Merge tag 'v208' into fuddlebaserock/ps/update-linux-v3.12-systemd-v208

systemd 208

63 files changed, 2804 insertions, 1121 deletions

diff --git a/src/shared/acl-util.c b/src/shared/acl-util.c
index 48bb12f46b..fb04e49dc4 100644
--- a/src/shared/acl-util.c
+++ b/src/shared/acl-util.c
@@ -69,6 +69,34 @@ int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry) {
         return 0;
 }
 
+int calc_acl_mask_if_needed(acl_t *acl_p) {
+        acl_entry_t i;
+        int found;
+
+        assert(acl_p);
+
+        for (found = acl_get_entry(*acl_p, ACL_FIRST_ENTRY, &i);
+             found > 0;
+             found = acl_get_entry(*acl_p, ACL_NEXT_ENTRY, &i)) {
+
+                acl_tag_t tag;
+
+                if (acl_get_tag_type(i, &tag) < 0)
+                        return -errno;
+
+                if (tag == ACL_MASK)
+                        return 0;
+        }
+
+        if (found < 0)
+                return -errno;
+
+        if (acl_calc_mask(acl_p) < 0)
+                return -errno;
+
+        return 0;
+}
+
 int search_acl_groups(char*** dst, const char* path, bool* belong) {
         acl_t acl;
 
diff --git a/src/shared/acl-util.h b/src/shared/acl-util.h
index 23090d9984..36ef490d7e 100644
--- a/src/shared/acl-util.h
+++ b/src/shared/acl-util.h
@@ -24,4 +24,5 @@
 #include <stdbool.h>
 
 int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry);
+int calc_acl_mask_if_needed(acl_t *acl_p);
 int search_acl_groups(char*** dst, const char* path, bool* belong);
diff --git a/src/shared/acpi-fpdt.c b/src/shared/acpi-fpdt.c
new file mode 100644
index 0000000000..b094f34a5f
--- /dev/null
+++ b/src/shared/acpi-fpdt.c
@@ -0,0 +1,155 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+/***
+  This file is part of systemd.
+
+  Copyright 2013 Kay Sievers
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/types.h>
+
+#include <util.h>
+#include <fileio.h>
+#include <time-util.h>
+#include <acpi-fpdt.h>
+
+struct acpi_table_header {
+        char signature[4];
+        uint32_t length;
+        uint8_t revision;
+        uint8_t checksum;
+        char oem_id[6];
+        char oem_table_id[8];
+        uint32_t oem_revision;
+        char asl_compiler_id[4];
+        uint32_t asl_compiler_revision;
+};
+
+enum {
+        ACPI_FPDT_TYPE_BOOT =   0,
+        ACPI_FPDT_TYPE_S3PERF = 1,
+};
+
+struct acpi_fpdt_header {
+        uint16_t type;
+        uint8_t length;
+        uint8_t revision;
+        uint8_t reserved[4];
+        uint64_t ptr;
+};
+
+struct acpi_fpdt_boot_header {
+        char signature[4];
+        uint32_t length;
+};
+
+enum {
+        ACPI_FPDT_S3PERF_RESUME_REC =   0,
+        ACPI_FPDT_S3PERF_SUSPEND_REC =  1,
+        ACPI_FPDT_BOOT_REC =            2,
+};
+
+struct acpi_fpdt_boot {
+        uint16_t type;
+        uint8_t length;
+        uint8_t revision;
+        uint8_t reserved[4];
+        uint64_t reset_end;
+        uint64_t load_start;
+        uint64_t startup_start;
+        uint64_t exit_services_entry;
+        uint64_t exit_services_exit;
+};
+
+int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit) {
+        char *buf;
+        struct acpi_table_header *tbl;
+        size_t l;
+        struct acpi_fpdt_header *rec;
+        int r;
+        uint64_t ptr = 0;
+        _cleanup_close_ int fd = -1;
+        struct acpi_fpdt_boot_header hbrec;
+        struct acpi_fpdt_boot brec;
+
+        r = read_full_file("/sys/firmware/acpi/tables/FPDT", &buf, &l);
+        if (r < 0)
+                return r;
+
+        if (l < sizeof(struct acpi_table_header) + sizeof(struct acpi_fpdt_header))
+                return -EINVAL;
+
+        tbl = (struct acpi_table_header *)buf;
+        if (l != tbl->length)
+                return -EINVAL;
+
+        if (memcmp(tbl->signature, "FPDT", 4) != 0)
+                return -EINVAL;
+
+        /* find Firmware Basic Boot Performance Pointer Record */
+        for (rec = (struct acpi_fpdt_header *)(buf + sizeof(struct acpi_table_header));
+             (char *)rec < buf + l;
+             rec = (struct acpi_fpdt_header *)((char *)rec + rec->length)) {
+                if (rec->type != ACPI_FPDT_TYPE_BOOT)
+                        continue;
+                if (rec->length != sizeof(struct acpi_fpdt_header))
+                        continue;
+
+                ptr = rec->ptr;
+                break;
+        }
+
+        if (ptr == 0)
+                return -EINVAL;
+
+        /* read Firmware Basic Boot Performance Data Record */
+        fd = open("/dev/mem", O_CLOEXEC|O_RDONLY);
+        if (fd < 0)
+                return -errno;
+
+        l = pread(fd, &hbrec, sizeof(struct acpi_fpdt_boot_header), ptr);
+        if (l != sizeof(struct acpi_fpdt_boot_header))
+                return -EINVAL;
+
+        if (memcmp(hbrec.signature, "FBPT", 4) != 0)
+                return -EINVAL;
+
+        if (hbrec.length < sizeof(struct acpi_fpdt_boot_header) + sizeof(struct acpi_fpdt_boot))
+                return -EINVAL;
+
+        l = pread(fd, &brec, sizeof(struct acpi_fpdt_boot), ptr + sizeof(struct acpi_fpdt_boot_header));
+        if (l != sizeof(struct acpi_fpdt_boot))
+                return -EINVAL;
+
+        if (brec.length != sizeof(struct acpi_fpdt_boot))
+                return -EINVAL;
+
+        if (brec.type != ACPI_FPDT_BOOT_REC)
+                return -EINVAL;
+
+        if (loader_start)
+                *loader_start = brec.startup_start / 1000;
+        if (loader_exit)
+                *loader_exit = brec.exit_services_exit / 1000;
+
+        return 0;
+}
diff --git a/src/shared/acpi-fpdt.h b/src/shared/acpi-fpdt.h
new file mode 100644
index 0000000000..fc4fe6f10f
--- /dev/null
+++ b/src/shared/acpi-fpdt.h
@@ -0,0 +1,26 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2013 Kay Sievers
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <time-util.h>
+
+int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit);
diff --git a/src/shared/boot-timestamps.c b/src/shared/boot-timestamps.c
new file mode 100644
index 0000000000..944996582e
--- /dev/null
+++ b/src/shared/boot-timestamps.c
@@ -0,0 +1,65 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+/***
+  This file is part of systemd.
+
+  Copyright 2012 Lennart Poettering
+  Copyright 2013 Kay Sievers
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+#include <unistd.h>
+
+#include "boot-timestamps.h"
+#include "acpi-fpdt.h"
+#include "efivars.h"
+
+int boot_timestamps(const dual_timestamp *n, dual_timestamp *firmware, dual_timestamp *loader) {
+        usec_t x, y, a;
+        int r;
+        dual_timestamp _n;
+
+        assert(firmware);
+        assert(loader);
+
+        if (!n) {
+                dual_timestamp_get(&_n);
+                n = &_n;
+        }
+
+        r = acpi_get_boot_usec(&x, &y);
+        if (r < 0) {
+                r = efi_loader_get_boot_usec(&x, &y);
+                if (r < 0)
+                        return r;
+        }
+
+        /* Let's convert this to timestamps where the firmware
+         * began/loader began working. To make this more confusing:
+         * since usec_t is unsigned and the kernel's monotonic clock
+         * begins at kernel initialization we'll actually initialize
+         * the monotonic timestamps here as negative of the actual
+         * value. */
+
+        firmware->monotonic = y;
+        loader->monotonic = y - x;
+
+        a = n->monotonic + firmware->monotonic;
+        firmware->realtime = n->realtime > a ? n->realtime - a : 0;
+
+        a = n->monotonic + loader->monotonic;
+        loader->realtime = n->realtime > a ? n->realtime - a : 0;
+
+        return 0;
+}
diff --git a/src/shared/boot-timestamps.h b/src/shared/boot-timestamps.h
new file mode 100644
index 0000000000..a3d2405b56
--- /dev/null
+++ b/src/shared/boot-timestamps.h
@@ -0,0 +1,27 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2012 Lennart Poettering
+  Copyright 2013 Kay Sievers
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <time-util.h>
+
+int boot_timestamps(const dual_timestamp *n, dual_timestamp *firmware, dual_timestamp *loader);
diff --git a/src/shared/cgroup-label.c b/src/shared/cgroup-label.c
deleted file mode 100644
index 5b5163c250..0000000000
--- a/src/shared/cgroup-label.c
+++ /dev/null
@@ -1,77 +0,0 @@
-/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
-
-/***
-  This file is part of systemd.
-
-  Copyright 2010 Lennart Poettering
-
-  systemd is free software; you can redistribute it and/or modify it
-  under the terms of the GNU Lesser General Public License as published by
-  the Free Software Foundation; either version 2.1 of the License, or
-  (at your option) any later version.
-
-  systemd is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-  Lesser General Public License for more details.
-
-  You should have received a copy of the GNU Lesser General Public License
-  along with systemd; If not, see <http://www.gnu.org/licenses/>.
-***/
-
-#include <errno.h>
-#include <unistd.h>
-#include <signal.h>
-#include <string.h>
-#include <stdlib.h>
-#include <dirent.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <ftw.h>
-
-#include "cgroup-util.h"
-#include "log.h"
-#include "set.h"
-#include "macro.h"
-#include "util.h"
-#include "mkdir.h"
-
-int cg_create(const char *controller, const char *path, const char *suffix) {
-        _cleanup_free_ char *fs = NULL;
-        int r;
-
-        r = cg_get_path_and_check(controller, path, suffix, &fs);
-        if (r < 0)
-                return r;
-
-        r = mkdir_parents_label(fs, 0755);
-        if (r < 0)
-                return r;
-
-        if (mkdir(fs, 0755) < 0) {
-
-                if (errno == EEXIST)
-                        return 0;
-
-                return -errno;
-        }
-
-        return 1;
-}
-
-int cg_create_and_attach(const char *controller, const char *path, pid_t pid) {
-        int r, q;
-
-        assert(pid >= 0);
-
-        r = cg_create(controller, path, NULL);
-        if (r < 0)
-                return r;
-
-        q = cg_attach(controller, path, pid);
-        if (q < 0)
-                return q;
-
-        /* This does not remove the cgroup on failure */
-        return r;
-}
diff --git a/src/shared/cgroup-show.c b/src/shared/cgroup-show.c
index 83cc0731b8..e971f36190 100644
--- a/src/shared/cgroup-show.c
+++ b/src/shared/cgroup-show.c
@@ -241,7 +241,6 @@ static int show_extra_pids(const char *controller, const char *path, const char
         unsigned i, j;
         int r;
 
-        assert(controller);
         assert(path);
 
         if (n_pids <= 0)
diff --git a/src/shared/cgroup-util.c b/src/shared/cgroup-util.c
index 43c415d760..8a4eddab7a 100644
--- a/src/shared/cgroup-util.c
+++ b/src/shared/cgroup-util.c
@@ -38,6 +38,8 @@
 #include "strv.h"
 #include "unit-name.h"
 #include "fileio.h"
+#include "special.h"
+#include "mkdir.h"
 
 int cg_enumerate_processes(const char *controller, const char *path, FILE **_f) {
         _cleanup_free_ char *fs = NULL;
@@ -58,25 +60,6 @@ int cg_enumerate_processes(const char *controller, const char *path, FILE **_f)
         return 0;
 }
 
-int cg_enumerate_tasks(const char *controller, const char *path, FILE **_f) {
-        _cleanup_free_ char *fs = NULL;
-        FILE *f;
-        int r;
-
-        assert(_f);
-
-        r = cg_get_path(controller, path, "tasks", &fs);
-        if (r < 0)
-                return r;
-
-        f = fopen(fs, "re");
-        if (!f)
-                return -errno;
-
-        *_f = f;
-        return 0;
-}
-
 int cg_read_pid(FILE *f, pid_t *_pid) {
         unsigned long ul;
 
@@ -150,7 +133,7 @@ int cg_read_subgroup(DIR *d, char **fn) {
         return 0;
 }
 
-int cg_rmdir(const char *controller, const char *path, bool honour_sticky) {
+int cg_rmdir(const char *controller, const char *path) {
         _cleanup_free_ char *p = NULL;
         int r;
 
@@ -158,22 +141,6 @@ int cg_rmdir(const char *controller, const char *path, bool honour_sticky) {
         if (r < 0)
                 return r;
 
-        if (honour_sticky) {
-                char *tasks;
-
-                /* If the sticky bit is set don't remove the directory */
-
-                tasks = strappend(p, "/tasks");
-                if (!tasks)
-                        return -ENOMEM;
-
-                r = file_is_priv_sticky(tasks);
-                free(tasks);
-
-                if (r > 0)
-                        return 0;
-        }
-
         r = rmdir(p);
         if (r < 0 && errno != ENOENT)
                 return -errno;
@@ -304,7 +271,7 @@ int cg_kill_recursive(const char *controller, const char *path, int sig, bool si
                 ret = r;
 
         if (rem) {
-                r = cg_rmdir(controller, path, true);
+                r = cg_rmdir(controller, path);
                 if (r < 0 && ret >= 0 && r != -ENOENT && r != -EBUSY)
                         return r;
         }
@@ -365,7 +332,7 @@ int cg_migrate(const char *cfrom, const char *pfrom, const char *cto, const char
                 pid_t pid = 0;
                 done = true;
 
-                r = cg_enumerate_tasks(cfrom, pfrom, &f);
+                r = cg_enumerate_processes(cfrom, pfrom, &f);
                 if (r < 0) {
                         if (ret >= 0 && r != -ENOENT)
                                 return r;
@@ -413,7 +380,14 @@ int cg_migrate(const char *cfrom, const char *pfrom, const char *cto, const char
         return ret;
 }
 
-int cg_migrate_recursive(const char *cfrom, const char *pfrom, const char *cto, const char *pto, bool ignore_self, bool rem) {
+int cg_migrate_recursive(
+                const char *cfrom,
+                const char *pfrom,
+                const char *cto,
+                const char *pto,
+                bool ignore_self,
+                bool rem) {
+
         _cleanup_closedir_ DIR *d = NULL;
         int r, ret = 0;
         char *fn;
@@ -454,7 +428,7 @@ int cg_migrate_recursive(const char *cfrom, const char *pfrom, const char *cto,
                 ret = r;
 
         if (rem) {
-                r = cg_rmdir(cfrom, pfrom, true);
+                r = cg_rmdir(cfrom, pfrom);
                 if (r < 0 && ret >= 0 && r != -ENOENT && r != -EBUSY)
                         return r;
         }
@@ -462,6 +436,37 @@ int cg_migrate_recursive(const char *cfrom, const char *pfrom, const char *cto,
         return ret;
 }
 
+int cg_migrate_recursive_fallback(
+                const char *cfrom,
+                const char *pfrom,
+                const char *cto,
+                const char *pto,
+                bool ignore_self,
+                bool rem) {
+
+        int r;
+
+        assert(cfrom);
+        assert(pfrom);
+        assert(cto);
+        assert(pto);
+
+        r = cg_migrate_recursive(cfrom, pfrom, cto, pto, ignore_self, rem);
+        if (r < 0) {
+                char prefix[strlen(pto) + 1];
+
+                /* This didn't work? Then let's try all prefixes of the destination */
+
+                PATH_FOREACH_PREFIX(prefix, pto) {
+                        r = cg_migrate_recursive(cfrom, pfrom, cto, prefix, ignore_self, rem);
+                        if (r >= 0)
+                                break;
+                }
+        }
+
+        return 0;
+}
+
 static const char *normalize_controller(const char *controller) {
 
         assert(controller);
@@ -477,19 +482,19 @@ static const char *normalize_controller(const char *controller) {
 static int join_path(const char *controller, const char *path, const char *suffix, char **fs) {
         char *t = NULL;
 
-        if (controller) {
-                if (path && suffix)
+        if (!isempty(controller)) {
+                if (!isempty(path) && !isempty(suffix))
                         t = strjoin("/sys/fs/cgroup/", controller, "/", path, "/", suffix, NULL);
-                else if (path)
+                else if (!isempty(path))
                         t = strjoin("/sys/fs/cgroup/", controller, "/", path, NULL);
-                else if (suffix)
+                else if (!isempty(suffix))
                         t = strjoin("/sys/fs/cgroup/", controller, "/", suffix, NULL);
                 else
                         t = strappend("/sys/fs/cgroup/", controller);
         } else {
-                if (path && suffix)
+                if (!isempty(path) && !isempty(suffix))
                         t = strjoin(path, "/", suffix, NULL);
-                else if (path)
+                else if (!isempty(path))
                         t = strdup(path);
                 else
                         return -EINVAL;
@@ -564,8 +569,9 @@ int cg_get_path_and_check(const char *controller, const char *path, const char *
 }
 
 static int trim_cb(const char *path, const struct stat *sb, int typeflag, struct FTW *ftwbuf) {
-        char *p;
-        bool is_sticky;
+        assert(path);
+        assert(sb);
+        assert(ftwbuf);
 
         if (typeflag != FTW_DP)
                 return 0;
@@ -573,18 +579,6 @@ static int trim_cb(const char *path, const struct stat *sb, int typeflag, struct
         if (ftwbuf->level < 1)
                 return 0;
 
-        p = strappend(path, "/tasks");
-        if (!p) {
-                errno = ENOMEM;
-                return 1;
-        }
-
-        is_sticky = file_is_priv_sticky(p) > 0;
-        free(p);
-
-        if (is_sticky)
-                return 0;
-
         rmdir(path);
         return 0;
 }
@@ -604,19 +598,8 @@ int cg_trim(const char *controller, const char *path, bool delete_root) {
                 r = errno ? -errno : -EIO;
 
         if (delete_root) {
-                bool is_sticky;
-                char *p;
-
-                p = strappend(fs, "/tasks");
-                if (!p)
-                        return -ENOMEM;
-
-                is_sticky = file_is_priv_sticky(p) > 0;
-                free(p);
-
-                if (!is_sticky)
-                        if (rmdir(fs) < 0 && errno != ENOENT && r == 0)
-                                return -errno;
+                if (rmdir(fs) < 0 && errno != ENOENT)
+                        return -errno;
         }
 
         return r;
@@ -636,6 +619,46 @@ int cg_delete(const char *controller, const char *path) {
         return r == -ENOENT ? 0 : r;
 }
 
+int cg_create(const char *controller, const char *path) {
+        _cleanup_free_ char *fs = NULL;
+        int r;
+
+        r = cg_get_path_and_check(controller, path, NULL, &fs);
+        if (r < 0)
+                return r;
+
+        r = mkdir_parents(fs, 0755);
+        if (r < 0)
+                return r;
+
+        if (mkdir(fs, 0755) < 0) {
+
+                if (errno == EEXIST)
+                        return 0;
+
+                return -errno;
+        }
+
+        return 1;
+}
+
+int cg_create_and_attach(const char *controller, const char *path, pid_t pid) {
+        int r, q;
+
+        assert(pid >= 0);
+
+        r = cg_create(controller, path);
+        if (r < 0)
+                return r;
+
+        q = cg_attach(controller, path, pid);
+        if (q < 0)
+                return q;
+
+        /* This does not remove the cgroup on failure */
+        return r;
+}
+
 int cg_attach(const char *controller, const char *path, pid_t pid) {
         _cleanup_free_ char *fs = NULL;
         char c[DECIMAL_STR_MAX(pid_t) + 2];
@@ -644,7 +667,7 @@ int cg_attach(const char *controller, const char *path, pid_t pid) {
         assert(path);
         assert(pid >= 0);
 
-        r = cg_get_path_and_check(controller, path, "tasks", &fs);
+        r = cg_get_path_and_check(controller, path, "cgroup.procs", &fs);
         if (r < 0)
                 return r;
 
@@ -656,6 +679,30 @@ int cg_attach(const char *controller, const char *path, pid_t pid) {
         return write_string_file(fs, c);
 }
 
+int cg_attach_fallback(const char *controller, const char *path, pid_t pid) {
+        int r;
+
+        assert(controller);
+        assert(path);
+        assert(pid >= 0);
+
+        r = cg_attach(controller, path, pid);
+        if (r < 0) {
+                char prefix[strlen(path) + 1];
+
+                /* This didn't work? Then let's try all prefixes of
+                 * the destination */
+
+                PATH_FOREACH_PREFIX(prefix, path) {
+                        r = cg_attach(controller, prefix, pid);
+                        if (r >= 0)
+                                break;
+                }
+        }
+
+        return 0;
+}
+
 int cg_set_group_access(
                 const char *controller,
                 const char *path,
@@ -683,52 +730,30 @@ int cg_set_task_access(
                 const char *path,
                 mode_t mode,
                 uid_t uid,
-                gid_t gid,
-                int sticky) {
+                gid_t gid) {
 
         _cleanup_free_ char *fs = NULL, *procs = NULL;
         int r;
 
         assert(path);
 
-        if (mode == (mode_t) -1 && uid == (uid_t) -1 && gid == (gid_t) -1 && sticky < 0)
+        if (mode == (mode_t) -1 && uid == (uid_t) -1 && gid == (gid_t) -1)
                 return 0;
 
         if (mode != (mode_t) -1)
                 mode &= 0666;
 
-        r = cg_get_path(controller, path, "tasks", &fs);
+        r = cg_get_path(controller, path, "cgroup.procs", &fs);
         if (r < 0)
                 return r;
 
-        if (sticky >= 0 && mode != (mode_t) -1)
-                /* Both mode and sticky param are passed */
-                mode |= (sticky ? S_ISVTX : 0);
-        else if ((sticky >= 0 && mode == (mode_t) -1) ||
-                 (mode != (mode_t) -1 && sticky < 0)) {
-                struct stat st;
-
-                /* Only one param is passed, hence read the current
-                 * mode from the file itself */
-
-                r = lstat(fs, &st);
-                if (r < 0)
-                        return -errno;
-
-                if (mode == (mode_t) -1)
-                        /* No mode set, we just shall set the sticky bit */
-                        mode = (st.st_mode & ~S_ISVTX) | (sticky ? S_ISVTX : 0);
-                else
-                        /* Only mode set, leave sticky bit untouched */
-                        mode = (st.st_mode & ~0777) | mode;
-        }
-
         r = chmod_and_chown(fs, mode, uid, gid);
         if (r < 0)
                 return r;
 
-        /* Always keep values for "cgroup.procs" in sync with "tasks" */
-        r = cg_get_path(controller, path, "cgroup.procs", &procs);
+        /* Compatibility, Always keep values for "tasks" in sync with
+         * "cgroup.procs" */
+        r = cg_get_path(controller, path, "tasks", &procs);
         if (r < 0)
                 return r;
 
@@ -861,6 +886,32 @@ int cg_install_release_agent(const char *controller, const char *agent) {
         return 0;
 }
 
+int cg_uninstall_release_agent(const char *controller) {
+        _cleanup_free_ char *fs = NULL;
+        int r;
+
+        r = cg_get_path(controller, NULL, "notify_on_release", &fs);
+        if (r < 0)
+                return r;
+
+        r = write_string_file(fs, "0");
+        if (r < 0)
+                return r;
+
+        free(fs);
+        fs = NULL;
+
+        r = cg_get_path(controller, NULL, "release_agent", &fs);
+        if (r < 0)
+                return r;
+
+        r = write_string_file(fs, "");
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
 int cg_is_empty(const char *controller, const char *path, bool ignore_self) {
         _cleanup_fclose_ FILE *f = NULL;
         pid_t pid = 0, self_pid;
@@ -869,7 +920,7 @@ int cg_is_empty(const char *controller, const char *path, bool ignore_self) {
 
         assert(path);
 
-        r = cg_enumerate_tasks(controller, path, &f);
+        r = cg_enumerate_processes(controller, path, &f);
         if (r < 0)
                 return r == -ENOENT ? 1 : r;
 
@@ -993,19 +1044,28 @@ int cg_split_spec(const char *spec, char **controller, char **path) {
                 return -EINVAL;
         }
 
-        u = strdup(e+1);
-        if (!u) {
-                free(t);
-                return -ENOMEM;
-        }
-        if (!path_is_safe(u) ||
-            !path_is_absolute(u)) {
-                free(t);
-                free(u);
-                return -EINVAL;
-        }
+        if (streq(e+1, "")) {
+                u = strdup("/");
+                if (!u) {
+                        free(t);
+                        return -ENOMEM;
+                }
+        } else {
+                u = strdup(e+1);
+                if (!u) {
+                        free(t);
+                        return -ENOMEM;
+                }
+
+                if (!path_is_safe(u) ||
+                    !path_is_absolute(u)) {
+                        free(t);
+                        free(u);
+                        return -EINVAL;
+                }
 
-        path_kill_slashes(u);
+                path_kill_slashes(u);
+        }
 
         if (controller)
                 *controller = t;
@@ -1075,96 +1135,20 @@ int cg_mangle_path(const char *path, char **result) {
         return cg_get_path(c ? c : SYSTEMD_CGROUP_CONTROLLER, p ? p : "/", NULL, result);
 }
 
-int cg_get_system_path(char **path) {
-        char *p;
-        int r;
-
-        assert(path);
-
-        r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 1, &p);
-        if (r < 0) {
-                p = strdup("/system");
-                if (!p)
-                        return -ENOMEM;
-        }
-
-        if (endswith(p, "/system"))
-                *path = p;
-        else {
-                char *q;
-
-                q = strappend(p, "/system");
-                free(p);
-                if (!q)
-                        return -ENOMEM;
-
-                *path = q;
-        }
-
-        return 0;
-}
-
 int cg_get_root_path(char **path) {
-        char *root, *e;
+        char *p, *e;
         int r;
 
         assert(path);
 
