summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* coredumpctl: stop truncating information about coredumpv248.9Zbigniew Jędrzejewski-Szmek2021-10-131-0/+2
| | | | | | | | | | With the changes to limit that print 'Found module …' over and over, we were hitting the journal field message limit, effectively truncating the info output. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1998488. (cherry picked from commit 384c6207669eb0d92aa0043dbc01957c6c7ff41e) (cherry picked from commit 473627e1c9fcdf8f819ced2bb79cb7e9ff598b0c)
* Revert "core: Check unit start rate limiting earlier"Zbigniew Jędrzejewski-Szmek2021-10-1316-169/+43
| | | | | | | | This reverts commit 1f77dbfaaedcb8bdecc6610fa96f7fed80bfb8d8. This was causing problems during boot, see https://bodhi.fedoraproject.org/updates/FEDORA-2021-a1a52487e6, https://bugzilla.redhat.com/show_bug.cgi?id=2013386.
* localed: use PROJECT_FILE rather than __FILE__ for loggingv248.8Lennart Poettering2021-10-121-1/+1
| | | | | | | | All our log.h code uses PROJECT_FILE for this, let's hence use it here too. (cherry picked from commit 11c8b1f1031d368358286f4bb26abebd73cd2868) (cherry picked from commit 00b0393e65252bf631670604f58b844780b08c50)
* coredump: Don't log an error if D-Bus isn't runningDaan De Meyer2021-10-121-0/+4
| | | | | | | | | | coredumpctl could be used in a chroot where D-Bus isn't running. If that's the case, we shouldn't consider it an error if we can't connect to the D-Bus daemon so let's reduce the severity of the error we log when we can't connect to D-Bus because the socket doesn't exist. (cherry picked from commit 414bd2e786f9912f51b82e5fe4a1126179a5652a) (cherry picked from commit 6745eaa6308b835e2c5e68d49e9bece29fd37fa2)
* core/service: also check path in exec commandsYu Watanabe2021-10-121-1/+7
| | | | | (cherry picked from commit 8688a389cabdff61efe187bb85cc1776de03c460) (cherry picked from commit b3978cf401306a793c7531299a5e9b3c63e53a27)
* core: fix SIGABRT on empty exec command argvHenri Chain2021-10-123-0/+45
| | | | | | | | | | | | | | This verifies that the argv part of any exec_command parameters that are sent through dbus is not empty at deserialization time. There is an additional check in service.c service_verify() that again checks if all exec_commands are correctly populated, after the service has been loaded, whether through dbus or otherwise. Fixes #20933. (cherry picked from commit 29500cf8c47e6eb0518d171d62aa8213020c9152) (cherry picked from commit 7a58bf7aac8b2c812ee0531b0cc426e0067edd35)
* user-record: disable two pbkdf fields that don't apply for pkbdf2Lennart Poettering2021-10-121-4/+5
| | | | | | Fixes: #20830 (cherry picked from commit 8b4f88d13681c6dec839de06c668d32374d44724) (cherry picked from commit 5ee578fd13809e08fbda1a9bca2256ffd24e9857)
* basic/env-util: correctly parse extended vars after non-extended vars (#20941)Andrew Soutar2021-10-122-1/+5
| | | | | (cherry picked from commit 5ef97a712236f0ddddec52665c0aea7d4e6d3c13) (cherry picked from commit 74583cad5a3bf4051b879b8b1ac53934027ef485)
* repart: use right error variableLennart Poettering2021-10-121-2/+2
| | | | | (cherry picked from commit 8ac04a65477b59c9143b635c0c0daa5152d9b466) (cherry picked from commit b57f76bff912de738a8da8feceb298160bebab26)
* sleep: don't skip resume device with low priority/available spaceEgor2021-10-121-9/+11
| | | | | | | | | | this fixes hibernation when there's a higher priority swap preceding the resume swap in /proc/swaps. fixes #19486 (cherry picked from commit 936a7cb66a0b423e75ceef87f02537067ad17002) (cherry picked from commit 20c776c5e92201e01d4bfbea4ecbc4df758bcf09)
* mount-util: fix fd_is_mount_point() when both the parent and directory are ↵Franck Bui2021-10-121-27/+41
