summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* pid1: stop making /dev noexecdev-no-noexecZbigniew Jędrzejewski-Szmek2020-12-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | Quoting Andy Lutomirski: > The upcoming Linux SGX driver has a device node /dev/sgx. User code opens > it, does various setup things, mmaps it, and needs to be able to create > PROT_EXEC mappings. This gets quite awkward if /dev is mounted noexec. We already didn't use noexec in spawn, and this extends this behaviour to other systems. Afaik, the kernel would refuse execve() on a character or block device anyway. Thus noexec on /dev matters only for actual binaries copied to /dev, which requires root privileges in the first place. We don't do noexec on either /tmp or /dev/shm (because that causes immediate problems with stuff like Java and cffi). And if you have those two at your disposal anyway, having noexec on /dev doesn't seem important. So the 'noexec' attribute on /dev doesn't really mean much, since there are multiple other similar directories which don't require root privileges to write to. C.f. https://salsa.debian.org/kernel-team/initramfs-tools/-/commit/33c10ef43b03dc6d9ee09a46c598f6ee34ad0b81.
* Merge pull request #17935 from ↵Zbigniew Jędrzejewski-Szmek2020-12-112-19/+22
|\ | | | | | | | | yuwata/network-fix-another-race-in-link-reconfigure-17929 network: do not reconfigure interface when the link gains carrier but udev not initialized it yet
| * network: adjust commentsZbigniew Jędrzejewski-Szmek2020-12-111-3/+3
| | | | | | Co-authored-by: Carlo Teubner <435950+c4rlo@users.noreply.github.com>
| * network: do not reconfigure interface when the link gains carrier but udev ↵Yu Watanabe2020-12-112-19/+22
|/ | | | | | | | | | | not initialized it yet When an interface gains carrier but udev have not initialized the interface or link_initialized_handler() has not been called yet, then link_configure will be called twice. Thus LLDP client will be configured twice, and triggers assertion. Fixes #17929.
* cryptsetup: Fix crypto device missing issue after bootupJinyuan Si2020-12-101-1/+1
| | | | | | | | | | | | | | | | | | | | Normally, the udev rules operate on "change" events. But when coldplugging, there's an "add" event present. The udev rules have to recognize this and do some actions in this particular situation, too. Also, we don't want the nodes to be created prematurely on "add" events while not coldplugging. The udev rules will check DM_UDEV_PRIMARY_SOURCE_FLAG to see if the device was activated correctly before and if not, it ignore the "add" event totally. This way the udev rules can support udev triggers generating "add" events (e.g. "udevadm trigger --action=add" or "echo add > /sys/block/<dm_device>/uevent"). In this case, the udevd service is started after systemd-cryptsetup@config.service, is started, which will cause udevd service to miss the "change" uevent with DM_UDEV_PRIMARY_SOURCE_FLAG flag generated by systemd-cryptsetup@config.service. To solve this issue, we let the cryptsetup service be started after the udevd service.
* Merge pull request #17903 from yuwata/udev-options-log-levelLennart Poettering2020-12-1010-49/+97
|\ | | | | udev: introduce OPTIONS="log_level=xxx" rule
| * man: mention new OPTIONS=log_level= udev ruleYu Watanabe2020-12-101-0/+18
| |
| * udev: introduce new OPTIONS="log_level=" udev ruleYu Watanabe2020-12-106-5/+45
| |
| * udev: introduce log_device_uevent() helper functionYu Watanabe2020-12-103-30/+20
| | | | | | | | And this drops duplicated check for seqnum and device action.
| * udev: drop meaningless size optimizationYu Watanabe2020-12-103-14/+14
| | | | | | | | | | These objects are not allocated multiple times simultaneously per single process.
* | Drop compat "gateway" nameZbigniew Jędrzejewski-Szmek2020-12-105-28/+8
| | | | | | | | | | | | | | Back in 5248e7e1f11aba6859de0b28f0dd3778b22842f2 (July 2017) we moved over to "_gateway", with the old name declared to be temporary measure. Since we're doing a bunch of changes to resolved now, it seems to be a good moment to make this simplification and not add support for the compat name in new code.
* | veritysetup: also place udev socket depLennart Poettering2020-12-101-1/+1
| | | | | | | | | | In light of #17848, also place udev socket dep in veritysetup, it's the same issue after all.
* | seccomp: don't install filters for archs that can't use syscallsGreg Depoire--Ferrer2020-12-103-24/+41
| | | | | | | | | | | | | | | | | | When seccomp_restrict_archs is called, architectures that are blocked are replaced by the SECCOMP_LOCAL_ARCH_BLOCKED marker so that they are not disabled again and filters are not installed for them. This can make some service that use SystemCallArchitecture= and SystemCallFilter= start faster.
