summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* generators: optionally, measure file systems at bootLennart Poettering2023-01-178-4/+115
| | | | | | If we use gpt-auto-generator, automatically measure root fs and /var. Otherwise, add x-systemd.measure option to request this.
* units: rework growfs units to be just a regular unit that is instantiatedLennart Poettering2023-01-175-49/+126
| | | | | | | | | | | | | | | | The systemd-growfs@.service units are currently written in full for each file system to grow. Which is kinda pointless given that (besides an optional ordering dep) they contain always the same definition. Let's fix that and add a static template for this logic, that the generator simply instantiates (and adds an ordering dep for). This mimics how systemd-fsck@.service is handled. Similar to the wait that for root fs there's a special instance systemd-fsck-root.service we also add a special instance systemd-growfs-root.service for the root fs, since it has slightly different deps. Fixes: #20788 See: #10014
* generator: teach generator_add_symlink() to instantiate specified unitLennart Poettering2023-01-172-13/+45
| | | | | | | | | | if we want generators to instantiate a template service, we need to teach generator_add_symlink() the concept. Just some preparation for a later commit. While we are at it, modernize the function around path_extract_filename() + path_extract_directory()
* units: measure /etc/machine-id into PCR 15 during early bootLennart Poettering2023-01-172-0/+25
| | | | | | | We want PCR 15 to be useful for binding per-system policy to. Let's measure the machine ID into it, to ensure that every OS we can distinguish will get a different PCR (even if the root disk encryption key is already measured into it).
* pcrphase: make tool more generic, reuse for measuring machine id/fs uuidsLennart Poettering2023-01-172-24/+187
| | | | See: #24503
* gpt-auto-generator: automatically measure root/var volume keys into PCR 15Lennart Poettering2023-01-172-5/+39
| | | | | let's enable PCR 15 measurements automatically if gpt-auto discovery is used and systemd-stub is also used.
* man: document the new crypttab measurement optionsLennart Poettering2023-01-172-0/+27
|
* cryptsetup: add tpm2-measure-pcr= and tpm2-measure-bank= crypttab optionsLennart Poettering2023-01-173-15/+217
| | | | | | | | | These options allow measuring the volume key used for unlocking the volume to a TPM2 PCR. This is ideally used for the volume key of the root file system and can then be used to bind other resources to the root file system volume in a secure way. See: #24503
* tpm2-util: optionally do HMAC in tpm2_extend_bytes() in case we process ↵Lennart Poettering2023-01-173-6/+23
| | | | | | | | | | | | | | sensitive data When measuring data into a PCR we are supposed to hash the data on the CPU and then pass the hash value over the wire to the TPM2. That's all good as long as the data we intend to measure is not sensitive. Let's be extra careful though if we want to measure sensitive data, for example the root file system volume key. Instead of just hashing that and passing it over the wire to the TPM2, let's do a HMAC signature instead. It's also a hash operation, but should protect our secret reasonably well and not leak direct information about it to wiretappers.
* tpm2-util: split out code that extends a PCR from pcrphaseLennart Poettering2023-01-173-39/+72
| | | | This way we can reuse it later outside of pcrphase
* tpm2-util: split out code that derives "good" TPM2 banks into an strv from ↵Lennart Poettering2023-01-173-22/+50
| | | | | | pcrphase and generalize it in tpm2-util.c That way we can reuse it later from different places.
* Merge pull request #26004 from poettering/cleanuo-erase-moarYu Watanabe2023-01-178-177/+156
|\ | | | | tree-wide: use CLEANUP_ERASE() at many places
| * memory-util: add CLEANUP_ERASE_PTR() macro and use itLennart Poettering2023-01-163-70/+89
| |
| * tree-wide: use CLEANUP_ERASE() at various placesLennart Poettering2023-01-165-107/+67
| | | | | | | | | | | | Let's use this new macro wherever it makes sense, as it allows us to shorten or clean-up paths, and makes it less likely to miss a return path.