| | | | | | | | | | | | network fs The second call to name_to_handle_at_loop() didn't check for the specific errors that can happen when the parent dir is mounted by nfs and instead of falling back like it's done for the child dir, fd_is_mount_point() failed in this case. (cherry picked from commit 964ccab8286a7e75d7e9107f574f5cb23752bd5d) (cherry picked from commit 8de173ff933510200ac3db77f1ae713f2c4acdc3)
* test: Add failing/non-failing syscall filter test setting architectureBenjamin Berg2021-10-123-0/+19
| | | | | | | | | This adds a high level test verifying that syscall filtering in combination with a simple architecture filter for the "native" architecture works fine. (cherry picked from commit e975a94559900f47a3a5cc333682992616877a67) (cherry picked from commit 663e750998c78d81a758be860148dfe433669c88)
* test: Check that "native" architecture is always filteredBenjamin Berg2021-10-121-0/+61
| | | | | (cherry picked from commit 08bf703cc1511817cdf67543c3b166dc8831ba8c) (cherry picked from commit ef92d7fc97a543d2b7e0730f2b78d8ef2a91959c)
* seccomp: Always install filters for native architectureBenjamin Berg2021-10-121-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The commit 6597686865ff ("seccomp: don't install filters for archs that can't use syscalls") introduced a regression where filters may not be installed for the "native" architecture. This means that setting SystemCallArchitectures=native for a unit effectively disables the SystemCallFilter= and SystemCallLog= options. Conceptually, we have two filter stages: 1. architecture used for syscall (SystemCallArchitectures=) 2. syscall + architecture combination (SystemCallFilter=) The above commit tried to optimize the filter generation by skipping the second level filtering when it is not required. However, systemd will never fully block the "native" architecture using the first level filter. This makes the code a lot simpler, as systemd can execve() the target binary using its own architecture. And, it should be perfectly fine as the "native" architecture will always be the one with the most restrictive seccomp filtering. Said differently, the bug arises because (on x86_64): 1. x86_64 is permitted by libseccomp already 2. native != x86_64 3. the loop wants to block x86_64 because the permitted set only contains "native" (i.e. "native" != "x86_64") 4. x86_64 is marked as blocked in seccomp_local_archs Thereby we have an inconsistency, where it is marked as blocked in the seccomp_local_archs array but it is allowed by libseccomp. i.e. we will skip generating filter stage 2 without having stage 1 in place. The fix is simple, we just skip the native architecture when looping seccomp_local_archs. This way the inconsistency cannot happen. (cherry picked from commit f833df38488ea40fc3d601ccefd64cfa3fce8bb4) (cherry picked from commit ba8bce7b562f9ef83a4de697eae2f97cf1806e3d)
* test-seccomp: tighten privilege check before seccomp()Lennart Poettering2021-10-121-24/+29
| | | | | | | | geteuid() without CAP_SYS_ADMIN is not enough to do unrestricted seccomp(). Hence tighten the check. See: #19746 (cherry picked from commit 6da5d7de78dd6b98d42cbe177975887907ea6dc2)
* networkd-test: fix resolved_domain_restricted_dnsMichael Biebl2021-10-121-5/+5
| | | | | | | | | | | | | | | | | | | | megasearch.net was meant to be a non-existing bogus domain, and had been for a long time. But it seems some domain grabber recently registered it, and it's an actual thing now: $ host megasearch.net megasearch.net has address 207.148.248.143 This causes the test to fail randomly. Use search.example.com instead which yields $ host search.example.com Host search.example.com not found: 3(NXDOMAIN) Fixes: #18357 (cherry picked from commit 528dd6a42389fcf4aa490c0fa0d858772e930d13) (cherry picked from commit 974f94103908fd7f3221fb4e6fe9a590c35fc6f2)
* core/mount: add implicit unit dependencies even if when mount unit is ↵Yu Watanabe2021-10-121-0/+4
| | | | | | | | | generated from /proc/self/mountinfo Hopefully fixes #20566. (cherry picked from commit aebff2e7ce209fc2d75b894a3ae8b80f6f36ec11) (cherry picked from commit 1bb8af46d1181a407cbc858025b85392f3af7812)
