summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* src/ukify/test/test_ukify: fix skipped testsEmanuele Giuseppe Esposito2023-05-101-1/+1
| | | | | | | | | Some tests are skipped because initrd extracted from bootctl is "/boot/initramfs-5.14.0-284.el9.x86_64.img $tuned_initrd" and not just "/boot/initramfs-5.14.0-284.el9.x86_64.img". Therefore split and remove the additional garbage. Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
* src/ukify/test/test_ukify: add pesign unit testEmanuele Giuseppe Esposito2023-05-101-2/+53
| | | | Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
* ukify: support pesign as alternative to sbsignEmanuele Giuseppe Esposito2023-05-102-48/+138
| | | | | | | | | | | | | | sbsign is not available everywhere, for example RHEL does not have it. Add pesign as alternative to it. pesign will use options "--secureboot-certificate-name" (mandatory) and "--secureboot-certificate-dir" (optional), while sbsign will use "--secureboot-private-key" and "--secureboot-certificate". By default, use sbsign. If no key/cert is provided or sbsign is not found, try pesign. Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
* ukify: typo in doc and print when package is missingEmanuele Giuseppe Esposito2023-05-102-2/+4
| | | | | | | | | | | If a package is missing, a subprocess is started with None as command argument. Error raised by subprocess is therefore not helpful at all to understand what needs to be done to fix that error. Also fix doc since systemd-stub will look for .cmdline files, and not .cmdline.efi files. Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
* core/unit: check the validity of unit type with activation_details_vtableYu Watanabe2023-05-081-3/+5
| | | | Follow-up for 24e91e08f8958241195f97472353adef94884b33.
* parse-util: make parse_fd() return -EBADFYu Watanabe2023-05-086-13/+4
| | | | | | | | The previous error code -ERANGE is slightly ambiguous, and use more specific one. This also drops unnecessary error handlings. Follow-up for 754d8b9c330150fdb3767491e24975f7dfe2a203 and e652663a043cb80936bb12ad5c87766fc5150c24.
* zsh: add service-log-{level,target} completions for systemctlRonan Pigott2023-05-081-0/+26
|
* hwdb: add landscape IdeaPad Miix 310 sensor orientation (#27555)Janne Sirén2023-05-071-0/+4
| | | Enables support for landscape orientated display variants of the IdeaPad Miix 310 2-in-1 laptop.
* crypttab: Support for VeraCrypt PIM and detached headers for ↵Klaus Zipfel2023-05-062-8/+43
| | | | | TrueCrypt/VeraCrypt (#27548) * Added veracrypt-pim=<PIM> LUKS option for crypttab
* Merge pull request #26357 from ddstreet/tpm2_policy_sessionLuca Boccassi2023-05-062-87/+129
|\ | | | | Tpm2 policy session
| * tpm2: move policy building out of policy session creationDan Streetman2023-05-051-87/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This retains the use of policy sessions instead of trial sessions in most cases, based on the code comment that some TPMs do not implement trial sessions correctly. However, it's likely that the issue was not the TPMs, but our code's incorrect use of PolicyPCR inside a trial session; we are not providing expected PCR values with our call to PolicyPCR inside a trial session, but the spec indicates that in a trial session, the TPM *may* return error if the expected PCR value(s) are not provided. That may have been the source of the original confusion about trial sessions. More details: https://github.com/systemd/systemd/pull/26357#pullrequestreview-1409983694 Also, future commits will replace the use of trial sessions with policy calculations, which avoids the problem entirely.
| * tpm2: add tpm2_is_encryption_session()Dan Streetman2023-05-052-0/+17
| |
* | Merge pull request #27262 from keszybz/ukify-installZbigniew Jędrzejewski-Szmek2023-05-0614-467/+1355
|\ \ | | | | | | Add kernel-install plugin that calls ukify
| * | test_ukify: add test for combining config and cmdlineZbigniew Jędrzejewski-Szmek2023-05-051-0/+80
| | |
| * | man: describe all the changes to ukifyZbigniew Jędrzejewski-Szmek2023-05-051-194/+325
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As in mkosi(1), let's describe the config file and commandline options together. This is nice for us, because we don't need to duplicate descriptions and we're less likely to forget to update one place or the other. This is also nice for users, because they can easily figure out what can be configured where. The options are now ordered by config file section. --summary was not described before. More examples are added.
| * | ci: install pytest-flakesZbigniew Jędrzejewski-Szmek2023-05-052-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | Some web searches say that it's packaged for those distros and not the others… v2: - drop arch. https://aur.archlinux.org/packages/python-pytest-flakes exists, but installation fails in CI.
