summaryrefslogtreecommitdiff
path: root/meson.build
Commit message (Collapse)AuthorAgeFilesLines
...
* Merge pull request #26082 from kraxel/ukiLennart Poettering2023-01-181-0/+2
|\ | | | | bootctl: add is-uki command
| * bootctl: add kernel-identity commandGerd Hoffmann2023-01-181-0/+2
| | | | | | | | | | The command takes a kernel as argument and checks what kind of kernel the image is. Returns one of uki, pe or unknown.
* | pcrphase: make tool more generic, reuse for measuring machine id/fs uuidsLennart Poettering2023-01-171-0/+1
| | | | | | | | See: #24503
* | cryptsetup: add tpm2-measure-pcr= and tpm2-measure-bank= crypttab optionsLennart Poettering2023-01-171-1/+2
|/ | | | | | | | | These options allow measuring the volume key used for unlocking the volume to a TPM2 PCR. This is ideally used for the volume key of the root file system and can then be used to bind other resources to the root file system volume in a secure way. See: #24503
* meson: use 0|1 for SD_BOOTZbigniew Jędrzejewski-Szmek2023-01-101-0/+3
| | | | | | | We converted to not using #ifdef for most of our defines because the syntax is nicer and we are protected against typos and can set -Werror=undef. Let's do the same for SD_BOOT. The define is nicely hidden in build.h for normal builds, and for EFI builds we were already setting SD_BOOT on the commandline.
* boot: Remove option TPM PCR compat optionJan Janssen2023-01-091-2/+0
| | | | It says remove in 2023; happy to oblige.
* p11kit: switch to dlopen()Luca Boccassi2022-12-191-0/+2
|
* bootctl: split out "install" verb tooLennart Poettering2022-12-191-0/+2
|
* bootctl: split out "status" verb tooLennart Poettering2022-12-191-0/+2
|
* bootctl: split out "set-efivar" verbs, tooLennart Poettering2022-12-191-0/+2
|
* bootctl: also split out 'systemd-efi-options' verbLennart Poettering2022-12-191-0/+2
|
* bootctl: split out random seed verb, tooLennart Poettering2022-12-191-1/+6
|
* bootctl: let's start splitting up bootctl like we did for systemctl and othersLennart Poettering2022-12-191-1/+3
|
* meson: fix cross-compilation of LONG_MAXasavah2022-12-181-1/+5
| | | | https://github.com/systemd/systemd/pull/25618#issuecomment-1355019553
* Merge pull request #25180 from keszybz/ukifyLennart Poettering2022-12-081-1/+33
|\ | | | | ukify: add helper to create UKIs
| * tests: add pytest tests for ukifyZbigniew Jędrzejewski-Szmek2022-12-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some gymnastics were needed to import ukify as a module. Before the file was templated, this was trivial: insert the directory in sys.path, call import. But it's a real pain to import the unsuffixed file after processing. Instead, the untemplated file is imported, which works well enough for tests and is very simple. The tests can be called via pytest: PATH=build/:$PATH pytest -v src/ukify/test/test_ukify.py or directly: PATH=build/:$PATH src/ukify/test/test_ukify.py or via the meson test machinery output: meson test -C build test-ukify -v or without verbose output: meson test -C build test-ukify Zekret files are obfuscated using base64.
| * meson,ukify: hook up ukify, add --version optionZbigniew Jędrzejewski-Szmek2022-12-071-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The option is added because we have a similar one for kernel-install. This program requires python, and some people might want to skip it because of this. The tool is installed in /usr/lib/systemd for now, since the interface might change. A template file is used, but there is no .in suffix. The problem is that we'll later want to import the file as a module for tests, but recent Python versions make it annoyingly hard to import a module from a file without a .py suffix. imp.load_sources() works, but it is deprecated and throws warnings. importlib.machinery.SourceFileLoader().load_module() works, but is also deprecated. And the documented replacements are a maze of twisted little callbacks that result in an empty module. So let's take the easy way out, and skip the suffix which makes it easy to import the template as a module after adding the directory to sys.path.
| * tests: add a simple test that bootctl output is valid jsonZbigniew Jędrzejewski-Szmek2022-12-011-1/+9
| | | | | | | | | | python's json.tool module is used because it does validation. jq is more forgiving. Also, json is in the stdlib, so it should be always available.