* | mmap-cache: bind prot(ection) to MMapFileDescriptorVito Caputo2020-12-106-41/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are no mmap_cache_get() users that actually deviate prot from the JournalFile's f->prot. So there's no point in making this a separate parameter to mmap_cache_get(), nor is there any need to store it in JournalFile's f->prot. Instead just pass it to mmap_cache_add_fd() at MMapFileDescriptor creation, storing it in there for the mmap() callers, which already receive MMapFileDescriptor *. For functions receiving both an MMapFileDescriptor * and prot, the prot argument has been simply removed and call sites updated. Formalizing this fd:prot binding at the public API also enables discarding the prot check in window_matches(), which is a hot function on long window lists, so a minor CPU efficiency gain should be had there as seen with the past removal of the fd check. Unnoticable for uncached journals, but maybe a little runtime improvement when cached in specific circumstances. window_matches_fd() has also been simplified to treat the MMapFileDescrptor * as equivalent to its fd and prot.
* | three spdx header fixesLennart Poettering2020-12-103-3/+3
| |
* | Merge pull request #17851 from yuwata/network-address-compare-funcLennart Poettering2020-12-106-71/+132
|\ \ | | | | | | network: revert previous changes to address_compare_func()
| * | network: warn when NDISC and DHCPv6 provide the same addressYu Watanabe2020-12-081-6/+67
| | | | | | | | | | | | | | | | | | | | | With some router, the address in NDISC generated with EUI-64 conflicts with an address provided by DHCPv6. Prompted by #17831.
| * | network: fix SIGABRT related to unreachable route with DHCP6Yu Watanabe2020-12-081-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After #17834, unreachable routes generated through DHCP6 are managed by Manager. But they are referrenced by the DHCP6 uplink. So, the routes managed by Manager must be freed after all Link objects are freed. Follow-up for 575f14eef010101c60e9d4d970e542c815be1994. Fixes SIGABRT reproted in #17831.
| * | network: use address_get() in address_exists()Yu Watanabe2020-12-083-21/+15
| | | | | | | | | | | | And rename address_exists() to link_has_ipv6_address().
| * | network: revert previous changes to address_compare_func()Yu Watanabe2020-12-082-41/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This partially reverts fe841414ef157f7f01d339c5d5730126e7b5fe0a and 2a236f9fc0ff8fb2152032551436fde74da7217a. For IPv4, kernel compares the local address, prefix, and prefixlen. For IPv6, kernel compares only the local address. Let's follow the kernel's comparison way. Fixes #17831.
* | | mmap-cache: separate context and window list cache hit accountingVito Caputo2020-12-101-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | Account and log these statistics separately since their overheads are potentially quite different when the window lists are large. There should probably be a histogram of window list traversal counts too.
* | | networkd-test: add final newlines in generated files, use .format()Zbigniew Jędrzejewski-Szmek2020-12-101-30/+50
| | |
* | | udev: Fix sound.target dependencyTakashi Iwai2020-12-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The recent bug report indicated a race at device creation and the sound.target dependencies, and the cause turned out to be the condition of the sound.target trigger. Currently it's set for "card*", but this is actually the parent object; i.e. the sound.target is triggered before the sound devices are created. For assuring the whole sound device creations beforehand, we need to use "controlC*" instead of "card*"; as already described in 78-sound-card.rules, this is guaranteed to be the last device, and can be used as a synchronization point. BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1179363 Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | | Merge pull request #17877 from yuwata/missing-syscall-sortYu Watanabe2020-12-101-138/+190
|\ \ \ | |_|/ |/| | missing: sort architectures in missing_syscall.h
| * | missing: update warning messagesYu Watanabe2020-12-081-9/+9
| | |
| * | missing: add missing syscalls for ia64, m68k, sparc, arc, and tilegxYu Watanabe2020-12-081-8/+58
| | | | | | | | | | | | | | | These are not tested, but several syscalls are defined for these architectures. Let's add syscalls comprehensively.
| * | missing: drop redundant conditionYu Watanabe2020-12-081-5/+5
| | |
| * | missing: support 32bit powerpcYu Watanabe2020-12-081-2/+2
| | |
| * | missing: sort architectures in missing_syscall.hYu Watanabe2020-12-081-130/+132
| |/
* | Merge pull request #17869 from DaanDeMeyer/mkosi-gdbLennart Poettering2020-12-095-2/+12
|\ \ | | | | | | mkosi: Add gdb to final images
| * | mkosi: Add strace to final imagesDaan De Meyer2020-12-095-2/+5
| | | | | | | | | | | | Useful for debugging purposes.
| * | mkosi: Add gdb to final imagesDaan De Meyer2020-12-095-0/+7
| | | | | | | | | | | | | | | | | | Let's add a debugger to the mkosi images so we can debug coredumps from inside mkosi qemu VMs (and hopefully in the future from mkosi systemd-nspawn containers as well).
