summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Revert "units: set ConditionVirtualization=!private-users on journald audit ↵revert-6508-audit-socketLennart Poettering2017-08-021-1/+0
| | | | | | socket (#6508)" This reverts commit d2a1ba103b4ea22764953d795c36db3d492d50c9.
* Revert "modprobe.d: ship drop-in to set bonding max_bonds to 0 (#6448)"Lennart Poettering2017-08-020-0/+0
| | | | This reverts commit 582faeb461aa0dd01b55bf6c9b1433532fc927d3.
* units: set ConditionVirtualization=!private-users on journald audit socket ↵Dimitri John Ledkov2017-08-021-0/+1
| | | | | (#6508) It fails to start in an unprivileged container as audit is not namespace aware.
* scsi_id: add missing options to getopt_long() (#6501)Jan Synacek2017-08-021-1/+1
|
* networkd: add scope to address section (#6449)Susant Sahani2017-08-014-1/+54
| | | | | | | This work allows to configure address Scope to host | link | global or a number. Closes #6446
* Merge pull request #6420 from keszybz/gateway-nameLennart Poettering2017-08-019-10/+55
|\ | | | | Rename "gateway" to "_gateway" and other resolved changes
| * resolved: add debug message about stub listenerZbigniew Jędrzejewski-Szmek2017-07-311-0/+8
| |
| * resolved,nss-myhostname: use _gateway for the gatewayZbigniew Jędrzejewski-Szmek2017-07-316-7/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This changes the symbolic name for the default gateway from "gateway" to "_gateway". A new configuration option -Dcompat-gateway-hostname=true|false is added. If it is set, the old name is also supported, but the new name is used as the canonical name in either case. This is intended as a temporary measure to make the transition easier, and the option should be removed after a few releases, at which point only the new name will be used. The old "gateway" name mostly works OK, but hasn't gained widespread acceptance because of the following (potential) conflicts: - it is completely legal to have a host called "gateway" - there is no guarantee that "gateway" will not be registered as a TLD, even though this currently seems unlikely. (Even then, there would be no conflict except for the case when the top-level domain itself was being resolved. The "gateway" or "_gateway" labels have only special meaning when the whole name consists of a single label, so resolution of any subdomain of the hypothetical gateway. TLD would still work OK. ) Moving to "_gateway" avoids those issues because underscores are not allowed in host names (RFC 1123, §2.1) and avoids potential conflicts with local or global names. v2: - simplify the logic to hardcode "_gateway" and allow -Dcompat-gateway-hostname=true as a temporary measure.
| * resolved: make sure idn2 conversions are roundtrippableZbigniew Jędrzejewski-Szmek2017-07-212-3/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While working on the gateway→_gateway conversion, I noticed that libidn2 strips the leading underscore in some names. https://gitlab.com/libidn/libidn2/issues/30 was resolved in https://gitlab.com/libidn/libidn2/commit/05d753ea69e2308cd02436d0511f4b844071dc79, which disabled "STD3 ASCII rules" by default, i.e. disabled stripping of underscores. So the situation is that with previously released libidn2 versions we would get incorrect behaviour, and once new libidn2 is released, we should be OK. Let's implement a simple test which checks that the name survives the roundtrip, and if it doesn't, skip IDN resolution. Under old libidn2 this will fail in more cases, and under new libidn2 in fewer, but should be the right thing to do also under new libidn2.
* | core: check which MACs to use before a new mount ns is created (#6498)Fabio Kung2017-08-011-22/+36
| | | | | | | | | | | | | | | | | | /sys is not guaranteed to exist when a new mount namespace is created. It is only mounted under conditions specified by `namespace_info_mount_apivfs`. Checking if the three available MAC LSMs are enabled requires a sysfs mounted at /sys, so the checks are moved to before a new mount ns is created.