* | meson: build a standalone version of systemd-shutdownZbigniew Jędrzejewski-Szmek2022-12-061-0/+16
| | | | | | | | | | | | | | | | I'd like to use this as a basis for an exitrd: When compiled with -Dstandalone-binaries=true -Db_lto=true -Dbuildtype=release, the new file is 800k. It's more than I'd like, but still quite a bit less than libsystemd-shared.so, which is 3800k.
* | test: do the --help/--version checks for repart.standalone tooZbigniew Jędrzejewski-Szmek2022-12-061-0/+1
| |
* | manager: define a string constant for LONG_MAX and use that for sysctlZbigniew Jędrzejewski-Szmek2022-12-031-0/+4
| | | | | | | | | | This moves the formatting of the constant to compilation time and let's us avoid asprintf() in the very hot path of initial boot.
* | fdisk: introduce common fdisk_new_context_fd() helperLennart Poettering2022-11-261-4/+8
| | | | | | | | | | We do the same thing over and over again and it's a bit ugly, hence let's unify the code for it at one common place.
* | meson: resort importsZbigniew Jędrzejewski-Szmek2022-11-251-8/+8
|/
* Merge pull request #25389 from fbuihuu/update-test-for-opensuseYu Watanabe2022-11-191-1/+1
|\ | | | | Update test/ for openSUSE
| * meson: install test-kernel-install only when -Dkernel-install=trueFranck Bui2022-11-181-1/+1
| | | | | | | | | | | | | | | | This patch fixes the following build failure: meson.build:3853:8: ERROR: Unknown variable "test_kernel_install_sh". Fixes #25432.
* | shared/tpm2-util: Fix "Error: Esys invalid ESAPI handle (40000001)" warningVitaly Kuznetsov2022-11-161-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | systemd-cryptenroll complains (but succeeds!) upon binding to a signed PCR policy: $ systemd-cryptenroll --unlock-key-file=/tmp/passphrase --tpm2-device=auto --tpm2-public-key=... --tpm2-signature=..." /tmp/tmp.img ERROR:esys:src/tss2-esys/esys_iutil.c:394:iesys_handle_to_tpm_handle() Error: Esys invalid ESAPI handle (40000001). WARNING:esys:src/tss2-esys/esys_iutil.c:415:iesys_is_platform_handle() Convert handle from TPM2_RH to ESYS_TR, got: 0x40000001 ERROR:esys:src/tss2-esys/esys_iutil.c:394:iesys_handle_to_tpm_handle() Error: Esys invalid ESAPI handle (40000001). WARNING:esys:src/tss2-esys/esys_iutil.c:415:iesys_is_platform_handle() Convert handle from TPM2_RH to ESYS_TR, got: 0x4000000 New TPM2 token enrolled as key slot 1. The problem seems to be that Esys_LoadExternal() function from tpm2-tss expects a 'ESYS_TR_RH*' constant specifying the requested hierarchy and not a 'TPM2_RH_*' one (see Esys_LoadExternal() -> Esys_LoadExternal_Async() -> iesys_handle_to_tpm_handle() call chain). It all works because Esys_LoadExternal_Async() falls back to using the supplied values when iesys_handle_to_tpm_handle() fails: r = iesys_handle_to_tpm_handle(hierarchy, &tpm_hierarchy); if (r != TSS2_RC_SUCCESS) { ... tpm_hierarchy = hierarchy; } Note, TPM2_RH_OWNER was used on purpose to support older tpm2-tss versions (pre https://github.com/tpm2-software/tpm2-tss/pull/1531), use meson magic to preserve compatibility. Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
* | missing_syscall: Add rt_tgsigqueueinfo()Daan De Meyer2022-11-161-0/+4
| |
* | repart: Do offline encryption instead of onlineDaan De Meyer2022-11-151-1/+4
| | | | | | | | | | | | | | | | | | | | Offline encryption can be done without mounting the luks device. For now we still use loop devices to split out the partition we want to write to but in a later commit we'll replace this with a regular file. For offline encryption, we need to keep 2x the luks header size space free at the end of the partition, so this means our encrypted partitions will be 16M larger than before.