* | sd-dhcp-client: gracefully handle invalid ether type client IDYu Watanabe2023-01-161-20/+18
| | | | | | | | | | | | | | | | Currently, sd-dhcp-server accepts spurious client IDs, then the leases exposed by networkd may be invalid. Let's make networkctl gracefully show such leases. Fixes #25984.
* | busctl: simplify peeking the typeLennart Poettering2023-01-161-20/+10
| | | | | | | | | | | | | | let's peek the type before we enter the variant, not after, so that we can reuse it as-is, instead having to recombine it later. Follow-up for: #26049
* | sd-dhcp6: always append the default status message generated from status codeYu Watanabe2023-01-162-13/+18
| | | | | | | | Fixes #25988.
* | network: fix memleakYu Watanabe2023-01-162-2/+10
| | | | | | | | | | | | Fixes a bug introduced by af2aea8bb64b0dc42ecbe5549216eb567681a803. Fixes #25883 and #25891.
* | Merge pull request #26071 from yuwata/network-dhcp-quick-ackLuca Boccassi2023-01-166-9/+40
|\ \ | | | | | | network: make TCP quick ACK mode for dynamic routes configurable
| * | NEWS: mention QuickAck=Yu Watanabe2023-01-161-0/+5
| | |
| * | NEWS: move one entry to the correct sectionYu Watanabe2023-01-161-7/+7
| | |
| * | network: introduce QuickAck= for [DHCPv4] and [IPv6AcceptRA]Yu Watanabe2023-01-165-2/+28
| | | | | | | | | | | | Closes #25906.
* | | Merge pull request #26054 from aplanas/fix_user_credsLuca Boccassi2023-01-161-20/+16
|\ \ \ | | | | | | | | creds-util: some fixes related with TPM2 and capabilities
| * | | creds-util: merge the TPM2 detection for initrdAlberto Planas2023-01-161-9/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch merge the TPM2 detection paths when we are inside and outside an initrd. Signed-off-by: Alberto Planas <aplanas@suse.com>
| * | | creds-util: do not try TPM2 if there is not supportAlberto Planas2023-01-161-9/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During the credentials encryption, if systemd it is compiled with TPM2 support, it will try to use it depending on the key flags passed. The current code only checks if the system has a functional TPM2 if the case of the INITRD flag. This patch do a similar check in the case that it is outside initrd (but still automatic). Signed-off-by: Alberto Planas <aplanas@suse.com>
| * | | creds-util: check for CAP_DAC_READ_SEARCHAlberto Planas2023-01-161-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In make_credential_host_secret, the credential.secret file is generated first as a temporary anonymous file that is later instantiated with linkat(2). This system call requires CAP_DAC_READ_SEARCH capability when the flag AT_EMPTY_PATH is used. This patch check if the capability is effective, and if not uses the alternative codepath for creating named temporary files. Non-root users can now create per-user credentials with: export SYSTEMD_CREDENTIAL_SECRET=$HOME/.config/systemd/credential.secret systemd-creds setup Signed-off-by: Alberto Planas <aplanas@suse.com>
* | | | Merge pull request #26051 from YHNdnzj/systemctl-list-dependencies-typeLuca Boccassi2023-01-165-10/+70
|\ \ \ \ | |_|_|/ |/| | | systemctl: list-dependencies: support --type= and --state=
| * | | systemctl: list-dependencies: support --type= and --state=Mike Yuan2023-01-165-9/+69
| | | | | | | | | | | | | | | | Closes #25975
| * | | systemctl: list-dependencies: pass bool where appropriateMike Yuan2023-01-131-1/+1
| | | |
* | | | update TODOLennart Poettering2023-01-161-0/+11
| | | |
* | | | Merge pull request #25999 from DaanDeMeyer/mkosiDaan De Meyer2023-01-164-29/+7
|\ \ \ \ | | | | | | | | | | ci: Update mkosi action to latest commit
| * | | | mkosi: Use meson setupDaan De Meyer2023-01-151-1/+1
| | | | |
| * | | | boot: Remove -O1 workaroundDaan De Meyer2023-01-151-9/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that we have ukify and mkosi has been updated to use it, we have a solution in place to make sure that PE sections don't overlap in a UKI so let's drop the workaround to avoid overlapping PE sections.
| * | | | ci: Update mkosi action to latest commitDaan De Meyer2023-01-152-19/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's make sure we're testing with the latest changes in mkosi. This includes both the switch to systemd-repart and ukify, making sure we get extra testing coverage for those components. This also drops options from the centos config that have been removed in the newer mkosi. For some reason idmapping runs into some issues so we disable it for now.