| * | test_ukify: rework how --flakes argument is appendedZbigniew Jędrzejewski-Szmek2023-05-053-6/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The usual approach is to put 'addopts = --flakes' in setup.cfg. Unfortunately this fails badly when pytest-flakes is not installed: ERROR: usage: test_ukify.py [options] [file_or_dir] [file_or_dir] [...] test_ukify.py: error: unrecognized arguments: --flakes pytest-flakes is not packaged everywhere, and this test is not very important, so let's just do it only if pytest-flakes is available. We now detect if pytest-flakes is available and only add '--flakes' conditionally. This unfortunately means that when invoked via 'pytest' or directly as 'src/ukify/test/test_ukify.py', '--flakes' will not be appended automatically. But I don't see a nice way to achieve previous automatic behaviour. (I first considered making 'setup.cfg' templated. But then it is created in the build directory, but we would need it in the source directory for pytest to load it automatically. So to load the file, we'd need to give an argument to pytest anyway, so we don't gain anything with this more complex approach.)
| * | test_ukify: propagate failureZbigniew Jędrzejewski-Szmek2023-05-051-1/+1
| | | | | | | | | | | | | | | Oops. This explains why the tests were "passing" in CI even though a direct pytest invocation would fail.
| * | ukify: appease mypyZbigniew Jędrzejewski-Szmek2023-05-051-21/+42
| | | | | | | | | | | | | | | | | | | | | Note to self: PEP 585 introduced using collection types as types, and is available since 3.9. PEP 604 allows writing unions with "|", but is only available since 3.10, so not yet here because we maintain compat with 3.9.
| * | TODO: remove two entriesZbigniew Jędrzejewski-Szmek2023-05-051-6/+1
| | | | | | | | | | | | | | | 0ccfd3564b2532a4da6526a9e030362c4a142b77 implemented one of the items, and this pull requests handles the other one.
| * | test/60-ukify: override stub location in testsZbigniew Jędrzejewski-Szmek2023-05-053-3/+12
| | | | | | | | | | | | Without this, build would fail if the stub is not available in /usr/lib/.
| * | test-kernel-install: test 60-ukify.install and 90-uki-copy.installZbigniew Jędrzejewski-Szmek2023-05-053-17/+48
| | | | | | | | | | | | | | | | | | We install a kernel with layout=uki and uki_generator=ukify, and test that a UKI gets installed in the expected place. The two plugins cooperate, so it's easiest to test them together.
| * | 60-ukify: kernel-install plugin that calls ukify to create a UKIZbigniew Jędrzejewski-Szmek2023-05-052-2/+234
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 60-ukify.install calls ukify with a config file, so singing and policies and splash will be done through the ukify config file, without 60-ukify.install knowing anything directly. In meson.py, the variable for loaderentry.install.in is used just once, let's drop it. (I guess this approach was copied from kernel_install_in, which is used in another file.) The general idea is based on cvlc12's #27119, but now in Python instead of bash.
| * | test_ukify: add tests for the new functionalityZbigniew Jędrzejewski-Szmek2023-05-051-0/+88
| | |
| * | ukify: PeError → PEErrorZbigniew Jędrzejewski-Szmek2023-05-051-13/+13
| | | | | | | | | | | | | | | We don't lowercase acronyms in systemd usually. Remove unnused f'' prefix to avoid a pylint warning.
