currently fstab entries with 'nofail' option are mounted
asynchronously and there is no way how to specify dependencies
between such fstab entry and another units. It means that
users are forced to write additional dependency units manually.
The patch introduces new systemd fstab options:
x-systemd.before=<PATH>
x-systemd.after=<PATH>
- to specify another mount dependency (PATH is translated to unit name)
x-systemd.before=<UNIT>
x-systemd.after=<UNIT>
- to specify arbitrary UNIT dependency
For example mount where A should be mounted before local-fs.target unit:
/dev/sdb1 /mnt/test/A none nofail,x-systemd.before=local-fs.target
Lennart Poettering [Mon, 13 Feb 2017 19:45:25 +0000 (20:45 +0100)]
resolved: name announce timer event source
Lennart Poettering [Mon, 13 Feb 2017 19:44:11 +0000 (20:44 +0100)]
resolved: let's propagate errors from dns_scope_announce() and elsewhere
We don't actually make use of the return value for now, but it matches
our coding style elsewhere, and it actually shortens our code quite a
bit.
Also, add a missing OOM check after dns_answer_new().
Lennart Poettering [Mon, 13 Feb 2017 19:41:09 +0000 (20:41 +0100)]
resolved: count the number of addresses per link
This becomes handy later on. Moreover, we keep track of similar counters
for other objects like this too, hence adding this here too is obvious.
Lennart Poettering [Mon, 13 Feb 2017 19:34:39 +0000 (20:34 +0100)]
resolved: don't return ANY transactions when looking for transactions
This reverts a part of
53fda2bb933694c9bdb1bbf1f5583e39673b74b2:
On classic DNS and LLMNR ANY requests may be replied to with any kind of
RR, and the reply does not have to be comprehensive: these protocols
simply define that if there's an RRset that can answer the question,
then at least one should be sent as reply, but not necessarily all. This
means it's not safe to "merge" transactions for arbitrary RR types into
ANY requests, as the reply might not answer the specific question.
As the merging is primarily an optimization, let's undo this for now.
This logic may be readded later, in a way that only applies to mDNS.
Also, there's an OOM problem with this chunk: dns_resource_key_new()
might fail due to OOM and this is not handled. (This is easily removed
though, by using DNS_RESOURCE_KEY_CONST()).
Djalal Harouni [Mon, 13 Feb 2017 18:25:13 +0000 (19:25 +0100)]
Merge pull request #5331 from namhyung/coredump-reverse
Add -r/--reverse option to coredumpctl
Lennart Poettering [Mon, 13 Feb 2017 14:29:40 +0000 (15:29 +0100)]
Merge pull request #5319 from keszybz/test-execute
test-execute without capsh
Lennart Poettering [Mon, 13 Feb 2017 14:00:10 +0000 (15:00 +0100)]
Merge pull request #5320 from jwrdegoede/cube-iwork8-air
Extended evdev keyboard match rule + cube iwork8 air keymap fixup hwdb entry
Namhyung Kim [Mon, 13 Feb 2017 13:55:25 +0000 (22:55 +0900)]
coredumpctl: Add -r/--reverse option
Like journalctl, users sometimes want to see coredump list in reverse
order.
Signed-off-by: Namhyung Kim <namhyung@gmail.com>
Namhyung Kim [Mon, 13 Feb 2017 13:35:37 +0000 (22:35 +0900)]
coredumpctl: Remove dubious newline in the help message
It seems the -o opiton and -D option can be printed together.
Signed-off-by: Namhyung Kim <namhyung@gmail.com>
Martin Pitt [Mon, 13 Feb 2017 07:58:57 +0000 (08:58 +0100)]
Merge pull request #5322 from keszybz/silence-gcc-warning
Silence gcc warnings
Zbigniew Jędrzejewski-Szmek [Sun, 12 Feb 2017 20:38:51 +0000 (15:38 -0500)]
Merge pull request #4832 from rojkov/mdns
Lennart Poettering [Sun, 12 Feb 2017 20:25:40 +0000 (21:25 +0100)]
seccomp: disable RestrictAddressFamilies= for the ABI we shall block, not the one we are compiled for (#5272)
It's a difference. Not a big one, but let's be correct here.
