summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* | lsm-util: move detection of support of LSMs into a new lsm-util.[ch] helperLennart Poettering2023-04-184-37/+40
| | | | | | | | | | | | | | This makes the bpf LSM check generic, so that we can use it elsewhere. it also drops the caching inside it, given that bpf-lsm code in PID1 will cache it a second time a stack frame further up when it checks for various other bpf functionality.
* | bpf-firewall: give a name to maps usedDominique Martinet2023-04-183-5/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Running systemd with IP accounting enabled generates many bpf maps (two per unit for accounting, another two if IPAddressAllow/Deny are used). Systemd itself knows which maps belong to what unit and commands like `systemctl status <unit>` can be used to query what service has which map, but monitoring these values all the time costs 4 dbus requests (calling the .IP{E,I}gress{Bytes,Packets} method for each unit) and makes services like the prometheus systemd_exporter[1] somewhat slow when doing that for every units, while less precise information could quickly be obtained by looking directly at the maps. Unfortunately, bpf map names are rather limited: - only 15 characters in length (16, but last byte must be 0) - only allows isalnum(), _ and . characters If it wasn't for the length limit we could use the normal unit escape functions but I've opted to just make any forbidden character into underscores for maximum brievty -- the map prefix is also rather short: This isn't meant as a precise mapping, but as a hint for admins who want to look at these. (Note there is no problem if multiple maps have the same name) Link: https://github.com/povilasv/systemd_exporter [1]
* | process-util: be more careful with pidfd_get_pid() special casesLennart Poettering2023-04-171-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's be more careful with generating error codes for (expected) error causes. This does not introduce new error conditions, it just changes what we return under specific cases, to make things nicely recognizable in each case. Most importantly this detects if fdinfo reports a pid of "-1" for pidfds with processes that are already reaped (and thus have no PID anymore) None of our current users care about these error codes, but let's get this right for the future.
* | fsck: use execv_p_ and execl_p_Florian Klink2023-04-173-30/+5
| | | | | | | | | | Instead of invoking find_executable on our own, use the variants of exec provided by glibc which does this for us.
* | creds: make available to all ExecStartPre= and ExecStart= processesLuca Boccassi2023-04-172-1/+10
| | | | | | | | Fixes https://github.com/systemd/systemd/issues/27275
* | user-util:remove duplicate includesjcg2023-04-171-1/+0
| |
* | virt: Further improve detection of EC2 metal instancesBenjamin Herrenschmidt2023-04-171-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit f90eea7d18d9ebe88e6a66cd7a86b618def8945d virt: Improve detection of EC2 metal instances Added support for detecting EC2 metal instances via the product name in DMI by testing for the ".metal" suffix. Unfortunately this doesn't cover all cases, as there are going to be instance types where ".metal" is not a suffix (ie, .metal-16xl, .metal-32xl, ...) This modifies the logic to also allow those new forms. Signed-off-by: Benjamin Herrenschmidt <benh@amazon.com>
* | mkosi: Use kernel-core for Fedora and CentOS imagesDaan De Meyer2023-04-172-3/+2
| | | | | | | | Let's reduce image size by using a smaller kernel package.
* | hwdb: add accelerometer mount matrix for Lenovo Yoga Tablet 2 851F/LHans de Goede2023-04-161-0/+4
| | | | | | | | | | Add an accelerometer mount matrix for Lenovo Yoga Tablet 2 851F/L, to fix screen rotation now that the kernel has support for the LSM303D IMU.
* | Merge pull request #27298 from mrc0mmand/test-async-tweaksLuca Boccassi2023-04-162-9/+8
|\ \ | | | | | | test: modernize test-async a bit
| * | docs: add a missing $ signFrantisek Sumsal2023-04-161-1/+1
| | | | | | | | | | | | | | | Addresses https://github.com/systemd/systemd/pull/27283#pullrequestreview-1386816102. Follow-up to 1a127aa02b.
| * | test: modernize test-async a bitFrantisek Sumsal2023-04-161-8/+7
| | | | | | | | | | | | | | | Mainly to give it some debug output to, hopefully, see why it sometimes gets stuck in CI when run with sanitizers.