* | Merge pull request #6392 from poettering/journal-cacheLennart Poettering2017-07-3133-434/+988
|\ \ | | | | | | add limited metadata caching to journald and other journal improvements
| * | journald: add minimal client metadata cachingLennart Poettering2017-07-3110-371/+851
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cache client metadata, in order to be improve runtime behaviour under pressure. This is inspired by @vcaputo's work, specifically: https://github.com/systemd/systemd/pull/2280 That code implements related but different semantics. For a longer explanation what this change implements please have a look at the long source comment this patch adds to journald-context.c. After this commit: # time bash -c 'dd bs=$((1024*1024)) count=$((1*1024)) if=/dev/urandom | systemd-cat' 1024+0 records in 1024+0 records out 1073741824 bytes (1.1 GB, 1.0 GiB) copied, 11.2783 s, 95.2 MB/s real 0m11.283s user 0m0.007s sys 0m6.216s Before this commit: # time bash -c 'dd bs=$((1024*1024)) count=$((1*1024)) if=/dev/urandom | systemd-cat' 1024+0 records in 1024+0 records out 1073741824 bytes (1.1 GB, 1.0 GiB) copied, 52.0788 s, 20.6 MB/s real 0m52.099s user 0m0.014s sys 0m7.170s As side effect, this corrects the journal's rate limiter feature: we now always use the unit name as key for the ratelimiter.
| * | string-util: optimize strshorten() a bitLennart Poettering2017-07-311-1/+1
| | | | | | | | | | | | | | | There's no reason to determine the full length of the string, it's sufficient to know whether it is larger than the intended size...
| * | alloc-util: add new helpers memdup_suffix0() and newdup_suffix0()Lennart Poettering2017-07-313-10/+34
| | | | | | | | | | | | | | | | | | | | | These are similar to memdup() and newdup(), but reserve one extra NUL byte at the end of the new allocation and initialize it. It's useful when copying out data from fixed size character arrays where NUL termination can't be assumed.
| * | string-util: add strlen_ptr() helperLennart Poettering2017-07-318-7/+24
| | | | | | | | | | | | | | | strlen_ptr() is to strlen() what streq_ptr() is to streq(): i.e. it handles NULL strings in a smart way.
| * | process-util: slightly optimize querying of our own process metadataLennart Poettering2017-07-311-3/+27
| | | | | | | | | | | | When we are checking our own data, we can optimize things a bit.
| * | journald: only accept valid unit names for log streamsLennart Poettering2017-07-311-11/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's be a bit stricter in what we end up logging: ignore invalid unit name specifications. Let's validate all input! As we ignore unit names passed in from unprivileged clients anyway the effect of this additional check is minimal. (Also, no need to initialize the identifier/unit_id fields of stream objects to NULL if empty strings are passed, the default is NULL anyway...)
| * | journald: add comment explaining journal rate limit return codesLennart Poettering2017-07-311-0/+7
| | | | | | | | | | | | This is not obvious, hence let's add a comment.
| * | execute: don't pass unit ID in --user mode to journald for stream loggingLennart Poettering2017-07-311-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we create a log stream connection to journald, we pass along the unit ID. With this change we do this only when we run as system instance, not as user instance, to remove the ambiguity whether a user or system unit is specified. The effect of this change is minor: journald ignores the field anyway from clients with UID != 0. This patch hence only fixes the unit attribution for the --user instance of the root user.
| * | execute: make some code shorterLennart Poettering2017-07-311-8/+4
| | | | | | | | | | | | Let's simplify some lines to make it shorter.
| * | parse-util: introduce pid_is_valid()Lennart Poettering2017-07-313-2/+7
| | | | | | | | | | | | | | | | | | Checking for validity of a PID is relatively easy, but let's add a helper cal for this too, in order to make things more readable and more similar to uid_is_valid(), gid_is_valid() and friends.
| * | core, sd-bus, logind: make use of uid_is_valid() in more placesLennart Poettering2017-07-313-7/+7
| | |
| * | audit: introduce audit_session_is_valid() and make use of it everywhereLennart Poettering2017-07-315-10/+14
| | | | | | | | | | | | | | | | | | | | | Let's add a proper validation function, since validation isn't entirely trivial. Make use of it where applicable. Also make use of AUDIT_SESSION_INVALID where we need a marker for an invalid audit session.