-        r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 1, &root);
+        r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 1, &p);
         if (r < 0)
                 return r;
 
-        e = endswith(root, "/system");
-        if (e == root)
-                e[1] = 0;
-        else if (e)
+        e = endswith(p, "/" SPECIAL_SYSTEM_SLICE);
+        if (e)
                 *e = 0;
 
-        *path = root;
-        return 0;
-}
-
-int cg_get_user_path(char **path) {
-        _cleanup_free_ char *root = NULL;
-        char *p;
-
-        assert(path);
-
-        /* Figure out the place to put user cgroups below. We use the
-         * same as PID 1 has but with the "/system" suffix replaced by
-         * "/user" */
-
-        if (cg_get_root_path(&root) < 0 || streq(root, "/"))
-                p = strdup("/user");
-        else
-                p = strappend(root, "/user");
-
-        if (!p)
-                return -ENOMEM;
-
-        *path = p;
-        return 0;
-}
-
-int cg_get_machine_path(const char *machine, char **path) {
-        _cleanup_free_ char *root = NULL, *escaped = NULL;
-        char *p;
-
-        assert(path);
-
-        if (machine) {
-                const char *name = strappenda(machine, ".nspawn");
-
-                escaped = cg_escape(name);
-                if (!escaped)
-                        return -ENOMEM;
-        }
-
-        p = strjoin(cg_get_root_path(&root) >= 0 && !streq(root, "/") ? root : "",
-                    "/machine", machine ? "/" : "", machine ? escaped : "", NULL);
-        if (!p)
-                return -ENOMEM;
-
         *path = p;
         return 0;
 }
@@ -1247,7 +1231,7 @@ int cg_pid_get_path_shifted(pid_t pid, char **root, char **cgroup) {
 }
 
 int cg_path_decode_unit(const char *cgroup, char **unit){
-        char *p, *e, *c, *s, *k;
+        char *e, *c, *s;
 
         assert(cgroup);
         assert(unit);
@@ -1256,33 +1240,31 @@ int cg_path_decode_unit(const char *cgroup, char **unit){
         c = strndupa(cgroup, e - cgroup);
         c = cg_unescape(c);
 
-        /* Could this be a valid unit name? */
-        if (!unit_name_is_valid(c, true))
+        if (!unit_name_is_valid(c, false))
                 return -EINVAL;
 
-        if (!unit_name_is_template(c))
-                s = strdup(c);
-        else {
-                if (*e != '/')
-                        return -EINVAL;
+        s = strdup(c);
+        if (!s)
+                return -ENOMEM;
 
-                e += strspn(e, "/");
+        *unit = s;
+        return 0;
+}
 
-                p = strchrnul(e, '/');
-                k = strndupa(e, p - e);
-                k = cg_unescape(k);
+static const char *skip_slices(const char *p) {
+        /* Skips over all slice assignments */
 
-                if (!unit_name_is_valid(k, false))
-                        return -EINVAL;
+        for (;;) {
+                size_t n;
 
-                s = strdup(k);
-        }
+                p += strspn(p, "/");
 
-        if (!s)
-                return -ENOMEM;
+                n = strcspn(p, "/");
+                if (n <= 6 || memcmp(p + n - 6, ".slice", 6) != 0)
+                        return p;
 
-        *unit = s;
-        return 0;
+                p += n;
+        }
 }
 
 int cg_path_get_unit(const char *path, char **unit) {
@@ -1291,9 +1273,7 @@ int cg_path_get_unit(const char *path, char **unit) {
         assert(path);
         assert(unit);
 
-        e = path_startswith(path, "/system/");
-        if (!e)
-                return -ENOENT;
+        e = skip_slices(path);
 
         return cg_path_decode_unit(e, unit);
 }
@@ -1311,15 +1291,21 @@ int cg_pid_get_unit(pid_t pid, char **unit) {
         return cg_path_get_unit(cgroup, unit);
 }
 
-_pure_ static const char *skip_label(const char *e) {
-        assert(e);
+static const char *skip_session(const char *p) {
+        size_t n;
 
-        e = strchr(e, '/');
-        if (!e)
+        assert(p);
+
+        p += strspn(p, "/");
+
+        n = strcspn(p, "/");
+        if (n <= 12 || memcmp(p, "session-", 8) != 0 || memcmp(p + n - 6, ".scope", 6) != 0)
                 return NULL;
 
-        e += strspn(e, "/");
-        return e;
+        p += n;
+        p += strspn(p, "/");
+
+        return p;
 }
 
 int cg_path_get_user_unit(const char *path, char **unit) {
@@ -1332,24 +1318,16 @@ int cg_path_get_user_unit(const char *path, char **unit) {
          * cgroups might have arbitrary child cgroups and we shouldn't get
          * confused by those */
 
-        e = path_startswith(path, "/user/");
-        if (!e)
-                return -ENOENT;
-
-        /* Skip the user name */
-        e = skip_label(e);
-        if (!e)
-                return -ENOENT;
+        /* Skip slices, if there are any */
+        e = skip_slices(path);
 
-        /* Skip the session ID */
-        e = skip_label(e);
+        /* Skip the session scope, require that there is one */
+        e = skip_session(e);
         if (!e)
                 return -ENOENT;
 
-        /* Skip the systemd cgroup */
-        e = skip_label(e);
-        if (!e)
-                return -ENOENT;
+        /* And skip more slices */
+        e = skip_slices(e);
 
         return cg_path_decode_unit(e, unit);
 }
@@ -1368,23 +1346,34 @@ int cg_pid_get_user_unit(pid_t pid, char **unit) {
 }
 
 int cg_path_get_machine_name(const char *path, char **machine) {
-        const char *e, *n;
+        const char *e, *n, *x;
         char *s, *r;
+        size_t l;
 
         assert(path);
         assert(machine);
 
-        e = path_startswith(path, "/machine/");
-        if (!e)
-                return -ENOENT;
+        /* Skip slices, if there are any */
+        e = skip_slices(path);
 
         n = strchrnul(e, '/');
         if (e == n)
                 return -ENOENT;
 
         s = strndupa(e, n - e);
+        s = cg_unescape(s);
+
+        x = startswith(s, "machine-");
+        if (!x)
+                return -ENOENT;
+        if (!endswith(x, ".scope"))
+                return -ENOENT;
+
+        l = strlen(x);
+        if (l <= 6)
+                return -ENOENT;
 
-        r = strdup(cg_unescape(s));
+        r = strndup(x, l - 6);
         if (!r)
                 return -ENOMEM;
 
@@ -1406,32 +1395,38 @@ int cg_pid_get_machine_name(pid_t pid, char **machine) {
 }
 
 int cg_path_get_session(const char *path, char **session) {
-        const char *e, *n;
-        char *s;
+        const char *e, *n, *x;
+        char *s, *r;
+        size_t l;
 
         assert(path);
         assert(session);
 
-        e = path_startswith(path, "/user/");
-        if (!e)
-                return -ENOENT;
+        /* Skip slices, if there are any */
+        e = skip_slices(path);
 
-        /* Skip the user name */
-        e = skip_label(e);
-        if (!e)
+        n = strchrnul(e, '/');
+        if (e == n)
                 return -ENOENT;
 
-        n = strchrnul(e, '/');
-        if (n - e < 8)
+        s = strndupa(e, n - e);
+        s = cg_unescape(s);
+
+        x = startswith(s, "session-");
+        if (!x)
                 return -ENOENT;
-        if (memcmp(n - 8, ".session", 8) != 0)
+        if (!endswith(x, ".scope"))
                 return -ENOENT;
 
-        s = strndup(e, n - e - 8);
-        if (!s)
+        l = strlen(x);
+        if (l <= 6)
+                return -ENOENT;
+
+        r = strndup(x, l - 6);
+        if (!r)
                 return -ENOMEM;
 
-        *session = s;
+        *session = r;
         return 0;
 }
 
@@ -1449,23 +1444,25 @@ int cg_pid_get_session(pid_t pid, char **session) {
 }
 
 int cg_path_get_owner_uid(const char *path, uid_t *uid) {
-        const char *e, *n;
+        _cleanup_free_ char *slice = NULL;
+        const char *e;
         char *s;
+        int r;
 
         assert(path);
         assert(uid);
 
-        e = path_startswith(path, "/user/");
-        if (!e)
-                return -ENOENT;
+        r = cg_path_get_slice(path, &slice);
+        if (r < 0)
+                return r;
 
-        n = strchrnul(e, '/');
-        if (n - e < 5)
+        e = startswith(slice, "user-");
+        if (!e)
                 return -ENOENT;
-        if (memcmp(n - 5, ".user", 5) != 0)
+        if (!endswith(slice, ".slice"))
                 return -ENOENT;
 
-        s = strndupa(e, n - e - 5);
+        s = strndupa(e, strlen(e) - 6);
         if (!s)
                 return -ENOMEM;
 
@@ -1485,6 +1482,53 @@ int cg_pid_get_owner_uid(pid_t pid, uid_t *uid) {
         return cg_path_get_owner_uid(cgroup, uid);
 }
 
+int cg_path_get_slice(const char *p, char **slice) {
+        const char *e = NULL;
+        size_t m = 0;
+
+        assert(p);
+        assert(slice);
+
+        for (;;) {
+                size_t n;
+
+                p += strspn(p, "/");
+
+                n = strcspn(p, "/");
+                if (n <= 6 || memcmp(p + n - 6, ".slice", 6) != 0) {
+                        char *s;
+
+                        if (!e)
+                                return -ENOENT;
+
+                        s = strndup(e, m);
+                        if (!s)
+                                return -ENOMEM;
+
+                        *slice = s;
+                        return 0;
+                }
+
+                e = p;
+                m = n;
+
+                p += n;
+        }
+}
+
+int cg_pid_get_slice(pid_t pid, char **slice) {
+        _cleanup_free_ char *cgroup = NULL;
+        int r;
+
+        assert(slice);
+
+        r = cg_pid_get_path_shifted(pid, NULL, &cgroup);
+        if (r < 0)
+                return r;
+
+        return cg_path_get_slice(cgroup, slice);
+}
+
 int cg_controller_from_attr(const char *attr, char **controller) {
         const char *dot;
         char *c;
@@ -1572,9 +1616,7 @@ char *cg_unescape(const char *p) {
 }
 
 #define CONTROLLER_VALID                        \
-        "0123456789"                            \
-        "abcdefghijklmnopqrstuvwxyz"            \
-        "ABCDEFGHIJKLMNOPQRSTUVWXYZ"            \
+        DIGITS LETTERS                          \
         "_"
 
 bool cg_controller_is_valid(const char *p, bool allow_named) {
@@ -1601,3 +1643,188 @@ bool cg_controller_is_valid(const char *p, bool allow_named) {
 
         return true;
 }
+
+int cg_slice_to_path(const char *unit, char **ret) {
+        _cleanup_free_ char *p = NULL, *s = NULL, *e = NULL;
+        const char *dash;
+
+        assert(unit);
+        assert(ret);
+
+        if (!unit_name_is_valid(unit, false))
+                return -EINVAL;
+
+        if (!endswith(unit, ".slice"))
+                return -EINVAL;
+
+        p = unit_name_to_prefix(unit);
+        if (!p)
+                return -ENOMEM;
+
+        dash = strchr(p, '-');
+        while (dash) {
+                _cleanup_free_ char *escaped = NULL;
+                char n[dash - p + sizeof(".slice")];
+
+                strcpy(stpncpy(n, p, dash - p), ".slice");
+
+                if (!unit_name_is_valid(n, false))
+                        return -EINVAL;
+
+                escaped = cg_escape(n);
+                if (!escaped)
+                        return -ENOMEM;
+
+                if (!strextend(&s, escaped, "/", NULL))
+                        return -ENOMEM;
+
+                dash = strchr(dash+1, '-');
+        }
+
+        e = cg_escape(unit);
+        if (!e)
+                return -ENOMEM;
+
+        if (!strextend(&s, e, NULL))
+                return -ENOMEM;
+
+        *ret = s;
+        s = NULL;
+
+        return 0;
+}
+
+int cg_set_attribute(const char *controller, const char *path, const char *attribute, const char *value) {
+        _cleanup_free_ char *p = NULL;
+        int r;
+
+        r = cg_get_path(controller, path, attribute, &p);
+        if (r < 0)
+                return r;
+
+        return write_string_file(p, value);
+}
+
+static const char mask_names[] =
+        "cpu\0"
+        "cpuacct\0"
+        "blkio\0"
+        "memory\0"
+        "devices\0";
+
+int cg_create_everywhere(CGroupControllerMask supported, CGroupControllerMask mask, const char *path) {
+        CGroupControllerMask bit = 1;
+        const char *n;
+        int r;
+
+        /* This one will create a cgroup in our private tree, but also
+         * duplicate it in the trees specified in mask, and remove it
+         * in all others */
+
+        /* First create the cgroup in our own hierarchy. */
+        r = cg_create(SYSTEMD_CGROUP_CONTROLLER, path);
+        if (r < 0)
+                return r;
+
+        /* Then, do the same in the other hierarchies */
+        NULSTR_FOREACH(n, mask_names) {
+                if (mask & bit)
+                        cg_create(n, path);
+                else if (supported & bit)
+                        cg_trim(n, path, true);
+
+                bit <<= 1;
+        }
+
+        return 0;
+}
+
+int cg_attach_everywhere(CGroupControllerMask supported, const char *path, pid_t pid) {
+        CGroupControllerMask bit = 1;
+        const char *n;
+        int r;
+
+        r = cg_attach(SYSTEMD_CGROUP_CONTROLLER, path, pid);
+        if (r < 0)
+                return r;
+
+        NULSTR_FOREACH(n, mask_names) {
+                if (supported & bit)
+                        cg_attach_fallback(n, path, pid);
+
+                bit <<= 1;
+        }
+
+        return 0;
+}
+
+int cg_attach_many_everywhere(CGroupControllerMask supported, const char *path, Set* pids) {
+        Iterator i;
+        void *pidp;
+        int r = 0;
+
+        SET_FOREACH(pidp, pids, i) {
+                pid_t pid = PTR_TO_LONG(pidp);
+                int q;
+
+                q = cg_attach_everywhere(supported, path, pid);
+                if (q < 0)
+                        r = q;
+        }
+
+        return r;
+}
+
+int cg_migrate_everywhere(CGroupControllerMask supported, const char *from, const char *to) {
+        CGroupControllerMask bit = 1;
+        const char *n;
+        int r;
+
+        if (!path_equal(from, to))  {
+                r = cg_migrate_recursive(SYSTEMD_CGROUP_CONTROLLER, from, SYSTEMD_CGROUP_CONTROLLER, to, false, true);
+                if (r < 0)
+                        return r;
+        }
+
+        NULSTR_FOREACH(n, mask_names) {
+                if (supported & bit)
+                        cg_migrate_recursive_fallback(SYSTEMD_CGROUP_CONTROLLER, to, n, to, false, false);
+
+                bit <<= 1;
+        }
+
+        return 0;
+}
+
+int cg_trim_everywhere(CGroupControllerMask supported, const char *path, bool delete_root) {
+        CGroupControllerMask bit = 1;
+        const char *n;
+        int r;
+
+        r = cg_trim(SYSTEMD_CGROUP_CONTROLLER, path, delete_root);
+        if (r < 0)
+                return r;
+
+        NULSTR_FOREACH(n, mask_names) {
+                if (supported & bit)
+                        cg_trim(n, path, delete_root);
+
+                bit <<= 1;
+        }
+
+        return 0;
+}
+
+CGroupControllerMask cg_mask_supported(void) {
+        CGroupControllerMask bit = 1, mask = 0;
+        const char *n;
+
+        NULSTR_FOREACH(n, mask_names) {
+                if (check_hierarchy(n) >= 0)
+                        mask |= bit;
+
+                bit <<= 1;
+        }
+
+        return mask;
+}
diff --git a/src/shared/cgroup-util.h b/src/shared/cgroup-util.h
index 25dd277ba5..0963450b08 100644
--- a/src/shared/cgroup-util.h
+++ b/src/shared/cgroup-util.h
@@ -28,6 +28,15 @@
 #include "set.h"
 #include "def.h"
 
+/* A bit mask of well known cgroup controllers */
+typedef enum CGroupControllerMask {
+        CGROUP_CPU = 1,
+        CGROUP_CPUACCT = 2,
+        CGROUP_BLKIO = 4,
+        CGROUP_MEMORY = 8,
+        CGROUP_DEVICE = 16
+} CGroupControllerMask;
+
 /*
  * General rules:
  *
@@ -44,7 +53,6 @@
  */
 
 int cg_enumerate_processes(const char *controller, const char *path, FILE **_f);
-int cg_enumerate_tasks(const char *controller, const char *path, FILE **_f);
 int cg_read_pid(FILE *f, pid_t *_pid);
 
 int cg_enumerate_subgroups(const char *controller, const char *path, DIR **_d);
@@ -56,6 +64,7 @@ int cg_kill_recursive_and_wait(const char *controller, const char *path, bool re
 
 int cg_migrate(const char *cfrom, const char *pfrom, const char *cto, const char *pto, bool ignore_self);
 int cg_migrate_recursive(const char *cfrom, const char *pfrom, const char *cto, const char *pto, bool ignore_self, bool remove);
+int cg_migrate_recursive_fallback(const char *cfrom, const char *pfrom, const char *cto, const char *pto, bool ignore_self, bool rem);
 
 int cg_split_spec(const char *spec, char **controller, char **path);
 int cg_join_spec(const char *controller, const char *path, char **spec);
@@ -68,32 +77,34 @@ int cg_pid_get_path(const char *controller, pid_t pid, char **path);
 
 int cg_trim(const char *controller, const char *path, bool delete_root);
 
-int cg_rmdir(const char *controller, const char *path, bool honour_sticky);
+int cg_rmdir(const char *controller, const char *path);
 int cg_delete(const char *controller, const char *path);
 
-int cg_create(const char *controller, const char *path, const char *suffix);
+int cg_create(const char *controller, const char *path);
 int cg_attach(const char *controller, const char *path, pid_t pid);
+int cg_attach_fallback(const char *controller, const char *path, pid_t pid);
 int cg_create_and_attach(const char *controller, const char *path, pid_t pid);
 
+int cg_set_attribute(const char *controller, const char *path, const char *attribute, const char *value);
+
 int cg_set_group_access(const char *controller, const char *path, mode_t mode, uid_t uid, gid_t gid);
-int cg_set_task_access(const char *controller, const char *path, mode_t mode, uid_t uid, gid_t gid, int sticky);
+int cg_set_task_access(const char *controller, const char *path, mode_t mode, uid_t uid, gid_t gid);
 
 int cg_install_release_agent(const char *controller, const char *agent);
+int cg_uninstall_release_agent(const char *controller);
 
 int cg_is_empty(const char *controller, const char *path, bool ignore_self);
 int cg_is_empty_by_spec(const char *spec, bool ignore_self);
 int cg_is_empty_recursive(const char *controller, const char *path, bool ignore_self);
 
 int cg_get_root_path(char **path);
-int cg_get_system_path(char **path);
-int cg_get_user_path(char **path);
-int cg_get_machine_path(const char *machine, char **path);
 
 int cg_path_get_session(const char *path, char **session);
 int cg_path_get_owner_uid(const char *path, uid_t *uid);
 int cg_path_get_unit(const char *path, char **unit);
 int cg_path_get_user_unit(const char *path, char **unit);
 int cg_path_get_machine_name(const char *path, char **machine);
+int cg_path_get_slice(const char *path, char **slice);
 
 int cg_pid_get_path_shifted(pid_t pid, char **root, char **cgroup);
 
@@ -102,6 +113,7 @@ int cg_pid_get_owner_uid(pid_t pid, uid_t *uid);
 int cg_pid_get_unit(pid_t pid, char **unit);
 int cg_pid_get_user_unit(pid_t pid, char **unit);
 int cg_pid_get_machine_name(pid_t pid, char **machine);
+int cg_pid_get_slice(pid_t pid, char **slice);
 
 int cg_path_decode_unit(const char *cgroup, char **unit);
 
@@ -113,3 +125,13 @@ char *cg_escape(const char *p);
 char *cg_unescape(const char *p) _pure_;
 
 bool cg_controller_is_valid(const char *p, bool allow_named);
+
+int cg_slice_to_path(const char *unit, char **ret);
+
+int cg_create_everywhere(CGroupControllerMask supported, CGroupControllerMask mask, const char *path);
+int cg_attach_everywhere(CGroupControllerMask supported, const char *path, pid_t pid);
+int cg_attach_many_everywhere(CGroupControllerMask supported, const char *path, Set* pids);
+int cg_migrate_everywhere(CGroupControllerMask supported, const char *from, const char *to);
+int cg_trim_everywhere(CGroupControllerMask supported, const char *path, bool delete_root);
+
+CGroupControllerMask cg_mask_supported(void);
diff --git a/src/shared/conf-parser.c b/src/shared/conf-parser.c
index 2303d9a50b..6085d33391 100644
--- a/src/shared/conf-parser.c
+++ b/src/shared/conf-parser.c
@@ -599,6 +599,7 @@ int config_parse_path(const char *unit,
 
         char **s = data;
         char *n;
+        int offset;
 
         assert(filename);
         assert(lvalue);
@@ -611,7 +612,9 @@ int config_parse_path(const char *unit,
                 return 0;
         }
 
-        if (!path_is_absolute(rvalue)) {
+        offset = rvalue[0] == '-' && (streq(lvalue, "InaccessibleDirectories") ||
+                                      streq(lvalue, "ReadOnlyDirectories"));
+        if (!path_is_absolute(rvalue + offset)) {
                 log_syntax(unit, LOG_ERR, filename, line, EINVAL,
                            "Not an absolute path, ignoring: %s", rvalue);
                 return 0;
@@ -713,6 +716,7 @@ int config_parse_path_strv(const char *unit,
 
         FOREACH_WORD_QUOTED(w, l, rvalue, state) {
                 _cleanup_free_ char *n;
+                int offset;
 
                 n = strndup(w, l);
                 if (!n)
@@ -724,7 +728,9 @@ int config_parse_path_strv(const char *unit,
                         continue;
                 }
 
-                if (!path_is_absolute(n)) {
+                offset = n[0] == '-' && (streq(lvalue, "InaccessibleDirectories") ||
+                                         streq(lvalue, "ReadOnlyDirectories"));
+                if (!path_is_absolute(n + offset)) {
                         log_syntax(unit, LOG_ERR, filename, line, EINVAL,
                                    "Not an absolute path, ignoring: %s", rvalue);
                         continue;
diff --git a/src/shared/dbus-common.c b/src/shared/dbus-common.c
index b8c15cb9fc..c727cae7cd 100644
--- a/src/shared/dbus-common.c
+++ b/src/shared/dbus-common.c
@@ -178,9 +178,9 @@ int bus_connect_system_ssh(const char *user, const char *host, DBusConnection **
         assert(user || host);
 
         if (user && host)
-                asprintf(&p, "unixexec:path=ssh,argv1=-xT,argv2=%s@%s,argv3=systemd-stdio-bridge", user, host);
+                asprintf(&p, "unixexec:path=ssh,argv1=-xT,argv2=%s%%40%s,argv3=systemd-stdio-bridge", user, host);
         else if (user)
-                asprintf(&p, "unixexec:path=ssh,argv1=-xT,argv2=%s@localhost,argv3=systemd-stdio-bridge", user);
+                asprintf(&p, "unixexec:path=ssh,argv1=-xT,argv2=%s%%40localhost,argv3=systemd-stdio-bridge", user);
         else if (host)
                 asprintf(&p, "unixexec:path=ssh,argv1=-xT,argv2=%s,argv3=systemd-stdio-bridge", host);
 
@@ -1383,6 +1383,8 @@ int bus_method_call_with_reply(
                         r = -EACCES;
                 else if (dbus_error_has_name(&error, DBUS_ERROR_NO_REPLY))
                         r = -ETIMEDOUT;
+                else if (dbus_error_has_name(&error, DBUS_ERROR_DISCONNECTED))
+                        r = -ECONNRESET;
                 else
                         r = -EIO;
                 goto finish;
diff --git a/src/shared/def.h b/src/shared/def.h
index 5ba170f965..edd0bcf7a4 100644
--- a/src/shared/def.h
+++ b/src/shared/def.h
@@ -32,4 +32,9 @@
 #define SYSTEMD_CGROUP_CONTROLLER "name=systemd"
 
 #define SIGNALS_CRASH_HANDLER SIGSEGV,SIGILL,SIGFPE,SIGBUS,SIGQUIT,SIGABRT
-#define SIGNALS_IGNORE SIGKILL,SIGPIPE
+#define SIGNALS_IGNORE SIGPIPE
+
+#define DIGITS            "0123456789"
+#define LOWERCASE_LETTERS "abcdefghijklmnopqrstuvwxyz"
+#define UPPERCASE_LETTERS "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+#define LETTERS LOWERCASE_LETTERS UPPERCASE_LETTERS
diff --git a/src/shared/dev-setup.c b/src/shared/dev-setup.c
index b0ac02d461..50a187fda9 100644
--- a/src/shared/dev-setup.c
+++ b/src/shared/dev-setup.c
@@ -54,13 +54,19 @@ void dev_setup(const char *prefix) {
         const char *j, *k;
 
         static const char symlinks[] =
-                "/proc/kcore\0"      "/dev/core\0"
+                "-/proc/kcore\0"     "/dev/core\0"
                 "/proc/self/fd\0"    "/dev/fd\0"
                 "/proc/self/fd/0\0"  "/dev/stdin\0"
                 "/proc/self/fd/1\0"  "/dev/stdout\0"
                 "/proc/self/fd/2\0"  "/dev/stderr\0";
 