* | | process-util: make safe_fork() unset $NOTIFY_SOCKETYu Watanabe2023-04-175-4/+9
|/ / | | | | | | | | | | | | | | Propagating $NOTIFY_SOCKET is typically dangerous. Let's unset it unless explicitly requested to keep it. Fixes #27288. Replaces #27291.
* | mkosi: default to Fedora 38Zbigniew Jędrzejewski-Szmek2023-04-162-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | It'll be out this week. We can't update the man pages before it is realeased, but we can use it for mkosi builds and do some very late testing. Also, use filepath specification for /bin/pkg-config. We need it for meson, and meson calls it directly by this path. pkgconfig is a virtual Provides on pkgconf-pkg-config, and the indirection here just obfuscates things with no benefit. Add it explicitly for centos too. (I think it is pulled in by packages which contain pkg-config modules anyway, but it's better to be explicit).
* | exec-util: make execute_strv() optionally take root directoryYu Watanabe2023-04-162-3/+6
| | | | | | | | Preparation for rewriting kernel-install in C.
* | Merge pull request #27283 from mrc0mmand/assorted-test-tweaksYu Watanabe2023-04-1612-4/+245
|\ \ | | | | | | test: a bunch of assorted tweaks, Saturday edition
| * | test: add a couple of tests with invalid UTF-8 charactersFrantisek Sumsal2023-04-161-1/+19
| | |
| * | test: add a simple test for getenv_path_list()Frantisek Sumsal2023-04-161-0/+35
| | |
| * | test: add a couple of basic sanity tests for the security verbFrantisek Sumsal2023-04-161-0/+5
| | |
| * | test: add a couple of basic sanity tests for timedatectlFrantisek Sumsal2023-04-161-0/+22
| | |
| * | test: add a simple test for secure-bits stuffFrantisek Sumsal2023-04-162-0/+85
| | |
| * | shared: add a missing includeFrantisek Sumsal2023-04-161-0/+2
| | |
| * | test: add tests for uuid/uint64 specifiersFrantisek Sumsal2023-04-161-0/+27
| | | | | | | | | | | | | | | They're used in repart, but are not part of the "common" specifier lists, so cover them explicitly.
| * | test: add a test case for table_dup_cell()Frantisek Sumsal2023-04-151-0/+43
| | | | | | | | | | | | Also, sneak in coverage for "less popular" cell types.
| * | docs: a couple of typo fixes & formatting tweaksFrantisek Sumsal2023-04-151-3/+3
| | |
| * | test: stop the test unit when it's not needed anymoreFrantisek Sumsal2023-04-141-0/+1
| | | | | | | | | | | | | | | Otherwise it keeps printing stuff to the journal/console, adding unnecessary noise.
| * | test: check the colored --version outputFrantisek Sumsal2023-04-141-0/+3
| | |
* | | Merge pull request #27253 from yuwata/cmsg-find-and-copy-dataYu Watanabe2023-04-1613-47/+59
|\ \ \ | | | | | | | | socket-util: introduce CMSG_FIND_AND_COPY_DATA()
| * | | tree-wide: also use CMSG_TYPED_DATA() on writing message headerYu Watanabe2023-04-163-4/+4
| | | |
| * | | sd-dhcp-server: use CMSG_FIND_DATA() at one more placeYu Watanabe2023-04-161-14/+4
| | | |
| * | | tree-wide: copy timestamp data from cmsgYu Watanabe2023-04-164-14/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | On RISCV32, time_t is 64bit and size_t is 32bit, hence the timestamp data in message header may not be aligned. Fixes #27241.
| * | | socket-util: introduce CMSG_FIND_AND_COPY_DATA()Yu Watanabe2023-04-162-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The cmd(3) man page says about CMSG_DATA(): > The pointer returned cannot be assumed to be suitably aligned for > accessing arbitrary payload data types. Applications should not cast > it to a pointer type matching the payload, but should instead use > memcpy(3) to copy data to or from a suitably declared object. Hence, if we want to use unaligned data in cmsg, we need to copy it before use. That's typically important for reading timestamps in RISCV32, as the time_t is 64bit and size_t is 32bit on the system.
| * | | tree-wide: replace __alignof__() with alignof()Yu Watanabe2023-04-145-13/+14
| | | | | | | | | | | | | | | | Addresses https://github.com/systemd/systemd/pull/27254#discussion_r1165267046.