Lucas Werkmeister [Sun, 12 Feb 2017 20:20:08 +0000 (21:20 +0100)]
man: busctl: improve capture description (#5321)
Zbigniew Jędrzejewski-Szmek [Sun, 12 Feb 2017 20:08:19 +0000 (15:08 -0500)]
Merge pull request #5276 from poettering/resolved-cname
a good number of resolved fixes
Zbigniew Jędrzejewski-Szmek [Sun, 12 Feb 2017 18:22:18 +0000 (13:22 -0500)]
core/dbus: silence gcc warning about unitialized variable
src/core/dbus.c: In function 'find_unit':
src/core/dbus.c:334:15: warning: 'u' may be used uninitialized in this function [-Wmaybe-uninitialized]
*unit = u;
^
src/core/dbus.c:301:15: note: 'u' was declared here
Unit *u;
^
Zbigniew Jędrzejewski-Szmek [Sun, 12 Feb 2017 17:56:40 +0000 (12:56 -0500)]
core/manager: silence gcc warning about unitialized variable
At -O3, this was printed a hundred times for various callers of
manager_add_job_by_name(). AFAICT, there is no error and `unit` is always
intialized. Nevertheless, add explicit initialization to silence the noise.
src/core/manager.c: In function 'manager_start_target':
src/core/manager.c:1413:16: warning: 'unit' may be used uninitialized in this function [-Wmaybe-uninitialized]
return manager_add_job(m, type, unit, mode, e, ret);
^
src/core/manager.c:1401:15: note: 'unit' was declared here
Unit *unit;
^
Zbigniew Jędrzejewski-Szmek [Sun, 12 Feb 2017 17:40:09 +0000 (12:40 -0500)]
core/manager: make manager_load_unit*() functions always take output arg
We were inconsistent, manager_load_unit_prepare() would crash if _ret was ever NULL.
But none of the callers use NULL. So simplify things and require it to be non-NULL.
Hans de Goede [Sun, 12 Feb 2017 11:45:21 +0000 (12:45 +0100)]
hwdb: Cube iwork8 air button keymap fixup
The home and power buttons on the Cube iwork8 air tablet are swapped,
add a hwdb entry fixing this up.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Hans de Goede [Sun, 12 Feb 2017 11:33:22 +0000 (12:33 +0100)]
rules: Add extended evdev/input match rules for event nodes with the same name
Sometimes a system may have 2 input event nodes with the same name where
we only want to apply keyboard hwdb rules to 1 of the 2 devices.
This problem happens e.g. on devices where the soc_button_array driver is
used (e.g. intel atom based tablets) which registers 2 event nodes with
the name "gpio-keys".
This commit adds a new extended match rule which extends the match to also
check $attr{phys} and $attr{capabilities/ev}, allowing to differentiate
between devices with an identical name.
Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Lennart Poettering [Sun, 12 Feb 2017 05:44:46 +0000 (06:44 +0100)]
core: skip ReadOnlyPaths= and other permission-related mounts on PermissionsStartOnly= (#5309)
ReadOnlyPaths=, ProtectHome=, InaccessiblePaths= and ProtectSystem= are
about restricting access and little more, hence they should be disabled
if PermissionsStartOnly= is used or ExecStart= lines are prefixed with a
"+". Do that.
(Note that we will still create namespaces and stuff, since that's about
a lot more than just permissions. We'll simply disable the effect of
the four options mentioned above, but nothing else mount related.)
This also adds a test for this, to ensure this works as intended.
No documentation updates, as the documentation are already vague enough
to support the new behaviour ("If true, the permission-related execution
options…"). We could clarify this further, but I think we might want to
extend the switches' behaviour a bit more in future, hence leave it at
this for now.