         NULSTR_FOREACH_PAIR(j, k, symlinks) {
+                if (j[0] == '-') {
+                        j++;
+
+                        if (access(j, F_OK))
+                                continue;
+                }
 
                 if (prefix) {
                         char *linkname;
diff --git a/src/shared/device-nodes.c b/src/shared/device-nodes.c
new file mode 100644
index 0000000000..9837375099
--- /dev/null
+++ b/src/shared/device-nodes.c
@@ -0,0 +1,74 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+/***
+  This file is part of systemd.
+
+  Copyright 2008-2011 Kay Sievers
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <sys/types.h>
+
+#include "device-nodes.h"
+#include "utf8.h"
+
+int whitelisted_char_for_devnode(char c, const char *white) {
+        if ((c >= '0' && c <= '9') ||
+            (c >= 'A' && c <= 'Z') ||
+            (c >= 'a' && c <= 'z') ||
+            strchr("#+-.:=@_", c) != NULL ||
+            (white != NULL && strchr(white, c) != NULL))
+                return 1;
+        return 0;
+}
+
+int encode_devnode_name(const char *str, char *str_enc, size_t len) {
+        size_t i, j;
+
+        if (str == NULL || str_enc == NULL)
+                return -1;
+
+        for (i = 0, j = 0; str[i] != '\0'; i++) {
+                int seqlen;
+
+                seqlen = utf8_encoded_valid_unichar(&str[i]);
+                if (seqlen > 1) {
+                        if (len-j < (size_t)seqlen)
+                                goto err;
+                        memcpy(&str_enc[j], &str[i], seqlen);
+                        j += seqlen;
+                        i += (seqlen-1);
+                } else if (str[i] == '\\' || !whitelisted_char_for_devnode(str[i], NULL)) {
+                        if (len-j < 4)
+                                goto err;
+                        sprintf(&str_enc[j], "\\x%02x", (unsigned char) str[i]);
+                        j += 4;
+                } else {
+                        if (len-j < 1)
+                                goto err;
+                        str_enc[j] = str[i];
+                        j++;
+                }
+        }
+        if (len-j < 1)
+                goto err;
+        str_enc[j] = '\0';
+        return 0;
+err:
+        return -1;
+}
diff --git a/src/shared/device-nodes.h b/src/shared/device-nodes.h
new file mode 100644
index 0000000000..04ba4897e5
--- /dev/null
+++ b/src/shared/device-nodes.h
@@ -0,0 +1,25 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2012 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+int encode_devnode_name(const char *str, char *str_enc, size_t len);
+int whitelisted_char_for_devnode(char c, const char *additional);
diff --git a/src/shared/efivars.c b/src/shared/efivars.c
index 8d004bad33..1d5b6f9e72 100644
--- a/src/shared/efivars.c
+++ b/src/shared/efivars.c
@@ -24,6 +24,7 @@
 #include <fcntl.h>
 #include <ctype.h>
 
+#include "acpi-fpdt.h"
 #include "util.h"
 #include "utf8.h"
 #include "efivars.h"
@@ -413,7 +414,7 @@ static int read_usec(sd_id128_t vendor, const char *name, usec_t *u) {
         return 0;
 }
 
-static int get_boot_usec(usec_t *firmware, usec_t *loader) {
+int efi_loader_get_boot_usec(usec_t *firmware, usec_t *loader) {
         uint64_t x, y;
         int r;
 
@@ -440,43 +441,7 @@ static int get_boot_usec(usec_t *firmware, usec_t *loader) {
         return 0;
 }
 
-int efi_get_boot_timestamps(const dual_timestamp *n, dual_timestamp *firmware, dual_timestamp *loader) {
-        usec_t x, y, a;
-        int r;
-        dual_timestamp _n;
-
-        assert(firmware);
-        assert(loader);
-
-        if (!n) {
-                dual_timestamp_get(&_n);
-                n = &_n;
-        }
-
-        r = get_boot_usec(&x, &y);
-        if (r < 0)
-                return r;
-
-        /* Let's convert this to timestamps where the firmware
-         * began/loader began working. To make this more confusing:
-         * since usec_t is unsigned and the kernel's monotonic clock
-         * begins at kernel initialization we'll actually initialize
-         * the monotonic timestamps here as negative of the actual
-         * value. */
-
-        firmware->monotonic = y;
-        loader->monotonic = y - x;
-
-        a = n->monotonic + firmware->monotonic;
-        firmware->realtime = n->realtime > a ? n->realtime - a : 0;
-
-        a = n->monotonic + loader->monotonic;
-        loader->realtime = n->realtime > a ? n->realtime - a : 0;
-
-        return 0;
-}
-
-int efi_get_loader_device_part_uuid(sd_id128_t *u) {
+int efi_loader_get_device_part_uuid(sd_id128_t *u) {
         _cleanup_free_ char *p = NULL;
         int r, parsed[16];
         unsigned i;
diff --git a/src/shared/efivars.h b/src/shared/efivars.h
index 2b88c6075c..7921bedc9f 100644
--- a/src/shared/efivars.h
+++ b/src/shared/efivars.h
@@ -42,6 +42,5 @@ int efi_get_boot_option(uint16_t nr, char **title, sd_id128_t *partuuid, char **
 int efi_get_boot_order(uint16_t **order);
 int efi_get_boot_options(uint16_t **options);
 
-int efi_get_boot_timestamps(const dual_timestamp *n, dual_timestamp *firmware, dual_timestamp *loader);
-
-int efi_get_loader_device_part_uuid(sd_id128_t *u);
+int efi_loader_get_device_part_uuid(sd_id128_t *u);
+int efi_loader_get_boot_usec(usec_t *firmware, usec_t *loader);
diff --git a/src/shared/env-util.c b/src/shared/env-util.c
index 6a52fb960d..5e29629efd 100644
--- a/src/shared/env-util.c
+++ b/src/shared/env-util.c
@@ -27,11 +27,10 @@
 #include "utf8.h"
 #include "util.h"
 #include "env-util.h"
+#include "def.h"
 
 #define VALID_CHARS_ENV_NAME                    \
-        "0123456789"                            \
-        "abcdefghijklmnopqrstuvwxyz"            \
-        "ABCDEFGHIJKLMNOPQRSTUVWXYZ"            \
+        DIGITS LETTERS                          \
         "_"
 
 #ifndef ARG_MAX
diff --git a/src/shared/fileio.c b/src/shared/fileio.c
index ad068bf30d..603a1c7b38 100644
--- a/src/shared/fileio.c
+++ b/src/shared/fileio.c
@@ -23,7 +23,8 @@
 #include "fileio.h"
 #include "util.h"
 #include "strv.h"
-
+#include "utf8.h"
+#include "ctype.h"
 
 int write_string_to_file(FILE *f, const char *line) {
         errno = 0;
@@ -178,13 +179,15 @@ int read_full_file(const char *fn, char **contents, size_t *size) {
 static int parse_env_file_internal(
                 const char *fname,
                 const char *newline,
-                int (*push) (const char *key, char *value, void *userdata),
+                int (*push) (const char *filename, unsigned line,
+                             const char *key, char *value, void *userdata),
                 void *userdata) {
 
         _cleanup_free_ char *contents = NULL, *key = NULL;
         size_t key_alloc = 0, n_key = 0, value_alloc = 0, n_value = 0, last_value_whitespace = (size_t) -1, last_key_whitespace = (size_t) -1;
         char *p, *value = NULL;
         int r;
+        unsigned line = 1;
 
         enum {
                 PRE_KEY,
@@ -231,6 +234,7 @@ static int parse_env_file_internal(
                 case KEY:
                         if (strchr(newline, c)) {
                                 state = PRE_KEY;
+                                line ++;
                                 n_key = 0;
                         } else if (c == '=') {
                                 state = PRE_VALUE;
@@ -254,6 +258,7 @@ static int parse_env_file_internal(
                 case PRE_VALUE:
                         if (strchr(newline, c)) {
                                 state = PRE_KEY;
+                                line ++;
                                 key[n_key] = 0;
 
                                 if (value)
@@ -263,7 +268,7 @@ static int parse_env_file_internal(
                                 if (last_key_whitespace != (size_t) -1)
                                         key[last_key_whitespace] = 0;
 
-                                r = push(key, value, userdata);
+                                r = push(fname, line, key, value, userdata);
                                 if (r < 0)
                                         goto fail;
 
@@ -293,6 +298,7 @@ static int parse_env_file_internal(
                 case VALUE:
                         if (strchr(newline, c)) {
                                 state = PRE_KEY;
+                                line ++;
 
                                 key[n_key] = 0;
 
@@ -307,7 +313,7 @@ static int parse_env_file_internal(
                                 if (last_key_whitespace != (size_t) -1)
                                         key[last_key_whitespace] = 0;
 
-                                r = push(key, value, userdata);
+                                r = push(fname, line, key, value, userdata);
                                 if (r < 0)
                                         goto fail;
 
@@ -409,8 +415,10 @@ static int parse_env_file_internal(
                 case COMMENT:
                         if (c == '\\')
                                 state = COMMENT_ESCAPE;
-                        else if (strchr(newline, c))
+                        else if (strchr(newline, c)) {
                                 state = PRE_KEY;
+                                line ++;
+                        }
                         break;
 
                 case COMMENT_ESCAPE:
@@ -440,7 +448,7 @@ static int parse_env_file_internal(
                 if (last_key_whitespace != (size_t) -1)
                         key[last_key_whitespace] = 0;
 
-                r = push(key, value, userdata);
+                r = push(fname, line, key, value, userdata);
                 if (r < 0)
                         goto fail;
         }
@@ -452,27 +460,36 @@ fail:
         return r;
 }
 
-static int parse_env_file_push(const char *key, char *value, void *userdata) {
-        const char *k;
-        va_list* ap = (va_list*) userdata;
-        va_list aq;
+static int parse_env_file_push(const char *filename, unsigned line,
+                               const char *key, char *value, void *userdata) {
+        assert(utf8_is_valid(key));
+
+        if (value && !utf8_is_valid(value))
+                /* FIXME: filter UTF-8 */
+                log_error("%s:%u: invalid UTF-8 for key %s: '%s', ignoring.",
+                          filename, line, key, value);
+        else {
+                const char *k;
+                va_list* ap = (va_list*) userdata;
+                va_list aq;
 
-        va_copy(aq, *ap);
+                va_copy(aq, *ap);
 
-        while ((k = va_arg(aq, const char *))) {
-                char **v;
+                while ((k = va_arg(aq, const char *))) {
+                        char **v;
 
-                v = va_arg(aq, char **);
+                        v = va_arg(aq, char **);
 
-                if (streq(key, k)) {
-                        va_end(aq);
-                        free(*v);
-                        *v = value;
-                        return 1;
+                        if (streq(key, k)) {
+                                va_end(aq);
+                                free(*v);
+                                *v = value;
+                                return 1;
+                        }
                 }
-        }
 
-        va_end(aq);
+                va_end(aq);
+        }
 
         free(value);
         return 0;
@@ -495,19 +512,28 @@ int parse_env_file(
         return r;
 }
 
-static int load_env_file_push(const char *key, char *value, void *userdata) {
-        char ***m = userdata;
-        char *p;
-        int r;
+static int load_env_file_push(const char *filename, unsigned line,
+                              const char *key, char *value, void *userdata) {
+        assert(utf8_is_valid(key));
 
-        p = strjoin(key, "=", strempty(value), NULL);
-        if (!p)
-                return -ENOMEM;
+        if (value && !utf8_is_valid(value))
+                /* FIXME: filter UTF-8 */
+                log_error("%s:%u: invalid UTF-8 for key %s: '%s', ignoring.",
+                          filename, line, key, value);
+        else {
+                char ***m = userdata;
+                char *p;
+                int r;
 
-        r = strv_push(m, p);
-        if (r < 0) {
-                free(p);
-                return r;
+                p = strjoin(key, "=", strempty(value), NULL);
+                if (!p)
+                        return -ENOMEM;
+
+                r = strv_push(m, p);
+                if (r < 0) {
+                        free(p);
+                        return r;
+                }
         }
 
         free(value);
@@ -594,3 +620,79 @@ int write_env_file(const char *fname, char **l) {
 
         return r;
 }
+
+int executable_is_script(const char *path, char **interpreter) {
+        int r;
+        char _cleanup_free_ *line = NULL;
+        int len;
+        char *ans;
+
+        assert(path);
+
+        r = read_one_line_file(path, &line);
+        if (r < 0)
+                return r;
+
+        if (!startswith(line, "#!"))
+                return 0;
+
+        ans = strstrip(line + 2);
+        len = strcspn(ans, " \t");
+
+        if (len == 0)
+                return 0;
+
+        ans = strndup(ans, len);
+        if (!ans)
+                return -ENOMEM;
+
+        *interpreter = ans;
+        return 1;
+}
+
+/**
+ * Retrieve one field from a file like /proc/self/status.  pattern
+ * should start with '\n' and end with a ':'. Whitespace and zeros
+ * after the ':' will be skipped. field must be freed afterwards.
+ */
+int get_status_field(const char *filename, const char *pattern, char **field) {
+        _cleanup_free_ char *status = NULL;
+        char *t;
+        size_t len;
+        int r;
+
+        assert(filename);
+        assert(field);
+
+        r = read_full_file(filename, &status, NULL);
+        if (r < 0)
+                return r;
+
+        t = strstr(status, pattern);
+        if (!t)
+                return -ENOENT;
+
+        t += strlen(pattern);
+        if (*t) {
+                t += strspn(t, " \t");
+
+                /* Also skip zeros, because when this is used for
+                 * capabilities, we don't want the zeros. This way the
+                 * same capability set always maps to the same string,
+                 * irrespective of the total capability set size. For
+                 * other numbers it shouldn't matter. */
+                t += strspn(t, "0");
+                /* Back off one char if there's nothing but whitespace
+                   and zeros */
+                if (!*t || isspace(*t))
+                        t --;
+        }
+
+        len = strcspn(t, WHITESPACE);
+
+        *field = strndup(t, len);
+        if (!*field)
+                return -ENOMEM;
+
+        return 0;
+}
diff --git a/src/shared/fileio.h b/src/shared/fileio.h
index 0ca6878ea4..59e41502b1 100644
--- a/src/shared/fileio.h
+++ b/src/shared/fileio.h
@@ -35,3 +35,7 @@ int read_full_file(const char *fn, char **contents, size_t *size);
 int parse_env_file(const char *fname, const char *separator, ...) _sentinel_;
 int load_env_file(const char *fname, const char *separator, char ***l);
 int write_env_file(const char *fname, char **l);
+
+int executable_is_script(const char *path, char **interpreter);
+
+int get_status_field(const char *filename, const char *pattern, char **field);
diff --git a/src/shared/hashmap.c b/src/shared/hashmap.c
index 9f7db34397..f06fce6ef3 100644
--- a/src/shared/hashmap.c
+++ b/src/shared/hashmap.c
@@ -24,11 +24,15 @@
 #include <string.h>
 #include <errno.h>
 
+#ifdef HAVE_SYS_AUXV_H
+#include <sys/auxv.h>
+#endif
+
 #include "util.h"
 #include "hashmap.h"
 #include "macro.h"
 
-#define NBUCKETS 127
+#define INITIAL_N_BUCKETS 31
 
 struct hashmap_entry {
         const void *key;
@@ -42,13 +46,14 @@ struct Hashmap {
         compare_func_t compare_func;
 
         struct hashmap_entry *iterate_list_head, *iterate_list_tail;
-        unsigned n_entries;
 
+        struct hashmap_entry ** buckets;
+        unsigned n_buckets, n_entries;
+
+        unsigned random_xor;
         bool from_pool;
 };
 
-#define BY_HASH(h) ((struct hashmap_entry**) ((uint8_t*) (h) + ALIGN(sizeof(Hashmap))))
-
 struct pool {
         struct pool *next;
         unsigned n_tiles;
@@ -64,6 +69,11 @@ static void *first_entry_tile = NULL;
 static void* allocate_tile(struct pool **first_pool, void **first_tile, size_t tile_size) {
         unsigned i;
 
+        /* When a tile is released we add it to the list and simply
+         * place the next pointer at its offset 0. */
+
+        assert(tile_size >= sizeof(void*));
+
         if (*first_tile) {
                 void *r;
 
@@ -166,14 +176,19 @@ int uint64_compare_func(const void *_a, const void *_b) {
         return a < b ? -1 : (a > b ? 1 : 0);
 }
 
+static unsigned bucket_hash(Hashmap *h, const void *p) {
+        return (h->hash_func(p) ^ h->random_xor) % h->n_buckets;
+}
+
 Hashmap *hashmap_new(hash_func_t hash_func, compare_func_t compare_func) {
         bool b;
         Hashmap *h;
         size_t size;
+        void *auxv;
 
         b = is_main_thread();
 
-        size = ALIGN(sizeof(Hashmap)) + NBUCKETS * sizeof(struct hashmap_entry*);
+        size = ALIGN(sizeof(Hashmap)) + INITIAL_N_BUCKETS * sizeof(struct hashmap_entry*);
 
         if (b) {
                 h = allocate_tile(&first_hashmap_pool, &first_hashmap_tile, size);
@@ -191,23 +206,43 @@ Hashmap *hashmap_new(hash_func_t hash_func, compare_func_t compare_func) {
         h->hash_func = hash_func ? hash_func : trivial_hash_func;
         h->compare_func = compare_func ? compare_func : trivial_compare_func;
 
+        h->n_buckets = INITIAL_N_BUCKETS;
         h->n_entries = 0;
         h->iterate_list_head = h->iterate_list_tail = NULL;
 
+        h->buckets = (struct hashmap_entry**) ((uint8_t*) h + ALIGN(sizeof(Hashmap)));
+
         h->from_pool = b;
 
+        /* Let's randomize our hash functions a bit so that they are
+         * harder to guess for clients. For this, start out by cheaply
+         * using some bits the kernel passed into the process using
+         * the auxiliary vector. If the hashmap grows later on we will
+         * rehash everything using a new random XOR mask from
+         * /dev/random. */
+#ifdef HAVE_SYS_AUXV_H
+        auxv = (void*) getauxval(AT_RANDOM);
+        h->random_xor = auxv ? *(unsigned*) auxv : random_u();
+#else
+        h->random_xor = random_u();
+#endif
+
         return h;
 }
 
 int hashmap_ensure_allocated(Hashmap **h, hash_func_t hash_func, compare_func_t compare_func) {
+        Hashmap *q;
+
         assert(h);
 
         if (*h)
                 return 0;
 
-        if (!(*h = hashmap_new(hash_func, compare_func)))
+        q = hashmap_new(hash_func, compare_func);
+        if (!q)
                 return -ENOMEM;
 
+        *h = q;
         return 0;
 }
 
@@ -216,11 +251,11 @@ static void link_entry(Hashmap *h, struct hashmap_entry *e, unsigned hash) {
         assert(e);
 
         /* Insert into hash table */
-        e->bucket_next = BY_HASH(h)[hash];
+        e->bucket_next = h->buckets[hash];
         e->bucket_previous = NULL;
-        if (BY_HASH(h)[hash])
-                BY_HASH(h)[hash]->bucket_previous = e;
-        BY_HASH(h)[hash] = e;
+        if (h->buckets[hash])
+                h->buckets[hash]->bucket_previous = e;
+        h->buckets[hash] = e;
 
         /* Insert into iteration list */
         e->iterate_previous = h->iterate_list_tail;
@@ -260,7 +295,7 @@ static void unlink_entry(Hashmap *h, struct hashmap_entry *e, unsigned hash) {
         if (e->bucket_previous)
                 e->bucket_previous->bucket_next = e->bucket_next;
         else
-                BY_HASH(h)[hash] = e->bucket_next;
+                h->buckets[hash] = e->bucket_next;
 
         assert(h->n_entries >= 1);
         h->n_entries--;
@@ -272,8 +307,7 @@ static void remove_entry(Hashmap *h, struct hashmap_entry *e) {
         assert(h);
         assert(e);
 
-        hash = h->hash_func(e->key) % NBUCKETS;
-
+        hash = bucket_hash(h, e->key);
         unlink_entry(h, e, hash);
 
         if (h->from_pool)
@@ -291,6 +325,9 @@ void hashmap_free(Hashmap*h) {
 
         hashmap_clear(h);
 
+        if (h->buckets != (struct hashmap_entry**) ((uint8_t*) h + ALIGN(sizeof(Hashmap))))
+                free(h->buckets);
+
         if (h->from_pool)
                 deallocate_tile(&first_hashmap_tile, h);
         else
@@ -353,36 +390,91 @@ void hashmap_clear_free_free(Hashmap *h) {
         }
 }
 
-
 static struct hashmap_entry *hash_scan(Hashmap *h, unsigned hash, const void *key) {
         struct hashmap_entry *e;
         assert(h);
-        assert(hash < NBUCKETS);
+        assert(hash < h->n_buckets);
 
-        for (e = BY_HASH(h)[hash]; e; e = e->bucket_next)
+        for (e = h->buckets[hash]; e; e = e->bucket_next)
                 if (h->compare_func(e->key, key) == 0)
                         return e;
 
         return NULL;
 }
 
+static bool resize_buckets(Hashmap *h) {
+        struct hashmap_entry **n, *i;
+        unsigned m, nxor;
+
+        assert(h);
+
+        if (_likely_(h->n_entries*4 < h->n_buckets*3))
+                return false;
+
+        /* Increase by four */
+        m = (h->n_entries+1)*4-1;
+
+        /* If we hit OOM we simply risk packed hashmaps... */
+        n = new0(struct hashmap_entry*, m);
+        if (!n)
+                return false;
+
+        /* Let's use a different randomized xor value for the
+         * extension, so that people cannot guess what we are using
+         * here forever */
+        nxor = random_u();
+
+        for (i = h->iterate_list_head; i; i = i->iterate_next) {
+                unsigned hash, x;
+
+                hash = h->hash_func(i->key);
+
+                /* First, drop from old bucket table */
+                if (i->bucket_next)
+                        i->bucket_next->bucket_previous = i->bucket_previous;
+
+                if (i->bucket_previous)
+                        i->bucket_previous->bucket_next = i->bucket_next;
+                else
+                        h->buckets[(hash ^ h->random_xor) % h->n_buckets] = i->bucket_next;
+
+                /* Then, add to new backet table */
+                x = (hash ^ nxor) % m;
+
+                i->bucket_next = n[x];
+                i->bucket_previous = NULL;
+                if (n[x])
+                        n[x]->bucket_previous = i;
+                n[x] = i;
+        }
+
+        if (h->buckets != (struct hashmap_entry**) ((uint8_t*) h + ALIGN(sizeof(Hashmap))))
+                free(h->buckets);
+
+        h->buckets = n;
+        h->n_buckets = m;
+        h->random_xor = nxor;
+
+        return true;
+}
+
 int hashmap_put(Hashmap *h, const void *key, void *value) {
         struct hashmap_entry *e;
         unsigned hash;
 
         assert(h);
 
-        hash = h->hash_func(key) % NBUCKETS;
-
+        hash = bucket_hash(h, key);
         e = hash_scan(h, hash, key);
         if (e) {
-
                 if (e->value == value)
                         return 0;
-
                 return -EEXIST;
         }
 
+        if (resize_buckets(h))
+                hash = bucket_hash(h, key);
+
         if (h->from_pool)
                 e = allocate_tile(&first_entry_pool, &first_entry_tile, sizeof(struct hashmap_entry));
         else
@@ -405,7 +497,7 @@ int hashmap_replace(Hashmap *h, const void *key, void *value) {
 
         assert(h);
 
-        hash = h->hash_func(key) % NBUCKETS;
+        hash = bucket_hash(h, key);
         e = hash_scan(h, hash, key);
         if (e) {
                 e->key = key;
@@ -422,7 +514,7 @@ int hashmap_update(Hashmap *h, const void *key, void *value) {
 
         assert(h);
 
-        hash = h->hash_func(key) % NBUCKETS;
+        hash = bucket_hash(h, key);
         e = hash_scan(h, hash, key);
         if (!e)
                 return -ENOENT;
@@ -438,7 +530,7 @@ void* hashmap_get(Hashmap *h, const void *key) {
         if (!h)
                 return NULL;
 
-        hash = h->hash_func(key) % NBUCKETS;
+        hash = bucket_hash(h, key);
         e = hash_scan(h, hash, key);
         if (!e)
                 return NULL;
@@ -453,7 +545,7 @@ void* hashmap_get2(Hashmap *h, const void *key, void **key2) {
         if (!h)
                 return NULL;
 
-        hash = h->hash_func(key) % NBUCKETS;
+        hash = bucket_hash(h, key);
         e = hash_scan(h, hash, key);
         if (!e)
                 return NULL;
@@ -470,12 +562,8 @@ bool hashmap_contains(Hashmap *h, const void *key) {
         if (!h)
                 return false;
 
-        hash = h->hash_func(key) % NBUCKETS;
-
-        if (!hash_scan(h, hash, key))
-                return false;
-
-        return true;
+        hash = bucket_hash(h, key);
+        return !!hash_scan(h, hash, key);
 }
 
 void* hashmap_remove(Hashmap *h, const void *key) {
@@ -486,9 +574,9 @@ void* hashmap_remove(Hashmap *h, const void *key) {
         if (!h)
                 return NULL;
 
-        hash = h->hash_func(key) % NBUCKETS;
-
-        if (!(e = hash_scan(h, hash, key)))
+        hash = bucket_hash(h, key);
+        e = hash_scan(h, hash, key);
+        if (!e)
                 return NULL;
 
         data = e->value;
@@ -504,11 +592,12 @@ int hashmap_remove_and_put(Hashmap *h, const void *old_key, const void *new_key,
         if (!h)
                 return -ENOENT;
 
-        old_hash = h->hash_func(old_key) % NBUCKETS;
-        if (!(e = hash_scan(h, old_hash, old_key)))
+        old_hash = bucket_hash(h, old_key);
+        e = hash_scan(h, old_hash, old_key);
+        if (!e)
                 return -ENOENT;
 
-        new_hash = h->hash_func(new_key) % NBUCKETS;
+        new_hash = bucket_hash(h, new_key);
         if (hash_scan(h, new_hash, new_key))
                 return -EEXIST;
 
@@ -529,13 +618,14 @@ int hashmap_remove_and_replace(Hashmap *h, const void *old_key, const void *new_
         if (!h)
                 return -ENOENT;
 