* hwdb: sensors: Fix some modalias matches no longer working with newer kernelsHans de Goede2021-10-121-18/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kernels >= 5.8 have added new fields to the dmi/id/modalias file in the middle of the modalias (instead of adding them at the end). Specifically new ":br<value>:" and (optional) ":efr<value>:" fields have been added between the ":bd<value>:" and ":svn<value>:" fields. Note the 5.13.0 and 5.14.0 kernels also added a new ":sku<value>:" field between the ":pvr<value>:" and ":rvn<value>:" fields, this has been fixed in later 5.13.y and 5.14.y releases, by moving the sku field to the end: https://lore.kernel.org/lkml/20210831130508.14511-1-hdegoede@redhat.com/ Unfortunately the same cannot be done for the new br and efr fields since those have been added more then a year ago and hwdb even already has some newer entries relying on the new br field being there (and thus not working with older kernels). Fix the issue with the br and efr fields through the following changes: 1. Replace any matches on ":br<value>" from newer entries with an '*' 2. Replace "bd<value>:svn<value>" matches with: "bd<value>:*svn<value>" inserting an '*' where newer kernels will have the new br + efr fields This makes these matches working with old as well as new kernels. Link: https://github.com/systemd/systemd/issues/20550 Link: https://github.com/systemd/systemd/pull/20562 (cherry picked from commit f81351554285f1d4869fe842659b72797edfc899) (cherry picked from commit 52c9bc1c449ecdadc4e98f0519799c80cb3a4463)
* core: drop "const" from NeedsDaemonReload unit dbus propertyLennart Poettering2021-10-122-2/+2
| | | | | | | | | | It's not "const", it can change any time if people change the fs, and we don#t send out notifications for it. Hence don't claim it was const. (Otherwise clients might cache it, but they should not) Prompted-by: #20792 (cherry picked from commit e30a3ba16a5da4b46cd6c8bc363dbccb791fc45e) (cherry picked from commit 3636724012003a2f9b45eb9f8991ae93661de462)
* resolvconf-compat: make "-u" operation a NOPLennart Poettering2021-10-121-3/+6
| | | | | | | | | | | | | | | | | | According to the various man pages of "resolvconf" the -u switch is for: "-u Just run the update scripts (if updating is enabled)." "-u Force resolvconf to update all its subscribers. resolvconf does not update the subscribers when adding a resolv.conf that matches what it already has for that interface." We have no "subscribers", we ourselves are the only "subscriber" we support. Hence it's probably better to ignore such a request and make it a NOP, then to fail. Fixes: #20748 (cherry picked from commit bee07a399572e0d60600c040a84099ecb418ed33) (cherry picked from commit 4fe53426991e829c0add9378d91f3677a23076fd)
* Add remaining supported schemes as options for default-net-naming-schemedann frazier2021-10-121-1/+1
| | | | | (cherry picked from commit aa0a23ec8629aa033a098ab55e9d97ccd9fbf39c) (cherry picked from commit 879c3eed4293752210ce067206a2fadb862c6370)
* resolved: suppress writing DNS server info into /etc/resolv.conf for ↵Lennart Poettering2021-10-121-0/+7
| | | | | | | | | | non-standard UDP ports glibc doesn't support this, hence don#t generate it. Fixes: #20836 (cherry picked from commit a50dadf2fd7413bbfc26af7e2ad2900b3e06af82) (cherry picked from commit 2b2804757c8520b5cc133d9a3078f6fbec4a69cb)
* man: fix a reference in timedatectl man pageAnssi Hannula2021-10-121-2/+3
| | | | | | | | | | | timedatectl(1) says the synchronization service list generation is described "below", but in reality it is documented in systemd-timedated.service(8). Fix the sentence to reference the correct man page. (cherry picked from commit 9376b2aab3692d26de60a93e396f84fa2799b80b) (cherry picked from commit b7c6b9d4a71e38cb5ac33423a9e41a43c833d45e)