* | meson: install systemd-ac-power under /usr/binYu Watanabe2022-11-101-3/+2
|/ | | | | | | And test the its help message. The program is useful for e.g. scripts that conditionalize their tasks to be invoked only when running on AC power.
* build: Use -fstrict-flex-arrays=1 if supportedCristian Rodríguez2022-11-101-0/+1
| | | | | | | | | | | | | | | | | | Due to "historical reasons" both gcc and clang treat *all* trailing arrays members as flexible arrays, this has an evil side effect of inhibiting bounds checks on such members as __builtin_object_size cannot say for sure that: struct { ... type foo[3]; } has a trailing foo member of fixed size rather than unspecified. Ideally we should use -fstrict-flex-arrays as is, but we have to tolerate kernel uapi headers that use [0] and third party libraries written in c89 that may use [1] like curl.
* meson: add version.h dependency to more componentsFrantisek Sumsal2022-11-091-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Follow-up to c47511da7e2bab1a429fc1958a73d3f426ebb3da. ``` archlinux_systemd_ci: In file included from ../build/src/dissect/dissect.c:15: archlinux_systemd_ci: ../build/src/basic/build.h:4:10: fatal error: version.h: No such file or directory archlinux_systemd_ci: 4 | #include "version.h" archlinux_systemd_ci: | ^~~~~~~~~~~ archlinux_systemd_ci: compilation terminated. ``` ``` archlinux_systemd_ci: In file included from ../build/src/journal/cat.c:13: archlinux_systemd_ci: ../build/src/basic/build.h:4:10: fatal error: 'version.h' file not found archlinux_systemd_ci: #include "version.h" archlinux_systemd_ci: ^~~~~~~~~~~ archlinux_systemd_ci: 1 error generated. ``` ``` archlinux_systemd_ci: In file included from ../build/src/sysext/sysext.c:10: archlinux_systemd_ci: ../build/src/basic/build.h:4:10: fatal error: version.h: No such file or directory archlinux_systemd_ci: 4 | #include "version.h" archlinux_systemd_ci: | ^~~~~~~~~~~ archlinux_systemd_ci: compilation terminated. archlinux_systemd_ci: FAILED: systemd-inhibit.p/src_login_inhibit.c.o ``` ``` archlinux_systemd_ci: In file included from ../build/src/login/inhibit.c:12: archlinux_systemd_ci: ../build/src/basic/build.h:4:10: fatal error: version.h: No such file or directory archlinux_systemd_ci: 4 | #include "version.h" archlinux_systemd_ci: | ^~~~~~~~~~~ archlinux_systemd_ci: compilation terminated. ``` ...
* meson: add version.h as dependency to more targetsZbigniew Jędrzejewski-Szmek2022-11-081-79/+162
| | | | | | | | | | | version.h can be generated after compilation starts, creating a race condition between compilation of various .c files and creation of version.h. Let's add it as a dependency to more build targets that require version.h or build.h. So far we played whack'a'mole by adding versiondep whenever compilation failed. In principle any target which includes compilation (i.e. any that has .c sources directly), could require this. I don't understand why we didn't see more failures… But it seems reasonable to just add the dependency more widely.
* shutdown: Add Xen kexec supportSamuel Thibault2022-11-021-0/+13
| | | | | | In the Xen case, it's the hypervisor which manages kexec. We thus have to ask it whether a kernel is loaded, instead of relying on /sys/kernel/kexec_loaded.