-        old_hash = h->hash_func(old_key) % NBUCKETS;
-        if (!(e = hash_scan(h, old_hash, old_key)))
+        old_hash = bucket_hash(h, old_key);
+        e = hash_scan(h, old_hash, old_key);
+        if (!e)
                 return -ENOENT;
 
-        new_hash = h->hash_func(new_key) % NBUCKETS;
-
-        if ((k = hash_scan(h, new_hash, new_key)))
+        new_hash = bucket_hash(h, new_key);
+        k = hash_scan(h, new_hash, new_key);
+        if (k)
                 if (e != k)
                         remove_entry(h, k);
 
@@ -556,9 +646,10 @@ void* hashmap_remove_value(Hashmap *h, const void *key, void *value) {
         if (!h)
                 return NULL;
 
-        hash = h->hash_func(key) % NBUCKETS;
+        hash = bucket_hash(h, key);
 
-        if (!(e = hash_scan(h, hash, key)))
+        e = hash_scan(h, hash, key);
+        if (!e)
                 return NULL;
 
         if (e->value != value)
@@ -646,9 +737,10 @@ void *hashmap_iterate_skip(Hashmap *h, const void *key, Iterator *i) {
         if (!h)
                 return NULL;
 
-        hash = h->hash_func(key) % NBUCKETS;
+        hash = bucket_hash(h, key);
 
-        if (!(e = hash_scan(h, hash, key)))
+        e = hash_scan(h, hash, key);
+        if (!e)
                 return NULL;
 
         *i = (Iterator) e;
@@ -727,6 +819,14 @@ unsigned hashmap_size(Hashmap *h) {
         return h->n_entries;
 }
 
+unsigned hashmap_buckets(Hashmap *h) {
+
+        if (!h)
+                return 0;
+
+        return h->n_buckets;
+}
+
 bool hashmap_isempty(Hashmap *h) {
 
         if (!h)
@@ -746,9 +846,9 @@ int hashmap_merge(Hashmap *h, Hashmap *other) {
         for (e = other->iterate_list_head; e; e = e->iterate_next) {
                 int r;
 
-                if ((r = hashmap_put(h, e->key, e->value)) < 0)
-                        if (r != -EEXIST)
-                                return r;
+                r = hashmap_put(h, e->key, e->value);
+                if (r < 0 && r != -EEXIST)
+                        return r;
         }
 
         return 0;
@@ -770,13 +870,11 @@ void hashmap_move(Hashmap *h, Hashmap *other) {
 
                 n = e->iterate_next;
 
-                h_hash = h->hash_func(e->key) % NBUCKETS;
-
+                h_hash = bucket_hash(h, e->key);
                 if (hash_scan(h, h_hash, e->key))
                         continue;
 
-                other_hash = other->hash_func(e->key) % NBUCKETS;
-
+                other_hash = bucket_hash(other, e->key);
                 unlink_entry(other, e, other_hash);
                 link_entry(h, e, h_hash);
         }
@@ -791,12 +889,13 @@ int hashmap_move_one(Hashmap *h, Hashmap *other, const void *key) {
 
         assert(h);
 
-        h_hash = h->hash_func(key) % NBUCKETS;
+        h_hash = bucket_hash(h, key);
         if (hash_scan(h, h_hash, key))
                 return -EEXIST;
 
-        other_hash = other->hash_func(key) % NBUCKETS;
-        if (!(e = hash_scan(other, other_hash, key)))
+        other_hash = bucket_hash(other, key);
+        e = hash_scan(other, other_hash, key);
+        if (!e)
                 return -ENOENT;
 
         unlink_entry(other, e, other_hash);
@@ -810,7 +909,8 @@ Hashmap *hashmap_copy(Hashmap *h) {
 
         assert(h);
 
-        if (!(copy = hashmap_new(h->hash_func, h->compare_func)))
+        copy = hashmap_new(h->hash_func, h->compare_func);
+        if (!copy)
                 return NULL;
 
         if (hashmap_merge(copy, h) < 0) {
@@ -849,7 +949,7 @@ void *hashmap_next(Hashmap *h, const void *key) {
         if (!h)
                 return NULL;
 
-        hash = h->hash_func(key) % NBUCKETS;
+        hash = bucket_hash(h, key);
         e = hash_scan(h, hash, key);
         if (!e)
                 return NULL;
diff --git a/src/shared/hashmap.h b/src/shared/hashmap.h
index 15b7e27585..3d4f6721bc 100644
--- a/src/shared/hashmap.h
+++ b/src/shared/hashmap.h
@@ -76,6 +76,7 @@ int hashmap_move_one(Hashmap *h, Hashmap *other, const void *key);
 
 unsigned hashmap_size(Hashmap *h) _pure_;
 bool hashmap_isempty(Hashmap *h) _pure_;
+unsigned hashmap_buckets(Hashmap *h) _pure_;
 
 void *hashmap_iterate(Hashmap *h, Iterator *i, const void **key);
 void *hashmap_iterate_backwards(Hashmap *h, Iterator *i, const void **key);
diff --git a/src/shared/hwclock.c b/src/shared/hwclock.c
index cc11faa6c3..17f12de51f 100644
--- a/src/shared/hwclock.c
+++ b/src/shared/hwclock.c
@@ -151,7 +151,7 @@ int hwclock_reset_timezone(void) {
         /*
          * The very first time we set the kernel's timezone, it will warp
          * the clock. Do a dummy call here, so the time warping is sealed
-         * and we set only the time zone with next call.
+         * and we set only the timezone with next call.
          */
         if (settimeofday(tv_null, &tz) < 0)
                 return -errno;
diff --git a/src/shared/install-printf.c b/src/shared/install-printf.c
index c44459b4e0..1ee1243f4d 100644
--- a/src/shared/install-printf.c
+++ b/src/shared/install-printf.c
@@ -27,21 +27,35 @@
 #include "util.h"
 #include "install-printf.h"
 
-static char *specifier_prefix_and_instance(char specifier, void *data, void *userdata) {
+static int specifier_prefix_and_instance(char specifier, void *data, void *userdata, char **ret) {
         InstallInfo *i = userdata;
+        char *n;
+
         assert(i);
 
-        return unit_name_to_prefix_and_instance(i->name);
+        n = unit_name_to_prefix_and_instance(i->name);
+        if (!n)
+                return -ENOMEM;
+
+        *ret = n;
+        return 0;
 }
 
-static char *specifier_prefix(char specifier, void *data, void *userdata) {
+static int specifier_prefix(char specifier, void *data, void *userdata, char **ret) {
         InstallInfo *i = userdata;
+        char *n;
+
         assert(i);
 
-        return unit_name_to_prefix(i->name);
+        n = unit_name_to_prefix(i->name);
+        if (!n)
+                return -ENOMEM;
+
+        *ret = n;
+        return 0;
 }
 
-static char *specifier_instance(char specifier, void *data, void *userdata) {
+static int specifier_instance(char specifier, void *data, void *userdata, char **ret) {
         InstallInfo *i = userdata;
         char *instance;
         int r;
@@ -50,14 +64,19 @@ static char *specifier_instance(char specifier, void *data, void *userdata) {
 
         r = unit_name_to_instance(i->name, &instance);
         if (r < 0)
-                return NULL;
-        if (instance != NULL)
-                return instance;
-        else
-                return strdup("");
+                return r;
+
+        if (!instance) {
+                instance = strdup("");
+                if (!instance)
+                        return -ENOMEM;
+        }
+
+        *ret = instance;
+        return 0;
 }
 
-static char *specifier_user_name(char specifier, void *data, void *userdata) {
+static int specifier_user_name(char specifier, void *data, void *userdata, char **ret) {
         InstallInfo *i = userdata;
         const char *username;
         _cleanup_free_ char *tmp = NULL;
@@ -82,18 +101,20 @@ static char *specifier_user_name(char specifier, void *data, void *userdata) {
 
                 r = get_user_creds(&username, &uid, NULL, NULL, NULL);
                 if (r < 0)
-                        return NULL;
+                        return r;
 
                 if (asprintf(&printed, "%d", uid) < 0)
-                        return NULL;
+                        return -ENOMEM;
                 break;
         }}
 
-        return printed;
+
+        *ret = printed;
+        return 0;
 }
 
 
-char *install_full_printf(InstallInfo *i, const char *format) {
+int install_full_printf(InstallInfo *i, const char *format, char **ret) {
 
         /* This is similar to unit_full_printf() but does not support
          * anything path-related.
@@ -108,6 +129,7 @@ char *install_full_printf(InstallInfo *i, const char *format) {
          * %m the machine ID of the running system
          * %H the host name of the running system
          * %b the boot ID of the running system
+         * %v `uname -r` of the running system
          */
 
         const Specifier table[] = {
@@ -122,11 +144,13 @@ char *install_full_printf(InstallInfo *i, const char *format) {
                 { 'm', specifier_machine_id,          NULL },
                 { 'H', specifier_host_name,           NULL },
                 { 'b', specifier_boot_id,             NULL },
-                { 0, NULL, NULL }
+                { 'v', specifier_kernel_release,      NULL },
+                {}
         };
 
         assert(i);
         assert(format);
+        assert(ret);
 
-        return specifier_printf(format, table, i);
+        return specifier_printf(format, table, i, ret);
 }
diff --git a/src/shared/install-printf.h b/src/shared/install-printf.h
index 46f5294d21..6ffa488b1b 100644
--- a/src/shared/install-printf.h
+++ b/src/shared/install-printf.h
@@ -22,4 +22,4 @@
 #pragma once
 
 #include "install.h"
-char *install_full_printf(InstallInfo *i, const char *format);
+int install_full_printf(InstallInfo *i, const char *format, char **ret);
diff --git a/src/shared/install.c b/src/shared/install.c
index edf4d2a9fe..9722ed4e1c 100644
--- a/src/shared/install.c
+++ b/src/shared/install.c
@@ -506,7 +506,7 @@ static int find_symlinks_in_scope(
                 UnitFileState *state) {
 
         int r;
-        _cleanup_free_ char *path = NULL;
+        _cleanup_free_ char *path2 = NULL;
         bool same_name_link_runtime = false, same_name_link = false;
 
         assert(scope >= 0);
@@ -514,6 +514,7 @@ static int find_symlinks_in_scope(
         assert(name);
 
         if (scope == UNIT_FILE_SYSTEM || scope == UNIT_FILE_GLOBAL) {
+                _cleanup_free_ char *path = NULL;
 
                 /* First look in runtime config path */
                 r = get_config_path(scope, true, root_dir, &path);
@@ -530,11 +531,11 @@ static int find_symlinks_in_scope(
         }
 
         /* Then look in the normal config path */
-        r = get_config_path(scope, false, root_dir, &path);
+        r = get_config_path(scope, false, root_dir, &path2);
         if (r < 0)
                 return r;
 
-        r = find_symlinks(name, path, &same_name_link);
+        r = find_symlinks(name, path2, &same_name_link);
         if (r < 0)
                 return r;
         else if (r > 0) {
@@ -966,14 +967,15 @@ static int config_parse_user(const char *unit,
 
         InstallInfo *i = data;
         char* printed;
+        int r;
 
         assert(filename);
         assert(lvalue);
         assert(rvalue);
 
-        printed = install_full_printf(i, rvalue);
-        if (!printed)
-                return -ENOMEM;
+        r = install_full_printf(i, rvalue, &printed);
+        if (r < 0)
+                return r;
 
         free(i->user);
         i->user = printed;
@@ -1061,8 +1063,8 @@ static int unit_file_search(
                         info->path = path;
                 else {
                         if (r == -ENOENT && unit_name_is_instance(info->name)) {
-                                /* unit file doesn't exist, however instance enablement was request */
-                                /* we will check if it is possible to load template unit file */
+                                /* Unit file doesn't exist, however instance enablement was requested.
+                                 * We will check if it is possible to load template unit file. */
                                 char *template = NULL,
                                      *template_path = NULL,
                                      *template_dir = NULL;
@@ -1073,7 +1075,7 @@ static int unit_file_search(
                                         return -ENOMEM;
                                 }
 
-                                /* we will reuse path variable since we don't need it anymore */
+                                /* We will reuse path variable since we don't need it anymore. */
                                 template_dir = path;
                                 *(strrchr(path, '/') + 1) = '\0';
 
@@ -1084,7 +1086,7 @@ static int unit_file_search(
                                         return -ENOMEM;
                                 }
 
-                                /* let's try to load template unit */
+                                /* Let's try to load template unit. */
                                 r = unit_file_load(c, info, template_path, allow_symlink);
                                 if (r >= 0) {
                                         info->path = strdup(template_path);
@@ -1199,9 +1201,9 @@ static int install_info_symlink_alias(
         STRV_FOREACH(s, i->aliases) {
                 _cleanup_free_ char *alias_path = NULL, *dst = NULL;
 
-                dst = install_full_printf(i, *s);
-                if (!dst)
-                        return -ENOMEM;
+                q = install_full_printf(i, *s, &dst);
+                if (q < 0)
+                        return q;
 
                 alias_path = path_make_absolute(dst, config_path);
                 if (!alias_path)
@@ -1231,9 +1233,9 @@ static int install_info_symlink_wants(
         STRV_FOREACH(s, i->wanted_by) {
                 _cleanup_free_ char *path = NULL, *dst = NULL;
 
-                dst = install_full_printf(i, *s);
-                if (!dst)
-                        return -ENOMEM;
+                q = install_full_printf(i, *s, &dst);
+                if (q < 0)
+                        return q;
 
                 if (!unit_name_is_valid(dst, true)) {
                         r = -EINVAL;
@@ -1268,9 +1270,9 @@ static int install_info_symlink_requires(
         STRV_FOREACH(s, i->required_by) {
                 _cleanup_free_ char *path = NULL, *dst = NULL;
 
-                dst = install_full_printf(i, *s);
-                if (!dst)
-                        return -ENOMEM;
+                q = install_full_printf(i, *s, &dst);
+                if (q < 0)
+                        return q;
 
                 if (!unit_name_is_valid(dst, true)) {
                         r = -EINVAL;
@@ -1413,7 +1415,9 @@ static int install_context_mark_for_removal(
                 assert_se(hashmap_move_one(c->have_installed, c->will_install, i->name) == 0);
 
                 q = unit_file_search(c, i, paths, root_dir, false);
-                if (q < 0) {
+                if (q == -ENOENT) {
+                        /* do nothing */
+                } else if (q < 0) {
                         if (r >= 0)
                                 r = q;
 
@@ -1422,16 +1426,30 @@ static int install_context_mark_for_removal(
                         r += q;
 
                 if (unit_name_is_instance(i->name)) {
-                        char *unit_file = NULL;
+                        char *unit_file;
+
+                        if (i->path) {
+                                unit_file = path_get_file_name(i->path);
+
+                                if (unit_name_is_instance(unit_file))
+                                        /* unit file named as instance exists, thus all symlinks
+                                         * pointing to it will be removed */
+                                        q = mark_symlink_for_removal(remove_symlinks_to, i->name);
+                                else
+                                        /* does not exist, thus we will mark for removal symlinks
+                                         * to template unit file */
+                                        q = mark_symlink_for_removal(remove_symlinks_to, unit_file);
+                        } else {
+                                /* If i->path is not set, it means that we didn't actually find
+                                 * the unit file. But we can still remove symlinks to the
+                                 * nonexistent template. */
+                                unit_file = unit_name_template(i->name);
+                                if (!unit_file)
+                                        return log_oom();
 
-                        unit_file = path_get_file_name(i->path);
-
-                        if (unit_name_is_instance(unit_file))
-                                /* unit file named as instance exists, thus all symlinks pointing to it, will be removed */
-                                q = mark_symlink_for_removal(remove_symlinks_to, i->name);
-                        else
-                                /* does not exist, thus we will mark for removal symlinks to template unit file */
                                 q = mark_symlink_for_removal(remove_symlinks_to, unit_file);
+                                free(unit_file);
+                        }
                 } else
                         q = mark_symlink_for_removal(remove_symlinks_to, i->name);
 
@@ -1531,43 +1549,101 @@ int unit_file_reenable(
                 bool force,
                 UnitFileChange **changes,
                 unsigned *n_changes) {
+        int r;
+
+        r = unit_file_disable(scope, runtime, root_dir, files,
+                              changes, n_changes);
+        if (r < 0)
+                return r;
+
+        return unit_file_enable(scope, runtime, root_dir, files, force,
+                                changes, n_changes);
+}
+
+int unit_file_set_default(
+                UnitFileScope scope,
+                const char *root_dir,
+                char *file,
+                UnitFileChange **changes,
+                unsigned *n_changes) {
 
         _cleanup_lookup_paths_free_ LookupPaths paths = {};
         _cleanup_install_context_done_ InstallContext c = {};
-        char **i;
         _cleanup_free_ char *config_path = NULL;
-        _cleanup_set_free_free_ Set *remove_symlinks_to = NULL;
-        int r, q;
+        char *path;
+        int r;
+        InstallInfo *i = NULL;
 
         assert(scope >= 0);
         assert(scope < _UNIT_FILE_SCOPE_MAX);
 
+        if (unit_name_to_type(file) != UNIT_TARGET)
+                return -EINVAL;
+
         r = lookup_paths_init_from_scope(&paths, scope);
         if (r < 0)
                 return r;
 
-        r = get_config_path(scope, runtime, root_dir, &config_path);
+        r = get_config_path(scope, false, root_dir, &config_path);
         if (r < 0)
                 return r;
 
-        STRV_FOREACH(i, files) {
-                r = mark_symlink_for_removal(&remove_symlinks_to, *i);
-                if (r < 0)
-                        return r;
+        r = install_info_add_auto(&c, file);
+        if (r < 0)
+                return r;
 
-                r = install_info_add_auto(&c, *i);
-                if (r < 0)
+        i = (InstallInfo*)hashmap_first(c.will_install);
+
+        r = unit_file_search(&c, i, &paths, root_dir, false);
+        if (r < 0)
+                return r;
+
+        path = strappenda(config_path, "/default.target");
+        r = create_symlink(i->path, path, true, changes, n_changes);
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
+int unit_file_get_default(
+                UnitFileScope scope,
+                const char *root_dir,
+                char **name) {
+
+        _cleanup_lookup_paths_free_ LookupPaths paths = {};
+        char **p;
+        int r;
+
+        r = lookup_paths_init_from_scope(&paths, scope);
+        if (r < 0)
+                return r;
+
+        STRV_FOREACH(p, paths.unit_path) {
+                _cleanup_free_ char *path = NULL, *tmp = NULL;
+
+                if (isempty(root_dir))
+                        path = strappend(*p, "/default.target");
+                else
+                        path = strjoin(root_dir, "/", *p, "/default.target", NULL);
+
+                if (!path)
+                        return -ENOMEM;
+
+                r = readlink_malloc(path, &tmp);
+                if (r == -ENOENT)
+                        continue;
+                else if (r < 0)
                         return r;
-        }
 
-        r = remove_marked_symlinks(remove_symlinks_to, config_path, changes, n_changes, files);
+                *name = strdup(path_get_file_name(tmp));
+                if (!*name)
+                        return -ENOMEM;
 
-        /* Returns number of symlinks that where supposed to be installed. */
-        q = install_context_apply(&c, &paths, config_path, root_dir, force, changes, n_changes);
-        if (r == 0)
-                r = q;
+                return 0;
+        }
 
-        return r;
+        return -ENOENT;
 }
 
 UnitFileState unit_file_get_state(
@@ -1609,24 +1685,29 @@ UnitFileState unit_file_get_state(
                 if (!path)
                         return -ENOMEM;
 
+                /*
+                 * Search for a unit file in our default paths, to
+                 * be sure, that there are no broken symlinks.
+                 */
                 if (lstat(path, &st) < 0) {
                         r = -errno;
-                        if (errno == ENOENT)
-                                continue;
-
-                        return -errno;
-                }
+                        if (errno != ENOENT)
+                                return r;
 
-                if (!S_ISREG(st.st_mode) && !S_ISLNK(st.st_mode))
-                        return -ENOENT;
+                        if (!unit_name_is_instance(name))
+                                continue;
+                } else {
+                        if (!S_ISREG(st.st_mode) && !S_ISLNK(st.st_mode))
+                                return -ENOENT;
 
-                r = null_or_empty_path(path);
-                if (r < 0 && r != -ENOENT)
-                        return r;
-                else if (r > 0) {
-                        state = path_startswith(*i, "/run") ?
-                                UNIT_FILE_MASKED_RUNTIME : UNIT_FILE_MASKED;
-                        return state;
+                        r = null_or_empty_path(path);
+                        if (r < 0 && r != -ENOENT)
+                                return r;
+                        else if (r > 0) {
+                                state = path_startswith(*i, "/run") ?
+                                        UNIT_FILE_MASKED_RUNTIME : UNIT_FILE_MASKED;
+                                return state;
+                        }
                 }
 
                 r = find_symlinks_in_scope(scope, root_dir, name, &state);
diff --git a/src/shared/install.h b/src/shared/install.h
index 94516c9d05..5609d1e8df 100644
--- a/src/shared/install.h
+++ b/src/shared/install.h
@@ -80,6 +80,8 @@ int unit_file_link(UnitFileScope scope, bool runtime, const char *root_dir, char
 int unit_file_preset(UnitFileScope scope, bool runtime, const char *root_dir, char *files[], bool force, UnitFileChange **changes, unsigned *n_changes);
 int unit_file_mask(UnitFileScope scope, bool runtime, const char *root_dir, char *files[], bool force, UnitFileChange **changes, unsigned *n_changes);
 int unit_file_unmask(UnitFileScope scope, bool runtime, const char *root_dir, char *files[], UnitFileChange **changes, unsigned *n_changes);
+int unit_file_set_default(UnitFileScope scope, const char *root_dir, char *file, UnitFileChange **changes, unsigned *n_changes);
+int unit_file_get_default(UnitFileScope scope, const char *root_dir, char **name);
 
 UnitFileState unit_file_get_state(UnitFileScope scope, const char *root_dir, const char *filename);
 
diff --git a/src/shared/label.c b/src/shared/label.c
index 1fe4574633..fde39f2259 100644
--- a/src/shared/label.c
+++ b/src/shared/label.c
@@ -257,14 +257,14 @@ void label_free(const char *label) {
 #endif
 }
 
-int label_mkdir(const char *path, mode_t mode, bool apply) {
+int label_mkdir(const char *path, mode_t mode) {
 
         /* Creates a directory and labels it according to the SELinux policy */
 #ifdef HAVE_SELINUX
         int r;
         security_context_t fcon = NULL;
 
-        if (!apply || !use_selinux() || !label_hnd)
+        if (!use_selinux() || !label_hnd)
                 goto skipped;
 
         if (path_is_absolute(path))
diff --git a/src/shared/label.h b/src/shared/label.h
index dda4d1c024..09e15e3c08 100644
--- a/src/shared/label.h
+++ b/src/shared/label.h
@@ -40,7 +40,7 @@ void label_free(const char *label);
 
 int label_get_create_label_from_exe(const char *exe, char **label);
 
-int label_mkdir(const char *path, mode_t mode, bool apply);
+int label_mkdir(const char *path, mode_t mode);
 
 void label_retest_selinux(void);
 
diff --git a/src/shared/list.h b/src/shared/list.h
index 47f275a019..476757460a 100644
--- a/src/shared/list.h
+++ b/src/shared/list.h
@@ -81,7 +81,7 @@
                 (head) = _item;                                         \
         } while (false)
 
-/* Find the head of the list */
+/* Find the tail of the list */
 #define LIST_FIND_TAIL(t,name,item,tail)                                \
         do {                                                            \
                 t *_item = (item);                                      \
@@ -123,3 +123,10 @@
 
 #define LIST_FOREACH_AFTER(name,i,p)                                    \
         for ((i) = (p)->name##_next; (i); (i) = (i)->name##_next)
+
+/* Loop starting from p->next until p->prev.
+   p can be adjusted meanwhile. */
+#define LIST_LOOP_BUT_ONE(name,i,head,p)                                \
+        for ((i) = (p)->name##_next ? (p)->name##_next : (head);        \
+             (i) != (p);                                                \
+             (i) = (i)->name##_next ? (i)->name##_next : (head))
diff --git a/src/shared/log.c b/src/shared/log.c
index 27317f7ed3..8f4995a0c8 100644
--- a/src/shared/log.c
+++ b/src/shared/log.c
@@ -115,16 +115,20 @@ void log_close_syslog(void) {
 
 static int create_log_socket(int type) {
         int fd;
+        struct timeval tv;
 
-        /* All output to the syslog/journal fds we do asynchronously,
-         * and if the buffers are full we just drop the messages */
-
-        fd = socket(AF_UNIX, type|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
+        fd = socket(AF_UNIX, type|SOCK_CLOEXEC, 0);
         if (fd < 0)
                 return -errno;
 
         fd_inc_sndbuf(fd, SNDBUF_SIZE);
 
+        /* We need a blocking fd here since we'd otherwise lose
+        messages way too early. However, let's not hang forever in the
+        unlikely case of a deadlock. */
+        timeval_store(&tv, 1*USEC_PER_MINUTE);
+        setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+
         return fd;
 }
 
diff --git a/src/shared/logs-show.c b/src/shared/logs-show.c
index 116dc8a36c..7bb19b4006 100644
--- a/src/shared/logs-show.c
+++ b/src/shared/logs-show.c
@@ -32,7 +32,11 @@
 #include "hashmap.h"
 #include "journal-internal.h"
 
-#define PRINT_THRESHOLD 128
+/* up to three lines (each up to 100 characters),
+   or 300 characters, whichever is less */
+#define PRINT_LINE_THRESHOLD 3
+#define PRINT_CHAR_THRESHOLD 300
+
 #define JSON_THRESHOLD 4096
 
 static int print_catalog(FILE *f, sd_journal *j) {
@@ -92,15 +96,91 @@ static bool shall_print(const char *p, size_t l, OutputFlags flags) {
         if (flags & OUTPUT_SHOW_ALL)
                 return true;
 
-        if (l >= PRINT_THRESHOLD)
+        if (l >= PRINT_CHAR_THRESHOLD)
                 return false;
 