| * | ukify: rework option parsing to support a config fileZbigniew Jędrzejewski-Szmek2023-05-051-153/+417
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In some ways this is similar to mkosi: we have a argparse.ArgumentParser() with a bunch of options, and a configparser.ConfigParser() with an overlapping set of options. Many options are settable in both places, but not all. In mkosi, we define this in three places (a dataclass, and a function for argparse, and a function for configparser). Here, we have one huge list of ConfigItem instances. Each instance specifies the full metadata for both parsers. Argparse generates a --help string for all the options, and we also append a config file sample to --help based on the ConfigItem data: $ python src/ukify/ukify.py --help|tail -n 25 config file: [UKI] Linux = LINUX Initrd = INITRD… Cmdline = TEXT|@PATH OSRelease = TEXT|@PATH DeviceTree = PATH Splash = BMP PCRPKey = KEY Uname = VERSION EFIArch = ia32|x64|arm|aa64|riscv64 Stub = STUB PCRBanks = BANK… SigningEngine = ENGINE SecureBootPrivateKey = SB_KEY SecureBootCertificate = SB_CERT SignKernel = SIGN_KERNEL [PCRSignature:NAME] PCRPrivateKey = PATH PCRPublicKey = PATH Phases = PHASE-PATH… While writing this I needed to check the argument parsing, so I added a --summary switch. It just pretty-prints the resulting option dictionary: $ python src/ukify/ukify.py /efi//3a9d668b4db749398a4a5e78a03bffa5/6.2.11-300.fc38.x86_64/linux /efi//3a9d668b4db749398a4a5e78a03bffa5/6.2.11-300.fc38.x86_64/initrd --pcr-private-key=PRIV.key --pcr-public-key=PUB.key --config=man/ukify-example.conf --summary Host arch 'x86_64', EFI arch 'x64' {'_groups': [0, 'initrd', 'system'], 'cmdline': 'A1 B2 C3', 'config': 'man/ukify-example.conf', 'devicetree': None, 'efi_arch': 'x64', 'initrd': [PosixPath('initrd1'), PosixPath('initrd2'), PosixPath('initrd3'), PosixPath('/efi/3a9d668b4db749398a4a5e78a03bffa5/6.2.11-300.fc38.x86_64/initrd')], 'linux': PosixPath('/efi/3a9d668b4db749398a4a5e78a03bffa5/6.2.11-300.fc38.x86_64/linux'), 'measure': None, 'os_release': PosixPath('/etc/os-release'), 'output': 'linux.efi', 'pcr_banks': ['sha1', 'sha384'], 'pcr_private_keys': [PosixPath('PRIV.key'), PosixPath('pcr-private-initrd-key.pem'), PosixPath('pcr-private-system-key.pem')], 'pcr_public_keys': [PosixPath('PUB.key'), PosixPath('pcr-public-initrd-key.pem'), PosixPath('pcr-public-system-key.pem')], 'pcrpkey': None, 'phase_path_groups': [None, ['enter-initrd'], ['enter-initrd:leave-initrd', 'enter-initrd:leave-initrd:sysinit', 'enter-initrd:leave-initrd:sysinit:ready']], 'sb_cert': PosixPath('mkosi.secure-boot.crt'), 'sb_key': PosixPath('mkosi.secure-boot.key'), 'sections': [], 'sign_kernel': None, 'signing_engine': None, 'splash': None, 'stub': PosixPath('/usr/lib/systemd/boot/efi/linuxx64.efi.stub'), 'summary': True, 'tools': None, 'uname': None} With --summary, existence of input paths is not checked. I think we'll want to show them, instead of throwing an error, but in red, similarly to 'bootctl list'. This also fixes tests which were failing with e.g. E FileNotFoundError: [Errno 2] No such file or directory: '/ARG1' =========================== short test summary info ============================ FAILED ../src/ukify/test/test_ukify.py::test_parse_args_minimal - FileNotFoun... FAILED ../src/ukify/test/test_ukify.py::test_parse_args_many - FileNotFoundEr... FAILED ../src/ukify/test/test_ukify.py::test_parse_sections - FileNotFoundErr... =================== 3 failed, 10 passed, 3 skipped in 1.51s ====================
| * | test_ukify: fix two failing testsZbigniew Jędrzejewski-Szmek2023-05-031-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixup for 22ad038ac6e4fe5e4a68555f0e70bd0a16fb5616 and 3fc5eed47091363247012454df458e1a3303bf12. It seems that the tests are not executed properly in CI. Nevertheless, test-ukify appears in logs: rpm-build:fedora-rawhide-x86_64: 409/1191 systemd / test-ukify OK 0.16s This is strange.
| * | test_ukify: fix loop iterationZbigniew Jędrzejewski-Szmek2023-05-031-1/+1
| | | | | | | | | | | | We'd try to access 'linux' or 'initrd' after failing to set it.
| * | meson: allow building .standalone on demandZbigniew Jędrzejewski-Szmek2023-05-031-60/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can always build the standalone version whenever we build the normal version (the dependencies are the same). In most builds standalone binaries would be disabled. But it is occasionally useful to have them for testing, so move the conditional to install:, so the binaries can be build by giving the explicit target name. The default of 'build_by_default' for executable() is sadly true (since meson 0.38.0), so need to specify build_by_default: too. Also add systemd-shutdown.standalone to public_programs for additional testing.
| * | meson: avoid building executables that won't be installedZbigniew Jędrzejewski-Szmek2023-05-031-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When executable() or custom_target() has install: that is conditional as is false (i.e. not install:true), it won't be built by default. (build_by_default: defaults to install:). But if that program is added to public_programs, it will be build by default because it is pulled in by the test, effectively defeating the disablement. While at it, make 'ukify' follow the same pattern as 'kernel-install'. They will be used later together.
| * | ukify: add missing headerZbigniew Jędrzejewski-Szmek2023-05-031-0/+15
| | | | | | | | | | | | This file is installed, so it should have the long header.
| * | ukify: use UPPERCASE for parameter namesZbigniew Jędrzejewski-Szmek2023-05-031-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We generally nowadays use UPPERCASE for parameters in variuos help text. Let's be consistent here too, and also drop duplicated 'usage:': $ ukify -h usage: ukify [options…] LINUX INITRD… ukify -h | --help Build and sign Unified Kernel Images positional arguments: LINUX vmlinuz file [.linux section] INITRD… initrd files [.initrd section] ...
| * | 90-loaderentry: make sure that variables are setZbigniew Jędrzejewski-Szmek2023-05-031-3/+3
| | | | | | | | | | | | | | | We unconditionally use the variables later on, so let's make sure that they were passed as expected.