* namespace: Add hidepid/subset support checkDaan De Meyer2022-11-011-0/+2
| | | | | | Using fsopen()/fsconfig(), we can check if hidepid/subset are supported to avoid the noisy logs from the kernel if they aren't supported. This works on centos/redhat 8 as well since they've backported fsopen()/fsconfig().
* meson: systemd-repart.standaloneZbigniew Jędrzejewski-Szmek2022-10-311-0/+19
| | | | | | | | Repart is growing into an important tool on its own, and users might want to install newer versions on systems that have older systemd. Let's make this easier by providing a standalone binary. Related to https://github.com/systemd/mkosi/issues/1228.
* Merge pull request #24958 from Werkov/meson-generated-directivesLuca Boccassi2022-10-311-53/+37
|\ | | | | Generate dirrectives for fuzzer tests
| * meson: Generate fuzzer inputs with directivesMichal Koutný2022-10-201-18/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The lists of directives for fuzzer tests are maintained manually in the repo. There is a tools/check-directives.sh script that runs during test phase and reports stale directive lists. Let's rework the script into a generator so that these directive files are created on-the-flight and needn't be updated whenever a unit file directives change. The scripts is rewritten in Python to get rid of gawk dependency and each generated file is a separate meson target so that incremental builds refresh what is just necessary (and parallelize (negligible)). Note: test/fuzz/fuzz-unit-file/directives-all.slice is kept since there is not automated way to generate it (it is not covered by the check script neither).
| * meson: Store fuzz tests in structured wayMichal Koutný2022-10-111-40/+29
| | | | | | | | | | | | Put fuzzer tests into dictionary that maps `fuzzer->list of inputs` instead of the flat list. This is just refactoring with no intentional .
* | meson: always use libatomic if foundZbigniew Jędrzejewski-Szmek2022-10-211-10/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Semi-quoting https://github.com/systemd/systemd/issues/25057: clang-16 has made the choice to turn on -Werror=implicit-function-declaration,implicit-int. (See Gentoo's tracker bug https://bugs.gentoo.org/870412). Added in commit 132c73b57ad1d363e97e1f4720f0e920826f34e1, systemd now does a check to see if libatomic is needed with some compile/link tests with e.g. __atomic_exchange_1, but the tests don't provide a prototype for __atomic_exchange_1 so with clang-16 the test fails, breaking the build. Let's simplify things by linking to libatomic unconditionally if it is found and seems to work. If actually unneeded, it might be dropped via --as-needed. This seems to work with gcc and clang. declare_dependency() is used instead of cc.find_library(), because the latter picks up a symlink in gcc private directory (e.g. /usr/lib/gcc/x86_64-redhat-linux/12/libatomic.so), and we don't want that. Fixes #25057.
* | qrcode-util: Add support for libqrencode 3.0Daan De Meyer2022-10-171-1/+1
|/ | | | | | They didn't actually change API between major versions, so let's support the previous version as well so we can add CentOS 8 Stream back to CI.
* Revert "journal: Add --convert= command to journalctl"Daan De Meyer2022-10-081-4/+2
| | | | | | This reverts commit 721620e8a32907ffe546a582c5ac7136b6367510. This commit was accidentally merged as part of #22998
* meson: bump numbers for v252-rc1Luca Boccassi2022-10-071-3/+3
|
* journal: Add --convert= command to journalctlDaan De Meyer2022-10-071-2/+4
| | | | | | | | --convert writes the journal files read by journalctl to the given location. The location should be specified as a full journal file path (e.g. /a/b/c/converted.journal). The directory specifies where the converted journal files will be stored. The filename specifies the naming convention the converted journal files will follow.
