summaryrefslogtreecommitdiff
path: root/man
Commit message (Collapse)AuthorAgeFilesLines
* timesync: move stamp file to /var/lib/systemd/timesync/clockYu Watanabe2017-08-301-1/+1
|
* man: fix example indentation in tmpfiles.d(5) (#6578)Lennart Poettering2017-08-261-3/+3
| | | | docboc actually copies the indentation 1:1 into the final man page and that makes the example really weirdly aligned. Let's fix that.
* core: add two new special ExecStart= character prefixesLennart Poettering2017-08-101-7/+52
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds two new special character prefixes to ExecStart= and friends, in addition to the existing "-", "@" and "+": "!" → much like "+", except with a much reduced effect as it only disables the actual setresuid()/setresgid()/setgroups() calls, but leaves all other security features on, including namespace options. This is very useful in combination with RuntimeDirectory= or DynamicUser= and similar option, as a user is still allocated and used for the runtime directory, but the actual UID/GID dropping is left to the daemon process itself. This should make RuntimeDirectory= a lot more useful for daemons which insist on doing their own privilege dropping. "!!" → Similar to "!", but on systems supporting ambient caps this becomes a NOP. This makes it relatively straightforward to write unit files that make use of ambient capabilities to let systemd drop all privs while retaining compatibility with systems that lack ambient caps, where priv dropping is the left to the daemon codes themselves. This is an alternative approach to #6564 and related PRs.
* seccomp: add new @setuid seccomp groupLennart Poettering2017-08-101-0/+4
| | | | | | | This new group lists all UID/GID credential changing syscalls (which are quite a number these days). This will become particularly useful in a later commit, which uses this group to optionally permit user credential changing to daemons in case ambient capabilities are not available.
* Merge pull request #6579 from sourcejedi/gettyLennart Poettering2017-08-101-6/+8
|\ | | | | getty nitpicks
| * man/systemd-getty-generator fix/updateAlan Jenkins2017-08-091-6/+8
| | | | | | | | | | | | | | | | | | | | | | * Containers don't use serial-getty@console.service, they use console-getty.service instead, and suppress scanning for kernel or virtualizer consoles. * Nowadays gettys are started on *all* configured kernel consoles. * except for the line printer console, because that's not a tty. (Seriously. Search CONFIG_LP_CONSOLE).
* | tmpfiles: Allow create symlink on directories (#6039)William Douglas2017-08-091-7/+8
| | | | | | | | | | | | Currently if tmpfiles is run with force on symlink creation but there already exists a directory at that location, the creation will fail. This change updates the behavior to remove the directory with rm_fr and then attempts to create the symlink again.
* | build-sys: fix invalid args detected by meson 0.42 (#6561)userwithuid2017-08-091-3/+4
|/ | | | | | | | | | | | some run_target() calls were using params from custom_target() example message: WARNING: Passed invalid keyword argument "input". This will become a hard error in the future. New way to call targets: ninja man/man ninja man/html ninja man/update-man-rules
* core: propagate reload from RELOADING=1 notification (#6550)Jouke Witteveen2017-08-071-1/+2
|
* man: DynamicUser= does not imply PrivateDevices= (#6510)Yu Watanabe2017-08-071-5/+3
| | | Follow-up for effbd6d2eadb61bd236d118afc7901940c4c6b37.
* man: document socket requirement for systemd-socket-proxyd (#6535)dkg2017-08-051-0/+4
| | | | | | | | | | | | | | | | Without this requirement, if proxy-to-nginx.socket was down, and the sysadmin were to do: systemctl start proxy-to-nginx.service then the service would come up without a configured socket, which doesn't make sense. Normally this isn't how we expect a socket-activated service to start, but it's possible for an admin to do this (if the .socket were already running, the systemd-socket-proxyd process will start effectively idle). But the .service shouldn't end up in a broken state if the .socket isn't already listening. Adding the explicit Requires: should ensure that an admin with this configuration state can't accidentally break their system.
* man: fix typos (#6532)Jakub Wilk2017-08-034-7/+7
|
* networkd: add scope to address section (#6449)Susant Sahani2017-08-011-0/+8
| | | | | | | This work allows to configure address Scope to host | link | global or a number. Closes #6446
* escape: fix systemd-escape description textLennart Poettering2017-07-311-1/+1
| | | | | | | | The long man page paragraph got it right: the tool is for escaping systemd unit names, not just system unit names. Also fix the short man page paragraph and the --help text. Follow-up for 303608c1bcf9568371625fbbd9442946cadba422
* Merge pull request #6462 from keszybz/man-tweaksMartin Pitt2017-07-283-18/+37
|\ | | | | Some small man page fixes
| * man: do not recommend rescue.target for alt-↑Zbigniew Jędrzejewski-Szmek2017-07-281-3/+3
| | | | | | | | | | | | | | | | rescue.target does not work well, and we don't have a suitable emergency shell unit that can be started on existing systems right now. So let's just remove the recommendation for now. Fixes #6451.
| * man: do not encourgage starting of poweroff/halt/reboot/kexec targets directlyZbigniew Jędrzejewski-Szmek2017-07-281-8/+24
| | | | | | | | | | | | | | | | Going through logind and systemd allows polkit to be used, the job mode will be set properly, and is generally easier to get correct. Fixes #6452.
| * man: describe which units types are stopped on isolateZbigniew Jędrzejewski-Szmek2017-07-282-7/+10
| | | | | | | | Fixes #6455.