Fixes: #5308
Doug Christman [Sun, 12 Feb 2017 05:39:17 +0000 (00:39 -0500)]
calendarspec: fix duplicate detection (#5310)
a2eb5ea79c added a new field to `CalendarComponent`; update
`normalize_chain` to compare all fields when dropping duplicates
Evgeny Vereshchagin [Sun, 12 Feb 2017 05:38:16 +0000 (08:38 +0300)]
shared: pass *unsigned_long to namespace_flag_from_string_many (#5315)
Fixes:
```
src/shared/bus-unit-util.c: In function ‘bus_append_unit_property_assignment’:
src/shared/bus-unit-util.c:570:65: warning: passing argument 2 of ‘namespace_flag_from_string_many’ from incompatible pointer type [-Wincompatible-pointer-types]
r = namespace_flag_from_string_many(eq, &flags);
^
In file included from src/shared/bus-unit-util.c:31:0:
src/shared/nsflags.h:41:5: note: expected ‘long unsigned int *’ but argument is of type ‘uint64_t * {aka long long unsigned int *}’
int namespace_flag_from_string_many(const char *name, unsigned long *ret);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
Closes #5312
Evgeny Vereshchagin [Sun, 12 Feb 2017 05:36:34 +0000 (08:36 +0300)]
shared: convert unsigned long to uint64_t explicitly (#5314)
Closes #5313
Zbigniew Jędrzejewski-Szmek [Sun, 12 Feb 2017 05:31:39 +0000 (00:31 -0500)]
Merge pull request #5303 from poettering/deleted-units
a small number of install and unit management related fixes
Michael Shields [Sun, 12 Feb 2017 05:30:40 +0000 (21:30 -0800)]
It's now ok to use Google NTP servers (#5311)
Lucas Werkmeister [Sun, 12 Feb 2017 05:27:58 +0000 (06:27 +0100)]
man: systemd.journal-fields: document _SYSTEMD_INVOCATION_ID (#5316)
#4067 added documentation to systemd.exec(5), but not systemd.journal-fields(7).
Zbigniew Jędrzejewski-Szmek [Sun, 12 Feb 2017 05:26:00 +0000 (00:26 -0500)]
test-execute: use __func__ to shorten messages
Zbigniew Jędrzejewski-Szmek [Sun, 12 Feb 2017 05:22:20 +0000 (00:22 -0500)]
README: document capsh's usefulness
Zbigniew Jędrzejewski-Szmek [Sun, 12 Feb 2017 05:21:02 +0000 (00:21 -0500)]
test-execute: detect missing capsh in all tests
Fixes #5273.
Zbigniew Jędrzejewski-Szmek [Sat, 11 Feb 2017 00:52:58 +0000 (19:52 -0500)]
Merge pull request #5250 from ddstreet/test-sys-nodes-script
replace test/sys.tar.xz with script to create test/sys/ contents
Florian Klink [Fri, 10 Feb 2017 23:47:55 +0000 (00:47 +0100)]
networkd: add IPv6ProxyNDPAddress support (#5174)
IPv6 Neighbor discovery proxy is the IPv6 equivalent to proxy ARP for IPv4.
It is required when ISPs do not unconditional route IPv6 subnets
to their designated target, but expect neighbor solicitation messages
for every address on a link.
A variable IPv6ProxyNDPAddress= is introduced to the [Network] section,
each representing a IPv6 neighbour proxy entry in the neighbour table.
Zbigniew Jędrzejewski-Szmek [Fri, 10 Feb 2017 22:48:22 +0000 (17:48 -0500)]
basic/architecture: adjust Risc-V ifdef (#5304)
https://lists.freedesktop.org/archives/systemd-devel/2017-February/038286.html
Let's keep both the old and new for now, so systemd builds correctly in either
environment. Later on we should drop the old.
Lennart Poettering [Fri, 10 Feb 2017 22:47:50 +0000 (23:47 +0100)]
seccomp: order seccomp ABI list, so that our native ABI comes last (#5306)
this way, we can still call seccomp ourselves, even if seccomp() is
blocked by the filter we are installing.
Fixes: #5300
Dan Streetman [Fri, 10 Feb 2017 20:29:52 +0000 (15:29 -0500)]
test: remove sys.tar.xz
The tarball is no longer needed, as the sys-script.py script creates
all the sys/ contents.