* bootctl: Fix update not adding EFI entry if Boot IDs are non-consecutiveAnssi Hannula2021-10-121-1/+1
| | | | | | | | | | | | | | | | | | | | "bootctl update" tries to add sd-boot to the EFI boot loader list if it is not already there. To do so, it uses find_slot() which finds the proper BootXXXX slot ID to use and also returns 1 if an existing sd-boot entry was found at this ID or 0 if it is a new unused ID. In "update" case install_variables() only writes the entry in case 0 (no existing entry). However, find_slot() erroneously returns 1 if it finds a gap in the Boot IDs (i.e. when not resorting to max(ids) + 1). This causes "bootctl update" to not add a missing systemd-boot boot entry if the existing BootXXXX entry IDs are not consecutive. Fix that by returning 0 in find_slot() when an empty gap ID is selected to make it match the behavior when selecting an empty non-gap ID. (cherry picked from commit 26d54e1263dcb58daa6578595cc6ab1037315593) (cherry picked from commit 0028a3eb976dfa7209433dfa3a24b785f05fd352)
* watchdog: pass right error code to log function so that %m worksLennart Poettering2021-10-121-2/+2
| | | | | (cherry picked from commit a4588af942af976c55f72869340c24d5017db278) (cherry picked from commit 11d5f109b04cd61c8bf437065b5e178c485a49b4)
* sd-journal: Ignore data threshold if set to zero in ↵Daan De Meyer2021-10-121-1/+1
| | | | | | | | | | | | sd_journal_enumerate_fields() According to the documentation, Setting the data threshold to zero disables the data threshold alltogether. Let's make sure we actually implement this behaviour in sd_journal_enumerate_fields() by only applying the data threshold if it exceeds zero. (cherry picked from commit adbd80f51088058d55e703abe0ac11476cfe0ba4) (cherry picked from commit 99ae9b83b42abbe54c059ae964b737b64ae17df9)
* journalctl: never fail at flushing when the flushed flag is setFranck Bui2021-10-121-0/+5
| | | | | | | | | | | | | | | | Even if journald was not running, flushing the volatile journal used to work if the journal was already flushed (ie the flushed flag /run/systemd/journald/flushed was created). However since commit 4f413af2a0a, this behavior changed and now '--flush' fails because it tries to contact journald without checking the presence of the flushed flag anymore. This patch restores the previous behavior since there's no reason to fail when journalctl can figure out that the flush is not necessary. (cherry picked from commit f6fca35e642a112e80cc9bddb9a2b4805ad40df2) (cherry picked from commit dc331f4c9268d17a66f4393cfd0dba14c7022d41)
* sd-journal: Don't compare hashes from different journal filesDaan De Meyer2021-10-121-1/+5
| | | | | | | | | | | | | | | | | | | | In sd_journal_enumerate_fields(), we check if we've already handled a field by checking if we can find it in any of the already processed journal files. We do this by calling journal_file_find_field_object_with_hash(), which compares the size, payload and hash of the given field against all fields in a journal file, trying to find a match. However, since we now use per file hash functions, hashes for the same fields will differ between different journal files, meaning we'll never find an actual match. To fix the issue(), let's use journal_file_find_field_object() when one or more of the files we're comparing is using per file keyed hashes. journal_file_find_field_object() only takes the field payload and size as arguments and calculates the hash itself using the hash function from the journal file we're searching in. (cherry picked from commit 27bf0ab76e13611dce10210f2a22fb5fba05adbb) (cherry picked from commit 2f5b486edfdb6dc3d5465fe7569c19560208813c)
* Fix error building repart with no libcryptsetup (#20739)Marcus Harrison2021-10-121-0/+5
| | | | | (cherry picked from commit 2709d02906dd3ab5ecc2b3e19e2846b1714a7e5a) (cherry picked from commit d3dfc9afa2297e2e15019adf974da8fb0ab7270c)
* test-network: kernel treats the lowest IP address as unicast since 5.14Yu Watanabe2021-10-121-4/+0