| * | escape: fix systemd-escape description textLennart Poettering2017-07-312-2/+2
|/ / | | | | | | | | | | | | | | The long man page paragraph got it right: the tool is for escaping systemd unit names, not just system unit names. Also fix the short man page paragraph and the --help text. Follow-up for 303608c1bcf9568371625fbbd9442946cadba422
* | namespace: keep selinuxfs mounted read-write with ProtectKernelTunables (#5741)Nicolas Iooss2017-07-311-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a service unit uses "ProtectKernelTunables=yes", it currently remounts /sys/fs/selinux read-only. This makes libselinux report SELinux state as "disabled", because most SELinux features are not usable. For example it is not possible to validate security contexts (with security_check_context_raw() or /sys/fs/selinux/context). This behavior of libselinux has been described in http://danwalsh.livejournal.com/73099.html and confirmed in a recent email, https://marc.info/?l=selinux&m=149220233032594&w=2 . Since commit 0c28d51ac849 ("units: further lock down our long-running services"), systemd-localed unit uses ProtectKernelTunables=yes. Nevertheless this service needs to use libselinux API in order to create /etc/vconsole.conf, /etc/locale.conf... with the right SELinux contexts. This is broken when /sys/fs/selinux is mounted read-only in the mount namespace of the service. Make SELinux-aware systemd services work again when they are using ProtectKernelTunables=yes by keeping selinuxfs mounted read-write.
* | mount-setup: mount xenfs filesystem (#6491)vliaskov2017-07-311-0/+2
| |
* | core: Do not fail perpetual mount units without fragment (#6459)Abdó Roig-Maranges2017-07-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | mount_load does not require fragment files to be present in order to load mount units which are perpetual, or come from /proc/self/mountinfo. mount_verify should do the same, otherwise a synthesized '-.mount' would be marked as failed with "No such file or directory", as it is perpetual but not marked to come from /proc/self/mountinfo at this point. This happens for the user instance, and I suspect it was the cause of #5375 for the system instance, without gpt-generator.
* | Merge pull request #6472 from yuwata/journal-gateway-fixLennart Poettering2017-07-315-5/+25
|\ \ | | | | | | Some journal-gateway and journal-remote related fixes
| * | journal-remote: use MHD_OPTION_STRICT_FOR_CLIENT if MHD_USE_PEDANTIC_CHECKS ↵Yu Watanabe2017-07-281-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | is deprecated The option MHD_OPTION_STRICT_FOR_CLIENT is provided since libmicrohttpd-0.9.54, and MHD_USE_PEDANTIC_CHECKS will be deprecated in future. This makes support both option.
| * | journal-gateway: use MHD_USE_POLL_INTERNAL_THREAD instead of MHD_USE_POLLYu Watanabe2017-07-282-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The option MHD_USE_THREAD_PER_CONNECTION requires MHD_USE_POLL_INTERNAL_THREAD since libmicrohttpd-0.9.53. If MHD_USE_POLL is used instead of MHD_USE_POLL_INTERNAL_THREAD, then the library outputs the following warning: ``` Warning: MHD_USE_THREAD_PER_CONNECTION must be used only with MHD_USE_INTERNAL_POLLING_THREAD. Flag MHD_USE_INTERNAL_POLLING_THREAD was added. Consider setting MHD_USE_INTERNAL_POLLING_THREAD explicitly. ``` The option MHD_USE_POLL_INTERNAL_THREAD is defined as `MHD_USE_POLL_INTERNAL_THREAD = MHD_USE_POLL | MHD_USE_INTERNAL_POLLING_THREAD,` So, let's use MHD_USE_POLL_INTERNAL_THREAD instead of MHD_USE_POLL.
| * | journal-remote,gateway: use MHD_USE_TLS instead of MHD_USE_SSLYu Watanabe2017-07-283-3/+8
| | | | | | | | | | | | The option is renamed in libmicrohttpd-0.9.52.
| * | units,sysusers: use DynamicUser= for journal-gatewayd and drop user ↵Yu Watanabe2017-07-282-1/+1
| | | | | | | | | | | | systemd-journal-gateway from sysusers
* | | rfkill: fix erroneous behavior when polling the udev monitor (#6489)S. Fan2017-07-311-2/+6
| | | | | | | | | | | | | | | | | | | | | Comparing udev_device_get_sysname(device) and sysname will always return true. We need to check the device received from udev monitor instead. Also, fd_wait_for_event() sometimes never exits. Better set a timeout here.