Dan Streetman [Fri, 10 Feb 2017 20:29:46 +0000 (15:29 -0500)]
test: change Makefile.am to use sys-script.py instead of sys.tar.xz
Dan Streetman [Fri, 10 Feb 2017 20:29:23 +0000 (15:29 -0500)]
test: create sys-script.py script
The script contains the contents of all sys/ test files, and creates
all dirs/links/files when run. This replaces the sys.tar.xz tarball
that contained sys/, so changes to sys files only require a simple
commit in git, instead of checking in an entire new tarball for each
sys/ change.
Dan Streetman [Fri, 10 Feb 2017 20:27:18 +0000 (15:27 -0500)]
test: add script to convert sys/ into sys-script.py
Instead of keeping all sys/ nodes in a tarball, use a script
"sys-script.py" to create all the sys/ entries.
This adds a script to create that initial "sys-script.py" script, using
an existing sys/ directory, created from the sys.tar.xz contents.
The "sys-script.py" can then be edited or recreated later, when any sys/
files are added or modified; the change will be only a patch to the
"sys-script.py" script in git, instead of forcing git to store a new
binary tarball.
Lennart Poettering [Fri, 10 Feb 2017 14:18:23 +0000 (15:18 +0100)]
path-lookup: if $HOME can be determined but $XDG_RUNTIME_DIR can't, is it
So far, if either $HOME or $XDG_RUNTIME_DIR is not set we wouldn't use
either, and fail acquire_config_dirs() and acquire_control_dirs() in
their entireties. With this change, let's make use of the variables we
can acquire, and don't bother with the other.
Specifically this means: in both acquire_config_dirs() and
acquire_control_dirs() handle ENXIO from user_config_dir() and
user_runtime_dir() directly, instead of propagating it up and handling
it in the caller.
Lennart Poettering [Fri, 10 Feb 2017 14:17:18 +0000 (15:17 +0100)]
path-lookup: drop redundant strv_isempty() check
If the strv is empty, then strv_extend_strv_concat() is a NOP anyway,
and hence there is no reason to guard for this explicitly.
Lennart Poettering [Fri, 10 Feb 2017 14:16:11 +0000 (15:16 +0100)]
path-lookup: try harder acquiring them $HOME of a user
Let's use get_home_dir() for figuring out the home directory, so that
there's a good chance we succeed figuring out unit locations even if
$HOME isn't set.
Fixes: #5260
Lennart Poettering [Fri, 10 Feb 2017 14:14:18 +0000 (15:14 +0100)]
install: never hit assert() when we can't figure out where to write configuration symlinks
Under specific circumstances it might happen that we can't figure out
where to place our symlinks, for example because we are supposed to
create them in the runtime directory but $XDG_RUNTIME_DIR is not set. In
this case, return -ENXIO instead of hitting an assert().
(Yeah, the error isn't very descriptive, but for now this should at
least be good enough to remove the assert() being hit.)
Lennart Poettering [Fri, 10 Feb 2017 11:23:22 +0000 (12:23 +0100)]
install: when disabling units, do so even if the unit is missing
In some cases there might be unit symlinks in .wants/ or .requires/
directories even though the unit is otherwise fully removed. In this
case, don't fail removal, but still remove the symlinks.
This reworks the symlink marking logic to always add unit files that we
are missing to the changes list, but proceed with any symlink removal
for them. This way we'll still generate useful hints that a unit is
missing if you invoke "systemctl disable idontexist.service", but also
still remove any link to it.
Fixes: #4995
Lennart Poettering [Fri, 10 Feb 2017 10:54:18 +0000 (11:54 +0100)]
dbus: check selinux privilege before returning process list
We protect less interetsing stuff with selinux "status", let's do that
here too.
Lennart Poettering [Fri, 10 Feb 2017 02:54:48 +0000 (03:54 +0100)]
core: make sure to destroy all name watching bus slots when we are kicked off the bus (#5294)
Fixes: #4528
Martin Pitt [Fri, 10 Feb 2017 02:30:44 +0000 (03:30 +0100)]
tests: show journal on systemd-resolved.service failures (#5297)
In networkd-test.py, show resolved's journal on failure, to debug issues
like https://github.com/systemd/systemd/pull/5283.