| | | | | | | See kernel's 94c821c74bf5fe0c25e09df5334a16f98608db90. (cherry picked from commit 8be102f8b8019a9bd7e445532cad632cbc6986d3) (cherry picked from commit 64c59740ca21f47718c69b9c68ca28e6fab68741)
* unit: systemd-oomd.service requires cgroup memory controllerYu Watanabe2021-10-121-0/+1
| | | | | (cherry picked from commit ca589b1b4139c85e2ae55b62be0a2a6d3eb4db90) (cherry picked from commit 82ce34f42b4f5648416cc2ef8f78e722e1771114)
* core: Parse log environment settings again after applying manager environmentDaan De Meyer2021-10-121-0/+3
| | | | | | | | | | Currently, SYSTEMD_LOG_LEVEL set in the ManagerEnvironment property in system.conf or user.conf doesn't affect the manager's logging level. Parsing the logging environment variables again after pushing the manager environment into the process environment block makes sure any new environment changes also get taken into account for logging. (cherry picked from commit a4303b4096d9a75acd09c5b897ed3d20c9bca6de) (cherry picked from commit b246b5370e95756e9597d8ec967ae030b442e73f)
* nss-systemd: ensure returned strings point into provided bufferMichael Catanzaro2021-10-121-24/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Jamie Bainbridge found an issue where glib's g_get_user_database_entry() may crash after doing: ``` error = getpwnam_r (logname, &pwd, buffer, bufsize, &pw); // ... pw->pw_name[0] = g_ascii_toupper (pw->pw_name[0]); ``` in order to uppercase the first letter of the user's real name. This is a glib bug, because there is a different codepath that gets the pwd from vanilla getpwnam instead of getpwnam_r as shown here. When the pwd struct is returned by getpwnam, its fields point to static data owned by glibc/NSS, and so it must not be modified by the caller. After much debugging, Jamie Bainbridge has fixed this in https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2244 by making a copy of the data before modifying it, and that resolves all problems for glib. Yay! However, glib is crashing even when getpwnam_r is used instead of getpwnam! According to getpwnam_r(3), the strings in the pwd struct are supposed to be pointers into the buffer passed by the caller, so glib should be able to safely edit it directly in this case, so long as it doesn't try to increase the size of any of the strings. Problem is various functions throughout nss-systemd.c return synthesized records declared at the top of the file. These records are returned directly and so contain pointers to static strings owned by libsystemd-nss. systemd must instead copy all the strings into the provided buffer. This crash is reproducible if nss-systemd is listed first on the passwd line in /etc/nsswitch.conf, and the application looks up one of the synthesized user accounts "root" or "nobody", and finally the application attempts to edit one of the strings in the returned struct. All our synthesized records for the other struct types have the same problem, so this commit fixes them all at once. Fixes #20679 (cherry picked from commit 47fd7fa6c650d7a0ac41bc89747e3b866ffb9534) (cherry picked from commit 055ba736e12255cf79acc81aac382344129d03c5)
* nss-systemd: pack pw_passwd result into supplied bufferMichael Catanzaro2021-10-121-2/+4
| | | | | | | | | | | | | | | | | | | getpwnam_r() guarantees that the strings in the struct passwd that it returns are pointers into the buffer allocated by the application and passed to getpwnam_r(). This means applications may choose to modify the strings in place, as long as the length of the strings is not increased. So it's wrong for us to return a static string here, we really do have to copy it into the application-provided buffer like we do for all the other strings. This is only a theoretical problem since it would be very weird for an application to modify the pw_passwd field, but I spotted this when investigating a similar crash caused by glib editing a different field. See also: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2244 (cherry picked from commit 92b264676ccd79c89da270aabc1ec466fa18cd0d) (cherry picked from commit 84313bc5a262e87f49d176db169e1562d7060b33)