* | | hwdb: do not include '#' in modaliasYu Watanabe2023-05-061-1/+1
| | | | | | | | | | | | | | | Follow-up for 7bd3d6e35a6de8b1bf93e2fae28a64f0c7ffd2ac. Fixes #27516.
* | | Merge pull request #27527 from mrc0mmand/fuzz-manager-serializeLuca Boccassi2023-05-066-91/+174
|\ \ \ | |_|/ |/| | core: a couple of follow-ups for issues found by fuzz-manager-serialize
| * | test: add a test case for #27521Frantisek Sumsal2023-05-051-0/+0
| | | | | | | | | | | | Which got resolved by e652663a04.
| * | core: check the unit type more thoroughly when deserializingFrantisek Sumsal2023-05-052-1/+7
| | | | | | | | | | | | Resolves: #27523
| * | shared: refuse fd == INT_MAXFrantisek Sumsal2023-05-052-0/+17
| | | | | | | | | | | | | | | | | | | | | Since we do `FD_TO_PTR(fd)` that expands to `INT_TO_PTR(fd) + 1` which triggers an integer overflow. Resolves: #27522
| * | core: use extract_first_word() instead of sscanf()Frantisek Sumsal2023-05-051-90/+150
| | |
* | | zsh: remove usage of PREFIX in _systemctlRonan Pigott2023-05-051-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The usage of PREFIX in this completion is mostly counter to the intended usage of compsys in zsh. It is generally expected that completion code provide the available completions and tags in that word position so that compsys, with user configuration, can filter them to the appropriate set. One egregious error caused by the usage of PREFIX here is the caching of SYS_ALL_UNITS, which stored only the unit names prematurely filtered by the completion prefix, affecting all future completions. For example, $ systemctl cat nonsense<TAB> might find no matching units if nonsense* has no matches, but now $ systemctl cat <TAB> will fail in all future completions even though every unit file is a valid match, because the cached set has been erroneously filtered by the last prefix.
* | | basic/audit-util: make a test request before enabling use of auditNick Rosbrook2023-05-051-1/+60
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a container manager does not follow the guidance in https://systemd.io/CONTAINER_INTERFACE/ regarding audit capabilities, then the current check may not be sufficient to determine that audit will function properly. In particular, when calling bind() on the audit fd, we will get EPERM if running in a user-namespaced container. Expand the check to make an AUDIT_GET_FEATURE request on the audit fd to test if it is working. If this fails with ECONNREFUSED, we know it is because the kernel does not support the use of audit outside of the initial user namespace. Note that the approach of this patch was suggested here: https://github.com/systemd/systemd/pull/19443#issuecomment-829566659 Fixes: #6519
* | Merge pull request #27536 from dtardon/checked-fd-parsingLuca Boccassi2023-05-0514-47/+75
|\ \ | | | | | | Always check parsed fds for validity
| * | main: improve log messageDavid Tardon2023-05-051-1/+1
| | |
| * | tree-wide: use parse_fd()David Tardon2023-05-0511-47/+46
| | |
| * | test: add a test for parse_fd()David Tardon2023-05-051-0/+13
| | |
| * | fd-util: introduce parse_fd()David Tardon2023-05-052-0/+16
| | | | | | | | | | | | | | | It's a simple wrapper for safe_atoi() that returns error if the parsed fd is < 0 .
| * | main: add missing returnDavid Tardon2023-05-051-1/+1
| | | | | | | | | | | | Follow-up-for: 2b5107e1625e0847179da0d35eb544192766886f
* | | tpm2 PCRs: fix unchecked attempt to set PCR[24]OMOJOLA2023-05-052-2/+3
| | |
* | | man: small fixes to systemd.time Calendar EventsChristopher Gurnee2023-05-051-2/+2
|/ /
* | Merge pull request #27529 from DaanDeMeyer/kernel-topLuca Boccassi2023-05-049-8/+87
|\ \ | | | | | | mkosi: A few kernel build QOL improvements
View Lorry Controller Status