-        if (!utf8_is_printable_n(p, l))
+        if (!utf8_is_printable(p, l))
                 return false;
 
         return true;
 }
 
+static bool print_multiline(FILE *f, unsigned prefix, unsigned n_columns, OutputFlags flags, int priority, const char* message, size_t message_len) {
+        const char *color_on = "", *color_off = "";
+        const char *pos, *end;
+        bool ellipsized = false;
+        int line = 0;
+
+        if (flags & OUTPUT_COLOR) {
+                if (priority <= LOG_ERR) {
+                        color_on = ANSI_HIGHLIGHT_RED_ON;
+                        color_off = ANSI_HIGHLIGHT_OFF;
+                } else if (priority <= LOG_NOTICE) {
+                        color_on = ANSI_HIGHLIGHT_ON;
+                        color_off = ANSI_HIGHLIGHT_OFF;
+                }
+        }
+
+        for (pos = message;
+             pos < message + message_len;
+             pos = end + 1, line++) {
+                bool continuation = line > 0;
+                bool tail_line;
+                int len;
+                for (end = pos; end < message + message_len && *end != '\n'; end++)
+                        ;
+                len = end - pos;
+                assert(len >= 0);
+
+                /* We need to figure out when we are showing not-last line, *and*
+                 * will skip subsequent lines. In that case, we will put the dots
+                 * at the end of the line, instead of putting dots in the middle
+                 * or not at all.
+                 */
+                tail_line =
+                        line + 1 == PRINT_LINE_THRESHOLD ||
+                        end + 1 >= message + PRINT_CHAR_THRESHOLD;
+
+                if (flags & (OUTPUT_FULL_WIDTH | OUTPUT_SHOW_ALL) ||
+                    (prefix + len + 1 < n_columns && !tail_line)) {
+                        fprintf(f, "%*s%s%.*s%s\n",
+                                continuation * prefix, "",
+                                color_on, len, pos, color_off);
+                        continue;
+                }
+
+                /* Beyond this point, ellipsization will happen. */
+                ellipsized = true;
+
+                if (prefix < n_columns && n_columns - prefix >= 3) {
+                        if (n_columns - prefix > (unsigned) len + 3)
+                                fprintf(f, "%*s%s%.*s...%s\n",
+                                        continuation * prefix, "",
+                                        color_on, len, pos, color_off);
+                        else {
+                                _cleanup_free_ char *e;
+
+                                e = ellipsize_mem(pos, len, n_columns - prefix,
+                                                  tail_line ? 100 : 90);
+                                if (!e)
+                                        fprintf(f, "%*s%s%.*s%s\n",
+                                                continuation * prefix, "",
+                                                color_on, len, pos, color_off);
+                                else
+                                        fprintf(f, "%*s%s%s%s\n",
+                                                continuation * prefix, "",
+                                                color_on, e, color_off);
+                        }
+                } else
+                        fputs("...\n", f);
+
+                if (tail_line)
+                        break;
+        }
+
+        return ellipsized;
+}
+
 static int output_short(
                 FILE *f,
                 sd_journal *j,
@@ -115,14 +195,20 @@ static int output_short(
         _cleanup_free_ char *hostname = NULL, *identifier = NULL, *comm = NULL, *pid = NULL, *fake_pid = NULL, *message = NULL, *realtime = NULL, *monotonic = NULL, *priority = NULL;
         size_t hostname_len = 0, identifier_len = 0, comm_len = 0, pid_len = 0, fake_pid_len = 0, message_len = 0, realtime_len = 0, monotonic_len = 0, priority_len = 0;
         int p = LOG_INFO;
-        const char *color_on = "", *color_off = "";
+        bool ellipsized = false;
 
         assert(f);
         assert(j);
 
-        sd_journal_set_data_threshold(j, flags & OUTPUT_SHOW_ALL ? 0 : PRINT_THRESHOLD);
+        /* Set the threshold to one bigger than the actual print
+         * threshold, so that if the line is actually longer than what
+         * we're willing to print, ellipsization will occur. This way
+         * we won't output a misleading line without any indication of
+         * truncation.
+         */
+        sd_journal_set_data_threshold(j, flags & (OUTPUT_SHOW_ALL|OUTPUT_FULL_WIDTH) ? 0 : PRINT_CHAR_THRESHOLD + 1);
 
-        SD_JOURNAL_FOREACH_DATA(j, data, length) {
+        JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 
                 r = parse_field(data, length, "PRIORITY=", &priority, &priority_len);
                 if (r < 0)
@@ -177,6 +263,9 @@ static int output_short(
                         return r;
         }
 
+        if (r < 0)
+                return r;
+
         if (!message)
                 return 0;
 
@@ -199,7 +288,7 @@ static int output_short(
                         r = sd_journal_get_monotonic_usec(j, &t, &boot_id);
 
                 if (r < 0) {
-                        log_error("Failed to get monotonic: %s", strerror(-r));
+                        log_error("Failed to get monotonic timestamp: %s", strerror(-r));
                         return r;
                 }
 
@@ -224,14 +313,30 @@ static int output_short(
                         r = sd_journal_get_realtime_usec(j, &x);
 
                 if (r < 0) {
-                        log_error("Failed to get realtime: %s", strerror(-r));
+                        log_error("Failed to get realtime timestamp: %s", strerror(-r));
                         return r;
                 }
 
                 t = (time_t) (x / USEC_PER_SEC);
-                if (strftime(buf, sizeof(buf), "%b %d %H:%M:%S", localtime_r(&t, &tm)) <= 0) {
+
+                switch(mode) {
+                case OUTPUT_SHORT_ISO:
+                        r = strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S%z", localtime_r(&t, &tm));
+                        break;
+                case OUTPUT_SHORT_PRECISE:
+                        r = strftime(buf, sizeof(buf), "%b %d %H:%M:%S", localtime_r(&t, &tm));
+                        if (r > 0) {
+                                snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
+                                         ".%06llu", x % USEC_PER_SEC);
+                        }
+                        break;
+                default:
+                        r = strftime(buf, sizeof(buf), "%b %d %H:%M:%S", localtime_r(&t, &tm));
+                }
+
+                if (r <= 0) {
                         log_error("Failed to format time.");
-                        return r;
+                        return -EINVAL;
                 }
 
                 fputs(buf, f);
@@ -260,39 +365,19 @@ static int output_short(
                 n += fake_pid_len + 2;
         }
 
-        if (flags & OUTPUT_COLOR) {
-                if (p <= LOG_ERR) {
-                        color_on = ANSI_HIGHLIGHT_RED_ON;
-                        color_off = ANSI_HIGHLIGHT_OFF;
-                } else if (p <= LOG_NOTICE) {
-                        color_on = ANSI_HIGHLIGHT_ON;
-                        color_off = ANSI_HIGHLIGHT_OFF;
-                }
-        }
-
-        if (flags & OUTPUT_SHOW_ALL)
-                fprintf(f, ": %s%.*s%s\n", color_on, (int) message_len, message, color_off);
-        else if (!utf8_is_printable_n(message, message_len)) {
+        if (!(flags & OUTPUT_SHOW_ALL) && !utf8_is_printable(message, message_len)) {
                 char bytes[FORMAT_BYTES_MAX];
                 fprintf(f, ": [%s blob data]\n", format_bytes(bytes, sizeof(bytes), message_len));
-        } else if ((flags & OUTPUT_FULL_WIDTH) || (message_len + n + 1 < n_columns))
-                fprintf(f, ": %s%.*s%s\n", color_on, (int) message_len, message, color_off);
-        else if (n < n_columns && n_columns - n - 2 >= 3) {
-                _cleanup_free_ char *e;
-
-                e = ellipsize_mem(message, message_len, n_columns - n - 2, 90);
-
-                if (!e)
-                        fprintf(f, ": %s%.*s%s\n", color_on, (int) message_len, message, color_off);
-                else
-                        fprintf(f, ": %s%s%s\n", color_on, e, color_off);
-        } else
-                fputs("\n", f);
+        } else {
+                fputs(": ", f);
+                ellipsized |=
+                        print_multiline(f, n + 2, n_columns, flags, p, message, message_len);
+        }
 
         if (flags & OUTPUT_CATALOG)
                 print_catalog(f, j);
 
-        return 0;
+        return ellipsized;
 }
 
 static int output_verbose(
@@ -306,7 +391,7 @@ static int output_verbose(
         size_t length;
         _cleanup_free_ char *cursor = NULL;
         uint64_t realtime;
-        char ts[FORMAT_TIMESTAMP_MAX];
+        char ts[FORMAT_TIMESTAMP_MAX + 7];
         int r;
 
         assert(f);
@@ -314,10 +399,35 @@ static int output_verbose(
 
         sd_journal_set_data_threshold(j, 0);
 
-        r = sd_journal_get_realtime_usec(j, &realtime);
-        if (r < 0) {
-                log_error("Failed to get realtime timestamp: %s", strerror(-r));
+        r = sd_journal_get_data(j, "_SOURCE_REALTIME_TIMESTAMP", &data, &length);
+        if (r == -ENOENT)
+                log_debug("Source realtime timestamp not found");
+        else if (r < 0) {
+                log_full(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR,
+                         "Failed to get source realtime timestamp: %s", strerror(-r));
                 return r;
+        } else {
+                _cleanup_free_ char *value = NULL;
+                size_t size;
+
+                r = parse_field(data, length, "_SOURCE_REALTIME_TIMESTAMP=", &value, &size);
+                if (r < 0)
+                        log_debug("_SOURCE_REALTIME_TIMESTAMP invalid: %s", strerror(-r));
+                else {
+                        r = safe_atou64(value, &realtime);
+                        if (r < 0)
+                                log_debug("Failed to parse realtime timestamp: %s",
+                                          strerror(-r));
+                }
+        }
+
+        if (r < 0) {
+                r = sd_journal_get_realtime_usec(j, &realtime);
+                if (r < 0) {
+                        log_full(r == -EADDRNOTAVAIL ? LOG_DEBUG : LOG_ERR,
+                                 "Failed to get realtime timestamp: %s", strerror(-r));
+                        return r;
+                }
         }
 
         r = sd_journal_get_cursor(j, &cursor);
@@ -327,28 +437,47 @@ static int output_verbose(
         }
 
         fprintf(f, "%s [%s]\n",
-                format_timestamp(ts, sizeof(ts), realtime),
+                format_timestamp_us(ts, sizeof(ts), realtime),
                 cursor);
 
-        SD_JOURNAL_FOREACH_DATA(j, data, length) {
-                if (!shall_print(data, length, flags)) {
-                        const char *c;
-                        char bytes[FORMAT_BYTES_MAX];
+        JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
+                const char *c;
+                int fieldlen;
+                const char *on = "", *off = "";
 
-                        c = memchr(data, '=', length);
-                        if (!c) {
-                                log_error("Invalid field.");
-                                return -EINVAL;
-                        }
+                c = memchr(data, '=', length);
+                if (!c) {
+                        log_error("Invalid field.");
+                        return -EINVAL;
+                }
+                fieldlen = c - (const char*) data;
 
-                        fprintf(f, "\t%.*s=[%s blob data]\n",
-                               (int) (c - (const char*) data),
-                               (const char*) data,
-                               format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1));
-                } else
-                        fprintf(f, "\t%.*s\n", (int) length, (const char*) data);
+                if (flags & OUTPUT_COLOR && startswith(data, "MESSAGE=")) {
+                        on = ANSI_HIGHLIGHT_ON;
+                        off = ANSI_HIGHLIGHT_OFF;
+                }
+
+                if (flags & OUTPUT_SHOW_ALL ||
+                    (((length < PRINT_CHAR_THRESHOLD) || flags & OUTPUT_FULL_WIDTH)
+                     && utf8_is_printable(data, length))) {
+                        fprintf(f, "    %s%.*s=", on, fieldlen, (const char*)data);
+                        print_multiline(f, 4 + fieldlen + 1, 0, OUTPUT_FULL_WIDTH, 0, c + 1, length - fieldlen - 1);
+                        fputs(off, f);
+                } else {
+                        char bytes[FORMAT_BYTES_MAX];
+
+                        fprintf(f, "    %s%.*s=[%s blob data]%s\n",
+                                on,
+                                (int) (c - (const char*) data),
+                                (const char*) data,
+                                format_bytes(bytes, sizeof(bytes), length - (c - (const char *) data) - 1),
+                                off);
+                }
         }
 
+        if (r < 0)
+                return r;
+
         if (flags & OUTPUT_CATALOG)
                 print_catalog(f, j);
 
@@ -402,15 +531,15 @@ static int output_export(
                 (unsigned long long) monotonic,
                 sd_id128_to_string(boot_id, sid));
 
-        SD_JOURNAL_FOREACH_DATA(j, data, length) {
+        JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
 
                 /* We already printed the boot id, from the data in
                  * the header, hence let's suppress it here */
                 if (length >= 9 &&
-                    memcmp(data, "_BOOT_ID=", 9) == 0)
+                    startswith(data, "_BOOT_ID="))
                         continue;
 
-                if (!utf8_is_printable_n(data, length)) {
+                if (!utf8_is_printable(data, length)) {
                         const char *c;
                         uint64_t le64;
 
@@ -431,6 +560,9 @@ static int output_export(
                 fputc('\n', f);
         }
 
+        if (r < 0)
+                return r;
+
         fputc('\n', f);
 
         return 0;
@@ -449,7 +581,7 @@ void json_escape(
 
                 fputs("null", f);
 
-        else if (!utf8_is_printable_n(p, l)) {
+        else if (!utf8_is_printable(p, l)) {
                 bool not_first = false;
 
                 fputs("[ ", f);
@@ -474,7 +606,9 @@ void json_escape(
                         if (*p == '"' || *p == '\\') {
                                 fputc('\\', f);
                                 fputc(*p, f);
-                        } else if (*p < ' ')
+                        } else if (*p == '\n')
+                                fputs("\\n", f);
+                        else if (*p < ' ')
                                 fprintf(f, "\\u%04x", *p);
                         else
                                 fputc(*p, f);
@@ -557,7 +691,7 @@ static int output_json(
                 return -ENOMEM;
 
         /* First round, iterate through the entry and count how often each field appears */
-        SD_JOURNAL_FOREACH_DATA(j, data, length) {
+        JOURNAL_FOREACH_DATA_RETVAL(j, data, length, r) {
                 const char *eq;
                 char *n;
                 unsigned u;
@@ -591,6 +725,9 @@ static int output_json(
                 }
         }
 
+        if (r < 0)
+                return r;
+
         separator = true;
         do {
                 done = true;
@@ -747,6 +884,8 @@ static int (*output_funcs[_OUTPUT_MODE_MAX])(
                 OutputFlags flags) = {
 
         [OUTPUT_SHORT] = output_short,
+        [OUTPUT_SHORT_ISO] = output_short,
+        [OUTPUT_SHORT_PRECISE] = output_short,
         [OUTPUT_SHORT_MONOTONIC] = output_short,
         [OUTPUT_VERBOSE] = output_verbose,
         [OUTPUT_EXPORT] = output_export,
@@ -761,7 +900,8 @@ int output_journal(
                 sd_journal *j,
                 OutputMode mode,
                 unsigned n_columns,
-                OutputFlags flags) {
+                OutputFlags flags,
+                bool *ellipsized) {
 
         int ret;
         assert(mode >= 0);
@@ -772,6 +912,10 @@ int output_journal(
 
         ret = output_funcs[mode](f, j, mode, n_columns, flags);
         fflush(stdout);
+
+        if (ellipsized && ret > 0)
+                *ellipsized = true;
+
         return ret;
 }
 
@@ -781,7 +925,8 @@ static int show_journal(FILE *f,
                         unsigned n_columns,
                         usec_t not_before,
                         unsigned how_many,
-                        OutputFlags flags) {
+                        OutputFlags flags,
+                        bool *ellipsized) {
 
         int r;
         unsigned line = 0;
@@ -832,7 +977,7 @@ static int show_journal(FILE *f,
 
                         line ++;
 
-                        r = output_journal(f, j, mode, n_columns, flags);
+                        r = output_journal(f, j, mode, n_columns, flags, ellipsized);
                         if (r < 0)
                                 goto finish;
                 }
@@ -872,15 +1017,15 @@ finish:
 
 int add_matches_for_unit(sd_journal *j, const char *unit) {
         int r;
-        _cleanup_free_ char *m1 = NULL, *m2 = NULL, *m3 = NULL;
+        char *m1, *m2, *m3, *m4;
 
         assert(j);
         assert(unit);
 
-        if (asprintf(&m1, "_SYSTEMD_UNIT=%s", unit) < 0 ||
-            asprintf(&m2, "COREDUMP_UNIT=%s", unit) < 0 ||
-            asprintf(&m3, "UNIT=%s", unit) < 0)
-                return -ENOMEM;
+        m1 = strappenda("_SYSTEMD_UNIT=", unit);
+        m2 = strappenda("COREDUMP_UNIT=", unit);
+        m3 = strappenda("UNIT=", unit);
+        m4 = strappenda("OBJECT_SYSTEMD_UNIT=", unit);
 
         (void)(
             /* Look for messages from the service itself */
@@ -888,49 +1033,112 @@ int add_matches_for_unit(sd_journal *j, const char *unit) {
 
             /* Look for coredumps of the service */
             (r = sd_journal_add_disjunction(j)) ||
-            (r = sd_journal_add_match(j,
-                        "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
+            (r = sd_journal_add_match(j, "MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1", 0)) ||
+            (r = sd_journal_add_match(j, "_UID=0", 0)) ||
             (r = sd_journal_add_match(j, m2, 0)) ||
 
              /* Look for messages from PID 1 about this service */
             (r = sd_journal_add_disjunction(j)) ||
             (r = sd_journal_add_match(j, "_PID=1", 0)) ||
-            (r = sd_journal_add_match(j, m3, 0))
+            (r = sd_journal_add_match(j, m3, 0)) ||
+
+            /* Look for messages from authorized daemons about this service */
+            (r = sd_journal_add_disjunction(j)) ||
+            (r = sd_journal_add_match(j, "_UID=0", 0)) ||
+            (r = sd_journal_add_match(j, m4, 0))
         );
+
+        if (r == 0 && endswith(unit, ".slice")) {
+                char *m5 = strappend("_SYSTEMD_SLICE=", unit);
+
+                /* Show all messages belonging to a slice */
+                (void)(
+                        (r = sd_journal_add_disjunction(j)) ||
+                        (r = sd_journal_add_match(j, m5, 0))
+                        );
+        }
+
         return r;
 }
 
 int add_matches_for_user_unit(sd_journal *j, const char *unit, uid_t uid) {
         int r;
-        _cleanup_free_ char *m1 = NULL, *m2 = NULL, *m3 = NULL, *m4 = NULL;
+        char *m1, *m2, *m3, *m4;
+        char muid[sizeof("_UID=") + DECIMAL_STR_MAX(uid_t)];
 
         assert(j);
         assert(unit);
 
-        if (asprintf(&m1, "_SYSTEMD_USER_UNIT=%s", unit) < 0 ||
-            asprintf(&m2, "USER_UNIT=%s", unit) < 0 ||
-            asprintf(&m3, "COREDUMP_USER_UNIT=%s", unit) < 0 ||
-            asprintf(&m4, "_UID=%d", uid) < 0)
-                return -ENOMEM;
+        m1 = strappenda("_SYSTEMD_USER_UNIT=", unit);
+        m2 = strappenda("USER_UNIT=", unit);
+        m3 = strappenda("COREDUMP_USER_UNIT=", unit);
+        m4 = strappenda("OBJECT_SYSTEMD_USER_UNIT=", unit);
+        sprintf(muid, "_UID=%lu", (unsigned long) uid);
 
         (void) (
                 /* Look for messages from the user service itself */
                 (r = sd_journal_add_match(j, m1, 0)) ||
-                (r = sd_journal_add_match(j, m4, 0)) ||
+                (r = sd_journal_add_match(j, muid, 0)) ||
 
                 /* Look for messages from systemd about this service */
                 (r = sd_journal_add_disjunction(j)) ||
                 (r = sd_journal_add_match(j, m2, 0)) ||
-                (r = sd_journal_add_match(j, m4, 0)) ||
+                (r = sd_journal_add_match(j, muid, 0)) ||
 
                 /* Look for coredumps of the service */
                 (r = sd_journal_add_disjunction(j)) ||
                 (r = sd_journal_add_match(j, m3, 0)) ||
-                (r = sd_journal_add_match(j, m4, 0))
+                (r = sd_journal_add_match(j, muid, 0)) ||
+                (r = sd_journal_add_match(j, "_UID=0", 0)) ||
+
+                /* Look for messages from authorized daemons about this service */
+                (r = sd_journal_add_disjunction(j)) ||
+                (r = sd_journal_add_match(j, m4, 0)) ||
+                (r = sd_journal_add_match(j, muid, 0)) ||
+                (r = sd_journal_add_match(j, "_UID=0", 0))
         );
+
+        if (r == 0 && endswith(unit, ".slice")) {
+                char *m5 = strappend("_SYSTEMD_SLICE=", unit);
+
+                /* Show all messages belonging to a slice */
+                (void)(
+                        (r = sd_journal_add_disjunction(j)) ||
+                        (r = sd_journal_add_match(j, m5, 0)) ||
+                        (r = sd_journal_add_match(j, muid, 0))
+                        );
+        }
+
         return r;
 }
 
+int add_match_this_boot(sd_journal *j) {
+        char match[9+32+1] = "_BOOT_ID=";
+        sd_id128_t boot_id;
+        int r;
+
+        assert(j);
+
+        r = sd_id128_get_boot(&boot_id);
+        if (r < 0) {
+                log_error("Failed to get boot id: %s", strerror(-r));
+                return r;
+        }
+
+        sd_id128_to_string(boot_id, match + 9);
+        r = sd_journal_add_match(j, match, strlen(match));
+        if (r < 0) {
+                log_error("Failed to add match: %s", strerror(-r));
+                return r;
+        }
+
+        r = sd_journal_add_conjunction(j);
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
 int show_journal_by_unit(
                 FILE *f,
                 const char *unit,
@@ -940,11 +1148,12 @@ int show_journal_by_unit(
                 unsigned how_many,
                 uid_t uid,
                 OutputFlags flags,
-                bool system) {
+                bool system,
+                bool *ellipsized) {
 
         _cleanup_journal_close_ sd_journal*j = NULL;
         int r;
-        int jflags = SD_JOURNAL_LOCAL_ONLY | system * SD_JOURNAL_SYSTEM_ONLY;
+        int jflags = SD_JOURNAL_LOCAL_ONLY | system * SD_JOURNAL_SYSTEM;
 
         assert(mode >= 0);
         assert(mode < _OUTPUT_MODE_MAX);
@@ -957,6 +1166,10 @@ int show_journal_by_unit(
         if (r < 0)
                 return r;
 
+        r = add_match_this_boot(j);
+        if (r < 0)
+                return r;
+
         if (system)
                 r = add_matches_for_unit(j, unit);
         else
@@ -964,15 +1177,20 @@ int show_journal_by_unit(
         if (r < 0)
                 return r;
 
-        r = show_journal(f, j, mode, n_columns, not_before, how_many, flags);
-        if (r < 0)
-                return r;
+        if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
+                _cleanup_free_ char *filter;
 
-        return 0;
+                filter = journal_make_match_string(j);
+                log_debug("Journal filter: %s", filter);
+        }
+
+        return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
 }
 
 static const char *const output_mode_table[_OUTPUT_MODE_MAX] = {
         [OUTPUT_SHORT] = "short",
+        [OUTPUT_SHORT_ISO] = "short-iso",
+        [OUTPUT_SHORT_PRECISE] = "short-precise",
         [OUTPUT_SHORT_MONOTONIC] = "short-monotonic",
         [OUTPUT_VERBOSE] = "verbose",
         [OUTPUT_EXPORT] = "export",
diff --git a/src/shared/logs-show.h b/src/shared/logs-show.h
index b0f93a661a..11b3b59b7b 100644
--- a/src/shared/logs-show.h
+++ b/src/shared/logs-show.h
@@ -35,7 +35,10 @@ int output_journal(
                 sd_journal *j,
                 OutputMode mode,
                 unsigned n_columns,
-                OutputFlags flags);
+                OutputFlags flags,
+                bool *ellipsized);
+
+int add_match_this_boot(sd_journal *j);
 
 int add_matches_for_unit(
                 sd_journal *j,
@@ -55,7 +58,8 @@ int show_journal_by_unit(
                 unsigned how_many,
                 uid_t uid,
                 OutputFlags flags,
-                bool system);
+                bool system,
+                bool *ellipsized);
 
 void json_escape(
                 FILE *f,
diff --git a/src/shared/macro.h b/src/shared/macro.h
index 0874102ece..d4f92b60ec 100644
--- a/src/shared/macro.h
+++ b/src/shared/macro.h
@@ -159,23 +159,25 @@ static inline size_t ALIGN_TO(size_t l, size_t ali) {
         } while (false)
 #endif
 
+#define PTR_TO_INT(p) ((int) ((intptr_t) (p)))
+#define INT_TO_PTR(u) ((void *) ((intptr_t) (u)))
 #define PTR_TO_UINT(p) ((unsigned int) ((uintptr_t) (p)))
-#define UINT_TO_PTR(u) ((void*) ((uintptr_t) (u)))
-
-#define PTR_TO_UINT32(p) ((uint32_t) ((uintptr_t) (p)))
-#define UINT32_TO_PTR(u) ((void*) ((uintptr_t) (u)))
+#define UINT_TO_PTR(u) ((void *) ((uintptr_t) (u)))
 
+#define PTR_TO_LONG(p) ((long) ((intptr_t) (p)))
+#define LONG_TO_PTR(u) ((void *) ((intptr_t) (u)))
 #define PTR_TO_ULONG(p) ((unsigned long) ((uintptr_t) (p)))
-#define ULONG_TO_PTR(u) ((void*) ((uintptr_t) (u)))
+#define ULONG_TO_PTR(u) ((void *) ((uintptr_t) (u)))
 