* user-util: add generic definition for special password hash values in ↵Lennart Poettering2021-10-125-14/+24
| | | | | | | | | | | | | | | | /etc/passwd + /etc/shadow Let's add three defines for the 3 special cases of passwords. Some of our tools used different values for the "locked"/"invalid" case, let's settle on using "!*" which means the password is both locked *and* invalid. Other tools like to use "!!" for this case, which however is less than ideal I think, since the this could also be a considered an entry with an empty password, that can be enabled again by unlocking it twice. (cherry picked from commit 53c25ac968ab8b868506c3a1820d8c76beb0cd88)
* sd-event: take ref on event loop object before dispatching event sourcesMichal Sekletar2021-10-121-1/+1
| | | | | | | | | | | Idea is that all public APIs should take reference on objects that get exposed to user-provided callbacks. We take the reference as a protection from callbacks dropping it. We used to do this also here in sd_event_loop(). However, in cleanup portion of f814c871e6 this was accidentally dropped. (cherry picked from commit 9f6ef467818f902fe5369c8e37a39a3901bdcf4f) (cherry picked from commit a93ddddd00860bda05df72cfd5b80be9b3a93023)
* meson.build: change operator combining bools from + to andDan Streetman2021-10-121-1/+1
| | | | | | | | | | | | upstream meson stopped allowing combining boolean with the plus operator, and now requires using the logical and operator reference: https://github.com/mesonbuild/meson/commit/43302d3296baff6aeaf8e03f5d701b0402e37a6c Fixes: #20632 (cherry picked from commit c29537f39e4f413a6cbfe9669fa121bdd6d8b36f) (cherry picked from commit 7f16b730c80b017ad381eba918c066a911b5943f)
* nspawn: fix type to pass to connect()Lennart Poettering2021-10-121-1/+1
| | | | | | | | | | It expects a generic "struct sockaddr", not a "struct sockaddr_un". Pass the right member of the union. Not sure why gcc/llvm never complained about this... (cherry picked from commit 32b9736a230d47b73babcc5cfa27d672bb721bd0) (cherry picked from commit caa0827ca920617dc54e62be1ff8422ad9ce2d3a)
* udev: fix potential memleakYu Watanabe2021-10-121-2/+1
| | | | | (cherry picked from commit 4154524d47d24bcee3ebfed939912a847ebeb1b3) (cherry picked from commit f4a8e2c2115fc901e588a1672f129e7e3371f5d7)
* network: print Ethernet Link-Layer DHCP client ID with leading 0'sAlvin Šipraga2021-10-121-1/+1
| | | | | | | | | | | | | | | This is a small cosmetic change. Before: Offered DHCP leases: 192.168.0.183 (to 0:9:a7:36:bc:89) After: Offered DHCP leases: 192.168.0.183 (to 00:09:a7:36:bc:89) (cherry picked from commit 8e664ab6ecc9c420d2151f14b36824aecc76d8ac) (cherry picked from commit 133354a3b9fc7b88fb143f241cfc4565b943ae87)
* run/mount/systemctl: don't fork off PolicyKit/ask-pw agent when in --user modeLennart Poettering2021-10-123-0/+12
| | | | | | | | | | | When we are in --user mode there's no point in doing PolicyKit/ask-pw because both of these systems are only used by system-level services. Let's disable the two agents for that automaticlly hence. Prompted by: #20576 (cherry picked from commit 966f3a246c8c804d8a9c9d393f03c5c3fe0dd393) (cherry picked from commit fb999b918462361fefa435f86884f81edff503c5)
* man: Don't leak memory in path-documents exampleThomas Mühlbacher2021-10-121-1/+9
| | | | | | | | | | The `sd_path_lookup(3)` man page states that the returned string shall be `free(3)`'d but then doesn't do so in the example code. Also add basic error handling as well. (cherry picked from commit fee1863c83d04aa06d50a90ff42f5d4f4f2b9178) (cherry picked from commit 010770bbbe45e1c381f4db4f81b35872569a3944)
* hwdb: remove double empty line in --help textLennart Poettering2021-10-121-1/+1