| * | | socket-util: add one missing parenYu Watanabe2023-04-141-1/+1
| | | | | | | | | | | | | | | | Follow-up for b6256af75e0609e451198ed90c293efd50827ab3.
| * | | timesync: drop unnecessary initializationYu Watanabe2023-04-141-1/+1
| | | |
* | | | mkosi: Always disable sshd, dnsmasq and isc-dhcp-serverDaan De Meyer2023-04-152-5/+6
| | | |
* | | | mkosi: Update to latestDaan De Meyer2023-04-153-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | mkosi now installs a "ignore *" default preset on Debian. We also switch Debian to dbus-broker now that preset doesn't disable it anymore.
* | | | fsck: look for fsck binary not just in /sbinFlorian Klink2023-04-154-8/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This removes remaining hardcoded occurences of `/sbin/fsck`, and instead uses `find_executable` to find `fsck`. We also use `fsck_exists_for_fstype` to check for the `fsck.*` executable, which also checks in `$PATH`, so it's fair to assume fsck itself is also available.
* | | | Merge pull request #27273 from mrc0mmand/test-generatorsLuca Boccassi2023-04-148-48/+310
|\ \ \ \ | | | | | | | | | | test: add a couple of tests for getty/run/system-update generators
| * | | | test: add a couple of tests for run-generatorFrantisek Sumsal2023-04-141-0/+76
| | | | |
| * | | | test: add a couple of tests for system-update-generatorFrantisek Sumsal2023-04-141-0/+38
| | | | |
| * | | | test: properly distinguish between generator phasesFrantisek Sumsal2023-04-144-55/+56
| | | | | | | | | | | | | | | | | | | | | | | | | Let's make sure the units generated by generators are generated at the right stage.
| * | | | test: add a couple of tests for getty-generatorFrantisek Sumsal2023-04-142-0/+90
| | | | |
| * | | | test: allow overriding PID1's environment for test purposesFrantisek Sumsal2023-04-141-0/+18
| | | | |
| * | | | test: add a couple of test for fstab-related kernel cmdline argsFrantisek Sumsal2023-04-141-3/+40
| | | | |
| * | | | test: check if x-systemd.automount is ignored for rootfsFrantisek Sumsal2023-04-141-3/+9
| | | | |
| * | | | test: run the generators with debug log levelFrantisek Sumsal2023-04-143-5/+1
| | | | | | | | | | | | | | | | | | | | unless requested otherwise.
* | | | | preset: Add ignore directiveDaan De Meyer2023-04-148-43/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ignore directive specifies to not do anything with the given unit and leave existing configuration intact. This allows distributions to gradually adopt preset files by shipping a ignore * preset file.
* | | | | po: Translated using Weblate (Galician)Fran Diéguez2023-04-151-45/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently translated at 100.0% (193 of 193 strings) Co-authored-by: Fran Diéguez <frandieguez@gnome.org> Translate-URL: https://translate.fedoraproject.org/projects/systemd/master/gl/ Translation: systemd/main
* | | | | man/systemd-cryptenroll: update list of PCRs, link to uapi docsZbigniew Jędrzejewski-Szmek2023-04-141-159/+177
| |_|/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Entia non sunt multiplicanda praeter necessitatem. We had a list of PCRs in the man page which was already half out-of-date. Instead, link to web page with the "authoritative" list. Here, drop the descriptions of what shim and grub do. Instead, just give some short descriptions and mention what systemd components do. systemd-pcrmachine.service and systemd-pcrfs@.service are now mentioned too. https://github.com/uapi-group/specifications/commit/d0e590b1e2648e76ece66157ceade3f45b165b14 extended the table in the specs repo. https://github.com/uapi-group/specifications/pull/59 adds some more text there too. Also, rework the recommendation: hint that PCR 11 is useful, and recommend binding to policy signatures instead of direct PCR values. This new text is intentionally vague: doing this correctly is hard, but let's at least not imply that just binding to PCR 7 is useful in any way. Also, change "string alias" to "name" in discussion of PCR names. Inspired by https://discussion.fedoraproject.org/t/future-of-encryption-in-fedora/80397/17
View Lorry Controller Status