* | | Merge pull request #17884 from poettering/test-dlopenLennart Poettering2020-12-096-14/+94
|\ \ \ | | | | | | | | tests: add test that dlopen()s our weak shared library deps once
| * | | meson: specify correct libqrencode version in meson depLuca Boccassi2020-12-091-0/+1
| | | |
| * | | test: pull in weak deps into testsLuca Boccassi2020-12-091-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | (Pulled from @bluca's comment here: https://github.com/systemd/systemd/pull/17884#issuecomment-740005624 and turned into a commit by @poettering)
| * | | test: add test that dlopen()'s all our weak library deps onceLennart Poettering2020-12-092-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This test should ensure we notice if distros update shared libraries that broke so name, and we still use the old soname. (In contrast to what the commit summary says, this currently doesn#t cover really all such deps, specifically xkbcommon and PCRE are missing, since they currently aren't loaded from src/shared/. This is stuff to fix later)
| * | | qrcode-util: make dlopen() logic more like the other casesLennart Poettering2020-12-092-14/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's add a dlopen_qrencode() function that does the actual dlopen() stuff and caches the result. This is useful so that we later can automatically test for all dlopen hookups to work correctly.
* | | | udev: link_update() should fail if the entry in symlink dir couldn't have ↵Franck Bui2020-12-091-9/+12
| | | | | | | | | | | | | | | | | | | | | | | | been created Follow-up for 30f6dce62cb3a738b20253f2192270607c31b55b
* | | | virt: drop /proc/1/sched hackLennart Poettering2020-12-091-19/+2
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | On really old kernels (< 4.14+) a bug in /proc/1/sched handling in the kernel could be used to determine whether we are running in a PID namespace. This hasn't worked for a long time, and there's little point in making things work on old kernels we can't make work on current kernels, hence let's drop that old cruft. See: #8153
* | | log: add helper set sets log level in all realmsLennart Poettering2020-12-092-2/+8
| | | | | | | | | | | | Prompted-by: #17903
* | | man: document that automount units are privilegedLennart Poettering2020-12-092-0/+7
| | | | | | | | | | | | Fixes: #17886
* | | Merge pull request #17911 from yuwata/log-cli-program-use-journalLuca Boccassi2020-12-091-10/+11
|\ \ \ | | | | | | | | log: open journal when cli program run in a service unit
| * | | log: open journal when cli program run in a service unitYu Watanabe2020-12-091-1/+3
| | | | | | | | | | | | | | | | Previously, cli programs like networkctl always use console for logging.
| * | | log: make show_color variable tristateYu Watanabe2020-12-091-4/+4
| | | | | | | | | | | | | | | | Should not change any behavior.
| * | | log: merge conditions to reduce indentationYu Watanabe2020-12-091-5/+4
| | | |
* | | | Merge pull request #17882 from poettering/logind-async-closeLuca Boccassi2020-12-092-23/+13
|\ \ \ \ | | | | | | | | | | logind: fix closing of button input devices
| * | | | logind: use free_and_strdup() where appropriateLennart Poettering2020-12-091-11/+1
| | | | |
| * | | | logind: fix closing of button input devicesLennart Poettering2020-12-091-12/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a fix of #17751. Specifically: 1. Sort #include headers again 2. Remove tabs, as per coding style 3. Don't install fds in half-initialized objects 4. Use asynchronous_close() everywhere That all said: Quit frankly, I am not convinced we should do all this at all. If close()ing of these input devices is really that slow, then this should probably be fixed in the kernel, not worked around in userspace like this.