* | Merge pull request #6465 from keszybz/drop-kdbusMartin Pitt2017-07-281-8/+1
|\ \ | |/ |/| Drop kdbus-dependent code
| * Drop busname unit typeZbigniew Jędrzejewski-Szmek2017-07-231-8/+1
| | | | | | | | | | | | | | Since busname units are only useful with kdbus, they weren't actively used. This was dead code, only compile-tested. If busname units are ever added back, it'll be cleaner to start from scratch (possibly reverting parts of this patch).
* | man/systemd.network: DHCP defaults to "no" (#6423)Lion Yang2017-07-211-1/+2
| | | | | | Code at: /src/network/networkd-network.c#L160
* | doc/systemd-resolved.service: fix typo (#6422)Lion Yang2017-07-211-1/+1
|/ | | DNS sever => DNS server
* build-sys: drop gitignore patterns for in-tree buildsZbigniew Jędrzejewski-Szmek2017-07-181-5/+0
| | | | ... and other autotools-generated files.
* build-sys: drop support for generation of Makefile-man.amZbigniew Jędrzejewski-Szmek2017-07-181-1/+1
|
* build-sys: drop automake supportZbigniew Jędrzejewski-Szmek2017-07-181-1/+0
| | | | | v2: - also mention m4
* core: add {State,Cache,Log,Configuration}Directory= (#6384)Yu Watanabe2017-07-181-3/+24
| | | | | | | | This introduces {State,Cache,Log,Configuration}Directory= those are similar to RuntimeDirectory=. They create the directories under /var/lib, /var/cache/, /var/log, or /etc, respectively, with the mode specified in {State,Cache,Log,Configuration}DirectoryMode=. This also fixes #6391.
* Merge pull request #6387 from keszybz/fix-timeout-0Lennart Poettering2017-07-181-1/+4
|\ | | | | Fix x-systemd.timeout=0 in fstab
| * man: make crypttab(5) a bit easier to readZbigniew Jędrzejewski-Szmek2017-07-171-1/+4
| |
* | Merge pull request #6328 from yuwata/runtime-preserveLennart Poettering2017-07-171-21/+42
|\ \ | |/ |/| core: Allow preserving contents of RuntimeDirectory over process restart
| * core: support subdirectories in RuntimeDirectory= optionYu Watanabe2017-07-171-24/+27
| |
| * core: allow preserving contents of RuntimeDirectory= over process restartYu Watanabe2017-07-171-1/+19
| | | | | | | | | | | | | | This introduces RuntimeDirectoryPreserve= option which takes a boolean argument or 'restart'. Closes #6087.
* | Fix spelling (#6378)Lucas Werkmeister2017-07-151-1/+1
|/
* journald: make reading /dev/kmsg optional (#6362)Susant Sahani2017-07-151-0/+8
| | | Closes #6022
* Merge pull request #6300 from keszybz/refuse-to-load-some-unitsLennart Poettering2017-07-121-9/+26
|\ | | | | Refuse to load some units
| * man: add warnings that Private*= settings are not always appliedZbigniew Jędrzejewski-Szmek2017-07-111-9/+26
| |
* | fstab-generator: Chase symlinks where possible (#6293)Colin Walters2017-07-112-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This has a long history; see see 5261ba901845c084de5a8fd06500ed09bfb0bd80 which originally introduced the behavior. Unfortunately that commit doesn't include any rationale, but IIRC the basic issue is that systemd wants to model the real mount state as units, and symlinks make canonicalization much more difficult. At the same time, on a RHEL6 system (upstart), one can make e.g. `/home` a symlink, and things work as well as they always did; but one doesn't have access to the sophistication of mount units (dependencies, introspection, etc.) Supporting symlinks here will hence make it easier for people to do upgrades to RHEL7 and beyond. The `/home` as symlink case also appears prominently for OSTree; see https://ostree.readthedocs.io/en/latest/manual/adapting-existing/ Further work has landed in the nspawn case for this; see e.g. d944dc9553009822deaddec76814f5642a6a8176 A basic limitation with doing this in the fstab generator (and that I hit while doing some testing) is that we obviously can't chase symlinks into mounts, since the generator runs early before mounts. Or at least - doing so would require multiple passes over the fstab data (as well as looking at existing mount units), and potentially doing multi-phase generation. I'm not sure it's worth doing that without a real world use case. For now, this will fix at least the OSTree + `/home` <https://bugzilla.redhat.com/show_bug.cgi?id=1382873> case mentioned above, and in general anyone who for whatever reason has symlinks in their `/etc/fstab`.