Lennart Poettering [Fri, 10 Feb 2017 02:29:33 +0000 (03:29 +0100)]
seccomp: add forgotten munmap() syscall to @file-system (#5291)
We added mmap() and mmap2(), but forgot munmap(). Fix that.
Pointed out by @lucaswerkmeister:
https://github.com/systemd/systemd/pull/4537#issuecomment-
273275298
Zbigniew Jędrzejewski-Szmek [Fri, 10 Feb 2017 02:28:12 +0000 (21:28 -0500)]
Merge pull request #5293 from poettering/seccomp-docs
Two doc fixes
Evgeny Vereshchagin [Fri, 10 Feb 2017 01:03:59 +0000 (04:03 +0300)]
Merge pull request #5295 from poettering/shutup-canonicalize
Shut up canonicalize debug log messages
Lennart Poettering [Thu, 9 Feb 2017 20:01:28 +0000 (21:01 +0100)]
dbus: permit seeing process list of units whose unit files are missing
Previously, we'd refuse the GetUnitProcesses() bus call if the unit file
couldn't be loaded. Which is wrong, as admins should be able to inspect
services whose unit files was deleted. Change this logic, so that we
permit introspecting the processes of any unit that is loaded,
regardless if it has a unit file or not.
(Note that we won't load unit files in GetUnitProcess(), but only
operate on already loaded ones. That's because only loaded units can
have processes — as that's how our GC logic works — and hence loading
the unit just for the process tree is pointless, as it would be empty).
See: #4995
Lennart Poettering [Thu, 9 Feb 2017 19:10:03 +0000 (20:10 +0100)]
dropin: always initialize return parameters on success
Just as a matter of coding style: whenever we return successfully, let's
make sure all our return parameters are properly initialized to
something.
Lennart Poettering [Thu, 9 Feb 2017 19:08:58 +0000 (20:08 +0100)]
dropin: let's reduce duplicate a bit
After generating the template name we can shortcut things and just call
unit_file_find_dirs() from inside itself, just with the new name and
save a good number of duplicate lines.
Lennart Poettering [Thu, 9 Feb 2017 19:08:44 +0000 (20:08 +0100)]
dropin: let's prefer strjoina() over strjoin()
Lennart Poettering [Thu, 9 Feb 2017 19:07:00 +0000 (20:07 +0100)]
dropin: downgrade logging about paths we cannot canonicalize
After all, most units won't have drop-in dirs, hence there's no point in
logging about that.
Fixes: #5252
Lennart Poettering [Thu, 9 Feb 2017 17:40:42 +0000 (18:40 +0100)]
man: update pam_systemd and systemd-logind man pages a bit
This builds on @utezduyar's #4640, but extends on it.
Fixes: #4550
Replaces: #4640
Lennart Poettering [Thu, 9 Feb 2017 17:27:02 +0000 (18:27 +0100)]
man: improve documentation on seccomp regarding alternative ABIs
Let's clarify that RestrictAddressFamilies= and MemoryDenyWriteExecute=
are only fully effective if non-native system call architectures are
disabled, since they otherwise may be used to circumvent the filters, as
the filters aren't equally effective on all ABIs.
Fixes: #5277
Zbigniew Jędrzejewski-Szmek [Thu, 9 Feb 2017 15:28:37 +0000 (10:28 -0500)]
Introduce '## ' as internal comment prefix in .in files and filter out a comment (#5289)
Sometimes we have comments which don't make sense outside of the systemd
codebase, so let's filter them out from the user-visible files.
Fixes #5286.
Lennart Poettering [Wed, 8 Feb 2017 19:35:32 +0000 (20:35 +0100)]
resolved: if strict DNSSEC mode is selected never downgrade below DNSSEC server feature level due to packet loss
Fixes: #4315
Lennart Poettering [Wed, 8 Feb 2017 19:13:58 +0000 (20:13 +0100)]
resolved: also synthesize records for the full local hostname
Previously, we'd only synthesize RRs for the LLMNR and mDNS versions of
the hostnames (i.e. the first label of the kernel hostname, as well as
the first label of the kernel hostname suffixed with .local). With this
change, we also synthesize an RR for the full hostname, which is
relevant in case it has more than one label.