* | | | | mount: handle bind mount of file with non-existing targetDavid Tardon2023-01-162-4/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the target (Where=) of a mount does not exist, systemd tries to create it. But previously, it'd always been created as a directory. That doesn't work if one wants to bind-mount a file to a target that doesn't exist. Fixes: #17184
* | | | | man: clarify applicability of IPv6AcceptRA optionŁukasz Stelmach2023-01-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | There is no reason to not accept RAs on bondX devices (devices that aggregate other devices). It makes sense for aggregated devies though.
* | | | | gpt-auto: harden ESP/XBOOTLDR mounts with "noexec,nosuid,nodev"Mike Yuan2023-01-161-5/+5
| |_|/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When these partitions are probed by gpt-auto, they will always be hardened with such options. See also: https://github.com/systemd/systemd/issues/25776#issuecomment-1364115711 Closes #25776
* | | | man: udev_enumerate_new: fix typoUlrich Ölmann2023-01-161-1/+1
| |_|/ |/| |
* | | ukify: Fix version stringDaan De Meyer2023-01-151-1/+1
| | | | | | | | | | | | Let's make sure we mimick the version of our other CLI tooling.
* | | docs/man: remove reference to default vsock CIDLuca Boccassi2023-01-152-7/+3
|/ / | | | | | | | | | | | | This was dropped on reviewers' request in the revision that got merged, but reference in two documents was not updated. Fix it. Follow-up for: https://github.com/systemd/systemd/pull/25918
* | man: libudev: fix typoUlrich Ölmann2023-01-151-1/+1
| |
* | busctl: fix introspecting DBus propertiesYu Watanabe2023-01-151-2/+19
| | | | | | | | | | | | Follow-up for f2f7785d7a47ffa48ac929648794e1288509ddd8. Fixes #26033.
* | test: support a non-default SysV directoryFrantisek Sumsal2023-01-141-11/+14
| | | | | | | | | | | | | | | | | | | | Since the directory is configurable via -Dsysvinit-path= during build, it makes the test fail on Fedora/RHEL/CentOS, where it's set to /etc/rc.d/init.d, instead of the default /etc/init.d. Since we can't get the value at runtime (in a reasonable manner), let's just support the two most common paths for now. Follow up to 7fcf0fab078ed92a4f6c3c3658c0a9dfd67c9601.
* | open-file: Fix user-after-freeDaan De Meyer2023-01-131-1/+1
|/
* Merge pull request #26047 from yuwata/udev-node-cleanupsYu Watanabe2023-01-131-64/+54
|\ | | | | udev: several cleanups
| * udev: simplify a bit stack_directory_find_prioritized_devnode()Franck Bui2023-01-131-20/+15
| | | | | | | | | | And make the new format the one we expect as it should replace the old one pretty quickly.
| * udev: return ENODEV if link_directory_read_one() can't find the devnodeFranck Bui2023-01-131-1/+1
| | | | | | | | | | That's usually the errno code we return when a device cannot be found because it's been unplugged.
| * udev: let stack_directory_open() convert a slink into a dirname itselfFranck Bui2023-01-131-16/+18
| | | | | | | | | | | | | | | | | | We likely always want to open the directory via a slink. There's currently only one caller so it doesn't make any difference in practice but I think it's still nicer. No functional change.
| * udev: merge link_directory_lock() into link_directory_open()Franck Bui2023-01-131-39/+32
|/ | | | These 2 operations are inseparable.
* bootspec: show efi entry tooLudwig Nussel2023-01-131-0/+2
|
View Lorry Controller Status