* | man: briefly document permitted user/group name syntax for User=/Group= and ↵Lennart Poettering2017-07-102-19/+33
|/ | | | | | | syusers.d (#6321) As discussed here: https://lists.freedesktop.org/archives/systemd-devel/2017-July/039237.html
* systemd-mount: support unmounting devices on remote hostYu Watanabe2017-07-051-2/+2
| | | | | The commit 9017f5d88d5061487de53f00a1a8c0a83e41e760 prohibits to unmount devices on remote host. This makes reenable such feature.
* systemd-mount: support discovery of loop backing fileYu Watanabe2017-07-051-1/+2
| | | | | | | | | ``` $ suro systemd-mount /path/to/disk.img Started unit run-media-system-disk.img.mount for mount point: /run/media/system/disk.img ``` Closes #6226.
* fstab-generator: handle NFS "bg" mounts correctly. (#6103)NeilBrown2017-07-041-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When "bg" is specified for NFS mounts, and if the server is not accessible, two behaviors are possible depending on networking details. If a definitive error is received, such a EHOSTUNREACH or ECONNREFUSED, mount.nfs will fork and continue in the background, while /bin/mount will report success. If no definitive error is reported but the connection times out instead, then the mount.nfs timeout will normally be longer than the systemd.mount timeout, so mount.nfs will be killed by systemd. In the first case the mount has appeared to succeed even though it hasn't. This can be confusing. Also the background mount.nfs will never get cleaned up, even if the mount unit is stopped. In the second case, mount.nfs is killed early and so the mount will not complete when the server comes back. Neither of these are ideal. This patch modifies the options when an NFS bg mount is detected to force an "fg" mount, but retain the default "retry" time of 10000 minutes that applies to "bg" mounts. It also imposes "nofail" behaviour and sets the TimeoutSec for the mount to "infinity" so the retry= time is allowed to complete. This provides near-identical behaviour to an NFS bg mount started directly by "mount -a". The only difference is that systemd will not wait for the first mount attempt, while "mount -a" will. Fixes #6046
* man: remove unnecessary "the"Zbigniew Jędrzejewski-Szmek2017-07-031-1/+1
|
* Merge pull request #6231 from keszybz/man-nss-resolvedLennart Poettering2017-07-033-8/+34
|\ | | | | man: describe the relationship between nss-myhostname and nss-resolved
| * man: add zypper instructions for systemd-nspawnZbigniew Jędrzejewski-Szmek2017-07-021-0/+13
| | | | | | | | | | | | | | v2: - add -c and update the list of packages v3: - link to a man page on mankier.com
| * man: add more detail about quoting in ExecStart linesZbigniew Jędrzejewski-Szmek2017-06-301-6/+8
| | | | | | | | Fixes #624.
| * man: describe the relationship between nss-myhostname and nss-resolvedZbigniew Jędrzejewski-Szmek2017-06-281-2/+13
| | | | | | | | Fixes #1605.
* | Merge pull request #6233 from keszybz/man-locale-vconsoleLennart Poettering2017-07-032-3/+12
|\ \ | | | | | | Small doc updates for 00-keyboard.conf, vconsole.conf, locale.conf
| * | man: mention localed and localectl in locale.conf(5) and vconsole.conf(5)Zbigniew Jędrzejewski-Szmek2017-06-282-3/+12
| |/ | | | | | | | | | | | | | | Fixes #295. (We cannot add a comment to either of those files because they are documented to "only support variable assignments", so it's better to add an explanation in the man page instead.)
* | man: fix spelling error of sd_bus_error_set_const (#6246)Lars Karlitski2017-06-301-1/+1
|/
* systemd-mount: support unmounting loop devices by backing files (#6211)Yu Watanabe2017-06-281-2/+3
| | | | | | | This makes `systemd-umount` or `systemd-mount -u` support unmounting loop devices by the corresponding backing files, like `systemd-mount --umount /tmp/foo.img /tmp/bar.img` Fixes #6206.
* nspawn: register a scope for the unit if --register=no is specified (#6166)Lennart Poettering2017-06-281-25/+20
| | | | | | | | | | | | | | | | | Previously, only when --register=yes was set (the default) the invoked container would get its own scope, created by machined on behalf of nspawn. With this change if --register=no is set nspawn will still get its own scope (which is a good thing, so that --slice= and --property= take effect), but this is not done through machined but by registering a scope unit directly in PID 1. Summary: --register=yes → allocate a new scope through machined (the default) --register=yes --keep-unit → use the unit we are already running in an register with machined --register=no → allocate a new scope directly, but no machined --register=no --keep-unit → do not allocate nor register anything Fixes: #5823
View Lorry Controller Status