Fixes: #5041
Lennart Poettering [Wed, 8 Feb 2017 19:00:07 +0000 (20:00 +0100)]
nss-myhostname: don't fill scopeid for non-link-local addresses
Inspired by #4465, we shouldn't do this for nss-myhostname either.
Lennart Poettering [Wed, 8 Feb 2017 18:55:16 +0000 (19:55 +0100)]
resolved: when a server response with REFUSED, try a different one
Fixes: #4264
Lennart Poettering [Wed, 8 Feb 2017 18:40:48 +0000 (19:40 +0100)]
nss-resolve: don't set scopeindex for non-link-local addresses
Apparently some apps don't like that. And given that this isn't
necessary for link-local addresses, let's suppress this information.
Fixes: #4465
Lennart Poettering [Wed, 8 Feb 2017 18:22:49 +0000 (19:22 +0100)]
resolved: when following a CNAME initialize authenticated bit by the weakest answer
When following a CNAME chain, don't set the authenticated bit, unless
all lookups in the chain could be authenticated.
Lennart Poettering [Wed, 8 Feb 2017 18:12:55 +0000 (19:12 +0100)]
resolved: follow CNAMES for DNS stub replies
Clients expect us to follow CNAMEs for them, hence do so. On the first
iteration start putting together a packet, and then keep adding data we
acquire through CNAMEs to it, until we finally send it off.
Fixes: #3826
Lennart Poettering [Wed, 8 Feb 2017 16:59:58 +0000 (17:59 +0100)]
tree-wide: make bus_map_all_properties return a proper sd_bus_error
And then show it, to make things a bit friendlier to the user if we fail
acquiring some props.
In fact, this fixes a number of actual bugs, where we used an error
structure for output that we actually never got an error in.
Lennart Poettering [Wed, 8 Feb 2017 16:59:18 +0000 (17:59 +0100)]
core: fix minor memory leak
Zbigniew Jędrzejewski-Szmek [Thu, 9 Feb 2017 14:42:43 +0000 (09:42 -0500)]
Merge pull request #5287 from poettering/exit-codes
rework WorkingDirectory= and RootDirectory= management for services
Zbigniew Jędrzejewski-Szmek [Thu, 9 Feb 2017 14:18:41 +0000 (09:18 -0500)]
Merge pull request #5255 from poettering/percent-escape
fstab-generator: Options= applies specifier expansion
Lennart Poettering [Thu, 9 Feb 2017 12:17:00 +0000 (13:17 +0100)]
execute: set the right exit status for CHDIR vs. CHROOT
Fixes: #5125
Lennart Poettering [Thu, 9 Feb 2017 12:16:51 +0000 (13:16 +0100)]
execute: use prefix_roota() where appropriate
Lennart Poettering [Thu, 9 Feb 2017 10:58:39 +0000 (11:58 +0100)]
execute: set working directory to /root if User= is not set, but WorkingDirectory=~ is
Or actually, try to to do the right thing depending on what is
available:
- If we know $HOME from User=, then use that.
- If the UID for the service is 0, hardcode that WorkingDirectory=~ means WorkingDirectory=/root
- In any other case (which will be the unprivileged --user case), use
get_home_dir() to find the $HOME of the user we are running as.
- Otherwise fail.
Fixes: #5246 #5124
Lennart Poettering [Thu, 9 Feb 2017 10:43:44 +0000 (11:43 +0100)]
Revert "core/execute: set HOME, USER also for root users"
This reverts commit
8b89628a10af3863bfc97872912e9da4076a5929.