-#define PTR_TO_INT(p) ((int) ((intptr_t) (p)))
-#define INT_TO_PTR(u) ((void*) ((intptr_t) (u)))
-
-#define TO_INT32(p) ((int32_t) ((intptr_t) (p)))
-#define INT32_TO_PTR(u) ((void*) ((intptr_t) (u)))
+#define PTR_TO_INT32(p) ((int32_t) ((intptr_t) (p)))
+#define INT32_TO_PTR(u) ((void *) ((intptr_t) (u)))
+#define PTR_TO_UINT32(p) ((uint32_t) ((uintptr_t) (p)))
+#define UINT32_TO_PTR(u) ((void *) ((uintptr_t) (u)))
 
-#define PTR_TO_LONG(p) ((long) ((intptr_t) (p)))
-#define LONG_TO_PTR(u) ((void*) ((intptr_t) (u)))
+#define PTR_TO_INT64(p) ((int64_t) ((intptr_t) (p)))
+#define INT64_TO_PTR(u) ((void *) ((intptr_t) (u)))
+#define PTR_TO_UINT64(p) ((uint64_t) ((uintptr_t) (p)))
+#define UINT64_TO_PTR(u) ((void *) ((uintptr_t) (u)))
 
 #define memzero(x,l) (memset((x), 0, (l)))
 #define zero(x) (memzero(&(x), sizeof(x)))
@@ -269,7 +271,7 @@ do {                                                                    \
   * the const magic to the type, otherwise the compiler warns about
   * signed/unsigned comparison, because the magic can be 32 bit unsigned.
  */
-#define F_TYPE_CMP(a, b) (a == (typeof(a)) b)
+#define F_TYPE_EQUAL(a, b) (a == (typeof(a)) b)
 
 
 /* Returns the number of chars needed to format variables of the
@@ -282,4 +284,7 @@ do {                                                                    \
             sizeof(type) <= 4 ? 10 :                                    \
             sizeof(type) <= 8 ? 20 : sizeof(int[-2*(sizeof(type) > 8)])))
 
+#define SET_FLAG(v, flag, b) \
+        (v) = (b) ? ((v) | (flag)) : ((v) & ~(flag))
+
 #include "log.h"
diff --git a/src/shared/missing.h b/src/shared/missing.h
index d4ba0d3dcf..6c038d9f08 100644
--- a/src/shared/missing.h
+++ b/src/shared/missing.h
@@ -29,6 +29,7 @@
 #include <stdlib.h>
 #include <unistd.h>
 #include <linux/oom.h>
+#include <linux/input.h>
 
 #ifdef HAVE_AUDIT
 #include <libaudit.h>
@@ -138,7 +139,8 @@ static inline int fanotify_init(unsigned int flags, unsigned int event_f_flags)
 #ifndef HAVE_FANOTIFY_MARK
 static inline int fanotify_mark(int fanotify_fd, unsigned int flags, uint64_t mask,
                                 int dfd, const char *pathname) {
-#if defined _MIPS_SIM && _MIPS_SIM == _MIPS_SIM_ABI32 || defined __powerpc__ && !defined __powerpc64__
+#if defined _MIPS_SIM && _MIPS_SIM == _MIPS_SIM_ABI32 || defined __powerpc__ && !defined __powerpc64__ \
+    || defined __arm__ && !defined __aarch64__
         union {
                 uint64_t _64;
                 uint32_t _32[2];
@@ -161,15 +163,55 @@ static inline int fanotify_mark(int fanotify_fd, unsigned int flags, uint64_t ma
 #define BTRFS_PATH_NAME_MAX 4087
 #endif
 
+#ifndef BTRFS_DEVICE_PATH_NAME_MAX
+#define BTRFS_DEVICE_PATH_NAME_MAX 1024
+#endif
+
+#ifndef BTRFS_FSID_SIZE
+#define BTRFS_FSID_SIZE 16
+#endif
+
+#ifndef BTRFS_UUID_SIZE
+#define BTRFS_UUID_SIZE 16
+#endif
+
+#ifndef HAVE_LINUX_BTRFS_H
 struct btrfs_ioctl_vol_args {
         int64_t fd;
         char name[BTRFS_PATH_NAME_MAX + 1];
 };
 
+struct btrfs_ioctl_dev_info_args {
+        uint64_t devid;                         /* in/out */
+        uint8_t uuid[BTRFS_UUID_SIZE];          /* in/out */
+        uint64_t bytes_used;                    /* out */
+        uint64_t total_bytes;                   /* out */
+        uint64_t unused[379];                   /* pad to 4k */
+        char path[BTRFS_DEVICE_PATH_NAME_MAX];  /* out */
+};
+
+struct btrfs_ioctl_fs_info_args {
+        uint64_t max_id;                        /* out */
+        uint64_t num_devices;                   /* out */
+        uint8_t fsid[BTRFS_FSID_SIZE];          /* out */
+        uint64_t reserved[124];                 /* pad to 1k */
+};
+#endif
+
 #ifndef BTRFS_IOC_DEFRAG
 #define BTRFS_IOC_DEFRAG _IOW(BTRFS_IOCTL_MAGIC, 2, struct btrfs_ioctl_vol_args)
 #endif
 
+#ifndef BTRFS_IOC_DEV_INFO
+#define BTRFS_IOC_DEV_INFO _IOWR(BTRFS_IOCTL_MAGIC, 30, \
+                                 struct btrfs_ioctl_dev_info_args)
+#endif
+
+#ifndef BTRFS_IOC_FS_INFO
+#define BTRFS_IOC_FS_INFO _IOR(BTRFS_IOCTL_MAGIC, 31, \
+                               struct btrfs_ioctl_fs_info_args)
+#endif
+
 #ifndef BTRFS_SUPER_MAGIC
 #define BTRFS_SUPER_MAGIC 0x9123683E
 #endif
@@ -265,3 +307,19 @@ static inline int name_to_handle_at(int fd, const char *name, struct file_handle
 #ifndef TFD_TIMER_CANCEL_ON_SET
 #define TFD_TIMER_CANCEL_ON_SET (1 << 1)
 #endif
+
+#ifndef SO_REUSEPORT
+#define SO_REUSEPORT 15
+#endif
+
+#ifndef EVIOCREVOKE
+#define EVIOCREVOKE _IOW('E', 0x91, int)
+#endif
+
+#ifndef DRM_IOCTL_SET_MASTER
+#define DRM_IOCTL_SET_MASTER _IO('d', 0x1e)
+#endif
+
+#ifndef DRM_IOCTL_DROP_MASTER
+#define DRM_IOCTL_DROP_MASTER _IO('d', 0x1f)
+#endif
diff --git a/src/shared/mkdir-label.c b/src/shared/mkdir-label.c
new file mode 100644
index 0000000000..4ee6251bcd
--- /dev/null
+++ b/src/shared/mkdir-label.c
@@ -0,0 +1,53 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+/***
+  This file is part of systemd.
+
+  Copyright 2010 Lennart Poettering
+  Copyright 2013 Kay Sievers
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <assert.h>
+#include <string.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#include "label.h"
+#include "util.h"
+#include "path-util.h"
+#include "mkdir.h"
+
+int mkdir_label(const char *path, mode_t mode) {
+        return label_mkdir(path, mode);
+}
+
+int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid) {
+        return mkdir_safe_internal(path, mode, uid, gid, label_mkdir);
+}
+
+int mkdir_parents_label(const char *path, mode_t mode) {
+        return mkdir_parents_internal(NULL, path, mode, label_mkdir);
+}
+
+int mkdir_parents_prefix_label(const char *prefix, const char *path, mode_t mode) {
+        return mkdir_parents_internal(prefix, path, mode, label_mkdir);
+}
+
+int mkdir_p_label(const char *path, mode_t mode) {
+        return mkdir_p_internal(NULL, path, mode, label_mkdir);
+}
diff --git a/src/shared/mkdir.c b/src/shared/mkdir.c
index 0e51b64f69..b7e5c6e67b 100644
--- a/src/shared/mkdir.c
+++ b/src/shared/mkdir.c
@@ -26,18 +26,15 @@
 #include <stdlib.h>
 #include <stdio.h>
 
-#include "mkdir.h"
 #include "label.h"
 #include "util.h"
+#include "path-util.h"
+#include "mkdir.h"
 
-int mkdir_label(const char *path, mode_t mode) {
-        return label_mkdir(path, mode, true);
-}
-
-static int makedir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid, bool apply) {
+int mkdir_safe_internal(const char *path, mode_t mode, uid_t uid, gid_t gid, mkdir_func_t _mkdir) {
         struct stat st;
 
-        if (label_mkdir(path, mode, apply) >= 0)
+        if (_mkdir(path, mode) >= 0)
                 if (chmod_and_chown(path, mode, uid, gid) < 0)
                         return -errno;
 
@@ -56,36 +53,46 @@ static int makedir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid, boo
 }
 
 int mkdir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid) {
-        return makedir_safe(path, mode, uid, gid, false);
+        return mkdir_safe_internal(path, mode, uid, gid, false);
 }
 
-int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid) {
-        return makedir_safe(path, mode, uid, gid, true);
+static int is_dir(const char* path) {
+        struct stat st;
+
+        if (stat(path, &st) < 0)
+                return -errno;
+
+        return S_ISDIR(st.st_mode);
 }
 
-static int makedir_parents(const char *path, mode_t mode, bool apply) {
-        struct stat st;
+int mkdir_parents_internal(const char *prefix, const char *path, mode_t mode, mkdir_func_t _mkdir) {
         const char *p, *e;
+        int r;
 
         assert(path);
 
+        if (prefix && !path_startswith(path, prefix))
+                return -ENOTDIR;
+
         /* return immediately if directory exists */
         e = strrchr(path, '/');
         if (!e)
                 return -EINVAL;
+
+        if (e == path)
+                return 0;
+
         p = strndupa(path, e - path);
-        if (stat(p, &st) >= 0) {
-                if ((st.st_mode & S_IFMT) == S_IFDIR)
-                        return 0;
-                else
-                        return -ENOTDIR;
-        }
+        r = is_dir(p);
+        if (r > 0)
+                return 0;
+        if (r == 0)
+                return -ENOTDIR;
 
         /* create every parent directory in the path, except the last component */
         p = path + strspn(path, "/");
         for (;;) {
-                int r;
-                char *t;
+                char t[strlen(path) + 1];
 
                 e = p + strcspn(p, "/");
                 p = e + strspn(e, "/");
@@ -95,43 +102,32 @@ static int makedir_parents(const char *path, mode_t mode, bool apply) {
                 if (*p == 0)
                         return 0;
 
-                t = strndup(path, e - path);
-                if (!t)
-                        return -ENOMEM;
+                memcpy(t, path, e - path);
+                t[e-path] = 0;
 
-                r = label_mkdir(t, mode, apply);
-                free(t);
+                if (prefix && path_startswith(prefix, t))
+                        continue;
 
+                r = _mkdir(t, mode);
                 if (r < 0 && errno != EEXIST)
                         return -errno;
         }
 }
 
 int mkdir_parents(const char *path, mode_t mode) {
-        return makedir_parents(path, mode, false);
-}
-
-int mkdir_parents_label(const char *path, mode_t mode) {
-        return makedir_parents(path, mode, true);
-}
-
-static int is_dir(const char* path) {
-        struct stat st;
-        if (stat(path, &st) < 0)
-                return -errno;
-        return S_ISDIR(st.st_mode);
+        return mkdir_parents_internal(NULL, path, mode, mkdir);
 }
 
-static int makedir_p(const char *path, mode_t mode, bool apply) {
+int mkdir_p_internal(const char *prefix, const char *path, mode_t mode, mkdir_func_t _mkdir) {
         int r;
 
         /* Like mkdir -p */
 
-        r = makedir_parents(path, mode, apply);
+        r = mkdir_parents_internal(prefix, path, mode, _mkdir);
         if (r < 0)
                 return r;
 
-        r = label_mkdir(path, mode, apply);
+        r = _mkdir(path, mode);
         if (r < 0 && (errno != EEXIST || is_dir(path) <= 0))
                 return -errno;
 
@@ -139,9 +135,9 @@ static int makedir_p(const char *path, mode_t mode, bool apply) {
 }
 
 int mkdir_p(const char *path, mode_t mode) {
-        return makedir_p(path, mode, false);
+        return mkdir_p_internal(NULL, path, mode, mkdir);
 }
 
-int mkdir_p_label(const char *path, mode_t mode) {
-        return makedir_p(path, mode, true);
+int mkdir_p_prefix(const char *prefix, const char *path, mode_t mode) {
+        return mkdir_p_internal(prefix, path, mode, mkdir);
 }
diff --git a/src/shared/mkdir.h b/src/shared/mkdir.h
index ce1c35e9ba..5b34db4229 100644
--- a/src/shared/mkdir.h
+++ b/src/shared/mkdir.h
@@ -7,6 +7,7 @@
   This file is part of systemd.
 
   Copyright 2010 Lennart Poettering
+  Copyright 2013 Kay Sievers
 
   systemd is free software; you can redistribute it and/or modify it
   under the terms of the GNU Lesser General Public License as published by
@@ -22,11 +23,23 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-int mkdir_label(const char *path, mode_t mode);
+#include <sys/types.h>
+
 int mkdir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid);
-int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid);
 int mkdir_parents(const char *path, mode_t mode);
-int mkdir_parents_label(const char *path, mode_t mode);
 int mkdir_p(const char *path, mode_t mode);
+int mkdir_p_prefix(const char *prefix, const char *path, mode_t mode);
+
+/* selinux versions */
+int mkdir_label(const char *path, mode_t mode);
+int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid);
+int mkdir_parents_label(const char *path, mode_t mode);
 int mkdir_p_label(const char *path, mode_t mode);
+int mkdir_parents_prefix_label(const char *prefix, const char *path, mode_t mode);
+
+/* internally used */
+typedef int (*mkdir_func_t)(const char *pathname, mode_t mode);
+int mkdir_safe_internal(const char *path, mode_t mode, uid_t uid, gid_t gid, mkdir_func_t _mkdir);
+int mkdir_parents_internal(const char *prefix, const char *path, mode_t mode, mkdir_func_t _mkdir);
+int mkdir_p_internal(const char *prefix, const char *path, mode_t mode, mkdir_func_t _mkdir);
 #endif
diff --git a/src/shared/output-mode.h b/src/shared/output-mode.h
index 0efd430c5d..9da789db76 100644
--- a/src/shared/output-mode.h
+++ b/src/shared/output-mode.h
@@ -23,6 +23,8 @@
 
 typedef enum OutputMode {
         OUTPUT_SHORT,
+        OUTPUT_SHORT_ISO,
+        OUTPUT_SHORT_PRECISE,
         OUTPUT_SHORT_MONOTONIC,
         OUTPUT_VERBOSE,
         OUTPUT_EXPORT,
diff --git a/src/shared/path-util.c b/src/shared/path-util.c
index 0c1b6a0ab0..45099eeda8 100644
--- a/src/shared/path-util.c
+++ b/src/shared/path-util.c
@@ -102,7 +102,8 @@ char **path_split_and_make_absolute(const char *p) {
         char **l;
         assert(p);
 
-        if (!(l = strv_split(p, ":")))
+        l = strv_split(p, ":");
+        if (!l)
                 return NULL;
 
         if (!path_strv_make_absolute_cwd(l)) {
@@ -126,7 +127,7 @@ char *path_make_absolute(const char *p, const char *prefix) {
 }
 
 char *path_make_absolute_cwd(const char *p) {
-        char *cwd, *r;
+        _cleanup_free_ char *cwd = NULL;
 
         assert(p);
 
@@ -140,10 +141,7 @@ char *path_make_absolute_cwd(const char *p) {
         if (!cwd)
                 return NULL;
 
-        r = path_make_absolute(p, cwd);
-        free(cwd);
-
-        return r;
+        return path_make_absolute(p, cwd);
 }
 
 char **path_strv_make_absolute_cwd(char **l) {
@@ -156,7 +154,8 @@ char **path_strv_make_absolute_cwd(char **l) {
         STRV_FOREACH(s, l) {
                 char *t;
 
-                if (!(t = path_make_absolute_cwd(*s)))
+                t = path_make_absolute_cwd(*s);
+                if (!t)
                         return NULL;
 
                 free(*s);
@@ -426,3 +425,51 @@ int path_is_os_tree(const char *path) {
 
         return r < 0 ? 0 : 1;
 }
+
+int find_binary(const char *name, char **filename) {
+        assert(name);
+        if (strchr(name, '/')) {
+                char *p;
+
+                if (path_is_absolute(name))
+                        p = strdup(name);
+                else
+                        p = path_make_absolute_cwd(name);
+                if (!p)
+                        return -ENOMEM;
+
+                *filename = p;
+                return 0;
+        } else {
+                const char *path;
+                char *state, *w;
+                size_t l;
+
+                /**
+                 * Plain getenv, not secure_getenv, because we want
+                 * to actually allow the user to pick the binary.
+                 */
+                path = getenv("PATH");
+                if (!path)
+                        path = DEFAULT_PATH;
+
+                FOREACH_WORD_SEPARATOR(w, l, path, ":", state) {
+                        char *p;
+
+                        if (asprintf(&p, "%.*s/%s", (int) l, w, name) < 0)
+                                return -ENOMEM;
+
+                        if (access(p, X_OK) < 0) {
+                                free(p);
+                                continue;
+                        }
+
+                        path_kill_slashes(p);
+                        *filename = p;
+
+                        return 0;
+                }
+
+                return -ENOENT;
+        }
+}
diff --git a/src/shared/path-util.h b/src/shared/path-util.h
index d187743769..0a42de7e27 100644
--- a/src/shared/path-util.h
+++ b/src/shared/path-util.h
@@ -25,6 +25,12 @@
 
 #include "macro.h"
 
+#ifdef HAVE_SPLIT_USR
+#  define DEFAULT_PATH "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+#else
+#  define DEFAULT_PATH "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"
+#endif
+
 bool is_path(const char *p) _pure_;
 char** path_split_and_make_absolute(const char *p);
 char* path_get_file_name(const char *p) _pure_;
@@ -43,3 +49,15 @@ char** path_strv_canonicalize_uniq(char **l);
 int path_is_mount_point(const char *path, bool allow_symlink);
 int path_is_read_only_fs(const char *path);
 int path_is_os_tree(const char *path);
+
+int find_binary(const char *name, char **filename);
+
+/* Iterates through the path prefixes of the specified path, going up
+ * the tree, to root. Also returns "" (and not "/"!) for the root
+ * directory. Excludes the specified directory itself */
+#define PATH_FOREACH_PREFIX(prefix, path) \
+        for (char *_slash = ({ path_kill_slashes(strcpy(prefix, path)); streq(prefix, "/") ? NULL : strrchr(prefix, '/'); }); _slash && !(*_slash = 0); _slash = strrchr((prefix), '/'))
+
+/* Same as PATH_FOREACH_PREFIX but also includes the specified path itself */
+#define PATH_FOREACH_PREFIX_MORE(prefix, path) \
+        for (char *_slash = ({ path_kill_slashes(strcpy(prefix, path)); if (streq(prefix, "/")) prefix[0] = 0; strrchr(prefix, 0); }); _slash && !(*_slash = 0); _slash = strrchr((prefix), '/'))
diff --git a/src/shared/polkit.c b/src/shared/polkit.c
index cea7074ad3..1c5e9e3e0f 100644
--- a/src/shared/polkit.c
+++ b/src/shared/polkit.c
@@ -38,12 +38,8 @@ int verify_polkit(
 
 #ifdef ENABLE_POLKIT
         DBusMessage *m = NULL, *reply = NULL;
-        const char *unix_process = "unix-process", *pid = "pid", *starttime = "start-time", *cancel_id = "";
+        const char *system_bus_name = "system-bus-name", *name = "name", *cancel_id = "";
         uint32_t flags = interactive ? 1 : 0;
-        pid_t pid_raw;
-        uint32_t pid_u32;
-        unsigned long long starttime_raw;
-        uint64_t starttime_u64;
         DBusMessageIter iter_msg, iter_struct, iter_array, iter_dict, iter_variant;
         int r;
         dbus_bool_t authorized = FALSE, challenge = FALSE;
@@ -68,14 +64,6 @@ int verify_polkit(
 
 #ifdef ENABLE_POLKIT
 
-        pid_raw = bus_get_unix_process_id(c, sender, error);
-        if (pid_raw == 0)
-                return -EINVAL;
-
-        r = get_starttime_of_pid(pid_raw, &starttime_raw);
-        if (r < 0)
-                return r;
-
         m = dbus_message_new_method_call(
                         "org.freedesktop.PolicyKit1",
                         "/org/freedesktop/PolicyKit1/Authority",
@@ -86,22 +74,13 @@ int verify_polkit(
 
         dbus_message_iter_init_append(m, &iter_msg);
 
-        pid_u32 = (uint32_t) pid_raw;
-        starttime_u64 = (uint64_t) starttime_raw;
-
         if (!dbus_message_iter_open_container(&iter_msg, DBUS_TYPE_STRUCT, NULL, &iter_struct) ||
-            !dbus_message_iter_append_basic(&iter_struct, DBUS_TYPE_STRING, &unix_process) ||
+            !dbus_message_iter_append_basic(&iter_struct, DBUS_TYPE_STRING, &system_bus_name) ||
             !dbus_message_iter_open_container(&iter_struct, DBUS_TYPE_ARRAY, "{sv}", &iter_array) ||
             !dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict) ||
-            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &pid) ||
-            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "u", &iter_variant) ||
-            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT32, &pid_u32) ||
-            !dbus_message_iter_close_container(&iter_dict, &iter_variant) ||
-            !dbus_message_iter_close_container(&iter_array, &iter_dict) ||
-            !dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict) ||
-            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &starttime) ||
-            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "t", &iter_variant) ||
-            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT64, &starttime_u64) ||
+            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &name) ||
+            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "s", &iter_variant) ||
+            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_STRING, &sender) ||
             !dbus_message_iter_close_container(&iter_dict, &iter_variant) ||
             !dbus_message_iter_close_container(&iter_array, &iter_dict) ||
             !dbus_message_iter_close_container(&iter_struct, &iter_array) ||
diff --git a/src/shared/refcnt.h b/src/shared/refcnt.h
new file mode 100644
index 0000000000..0502c20a2e
--- /dev/null
+++ b/src/shared/refcnt.h
@@ -0,0 +1,34 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2013 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+/* A type-safe atomic refcounter */
+
+typedef struct {
+        volatile unsigned _value;
+} RefCount;
+
+#define REFCNT_GET(r) ((r)._value)
+#define REFCNT_INC(r) (__sync_add_and_fetch(&(r)._value, 1))
+#define REFCNT_DEC(r) (__sync_sub_and_fetch(&(r)._value, 1))
+
+#define REFCNT_INIT ((RefCount) { ._value = 1 })
diff --git a/src/shared/replace-var.c b/src/shared/replace-var.c
index e11c57a43d..478fc43a38 100644
--- a/src/shared/replace-var.c
+++ b/src/shared/replace-var.c
@@ -24,6 +24,7 @@
 #include "macro.h"
 #include "util.h"
 #include "replace-var.h"
+#include "def.h"
 
 /*
  * Generic infrastructure for replacing @FOO@ style variables in
@@ -40,7 +41,7 @@ static int get_variable(const char *b, char **r) {
         if (*b != '@')
                 return 0;
 
-        k = strspn(b + 1, "ABCDEFGHIJKLMNOPQRSTUVWXYZ_");
+        k = strspn(b + 1, UPPERCASE_LETTERS "_");
         if (k <= 0 || b[k+1] != '@')
                 return 0;
 
diff --git a/src/shared/set.c b/src/shared/set.c
index c338dc3a44..5a4bf11bdf 100644
--- a/src/shared/set.c
+++ b/src/shared/set.c
@@ -50,9 +50,12 @@ int set_put(Set *s, void *value) {
 }
 
 int set_consume(Set *s, void *value) {
-        int r = set_put(s, value);
+        int r;
+
+        r = set_put(s, value);
         if (r < 0)
                 free(value);
+
         return r;
 }
 
diff --git a/src/shared/sleep-config.c b/src/shared/sleep-config.c
index cd3238b405..d068bfce3c 100644
--- a/src/shared/sleep-config.c
+++ b/src/shared/sleep-config.c
@@ -163,6 +163,93 @@ int can_sleep_disk(char **types) {
         return false;
 }
 
+#define HIBERNATION_SWAP_THRESHOLD 0.98
+
+static int hibernation_partition_size(size_t *size, size_t *used) {
+        _cleanup_fclose_ FILE *f;
+        int i;
+
+        assert(size);
+        assert(used);
+
+        f = fopen("/proc/swaps", "r");
+        if (!f) {
+                log_full(errno == ENOENT ? LOG_DEBUG : LOG_WARNING,
+                         "Failed to retrieve open /proc/swaps: %m");
+                assert(errno > 0);
+                return -errno;
+        }
+
+        (void) fscanf(f, "%*s %*s %*s %*s %*s\n");
+
+        for (i = 1;; i++) {
+                _cleanup_free_ char *dev = NULL, *d = NULL, *type = NULL;
+                size_t size_field, used_field;
+                int k;
+
+                k = fscanf(f,
+                           "%ms "   /* device/file */
+                           "%ms "   /* type of swap */
+                           "%zd "   /* swap size */
+                           "%zd "   /* used */
+                           "%*i\n", /* priority */
+                           &dev, &type, &size_field, &used_field);
+                if (k != 4) {
+                        if (k == EOF)
+                                break;
+
+                        log_warning("Failed to parse /proc/swaps:%u", i);
+                        continue;
+                }
+
+                d = cunescape(dev);
+                if (!d)
+                        return -ENOMEM;
+
+                if (!streq(type, "partition")) {
+                        log_debug("Partition %s has type %s, ignoring.", d, type);
+                        continue;
+                }
+
+                *size = size_field;
+                *used = used_field;
+                return 0;
+        }
+
+        log_debug("No swap partitions were found.");
+        return -ENOSYS;
+}
+
+static bool enough_memory_for_hibernation(void) {
+        _cleanup_free_ char *active = NULL;
+        unsigned long long act;
+        size_t size, used;
+        int r;
+
+        r = hibernation_partition_size(&size, &used);
+        if (r < 0)
+                return false;
+
+        r = get_status_field("/proc/meminfo", "\nActive(anon):", &active);
+        if (r < 0) {
+                log_error("Failed to retrieve Active(anon) from /proc/meminfo: %s", strerror(-r));
+                return false;
+        }
+
+        r = safe_atollu(active, &act);
+        if (r < 0) {
+                log_error("Failed to parse Active(anon) from /proc/meminfo: %s: %s",
+                          active, strerror(-r));
+                return false;
+        }
+
+        r = act <= (size - used) * HIBERNATION_SWAP_THRESHOLD;
+        log_debug("Hibernation is %spossible, Active(anon)=%llu kB, size=%zu kB, used=%zu kB, threshold=%.2g%%",
+                  r ? "" : "im", act, size, used, 100*HIBERNATION_SWAP_THRESHOLD);
+
+        return r;
+}
+
 int can_sleep(const char *verb) {
         _cleanup_strv_free_ char **modes = NULL, **states = NULL;
         int r;
@@ -175,5 +262,8 @@ int can_sleep(const char *verb) {
         if (r < 0)
                 return false;
 