* | | cryptsetup: fix infinite timeout (#6486)Andrew Soutar2017-07-311-4/+4
| | | | | | | | | | | | | | | | | | 0004f698d causes `arg_timeout` to be infinity instead of 0 when timeout=0. The logic here now matches this change. Fixes #6381
* | | core: properly handle deserialization of unknown unit types (#6476)Zbigniew Jędrzejewski-Szmek2017-07-313-8/+47
| | | | | | | | | | | | | | | | | | | | | | | | We just abort startup, without printing any error. Make sure we always print something, and when we cannot deserialize some unit, just ignore it and continue. Fixup for 4bc5d27b942afa83cc3d95debd2ad48d42ac07a8. Without this, we would hang in daemon-reexec after upgrade.
* | | Merge pull request #6462 from keszybz/man-tweaksMartin Pitt2017-07-283-18/+37
|\ \ \ | | | | | | | | Some small man page fixes
| * | | man: do not recommend rescue.target for alt-↑Zbigniew Jędrzejewski-Szmek2017-07-281-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rescue.target does not work well, and we don't have a suitable emergency shell unit that can be started on existing systems right now. So let's just remove the recommendation for now. Fixes #6451.
| * | | man: do not encourgage starting of poweroff/halt/reboot/kexec targets directlyZbigniew Jędrzejewski-Szmek2017-07-281-8/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Going through logind and systemd allows polkit to be used, the job mode will be set properly, and is generally easier to get correct. Fixes #6452.
| * | | man: describe which units types are stopped on isolateZbigniew Jędrzejewski-Szmek2017-07-282-7/+10
| | | | | | | | | | | | | | | | Fixes #6455.
* | | | Merge pull request #6365 from keszybz/fast-testsMartin Pitt2017-07-2810-16/+121
|\ \ \ \ | | | | | | | | | | Make tests faster by default
| * | | | test-daemon: sleep just a little bit by defaultZbigniew Jędrzejewski-Szmek2017-07-131-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With previous commits, test-daemon is one of the slowest tests. Under normal circumstances, the notifications go nowhere anyway, because the test process does not have privileges. The timeout can be specified as an argument. This is useful to e.g. test handling of the notifications, which is much easier with a longer timeout.
| * | | | test-resolved-packet: skip most of the loopZbigniew Jędrzejewski-Szmek2017-07-133-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | We want to test the edge cases, but testing all the values in between is mostly pointless and slow on slow architectures (>1s on rpi).
| * | | | test-watchdog: wait just one cycle unless $SYSTEMD_SLOW_TESTSZbigniew Jędrzejewski-Szmek2017-07-131-3/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, if we fail to set the watchdog, run through the rest of the test without waiting. I think it's useful to still start the commands to test the error paths, but we can do it quickly.
| * | | | test-compress-benchmark: look at $SYSTEMD_SLOW_TESTSZbigniew Jędrzejewski-Szmek2017-07-131-1/+11
| | | | |
| * | | | test-hashmap: use $SYSTEMD_SLOW_TESTS variableZbigniew Jędrzejewski-Szmek2017-07-131-3/+70
| | | | | | | | | | | | | | | | | | | | | | | | | test-hashmap is a very good test, but it gets in the way when one wants to compile and quickly test changes.
| * | | | meson: add option to configure "slow" tests on/offZbigniew Jędrzejewski-Szmek2017-07-132-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is just the meson part, no functional change. Use meson -D slow-tests=yes to set the default, or SYSTEMD_SLOW_TESTS=yes build/test-foobar for just one test. Setting the default is more useful for installed tests.
| * | | | libudev: unused variableZbigniew Jędrzejewski-Szmek2017-07-121-1/+0
| | | | |
* | | | | Merge pull request #6461 from keszybz/meson-options-fixMartin Pitt2017-07-282-31/+34
|\ \ \ \ \ | | | | | | | | | | | | Meson options fix
| * | | | | meson: add empty lines before enabled/disabled statusZbigniew Jędrzejewski-Szmek2017-07-261-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Those line are long enough to wrap around a few times, and they are much more legible with some whitespace.
| * | | | | meson: -D remote and -D importd should be "combo" optionsZbigniew Jędrzejewski-Szmek2017-07-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The default should be 'auto', and we allow 'true' and 'false' too. Fixes #6445.
View Lorry Controller Status