This broke #5246
27o [Thu, 9 Feb 2017 09:36:13 +0000 (10:36 +0100)]
networkd: add multicast membership to lldp socket (#5282)
27o [Thu, 9 Feb 2017 09:15:21 +0000 (10:15 +0100)]
dhcp-server: always save the ACKed lease address (#5281)
Martin Pitt [Thu, 9 Feb 2017 07:35:28 +0000 (08:35 +0100)]
Merge pull request #5279 from keszybz/man-reverts
A revert and some other tweaks for the man pages
Zbigniew Jędrzejewski-Szmek [Thu, 9 Feb 2017 04:05:05 +0000 (23:05 -0500)]
Merge pull request #4962 from poettering/root-directory-2
Add new MountAPIVFS= boolean unit file setting + RootImage=
Zbigniew Jędrzejewski-Szmek [Thu, 9 Feb 2017 03:53:16 +0000 (22:53 -0500)]
man: add more commas for clarify and reword a few sentences
Zbigniew Jędrzejewski-Szmek [Thu, 9 Feb 2017 01:23:12 +0000 (20:23 -0500)]
man: revert documentation about RequiresMountsFor= honoring noauto
This effectively reverts commit
5d2abc04fc95f5c5f6d0eaf2f:
Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Date: Wed Apr 16 22:15:42 2014 -0400
man: document relationship between RequiresMountsFor and noauto
https://bugzilla.redhat.com/show_bug.cgi?id=1088057
Fixes #5249.
Zbigniew Jędrzejewski-Szmek [Thu, 9 Feb 2017 01:13:57 +0000 (20:13 -0500)]
man: break long lines and update Fedora versions
We should try to keep the unbreakable lines below 80 columns.
It's not always possible of course.
Also, use the dl.fp.o alias instead of a specific mirror.
Evgeny Vereshchagin [Thu, 9 Feb 2017 00:31:22 +0000 (03:31 +0300)]
Merge pull request #5270 from poettering/seccomp-namespace-fix
swap seccomp filter params on s390
David Glasser [Wed, 8 Feb 2017 23:12:36 +0000 (15:12 -0800)]
man: fix docs for swap's DefaultDependencies= (#5278)
There was a missing dependency and one with the wrong type. Additionally, refer
to DefaultDependencies= once instead of twice, without a vague reference in the
first one that doesn't mention that the value matters.
Fixes #5226.
Lennart Poettering [Wed, 8 Feb 2017 15:29:05 +0000 (16:29 +0100)]
update TODO
Lennart Poettering [Wed, 8 Feb 2017 15:21:11 +0000 (16:21 +0100)]
seccomp: on s390 the clone() parameters are reversed
Add a bit of code that tries to get the right parameter order in place
for some of the better known architectures, and skips
restrict_namespaces for other archs.
This also bypasses the test on archs where we don't know the right
order.
In this case I didn't bother with testing the case where no filter is
applied, since that is hopefully just an issue for now, as there's
nothing stopping us from supporting more archs, we just need to know
which order is right.
Fixes: #5241
Jan Synacek [Wed, 8 Feb 2017 19:57:08 +0000 (20:57 +0100)]
systemctl: make sure that --now is carried out (#5209)
When services are already enabled/disabled/masked, make sure
that --now still enforces start/stop.
Franck Bui [Wed, 8 Feb 2017 19:56:22 +0000 (20:56 +0100)]
sd-event: "when exiting no signal event are pending" is a wrong assertion (#5271)
The code make the following assertion: when freeing a event loop object
(usually it's done after exiting from the main event loop), no signal events
are still queued and are pending.
This assertion can be found in event_unmask_signal_data() with
"assert(!d->current);" assertion.
It appears that this assertion can be wrong at least in a specific case
described below.
Consider the following example which is inspired from udev: a process defines 3
source events: 2 are created by sd_event_add_signal() and 1 is created by
sd_event_add_post().
1. the process receives the 2 signals consecutively so that signal 'A' source
event is queued and pending. Consequently the post source event is also
queued and pending. This is done by sd_event_wait().
2. The callback for signal 'A' is called by sd_event_dispatch().
3. The next call to sd_event_wait() will queue signal 'B' source event.
4. The callback for the post source event is called and calls sd_event_exit().
5. the event loop is exited.
6. freeing the event loop object will lead to the assertion failure in
event_unmask_signal_data().
This patch simply removes this assertion as it doesn't seem to be a
bug if the signal data still reference a signal source at this point.