-        return can_sleep_state(states) && can_sleep_disk(modes);
+        if (!can_sleep_state(states) || !can_sleep_disk(modes))
+                return false;
+
+        return streq(verb, "suspend") || enough_memory_for_hibernation();
 }
diff --git a/src/shared/socket-util.c b/src/shared/socket-util.c
index c583d3dfea..9224208244 100644
--- a/src/shared/socket-util.c
+++ b/src/shared/socket-util.c
@@ -486,16 +486,16 @@ bool socket_address_is_netlink(const SocketAddress *a, const char *s) {
         return socket_address_equal(a, &b);
 }
 
-bool socket_address_needs_mount(const SocketAddress *a, const char *prefix) {
+const char* socket_address_get_path(const SocketAddress *a) {
         assert(a);
 
         if (socket_address_family(a) != AF_UNIX)
-                return false;
+                return NULL;
 
         if (a->sockaddr.un.sun_path[0] == 0)
-                return false;
+                return NULL;
 
-        return path_startswith(a->sockaddr.un.sun_path, prefix);
+        return a->sockaddr.un.sun_path;
 }
 
 bool socket_ipv6_is_supported(void) {
diff --git a/src/shared/socket-util.h b/src/shared/socket-util.h
index 7829a337fc..e0b85adf9f 100644
--- a/src/shared/socket-util.h
+++ b/src/shared/socket-util.h
@@ -92,7 +92,7 @@ int make_socket_fd(const char* address, int flags);
 
 bool socket_address_equal(const SocketAddress *a, const SocketAddress *b) _pure_;
 
-bool socket_address_needs_mount(const SocketAddress *a, const char *prefix);
+const char* socket_address_get_path(const SocketAddress *a);
 
 const char* socket_address_bind_ipv6_only_to_string(SocketAddressBindIPv6Only b) _const_;
 SocketAddressBindIPv6Only socket_address_bind_ipv6_only_from_string(const char *s) _pure_;
diff --git a/src/shared/specifier.c b/src/shared/specifier.c
index 7577c91052..8fbf6db5df 100644
--- a/src/shared/specifier.c
+++ b/src/shared/specifier.c
@@ -20,6 +20,7 @@
 ***/
 
 #include <string.h>
+#include <sys/utsname.h>
 
 #include "macro.h"
 #include "util.h"
@@ -31,21 +32,22 @@
  *
  */
 
-char *specifier_printf(const char *text, const Specifier table[], void *userdata) {
-        char *r, *t;
+int specifier_printf(const char *text, const Specifier table[], void *userdata, char **_ret) {
+        char *ret, *t;
         const char *f;
         bool percent = false;
         size_t l;
+        int r;
 
         assert(text);
         assert(table);
 
         l = strlen(text);
-        r = new(char, l+1);
-        if (!r)
-                return NULL;
+        ret = new(char, l+1);
+        if (!ret)
+                return -ENOMEM;
 
-        t = r;
+        t = ret;
 
         for (f = text; *f; f++, l--) {
 
@@ -60,32 +62,31 @@ char *specifier_printf(const char *text, const Specifier table[], void *userdata
                                                 break;
 
                                 if (i->lookup) {
-                                        char *n, *w;
+                                        _cleanup_free_ char *w = NULL;
+                                        char *n;
                                         size_t k, j;
 
-                                        w = i->lookup(i->specifier, i->data, userdata);
-                                        if (!w) {
-                                                free(r);
-                                                return NULL;
+                                        r = i->lookup(i->specifier, i->data, userdata, &w);
+                                        if (r < 0) {
+                                                free(ret);
+                                                return r;
                                         }
 
-                                        j = t - r;
+                                        j = t - ret;
                                         k = strlen(w);
 
                                         n = new(char, j + k + l + 1);
                                         if (!n) {
-                                                free(r);
-                                                free(w);
-                                                return NULL;
+                                                free(ret);
+                                                return -ENOMEM;
                                         }
 
-                                        memcpy(n, r, j);
+                                        memcpy(n, ret, j);
                                         memcpy(n + j, w, k);
 
-                                        free(r);
-                                        free(w);
+                                        free(ret);
 
-                                        r = n;
+                                        ret = n;
                                         t = n + j + k;
                                 } else {
                                         *(t++) = '%';
@@ -101,47 +102,81 @@ char *specifier_printf(const char *text, const Specifier table[], void *userdata
         }
 
         *t = 0;
-        return r;
+        *_ret = ret;
+        return 0;
 }
 
 /* Generic handler for simple string replacements */
 
-char* specifier_string(char specifier, void *data, void *userdata) {
-        return strdup(strempty(data));
+int specifier_string(char specifier, void *data, void *userdata, char **ret) {
+        char *n;
+
+        n = strdup(strempty(data));
+        if (!n)
+                return -ENOMEM;
+
+        *ret = n;
+        return 0;
 }
 
-char *specifier_machine_id(char specifier, void *data, void *userdata) {
+int specifier_machine_id(char specifier, void *data, void *userdata, char **ret) {
         sd_id128_t id;
-        char *buf;
+        char *n;
         int r;
 
         r = sd_id128_get_machine(&id);
         if (r < 0)
-                return NULL;
+                return r;
 
-        buf = new(char, 33);
-        if (!buf)
-                return NULL;
+        n = new(char, 33);
+        if (!n)
+                return -ENOMEM;
 
-        return sd_id128_to_string(id, buf);
+        *ret = sd_id128_to_string(id, n);
+        return 0;
 }
 
-char *specifier_boot_id(char specifier, void *data, void *userdata) {
+int specifier_boot_id(char specifier, void *data, void *userdata, char **ret) {
         sd_id128_t id;
-        char *buf;
+        char *n;
         int r;
 
         r = sd_id128_get_boot(&id);
         if (r < 0)
-                return NULL;
+                return r;
+
+        n = new(char, 33);
+        if (!n)
+                return -ENOMEM;
+
+        *ret = sd_id128_to_string(id, n);
+        return 0;
+}
 
-        buf = new(char, 33);
-        if (!buf)
-                return NULL;
+int specifier_host_name(char specifier, void *data, void *userdata, char **ret) {
+        char *n;
 
-        return sd_id128_to_string(id, buf);
+        n = gethostname_malloc();
+        if (!n)
+                return -ENOMEM;
+
+        *ret = n;
+        return 0;
 }
 
-char *specifier_host_name(char specifier, void *data, void *userdata) {
-        return gethostname_malloc();
+int specifier_kernel_release(char specifier, void *data, void *userdata, char **ret) {
+        struct utsname uts;
+        char *n;
+        int r;
+
+        r = uname(&uts);
+        if (r < 0)
+                return -errno;
+
+        n = strdup(uts.release);
+        if (!n)
+                return -ENOMEM;
+
+        *ret = n;
+        return 0;
 }
diff --git a/src/shared/specifier.h b/src/shared/specifier.h
index 0440dcac48..fca206f665 100644
--- a/src/shared/specifier.h
+++ b/src/shared/specifier.h
@@ -21,7 +21,7 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-typedef char* (*SpecifierCallback)(char specifier, void *data, void *userdata);
+typedef int (*SpecifierCallback)(char specifier, void *data, void *userdata, char **ret);
 
 typedef struct Specifier {
         const char specifier;
@@ -29,10 +29,11 @@ typedef struct Specifier {
         void *data;
 } Specifier;
 
-char *specifier_printf(const char *text, const Specifier table[], void *userdata);
+int specifier_printf(const char *text, const Specifier table[], void *userdata, char **ret);
 
-char *specifier_string(char specifier, void *data, void *userdata);
+int specifier_string(char specifier, void *data, void *userdata, char **ret);
 
-char *specifier_machine_id(char specifier, void *data, void *userdata);
-char *specifier_boot_id(char specifier, void *data, void *userdata);
-char *specifier_host_name(char specifier, void *data, void *userdata);
+int specifier_machine_id(char specifier, void *data, void *userdata, char **ret);
+int specifier_boot_id(char specifier, void *data, void *userdata, char **ret);
+int specifier_host_name(char specifier, void *data, void *userdata, char **ret);
+int specifier_kernel_release(char specifier, void *data, void *userdata, char **ret);
diff --git a/src/shared/strv.c b/src/shared/strv.c
index a5ce7e9593..adeee282b7 100644
--- a/src/shared/strv.c
+++ b/src/shared/strv.c
@@ -356,6 +356,43 @@ char *strv_join(char **l, const char *separator) {
         return r;
 }
 
+char *strv_join_quoted(char **l) {
+        char *buf = NULL;
+        char **s;
+        size_t allocated = 0, len = 0;
+
+        STRV_FOREACH(s, l) {
+                /* assuming here that escaped string cannot be more
+                 * than twice as long, and reserving space for the
+                 * separator and quotes.
+                 */
+                _cleanup_free_ char *esc = NULL;
+                size_t needed;
+
+                if (!GREEDY_REALLOC(buf, allocated,
+                                    len + strlen(*s) * 2 + 3))
+                        goto oom;
+
+                esc = cescape(*s);
+                if (!esc)
+                        goto oom;
+
+                needed = snprintf(buf + len, allocated - len, "%s\"%s\"",
+                                  len > 0 ? " " : "", esc);
+                assert(needed < allocated - len);
+                len += needed;
+        }
+
+        if (!buf)
+                buf = malloc0(1);
+
+        return buf;
+
+ oom:
+        free(buf);
+        return NULL;
+}
+
 char **strv_append(char **l, const char *s) {
         char **r, **k;
 
diff --git a/src/shared/strv.h b/src/shared/strv.h
index e35118752f..d1f2a0ef32 100644
--- a/src/shared/strv.h
+++ b/src/shared/strv.h
@@ -67,6 +67,7 @@ char **strv_split_quoted(const char *s);
 char **strv_split_newlines(const char *s);
 
 char *strv_join(char **l, const char *separator);
+char *strv_join_quoted(char **l);
 
 char **strv_parse_nulstr(const char *s, size_t l);
 char **strv_split_nulstr(const char *s);
diff --git a/src/shared/test-tables.h b/src/shared/test-tables.h
new file mode 100644
index 0000000000..3261302077
--- /dev/null
+++ b/src/shared/test-tables.h
@@ -0,0 +1,51 @@
+/***
+  This file is part of systemd
+
+  Copyright 2013 Zbigniew Jędrzejewski-Szmek
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <stdio.h>
+#include <stdlib.h>
+
+typedef const char* (*lookup_t)(int);
+typedef int (*reverse_t)(const char*);
+
+static inline void _test_table(const char *name,
+                               lookup_t lookup,
+                               reverse_t reverse,
+                               int size,
+                               bool sparse) {
+        int i;
+
+        for (i = -1; i < size + 1; i++) {
+                const char* val = lookup(i);
+                int rev;
+
+                if (val)
+                        rev = reverse(val);
+                else
+                        rev = reverse("--no-such--value----");
+
+                printf("%s: %d → %s → %d\n", name, i, val, rev);
+                if (i >= 0 && i < size ?
+                    sparse ? rev != i && rev != -1 : val == NULL || rev != i :
+                    val != NULL || rev != -1)
+                        exit(EXIT_FAILURE);
+        }
+}
+
+#define test_table(lower, upper) \
+        _test_table(STRINGIFY(lower), lower##_to_string, lower##_from_string, _##upper##_MAX, false)
diff --git a/src/shared/time-util.c b/src/shared/time-util.c
index 9ee711a49e..860be61e8b 100644
--- a/src/shared/time-util.c
+++ b/src/shared/time-util.c
@@ -168,6 +168,28 @@ char *format_timestamp(char *buf, size_t l, usec_t t) {
         return buf;
 }
 
+char *format_timestamp_us(char *buf, size_t l, usec_t t) {
+        struct tm tm;
+        time_t sec;
+
+        assert(buf);
+        assert(l > 0);
+
+        if (t <= 0)
+                return NULL;
+
+        sec = (time_t) (t / USEC_PER_SEC);
+        localtime_r(&sec, &tm);
+
+        if (strftime(buf, l, "%a %Y-%m-%d %H:%M:%S", &tm) <= 0)
+                return NULL;
+        snprintf(buf + strlen(buf), l - strlen(buf), ".%06llu", t % USEC_PER_SEC);
+        if (strftime(buf + strlen(buf), l - strlen(buf), " %Z", &tm) <= 0)
+                return NULL;
+
+        return buf;
+}
+
 char *format_timestamp_relative(char *buf, size_t l, usec_t t) {
         usec_t n, d;
 
diff --git a/src/shared/time-util.h b/src/shared/time-util.h
index f27a006891..7660fe1872 100644
--- a/src/shared/time-util.h
+++ b/src/shared/time-util.h
@@ -73,6 +73,7 @@ usec_t timeval_load(const struct timeval *tv) _pure_;
 struct timeval *timeval_store(struct timeval *tv, usec_t u);
 
 char *format_timestamp(char *buf, size_t l, usec_t t);
+char *format_timestamp_us(char *buf, size_t l, usec_t t);
 char *format_timestamp_relative(char *buf, size_t l, usec_t t);
 char *format_timespan(char *buf, size_t l, usec_t t, usec_t accuracy);
 
diff --git a/src/shared/unit-name.c b/src/shared/unit-name.c
index a809713595..bc8094d112 100644
--- a/src/shared/unit-name.c
+++ b/src/shared/unit-name.c
@@ -26,11 +26,10 @@
 #include "path-util.h"
 #include "util.h"
 #include "unit-name.h"
+#include "def.h"
 
 #define VALID_CHARS                             \
-        "0123456789"                            \
-        "abcdefghijklmnopqrstuvwxyz"            \
-        "ABCDEFGHIJKLMNOPQRSTUVWXYZ"            \
+        DIGITS LETTERS                          \
         ":-_.\\"
 
 static const char* const unit_type_table[_UNIT_TYPE_MAX] = {
@@ -44,6 +43,8 @@ static const char* const unit_type_table[_UNIT_TYPE_MAX] = {
         [UNIT_TIMER] = "timer",
         [UNIT_SWAP] = "swap",
         [UNIT_PATH] = "path",
+        [UNIT_SLICE] = "slice",
+        [UNIT_SCOPE] = "scope"
 };
 
 DEFINE_STRING_TABLE_LOOKUP(unit_type, UnitType);
@@ -51,6 +52,7 @@ DEFINE_STRING_TABLE_LOOKUP(unit_type, UnitType);
 static const char* const unit_load_state_table[_UNIT_LOAD_STATE_MAX] = {
         [UNIT_STUB] = "stub",
         [UNIT_LOADED] = "loaded",
+        [UNIT_NOT_FOUND] = "not-found",
         [UNIT_ERROR] = "error",
         [UNIT_MERGED] = "merged",
         [UNIT_MASKED] = "masked"
@@ -184,6 +186,7 @@ char *unit_name_change_suffix(const char *n, const char *suffix) {
         assert(n);
         assert(unit_name_is_valid(n, true));
         assert(suffix);
+        assert(suffix[0] == '.');
 
         assert_se(e = strrchr(n, '.'));
         a = e - n;
@@ -298,7 +301,7 @@ char *unit_name_path_escape(const char *f) {
 
         path_kill_slashes(p);
 
-        if (streq(p, "/")) {
+        if (streq(p, "/") || streq(p, "")) {
                 free(p);
                 return strdup("-");
         }
@@ -401,7 +404,6 @@ char *unit_name_template(const char *f) {
 
         strcpy(mempcpy(r, f, a), e);
         return r;
-
 }
 
 char *unit_name_from_path(const char *path, const char *suffix) {
@@ -453,7 +455,7 @@ char *unit_name_to_path(const char *name) {
 }
 
 char *unit_dbus_path_from_name(const char *name) {
-        char *e, *p;
+        _cleanup_free_ char *e = NULL;
 
         assert(name);
 
@@ -461,10 +463,23 @@ char *unit_dbus_path_from_name(const char *name) {
         if (!e)
                 return NULL;
 
-        p = strappend("/org/freedesktop/systemd1/unit/", e);
-        free(e);
+        return strappend("/org/freedesktop/systemd1/unit/", e);
+}
+
+int unit_name_from_dbus_path(const char *path, char **name) {
+        const char *e;
+        char *n;
+
+        e = startswith(path, "/org/freedesktop/systemd1/unit/");
+        if (!e)
+                return -EINVAL;
 
-        return p;
+        n = bus_path_unescape(e);
+        if (!n)
+                return -ENOMEM;
+
+        *name = n;
+        return 0;
 }
 
 char *unit_name_mangle(const char *name) {
@@ -506,16 +521,18 @@ char *unit_name_mangle(const char *name) {
         return r;
 }
 
-char *snapshot_name_mangle(const char *name) {
+char *unit_name_mangle_with_suffix(const char *name, const char *suffix) {
         char *r, *t;
         const char *f;
 
         assert(name);
+        assert(suffix);
+        assert(suffix[0] == '.');
 
         /* Similar to unit_name_mangle(), but is called when we know
          * that this is about snapshot units. */
 
-        r = new(char, strlen(name) * 4 + 1 + sizeof(".snapshot")-1);
+        r = new(char, strlen(name) * 4 + strlen(suffix) + 1);
         if (!r)
                 return NULL;
 
@@ -528,8 +545,8 @@ char *snapshot_name_mangle(const char *name) {
                         *(t++) = *f;
         }
 
-        if (!endswith(name, ".snapshot"))
-                strcpy(t, ".snapshot");
+        if (!endswith(name, suffix))
+                strcpy(t, suffix);
         else
                 *t = 0;
 
@@ -547,3 +564,30 @@ UnitType unit_name_to_type(const char *n) {
 
         return unit_type_from_string(e + 1);
 }
+
+int build_subslice(const char *slice, const char*name, char **subslice) {
+        char *ret;
+
+        assert(slice);
+        assert(name);
+        assert(subslice);
+
+        if (streq(slice, "-.slice"))
+                ret = strappend(name, ".slice");
+        else {
+                char *e;
+
+                e = endswith(slice, ".slice");
+                if (!e)
+                        return -EINVAL;
+
+                ret = new(char, (e - slice) + 1 + strlen(name) + 6 + 1);
+                if (!ret)
+                        return -ENOMEM;
+
+                stpcpy(stpcpy(stpcpy(mempcpy(ret, slice, e - slice), "-"), name), ".slice");
+        }
+
+        *subslice = ret;
+        return 0;
+}
diff --git a/src/shared/unit-name.h b/src/shared/unit-name.h
index 9eca8eb3c1..20138df089 100644
--- a/src/shared/unit-name.h
+++ b/src/shared/unit-name.h
@@ -41,6 +41,8 @@ enum UnitType {
         UNIT_TIMER,
         UNIT_SWAP,
         UNIT_PATH,
+        UNIT_SLICE,
+        UNIT_SCOPE,
         _UNIT_TYPE_MAX,
         _UNIT_TYPE_INVALID = -1
 };
@@ -48,6 +50,7 @@ enum UnitType {
 enum UnitLoadState {
         UNIT_STUB = 0,
         UNIT_LOADED,
+        UNIT_NOT_FOUND,
         UNIT_ERROR,
         UNIT_MERGED,
         UNIT_MASKED,
@@ -92,6 +95,9 @@ char *unit_name_from_path_instance(const char *prefix, const char *path, const c
 char *unit_name_to_path(const char *name);
 
 char *unit_dbus_path_from_name(const char *name);
+int unit_name_from_dbus_path(const char *path, char **name);
 
 char *unit_name_mangle(const char *name);
-char *snapshot_name_mangle(const char *name);
+char *unit_name_mangle_with_suffix(const char *name, const char *suffix);
+
+int build_subslice(const char *slice, const char*name, char **subslice);
diff --git a/src/shared/utf8.c b/src/shared/utf8.c
index 3964e8b1ce..a8e28accd3 100644
--- a/src/shared/utf8.c
+++ b/src/shared/utf8.c
@@ -3,6 +3,7 @@
 /***
   This file is part of systemd.
 
+  Copyright 2008-2011 Kay Sievers
   Copyright 2012 Lennart Poettering
 
   systemd is free software; you can redistribute it and/or modify it
@@ -19,7 +20,7 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-/* This file is based on the GLIB utf8 validation functions. The
+/* Parts of this file are based on the GLIB utf8 validation functions. The
  * original license text follows. */
 
 /* gutf8.c - Operations on UTF-8 strings.
@@ -51,8 +52,6 @@
 #include "utf8.h"
 #include "util.h"
 
-#define FILTER_CHAR '_'
-
 static inline bool is_unicode_valid(uint32_t ch) {
 
         if (ch >= 0x110000) /* End of unicode space */
@@ -67,17 +66,6 @@ static inline bool is_unicode_valid(uint32_t ch) {
         return true;
 }
 
-static inline bool is_continuation_char(uint8_t ch) {
-        if ((ch & 0xc0) != 0x80) /* 10xxxxxx */
-                return false;
-        return true;
-}
-
-static inline void merge_continuation_char(uint32_t *u_ch, uint8_t ch) {
-        *u_ch <<= 6;
-        *u_ch |= ch & 0x3f;
-}
-
 static bool is_unicode_control(uint32_t ch) {
 
         /*
@@ -86,170 +74,101 @@ static bool is_unicode_control(uint32_t ch) {
           '\t' is in C0 range, but more or less harmless and commonly used.
         */
 
-        return (ch < ' ' && ch != '\t') ||
+        return (ch < ' ' && ch != '\t' && ch != '\n') ||
                 (0x7F <= ch && ch <= 0x9F);
 }
 
-char* utf8_is_printable_n(const char* str, size_t length) {
-        uint32_t val = 0;
-        uint32_t min = 0;
-        const uint8_t *p;
-
-        assert(str);
-
-        for (p = (const uint8_t*) str; length; p++, length--) {
-                if (*p < 128) {
-                        val = *p;
-                } else {
-                        if ((*p & 0xe0) == 0xc0) { /* 110xxxxx two-char seq. */
-                                min = 128;
-                                val = (uint32_t) (*p & 0x1e);
-                                goto ONE_REMAINING;
-                        } else if ((*p & 0xf0) == 0xe0) { /* 1110xxxx three-char seq.*/
-                                min = (1 << 11);
-                                val = (uint32_t) (*p & 0x0f);
-                                goto TWO_REMAINING;
-                        } else if ((*p & 0xf8) == 0xf0) { /* 11110xxx four-char seq */
-                                min = (1 << 16);
-                                val = (uint32_t) (*p & 0x07);
-                        } else
-                                goto error;
-
-                        p++;
-                        length--;
-                        if (!length || !is_continuation_char(*p))
-                                goto error;
-                        merge_continuation_char(&val, *p);
-
-                TWO_REMAINING:
-                        p++;
-                        length--;
-                        if (!is_continuation_char(*p))
-                                goto error;
-                        merge_continuation_char(&val, *p);
-
-                ONE_REMAINING:
-                        p++;
-                        length--;
-                        if (!is_continuation_char(*p))
-                                goto error;
-                        merge_continuation_char(&val, *p);
-
-                        if (val < min)
-                                goto error;
-                }
+/* count of characters used to encode one unicode char */
+static int utf8_encoded_expected_len(const char *str) {
+        unsigned char c = (unsigned char)str[0];
+
+        if (c < 0x80)
+                return 1;
+        if ((c & 0xe0) == 0xc0)
+                return 2;
+        if ((c & 0xf0) == 0xe0)
+                return 3;
+        if ((c & 0xf8) == 0xf0)
+                return 4;
+        if ((c & 0xfc) == 0xf8)
+                return 5;
+        if ((c & 0xfe) == 0xfc)
+                return 6;
+        return 0;
+}
 
-                if (is_unicode_control(val))
-                        goto error;
+/* decode one unicode char */
+static int utf8_encoded_to_unichar(const char *str) {
+        int unichar;
+        int len;
+        int i;
+
+        len = utf8_encoded_expected_len(str);
+        switch (len) {
+        case 1:
+                return (int)str[0];
+        case 2:
+                unichar = str[0] & 0x1f;
+                break;
+        case 3:
+                unichar = (int)str[0] & 0x0f;
+                break;
+        case 4:
+                unichar = (int)str[0] & 0x07;
+                break;
+        case 5:
+                unichar = (int)str[0] & 0x03;
+                break;
+        case 6:
+                unichar = (int)str[0] & 0x01;
+                break;
+        default:
+                return -1;
         }
 
-        return (char*) str;
+        for (i = 1; i < len; i++) {
+                if (((int)str[i] & 0xc0) != 0x80)
+                        return -1;
+                unichar <<= 6;
+                unichar |= (int)str[i] & 0x3f;
+        }
 
-error:
-        return NULL;
+        return unichar;
 }
 
-static char* utf8_validate(const char *str, char *output) {
-        uint32_t val = 0;
-        uint32_t min = 0;
-        const uint8_t *p, *last;
-        int size;
-        uint8_t *o;
+bool utf8_is_printable(const char* str, size_t length) {
+        const uint8_t *p;
 
         assert(str);
 