| | | | | (cherry picked from commit aecc04f1800c87e0479e74e0225e288a403ba77e) (cherry picked from commit da61fe147e40ba26ed8cf405dbf0a0e71e060d0b)
* path-util: make find_executable() work without /proc mountedYu Watanabe2021-10-121-1/+5
| | | | | | | | | Follow-up for 888f65ace6296ed61285d31db846babf1c11885e. Hopefully fixes #20514. (cherry picked from commit 93413acd3ef3a637a0f31a1d133b103e1dc81fd6) (cherry picked from commit 727d0b55f46468d6171f4a326bd3139bab3c93ab)
* core: Check unit start rate limiting earlierDaan De Meyer2021-10-1216-43/+169
| | | | | | | | | | | | | | | | Fixes #17433. Currently, if any of the validations we do before we check start rate limiting fail, we can still enter a busy loop as no rate limiting gets applied. A common occurence of this scenario is path units triggering a service that fails a condition check. To fix the issue, we simply move up start rate limiting checks to be the first thing we do when starting a unit. To achieve this, we add a new method to the unit vtable and implement it for the relevant unit types so that we can do the start rate limit checks earlier on. (cherry picked from commit 9727f2427ff6b2e1f4ab927cc57ad8e888f04e95) (cherry picked from commit ed8fbbf1745c6a2dc0b8cd560ac8a3353f72e979)
* core: Remove circular includeDaan De Meyer2021-10-122-1/+1
| | | | | | | | | service.h includes socket.h and socket.h includes service.h. Move service.h include from socket.h to socket.c to remove the circular dependency. (cherry picked from commit a243128d1fcfc378df9fce1b4997148a17ef23a5) (cherry picked from commit a203879ae5914fa1a676dbd480a7ad41ca0d8e40)
* NEWS: net.ipv4.tcp_ecn = 1 was reverted at v240Sho Iizuka2021-10-121-0/+3
| | | | | | | Turning on ECN was reverted by 1e190df. (cherry picked from commit e447ffe4daca1d0beb57242f079125669e4e1c3c) (cherry picked from commit d69732ea03f2f4e71d0f0952cd0aaf71ceda4240)
* explicitly close FIDO2 devicespedro martelletto2021-10-122-1/+6
| | | | | | | | | | FIDO2 device access is serialised by libfido2 using flock(). Therefore, make sure to close a FIDO2 device once we are done with it, or we risk opening it again at a later point and deadlocking. Fixes #20664. (cherry picked from commit b6aa89b0a399992c8ea762e6ec4f30cff90618f2) (cherry picked from commit d6e4920b10c3da1665cb44f4686893b865003d12)
* Drop bundled copy of linux/if_arp.hZbigniew Jędrzejewski-Szmek2021-10-122-166/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | As far as I can see, we use this to get a list of ARPHRD_* defines (used in particular for Type= in .link files). If we drop our copy, and build against old kernel headers, the user will have a shorter list of types available. This seems OK, and I don't think it's worth carrying our own version of this file just to have newest possible entries. 7c5b9952c4f6e2b72f90edbe439982528b7cf223 recently updated this file, but we'd have to update it every time the kernel adds new entries. But if we look at the failure carefully: src/basic/arphrd-from-name.gperf:65:16: error: ‘ARPHRD_MCTP’ undeclared (first use in this function); did you mean ‘ARPHRD_FCPP’? 65 | MCTP, ARPHRD_MCTP | ^~ | ARPHRD_FCPP we see that the list we were generating was from the system headers, so it was only as good as the system headers anyway, without the newer entries in our bundled copy, if there were any. So let's make things simpler by always using system headers. And if somebody wants to fix things so that we always have the newest list, then we should just generate and store the converted list, not the full header. (cherry picked from commit e7f46ee3ae1cc66a94b293957721d68dc09d7449)
* basic/linux: Sync if_arp.h with Linux 5.14Chris Packham2021-10-121-0/+1
| | | | | | | | ARPHRD_MCTP was added in 5.14. Sync if_arp.h to pick up the definition Fixes #20694 (cherry picked from commit 7c5b9952c4f6e2b72f90edbe439982528b7cf223)
View Lorry Controller Status