| * | | | async: add trivial cleanup wrapper for asynchronous_close()Lennart Poettering2020-12-091-0/+6
| |/ / /
* | | | Silence cgroups v1 read-only filesystem warningDaan De Meyer2020-12-091-2/+20
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid warning messages when booting systemd-nspawn containers and using hybrid or legacy cgroups. systemd-nspawn mounts the cgroups v1 controller tree as read-only so these errors are expected and not problematic. Partially fixes #17862. Test plan: - Before: `mkosi --default .mkosi/mkosi.fedora boot` ``` ‣ Processing default... Spawning container image on /home/daan/projects/systemd/image.raw. Press ^] three times within 1s to kill container. systemd 247 running in system mode. (+PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified) Detected virtualization systemd-nspawn. Detected architecture x86-64. Welcome to Fedora 33 (Thirty Three)! Queued start job for default target Graphical Interface. -.slice: Failed to migrate controller cgroups from , ignoring: Read-only file system system.slice: Failed to delete controller cgroups /system.slice, ignoring: Read-only file system [ OK ] Created slice system-getty.slice. [ OK ] Created slice system-modprobe.slice. user.slice: Failed to delete controller cgroups /user.slice, ignoring: Read-only file system [ OK ] Created slice User and Session Slice. [ OK ] Started Dispatch Password Requests to Console Directory Watch. [ OK ] Started Forward Password Requests to Wall Directory Watch. [ OK ] Reached target Local Encrypted Volumes. [ OK ] Reached target Paths. [ OK ] Reached target Remote File Systems. [ OK ] Reached target Slices. [ OK ] Reached target Swap. [ OK ] Listening on Process Core Dump Socket. [ OK ] Listening on initctl Compatibility Named Pipe. [ OK ] Listening on Journal Socket (/dev/log). [ OK ] Listening on Journal Socket. [ OK ] Listening on User Database Manager Socket. dev-hugepages.mount: Failed to delete controller cgroups /dev-hugepages.mount, ignoring: Read-only file system Mounting Huge Pages File System... sys-fs-fuse-connections.mount: Failed to delete controller cgroups /sys-fs-fuse-connections.mount, ignoring: Read-only file system Mounting FUSE Control File System... Starting Journal Service... Starting Remount Root and Kernel File Systems... system.slice: Failed to delete controller cgroups /system.slice, ignoring: Read-only file system ``` After: `mkosi --default .mkosi/mkosi.fedora boot` ``` ‣ Processing default... Spawning container image on /home/daan/projects/systemd/mkosi.output/image.raw. Press ^] three times within 1s to kill container. systemd 247 running in system mode. (+PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified) Detected virtualization systemd-nspawn. Detected architecture x86-64. Welcome to Fedora 33 (Thirty Three)! Queued start job for default target Graphical Interface. [ OK ] Created slice system-getty.slice. [ OK ] Created slice system-modprobe.slice. [ OK ] Created slice User and Session Slice. [ OK ] Started Dispatch Password Requests to Console Directory Watch. [ OK ] Started Forward Password Requests to Wall Directory Watch. [ OK ] Reached target Local Encrypted Volumes. [ OK ] Reached target Paths. [ OK ] Reached target Remote File Systems. [ OK ] Reached target Slices. [ OK ] Reached target Swap. [ OK ] Listening on Process Core Dump Socket. [ OK ] Listening on initctl Compatibility Named Pipe. [ OK ] Listening on Journal Socket (/dev/log). [ OK ] Listening on Journal Socket. [ OK ] Listening on User Database Manager Socket. Mounting Huge Pages File System... Mounting FUSE Control File System... Starting Journal Service... Starting Remount Root and Kernel File Systems... [ OK ] Mounted Huge Pages File System. [ OK ] Mounted FUSE Control File System. [ OK ] Finished Remount Root and Kernel File Systems. Starting Create Static Device Nodes in /dev... [ OK ] Finished Create Static Device Nodes in /dev. [ OK ] Reached target Local File Systems (Pre). [ OK ] Reached target Local File Systems. Starting Restore /run/initramfs on shutdown... [ OK ] Finished Restore /run/initramfs on shutdown. [ OK ] Started Journal Service. Starting Flush Journal to Persistent Storage... [ OK ] Finished Flush Journal to Persistent Storage. Starting Create Volatile Files and Directories... [ OK ] Finished Create Volatile Files and Directories. Starting Network Name Resolution... Starting Update UTMP about System Boot/Shutdown... [ OK ] Finished Update UTMP about System Boot/Shutdown. [ OK ] Reached target System Initialization. [ OK ] Started Daily Cleanup of Temporary Directories. [ OK ] Reached target Timers. [ OK ] Listening on D-Bus System Message Bus Socket. [ OK ] Reached target Sockets. [ OK ] Reached target Basic System. Starting Home Area Manager... Starting User Login Management... Starting Permit User Sessions... [ OK ] Finished Permit User Sessions. [ OK ] Started Console Getty. [ OK ] Reached target Login Prompts. Starting D-Bus System Message Bus... [ OK ] Started D-Bus System Message Bus. [ OK ] Started Home Area Manager. [ OK ] Started User Login Management. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Finished Update UTMP about System Runlevel Changes. [ OK ] Started Network Name Resolution. [ OK ] Reached target Host and Network Name Lookups. Fedora 33 (Thirty Three) (built from systemd tree) Kernel 5.9.11-arch2-1 on an x86_64 (console) ```
View Lorry Controller Status