-        o = (uint8_t*) output;
-        for (p = (const uint8_t*) str; *p; p++) {
-                if (*p < 128) {
-                        if (o)
-                                *o = *p;
-                } else {
-                        last = p;
-
-                        if ((*p & 0xe0) == 0xc0) { /* 110xxxxx two-char seq. */
-                                size = 2;
-                                min = 128;
-                                val = (uint32_t) (*p & 0x1e);
-                                goto ONE_REMAINING;
-                        } else if ((*p & 0xf0) == 0xe0) { /* 1110xxxx three-char seq.*/
-                                size = 3;
-                                min = (1 << 11);
-                                val = (uint32_t) (*p & 0x0f);
-                                goto TWO_REMAINING;
-                        } else if ((*p & 0xf8) == 0xf0) { /* 11110xxx four-char seq */
-                                size = 4;
-                                min = (1 << 16);
-                                val = (uint32_t) (*p & 0x07);
-                        } else
-                                goto error;
-
-                        p++;
-                        if (!is_continuation_char(*p))
-                                goto error;
-                        merge_continuation_char(&val, *p);
-
-                TWO_REMAINING:
-                        p++;
-                        if (!is_continuation_char(*p))
-                                goto error;
-                        merge_continuation_char(&val, *p);
-
-                ONE_REMAINING:
-                        p++;
-                        if (!is_continuation_char(*p))
-                                goto error;
-                        merge_continuation_char(&val, *p);
-
-                        if (val < min)
-                                goto error;
-
-                        if (!is_unicode_valid(val))
-                                goto error;
-
-                        if (o) {
-                                memcpy(o, last, (size_t) size);
-                                o += size;
-                        }
-
-                        continue;
-
-                error:
-                        if (o) {
-                                *o = FILTER_CHAR;
-                                p = last; /* We retry at the next character */
-                        } else
-                                goto failure;
-                }
+        for (p = (const uint8_t*) str; length; p++) {
+                int encoded_len = utf8_encoded_valid_unichar((const char *)p);
+                int32_t val = utf8_encoded_to_unichar((const char*)p);
 
-                if (o)
-                        o++;
-        }
+                if (encoded_len < 0 || val < 0 || is_unicode_control(val))
+                        return false;
 
-        if (o) {
-                *o = '\0';
-                return output;
+                length -= encoded_len;
         }
 
-        return (char*) str;
-
-failure:
-        return NULL;
-}
-
-char* utf8_is_valid (const char *str) {
-        return utf8_validate(str, NULL);
+        return true;
 }
 
-char* utf8_filter (const char *str) {
-        char *new_str;
+const char *utf8_is_valid(const char *str) {
+        const uint8_t *p;
 
         assert(str);
 
-        new_str = malloc(strlen(str) + 1);
-        if (!new_str)
-                return NULL;
+        for (p = (const uint8_t*) str; *p; ) {
+                int len = utf8_encoded_valid_unichar((const char *)p);
 
-        return utf8_validate(str, new_str);
+                if (len < 0)
+                        return NULL;
+
+                p += len;
+        }
+
+        return str;
 }
 
 char *ascii_is_valid(const char *str) {
@@ -320,3 +239,50 @@ char *utf16_to_utf8(const void *s, size_t length) {
 
         return r;
 }
+
+/* expected size used to encode one unicode char */
+static int utf8_unichar_to_encoded_len(int unichar) {
+        if (unichar < 0x80)
+                return 1;
+        if (unichar < 0x800)
+                return 2;
+        if (unichar < 0x10000)
+                return 3;
+        if (unichar < 0x200000)
+                return 4;
+        if (unichar < 0x4000000)
+                return 5;
+        return 6;
+}
+
+/* validate one encoded unicode char and return its length */
+int utf8_encoded_valid_unichar(const char *str) {
+        int len;
+        int unichar;
+        int i;
+
+        len = utf8_encoded_expected_len(str);
+        if (len == 0)
+                return -1;
+
+        /* ascii is valid */
+        if (len == 1)
+                return 1;
+
+        /* check if expected encoded chars are available */
+        for (i = 0; i < len; i++)
+                if ((str[i] & 0x80) != 0x80)
+                        return -1;
+
+        unichar = utf8_encoded_to_unichar(str);
+
+        /* check if encoded length matches encoded value */
+        if (utf8_unichar_to_encoded_len(unichar) != len)
+                return -1;
+
+        /* check if value has valid range */
+        if (!is_unicode_valid(unichar))
+                return -1;
+
+        return len;
+}
diff --git a/src/shared/utf8.h b/src/shared/utf8.h
index 794ae15ab9..96a03ea7cb 100644
--- a/src/shared/utf8.h
+++ b/src/shared/utf8.h
@@ -21,14 +21,17 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include <stdbool.h>
+
 #include "macro.h"
 
-char *utf8_is_valid(const char *s) _pure_;
+const char *utf8_is_valid(const char *s) _pure_;
 char *ascii_is_valid(const char *s) _pure_;
 
-char *utf8_is_printable_n(const char* str, size_t length) _pure_;
+bool utf8_is_printable(const char* str, size_t length) _pure_;
 
-char *utf8_filter(const char *s);
 char *ascii_filter(const char *s);
 
 char *utf16_to_utf8(const void *s, size_t length);
+
+int utf8_encoded_valid_unichar(const char *str);
diff --git a/src/shared/util.c b/src/shared/util.c
index 673e0da6b6..9be6acfc8f 100644
--- a/src/shared/util.c
+++ b/src/shared/util.c
@@ -73,6 +73,7 @@
 #include "hashmap.h"
 #include "env-util.h"
 #include "fileio.h"
+#include "device-nodes.h"
 
 int saved_argc = 0;
 char **saved_argv = NULL;
@@ -128,40 +129,6 @@ char* endswith(const char *s, const char *postfix) {
         return (char*) s + sl - pl;
 }
 
-char* startswith(const char *s, const char *prefix) {
-        const char *a, *b;
-
-        assert(s);
-        assert(prefix);
-
-        a = s, b = prefix;
-        for (;;) {
-                if (*b == 0)
-                        return (char*) a;
-                if (*a != *b)
-                        return NULL;
-
-                a++, b++;
-        }
-}
-
-char* startswith_no_case(const char *s, const char *prefix) {
-        const char *a, *b;
-
-        assert(s);
-        assert(prefix);
-
-        a = s, b = prefix;
-        for (;;) {
-                if (*b == 0)
-                        return (char*) a;
-                if (tolower(*a) != tolower(*b))
-                        return NULL;
-
-                a++, b++;
-        }
-}
-
 bool first_word(const char *s, const char *word) {
         size_t sl, wl;
 
@@ -367,7 +334,7 @@ int safe_atolli(const char *s, long long int *ret_lli) {
 
 int safe_atod(const char *s, double *ret_d) {
         char *x = NULL;
-        double d;
+        double d = 0;
 
         assert(s);
         assert(ret_d);
@@ -726,9 +693,24 @@ int is_kernel_thread(pid_t pid) {
         return 0;
 }
 
+int get_process_capeff(pid_t pid, char **capeff) {
+        const char *p;
+
+        assert(capeff);
+        assert(pid >= 0);
+
+        if (pid == 0)
+                p = "/proc/self/status";
+        else
+                p = procfs_file_alloca(pid, "status");
+
+        return get_status_field(p, "\nCapEff:", capeff);
+}
 
 int get_process_exe(pid_t pid, char **name) {
         const char *p;
+        char *d;
+        int r;
 
         assert(pid >= 0);
         assert(name);
@@ -738,7 +720,15 @@ int get_process_exe(pid_t pid, char **name) {
         else
                 p = procfs_file_alloca(pid, "exe");
 
-        return readlink_malloc(p, name);
+        r = readlink_malloc(p, name);
+        if (r < 0)
+                return r;
+
+        d = endswith(*name, " (deleted)");
+        if (d)
+                *d = '\0';
+
+        return 0;
 }
 
 static int get_process_id(pid_t pid, const char *field, uid_t *uid) {
@@ -850,18 +840,18 @@ int readlink_malloc(const char *p, char **r) {
 }
 
 int readlink_and_make_absolute(const char *p, char **r) {
-        char *target, *k;
+        _cleanup_free_ char *target = NULL;
+        char *k;
         int j;
 
         assert(p);
         assert(r);
 
-        if ((j = readlink_malloc(p, &target)) < 0)
+        j = readlink_malloc(p, &target);
+        if (j < 0)
                 return j;
 
         k = file_in_same_dir(p, target);
-        free(target);
-
         if (!k)
                 return -ENOMEM;
 
@@ -1600,6 +1590,7 @@ bool fstype_is_network(const char *fstype) {
                 "cifs\0"
                 "smbfs\0"
                 "ncpfs\0"
+                "ncp\0"
                 "nfs\0"
                 "nfs4\0"
                 "gfs\0"
@@ -1830,8 +1821,10 @@ int open_terminal(const char *name, int mode) {
          * https://bugs.launchpad.net/ubuntu/+source/linux/+bug/554172/comments/245
          */
 
+        assert(!(mode & O_CREAT));
+
         for (;;) {
-                fd = open(name, mode);
+                fd = open(name, mode, 0);
                 if (fd >= 0)
                         break;
 
@@ -2193,8 +2186,10 @@ ssize_t loop_read(int fd, void *buf, size_t nbytes, bool do_poll) {
                                         return n > 0 ? n : -errno;
                                 }
 
-                                if (pollfd.revents != POLLIN)
-                                        return n > 0 ? n : -EIO;
+                                /* We knowingly ignore the revents value here,
+                                 * and expect that any error/EOF is reported
+                                 * via read()/write()
+                                 */
 
                                 continue;
                         }
@@ -2241,8 +2236,10 @@ ssize_t loop_write(int fd, const void *buf, size_t nbytes, bool do_poll) {
                                         return n > 0 ? n : -errno;
                                 }
 
-                                if (pollfd.revents != POLLOUT)
-                                        return n > 0 ? n : -EIO;
+                                /* We knowingly ignore the revents value here,
+                                 * and expect that any error/EOF is reported
+                                 * via read()/write()
+                                 */
 
                                 continue;
                         }
@@ -2261,7 +2258,7 @@ ssize_t loop_write(int fd, const void *buf, size_t nbytes, bool do_poll) {
 int parse_bytes(const char *t, off_t *bytes) {
         static const struct {
                 const char *suffix;
-                off_t factor;
+                unsigned long long factor;
         } table[] = {
                 { "B", 1 },
                 { "K", 1024ULL },
@@ -2274,7 +2271,7 @@ int parse_bytes(const char *t, off_t *bytes) {
         };
 
         const char *p;
-        off_t r = 0;
+        unsigned long long r = 0;
 
         assert(t);
         assert(bytes);
@@ -2301,7 +2298,17 @@ int parse_bytes(const char *t, off_t *bytes) {
 
                 for (i = 0; i < ELEMENTSOF(table); i++)
                         if (startswith(e, table[i].suffix)) {
-                                r += (off_t) l * table[i].factor;
+                                unsigned long long tmp;
+                                if ((unsigned long long) l > ULLONG_MAX / table[i].factor)
+                                        return -ERANGE;
+                                tmp = l * table[i].factor;
+                                if (tmp > ULLONG_MAX - r)
+                                        return -ERANGE;
+
+                                r += tmp;
+                                if ((unsigned long long) (off_t) r != r)
+                                        return -ERANGE;
+
                                 p = e + strlen(table[i].suffix);
                                 break;
                         }
@@ -2309,7 +2316,7 @@ int parse_bytes(const char *t, off_t *bytes) {
                 if (i >= ELEMENTSOF(table))
                         return -EINVAL;
 
-        } while (*p != 0);
+        } while (*p);
 
         *bytes = r;
 
@@ -2417,6 +2424,25 @@ fallback:
         return random() * RAND_MAX + random();
 }
 
+unsigned random_u(void) {
+        _cleanup_close_ int fd;
+        unsigned u;
+        ssize_t r;
+
+        fd = open("/dev/urandom", O_RDONLY|O_CLOEXEC|O_NOCTTY);
+        if (fd < 0)
+                goto fallback;
+
+        r = loop_read(fd, &u, sizeof(u), true);
+        if (r != sizeof(u))
+                goto fallback;
+
+        return u;
+
+fallback:
+        return random() * RAND_MAX + random();
+}
+
 void rename_process(const char name[8]) {
         assert(name);
 
@@ -2773,8 +2799,8 @@ int rm_rf_children_dangerous(int fd, bool only_dirs, bool honour_sticky, struct
 _pure_ static int is_temporary_fs(struct statfs *s) {
         assert(s);
         return
-                F_TYPE_CMP(s->f_type, TMPFS_MAGIC) ||
-                F_TYPE_CMP(s->f_type, RAMFS_MAGIC);
+                F_TYPE_EQUAL(s->f_type, TMPFS_MAGIC) ||
+                F_TYPE_EQUAL(s->f_type, RAMFS_MAGIC);
 }
 
 int rm_rf_children(int fd, bool only_dirs, bool honour_sticky, struct stat *root_dev) {
@@ -3275,7 +3301,7 @@ char *ellipsize_mem(const char *s, size_t old_length, size_t new_length, unsigne
 
         r = new0(char, new_length+1);
         if (!r)
-                return r;
+                return NULL;
 
         x = (new_length * percent) / 100;
 
@@ -3465,7 +3491,9 @@ DIR *xopendirat(int fd, const char *name, int flags) {
         int nfd;
         DIR *d;
 
-        nfd = openat(fd, name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|flags);
+        assert(!(flags & O_CREAT));
+
+        nfd = openat(fd, name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|flags, 0);
         if (nfd < 0)
                 return NULL;
 
@@ -3491,26 +3519,23 @@ int signal_from_string_try_harder(const char *s) {
 }
 
 static char *tag_to_udev_node(const char *tagvalue, const char *by) {
-        char *dn, *t, *u;
-        int r;
-
-        /* FIXME: to follow udev's logic 100% we need to leave valid
-         * UTF8 chars unescaped */
+        _cleanup_free_ char *t = NULL, *u = NULL;
+        char *dn;
+        size_t enc_len;
 
         u = unquote(tagvalue, "\"\'");
         if (u == NULL)
                 return NULL;
 
-        t = xescape(u, "/ ");
-        free(u);
-
+        enc_len = strlen(u) * 4;
+        t = new(char, enc_len);
         if (t == NULL)
                 return NULL;
 
-        r = asprintf(&dn, "/dev/disk/by-%s/%s", by, t);
-        free(t);
+        if (encode_devnode_name(u, t, enc_len) < 0)
+                return NULL;
 
-        if (r < 0)
+        if (asprintf(&dn, "/dev/disk/by-%s/%s", by, t) < 0)
                 return NULL;
 
         return dn;
@@ -4343,7 +4368,7 @@ int in_group(const char *name) {
 
 int glob_exists(const char *path) {
         _cleanup_globfree_ glob_t g = {};
-        int r, k;
+        int k;
 
         assert(path);
 
@@ -4351,15 +4376,37 @@ int glob_exists(const char *path) {
         k = glob(path, GLOB_NOSORT|GLOB_BRACE, NULL, &g);
 
         if (k == GLOB_NOMATCH)
-                r = 0;
+                return 0;
         else if (k == GLOB_NOSPACE)
-                r = -ENOMEM;
+                return -ENOMEM;
         else if (k == 0)
-                r = !strv_isempty(g.gl_pathv);
+                return !strv_isempty(g.gl_pathv);
         else
-                r = errno ? -errno : -EIO;
+                return errno ? -errno : -EIO;
+}
 
-        return r;
+int glob_extend(char ***strv, const char *path) {
+        _cleanup_globfree_ glob_t g = {};
+        int k;
+        char **p;
+
+        errno = 0;
+        k = glob(optarg, GLOB_NOSORT|GLOB_BRACE, NULL, &g);
+
+        if (k == GLOB_NOMATCH)
+                return -ENOENT;
+        else if (k == GLOB_NOSPACE)
+                return -ENOMEM;
+        else if (k != 0 || strv_isempty(g.gl_pathv))
+                return errno ? -errno : -EIO;
+
+        STRV_FOREACH(p, g.gl_pathv) {
+                k = strv_extend(strv, *p);
+                if (k < 0)
+                        break;
+        }
+
+        return k;
 }
 
 int dirent_ensure_type(DIR *d, struct dirent *de) {
@@ -4388,38 +4435,31 @@ int dirent_ensure_type(DIR *d, struct dirent *de) {
 }
 
 int in_search_path(const char *path, char **search) {
-        char **i, *parent;
+        char **i;
+        _cleanup_free_ char *parent = NULL;
         int r;
 
         r = path_get_parent(path, &parent);
         if (r < 0)
                 return r;
 
-        r = 0;
-
-        STRV_FOREACH(i, search) {
-                if (path_equal(parent, *i)) {
-                        r = 1;
-                        break;
-                }
-        }
-
-        free(parent);
+        STRV_FOREACH(i, search)
+                if (path_equal(parent, *i))
+                        return 1;
 
-        return r;
+        return 0;
 }
 
 int get_files_in_directory(const char *path, char ***list) {
-        DIR *d;
-        int r = 0;
-        unsigned n = 0;
-        char **l = NULL;
+        _cleanup_closedir_ DIR *d = NULL;
+        size_t bufsize = 0, n = 0;
+        _cleanup_strv_free_ char **l = NULL;
 
         assert(path);
 
         /* Returns all files in a directory in *list, and the number
          * of files as return value. If list is NULL returns only the
-         * number */
+         * number. */
 
         d = opendir(path);
         if (!d)
@@ -4431,11 +4471,9 @@ int get_files_in_directory(const char *path, char ***list) {
                 int k;
 
                 k = readdir_r(d, &buf.de, &de);
-                if (k != 0) {
-                        r = -k;
-                        goto finish;
-                }
-
+                assert(k >= 0);
+                if (k > 0)
+                        return -k;
                 if (!de)
                         break;
 
@@ -4445,43 +4483,25 @@ int get_files_in_directory(const char *path, char ***list) {
                         continue;
 
                 if (list) {
-                        if ((unsigned) r >= n) {
-                                char **t;
-
-                                n = MAX(16, 2*r);
-                                t = realloc(l, sizeof(char*) * n);
-                                if (!t) {
-                                        r = -ENOMEM;
-                                        goto finish;
-                                }
-
-                                l = t;
-                        }
-
-                        assert((unsigned) r < n);
+                        /* one extra slot is needed for the terminating NULL */
+                        if (!GREEDY_REALLOC(l, bufsize, n + 2))
+                                return -ENOMEM;
 
-                        l[r] = strdup(de->d_name);
-                        if (!l[r]) {
-                                r = -ENOMEM;
-                                goto finish;
-                        }
+                        l[n] = strdup(de->d_name);
+                        if (!l[n])
+                                return -ENOMEM;
 
-                        l[++r] = NULL;
+                        l[++n] = NULL;
                 } else
-                        r++;
+                        n++;
         }
 
-finish:
-        if (d)
-                closedir(d);
-
-        if (r >= 0) {
-                if (list)
-                        *list = l;
-        } else
-                strv_free(l);
+        if (list) {
+                *list = l;
+                l = NULL; /* avoid freeing */
+        }
 
-        return r;
+        return n;
 }
 
 char *strjoin(const char *x, ...) {
@@ -5264,13 +5284,17 @@ bool string_is_safe(const char *p) {
         return true;
 }
 
+/**
+ * Check if a string contains control characters.
+ * Spaces and tabs are not considered control characters.
+ */
 bool string_has_cc(const char *p) {
         const char *t;
 
         assert(p);
 
         for (t = p; *t; t++)
-                if (*t > 0 && *t < ' ')
+                if (*t > 0 && *t < ' ' && *t != '\t')
                         return true;
 
         return false;
@@ -5343,20 +5367,24 @@ bool is_locale_utf8(void) {
                 goto out;
         }
 
-        /* For LC_CTYPE=="C" return true,
-         * because CTYPE is effectly unset and
-         * everything defaults to UTF-8 nowadays. */
-
+        /* For LC_CTYPE=="C" return true, because CTYPE is effectly
+         * unset and everything can do to UTF-8 nowadays. */
         set = setlocale(LC_CTYPE, NULL);
         if (!set) {
                 cached_answer = true;
                 goto out;
         }
 
-        cached_answer = streq(set, "C");
+        /* Check result, but ignore the result if C was set
+         * explicitly. */
+        cached_answer =
+                streq(set, "C") &&
+                !getenv("LC_ALL") &&
+                !getenv("LC_CTYPE") &&
+                !getenv("LANG");
 
 out:
-        return (bool)cached_answer;
+        return (bool) cached_answer;
 }
 
 const char *draw_special_char(DrawSpecialChar ch) {
@@ -5671,7 +5699,7 @@ int search_and_fopen_nulstr(const char *path, const char *mode, const char *sear
 
 int create_tmp_dir(char template[], char** dir_name) {
         int r = 0;
-        char *d, *dt;
+        char *d = NULL, *dt;
 
         assert(dir_name);
 
@@ -5847,3 +5875,48 @@ bool id128_is_valid(const char *s) {
 
         return true;
 }
+
+void parse_user_at_host(char *arg, char **user, char **host) {
+        assert(arg);
+        assert(user);
+        assert(host);
+
+        *host = strchr(arg, '@');
+        if (*host == NULL)
+                *host = arg;
+        else {
+                *host[0]++ = '\0';
+                *user = arg;
+        }
+}
+
+int split_pair(const char *s, const char *sep, char **l, char **r) {
+        char *x, *a, *b;
+
+        assert(s);
+        assert(sep);
+        assert(l);
+        assert(r);
+
+        if (isempty(sep))
+                return -EINVAL;
+
+        x = strstr(s, sep);
+        if (!x)
+                return -EINVAL;
+
+        a = strndup(s, x - s);
+        if (!a)
+                return -ENOMEM;
+
+        b = strdup(x + strlen(sep));
+        if (!b) {
+                free(a);
+                return -ENOMEM;
+        }
+
+        *l = a;
+        *r = b;
+
+        return 0;
+}
diff --git a/src/shared/util.h b/src/shared/util.h
index 64e63b8c07..1b845b3803 100644
--- a/src/shared/util.h
+++ b/src/shared/util.h
@@ -106,9 +106,19 @@ static inline bool isempty(const char *p) {
         return !p || !p[0];
 }
 
+static inline const char *startswith(const char *s, const char *prefix) {
+        if (strncmp(s, prefix, strlen(prefix)) == 0)
+                return s + strlen(prefix);
+        return NULL;
+}
+
+static inline const char *startswith_no_case(const char *s, const char *prefix) {
+        if (strncasecmp(s, prefix, strlen(prefix)) == 0)
+                return s + strlen(prefix);
+        return NULL;
+}
+
 char *endswith(const char *s, const char *postfix) _pure_;
-char *startswith(const char *s, const char *prefix) _pure_;
-char *startswith_no_case(const char *s, const char *prefix) _pure_;
 
 bool first_word(const char *s, const char *word) _pure_;
 
@@ -210,6 +220,7 @@ int get_process_cmdline(pid_t pid, size_t max_length, bool comm_fallback, char *
 int get_process_exe(pid_t pid, char **name);
 int get_process_uid(pid_t pid, uid_t *uid);
 int get_process_gid(pid_t pid, gid_t *gid);
+int get_process_capeff(pid_t pid, char **capeff);
 
 char hexchar(int x) _const_;
 int unhexchar(char c) _const_;
@@ -242,6 +253,7 @@ int make_null_stdio(void);
 int make_console_stdio(void);
 
 unsigned long long random_ull(void);
+unsigned random_u(void);
 
 /* For basic lookup tables with strictly enumerated entries */
 #define __DEFINE_STRING_TABLE_LOOKUP(name,type,scope)                   \
@@ -373,6 +385,22 @@ void columns_lines_cache_reset(int _unused_ signum);
 
 bool on_tty(void);
 
+static inline const char *ansi_highlight(void) {
+        return on_tty() ? ANSI_HIGHLIGHT_ON : "";
+}
+
+static inline const char *ansi_highlight_red(void) {
+        return on_tty() ? ANSI_HIGHLIGHT_RED_ON : "";
+}
+
+static inline const char *ansi_highlight_green(void) {
+        return on_tty() ? ANSI_HIGHLIGHT_GREEN_ON : "";
+}
+
+static inline const char *ansi_highlight_off(void) {
+        return on_tty() ? ANSI_HIGHLIGHT_OFF : "";
+}
+
 int running_in_chroot(void);
 
 char *ellipsize(const char *s, size_t length, unsigned percent);
@@ -439,6 +467,7 @@ char* uid_to_name(uid_t uid);
 char* gid_to_name(gid_t gid);
 
 int glob_exists(const char *path);
+int glob_extend(char ***strv, const char *path);
 
 int dirent_ensure_type(DIR *d, struct dirent *de);
 
@@ -732,3 +761,6 @@ static inline void _reset_locale_(struct _locale_struct_ *s) {
              _saved_locale_.quit = true)
 
 bool id128_is_valid(const char *s) _pure_;
+void parse_user_at_host(char *arg, char **user, char **host);
+
+int split_pair(const char *s, const char *sep, char **l, char **r);
diff --git a/src/shared/virt.c b/src/shared/virt.c
index 1c86a3dd1e..4f8134a773 100644
--- a/src/shared/virt.c
+++ b/src/shared/virt.c
@@ -29,6 +29,8 @@
 
 /* Returns a short identifier for the various VM implementations */
 int detect_vm(const char **id) {
+        _cleanup_free_ char *cpuinfo_contents = NULL;
+        int r;
 
 #if defined(__i386__) || defined(__x86_64__)
 
@@ -67,7 +69,6 @@ int detect_vm(const char **id) {
         const char *j, *k;
         bool hypervisor;
         _cleanup_free_ char *hvtype = NULL;
-        int r;
 
         /* Try high-level hypervisor sysfs file first:
          *
@@ -164,6 +165,16 @@ int detect_vm(const char **id) {
         }
 
 #endif
+
+        /* Detect User-Mode Linux by reading /proc/cpuinfo */
+        r = read_full_file("/proc/cpuinfo", &cpuinfo_contents, NULL);
+        if (r < 0)
+                return r;
+        if (strstr(cpuinfo_contents, "\nvendor_id\t: User Mode Linux\n")) {
+                *id = "uml";
+                return 1;
+        }
+
         return 0;
 }