* Merge pull request #24511 from martinetd/bpf1Zbigniew Jędrzejewski-Szmek2022-10-061-1/+1
|\ | | | | libbpf: Add libbpf 1.0.0 compat
| * libbpf: add compat helpers for libbpf down to 0.1.0Dominique Martinet2022-10-061-1/+1
| | | | | | | | | | | | | | | | | | - new symbols are available from libbpf 0.6.0 so could be used with libbpf.so.0, but we're sure the old symbols will be there and this simplifies code - detection at runtime should always work, regardless of whether systemd has been compiled with older or newer libbpf and runs with older or newer libbpf
| * Bump libbpf version to 0.7Daan De Meyer2022-10-061-1/+1
| | | | | | | | | | | | | | | | We already depend on the skeleton APIs introduced in libbpf 0.7 so let's bump our minimum version to reflect that. We don't enforce bpf compilation on mkosi anymore since not all distros have sufficiently up-to-date libbpf available.
* | meson: Require TPM2 for measuring utilitiesMichal Koutný2022-10-061-1/+1
|/ | | | | | | | | | | | | | | | | | | | | | | I happened to run build with openssl but no tpm2 and ran into issues like: [313/1382] Compiling C object systemd-measure.p/src_boot_measure.c.o FAILED: systemd-measure.p/src_boot_measure.c.o cc -Isystemd-measure.p -I. -I.. -Isrc/basic -I../src/basic -Isrc/fundamental -I../src/fundamental -Isrc/systemd -I../src/systemd -I../src/libsystemd/sd-bus -I../src/libsystemd/sd-device -I../src/libsystemd/sd-event -I../src/libsystemd/sd-hwdb -I../src/libsystemd/sd-id128 -I../src/libsystemd/sd-journal -I../src/libsystemd/sd-netlink -I../src/libsystemd/sd-network -I../src/libsystemd/sd-resolve -Isrc/shared -I../src/shared -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Wextra -std=gnu11 -O0 -g -Wno-missing-field-initializers -Wno-unused-parameter -Wdate-time -Wendif-labels -Werror=format=2 -Werror=format-signedness -Werror=implicit-function-declaration -Werror=incompatible-pointer-types -Werror=int-conversion -Werror=overflow -Werror=override-init -Werror=return-type -Werror=shift-count-overflow -Werror=shift-overflow=2 -Werror=undef -Wfloat-equal -Wimplicit-fallthrough=5 -Winit-self -Wlogical-op -Wmissing-include-dirs -Wmissing-noreturn -Wnested-externs -Wold-style-definition -Wpointer-arith -Wredundant-decls -Wshadow -Wstrict-aliasing=2 -Wstrict-prototypes -Wsuggest-attribute=noreturn -Wunused-function -Wwrite-strings -Wno-unused-result -Werror=missing-declarations -Werror=missing-prototypes -fdiagnostics-show-option -fno-common -fno-strict-aliasing -fstack-protector -fstack-protector-strong -fvisibility=hidden --param=ssp-buffer-size=4 -fno-omit-frame-pointer -Werror=shadow -include config.h -DOPENSSL_LOAD_CONF -MD -MQ systemd-measure.p/src_boot_measure.c.o -MF systemd-measure.p/src_boot_measure.c.o.d -o systemd-measure.p/src_boot_measure.c.o -c ../src/boot/measure.c ../src/boot/measure.c: In function ‘verb_sign’: ../src/boot/measure.c:710:48: error: variable ‘c’ has initializer but incomplete type 710 | _cleanup_(tpm2_context_destroy) struct tpm2_context c = {}; [308/1382] Compiling C object systemd-pcrphase.p/src_boot_pcrphase.c.o FAILED: systemd-pcrphase.p/src_boot_pcrphase.c.o cc -Isystemd-pcrphase.p -I. -I.. -Isrc/basic -I../src/basic -Isrc/fundamental -I../src/fundamental -Isrc/systemd -I../src/systemd -I../src/libsystemd/sd-bus -I../src/libsystemd/sd-device -I../src/libsystemd/sd-event -I../src/libsystemd/sd-hwdb -I../src/libsystemd/sd-id128 -I../src/libsystemd/sd-journal -I../src/libsystemd/sd-netlink -I../src/libsystemd/sd-network -I../src/libsystemd/sd-resolve -Isrc/shared -I../src/shared -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Wextra -std=gnu11 -O0 -g -Wno-missing-field-initializers -Wno-unused-parameter -Wdate-time -Wendif-labels -Werror=format=2 -Werror=format-signedness -Werror=implicit-function-declaration -Werror=incompatible-pointer-types -Werror=int-conversion -Werror=overflow -Werror=override-init -Werror=return-type -Werror=shift-count-overflow -Werror=shift-overflow=2 -Werror=undef -Wfloat-equal -Wimplicit-fallthrough=5 -Winit-self -Wlogical-op -Wmissing-include-dirs -Wmissing-noreturn -Wnested-externs -Wold-style-definition -Wpointer-arith -Wredundant-decls -Wshadow -Wstrict-aliasing=2 -Wstrict-prototypes -Wsuggest-attribute=noreturn -Wunused-function -Wwrite-strings -Wno-unused-result -Werror=missing-declarations -Werror=missing-prototypes -fdiagnostics-show-option -fno-common -fno-strict-aliasing -fstack-protector -fstack-protector-strong -fvisibility=hidden --param=ssp-buffer-size=4 -fno-omit-frame-pointer -Werror=shadow -include config.h -DOPENSSL_LOAD_CONF -MD -MQ systemd-pcrphase.p/src_boot_pcrphase.c.o -MF systemd-pcrphase.p/src_boot_pcrphase.c.o.d -o systemd-pcrphase.p/src_boot_pcrphase.c.o -c ../src/boot/pcrphase.c ../src/boot/pcrphase.c: In function ‘determine_banks’: ../src/boot/pcrphase.c:117:24: error: unknown type name ‘TPMI_ALG_HASH’ 117 | _cleanup_free_ TPMI_ALG_HASH *algs = NULL; Guarding the utilites with HAVE_TPM2 fixes the issue for me. This complements #24811.
* meson: set minimum libbpf/bpftool versions for bpf-gccJames Hilliard2022-10-011-6/+16
| | | | | | | | We need the following libbpf commits for bpf-gcc compatibility: - https://github.com/libbpf/libbpf/commit/3d484ca47339b23afb2ec7c508ed9a3a5cf1d287 - https://github.com/libbpf/libbpf/commit/b31ca3fa0e62fde6aa66f855136e29e088ad9dde These are first present in libbpf 1.0.0 and bpftool 7.0.0.
* meson: libfido2 requires opensslYu Watanabe2022-09-251-3/+10
| | | | | | | | | | | | | | | | | | | | | | Fixes compile error with -Dopenssl=false. ``` In file included from ../../home/watanabe/git/systemd/src/shared/pkcs11-util.h:12, from ../../home/watanabe/git/systemd/src/cryptenroll/cryptenroll.c:24: ../../home/watanabe/git/systemd/src/shared/openssl-util.h:56:21: error: conflicting types for ‘X509’; have ‘struct X509’ 56 | typedef struct X509 X509; | ^~~~ In file included from /usr/include/openssl/crypto.h:25, from /usr/include/openssl/bio.h:20, from /usr/include/openssl/asn1.h:16, from /usr/include/openssl/ec.h:17, from /usr/include/fido.h:10, from ../../home/watanabe/git/systemd/src/shared/libfido2-util.h:18, from ../../home/watanabe/git/systemd/src/cryptenroll/cryptenroll-fido2.h:7, from ../../home/watanabe/git/systemd/src/cryptenroll/cryptenroll.c:6: /usr/include/openssl/ossl_typ.h:123:24: note: previous declaration of ‘X509’ with type ‘X509’ {aka ‘struct x509_st’} 123 | typedef struct x509_st X509; | ^~~~ ```
* repart: Add support for generating verity sig partitionsDaan De Meyer2022-09-231-1/+2
|
View Lorry Controller Status