summaryrefslogtreecommitdiff
path: root/src/core
Commit message (Collapse)AuthorAgeFilesLines
* Revert "core: Propagate condition failed state to triggering units."Daan De Meyer2021-12-1710-66/+22
| | | | This reverts commit 12ab94a1e4961a39c32efb60b71866ab588d3ea2.
* meson: stop building out convenience libraries by defaultZbigniew Jędrzejewski-Szmek2021-12-161-1/+2
| | | | | | | | | | | | | | | | | The meson default for static_library() are: build_by_default=true, install=false. We never interact with the static libraries, and we only care about them as a stepping-stone towards the installable executables or libraries. Thus let's only build them if they are a dependency of something else we are building. While at it, let's drop install:false, since this appears to be the default. This change would have fixed the issue with lib_import_common failing to build too: we wouldn't attempt to build it. In practice this changes very little, because we generally only declare static libraries where there's something in the default target that will make use of them. But it seems to be a better pattern to set build_by_default to false.
* Define FOREACH_DIRENT through FOREACH_DIRENT_ALLZbigniew Jędrzejewski-Szmek2021-12-151-3/+0
| | | | As in the previous commit, 'de' is used as the iterator variable name.
* tree-wide: make FOREACH_DIRENT_ALL define the iterator variableZbigniew Jędrzejewski-Szmek2021-12-151-3/+1
| | | | | | | | | The variable is not useful outside of the loop (it'll always be null after the loop is finished), so we can declare it inline in the loop. This saves one variable declaration and reduces the chances that somebody tries to use the variable outside of the loop. For consistency, 'de' is used everywhere for the var name.
* namespace: allow overriding /run with a TemporaryFileSystem=Topi Miettinen2021-12-111-1/+1
| | | | | | | | | | | | Lower priority of RUN, so that TMPFS and especially the mount flags given with `TemporaryFileSystem=` are used. This allows making `/run` private with drop-ins such as: ``` [Service] BindReadOnlyPaths=/run/systemd:/run/systemd:norbind TemporaryFileSystem=/run:nodev,noexec,nosuid,rw,size=32k,nr_inodes=10,mode=0755 ```
* Merge pull request #20598 from tomty89/order_noautoZbigniew Jędrzejewski-Szmek2021-12-111-9/+1
|\ | | | | fstab-generator, core/mount: Avoid special fs target before dependency only if nofail is used
| * core/mount: also add default before dependency for automount mount unitsTom Yan2021-09-021-9/+1
| | | | | | | | | | The dependency should not prevent automount from working as expected, and we do not want them to be stopped too early if they are active.
* | meson: use subdir_done() to reduce indentYu Watanabe2021-12-104-110/+118
| |
* | Merge pull request #20476 from jamacku/new-feature-reloaded-stampZbigniew Jędrzejewski-Szmek2021-12-073-0/+10
|\ \ | | | | | | core: indicate the time when units were loaded
| * | core: Indicate the time when the manager started loading units the last timeJan Macku2021-12-071-0/+5
| | |
| * | core: Add new DBUS properties UnitsReloadStartTimestamp and ↵Jan Macku2021-12-073-0/+5
| | | | | | | | | | | | UnitsLoadTimestampMontonic
* | | bpf: refactor skeleton generationJames Hilliard2021-12-0710-25/+154
| | | | | | | | | | | | This should hopefully fix cross compilation for the bpf programs.
* | | core: add StartUnitWithFlags DBUS methodLuca Boccassi2021-12-075-6/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When an activation job is skipped because of a Condition*= setting failing, currently the JobRemoved signal lists 'done' as the result, just as with a successful job. This is a problem when doing dbus activation: dbus-broker will receive a signal that says the job was successful, so then it moves into a state where it waits for the requested name to appear on the bus, but that never happens because the job was actually skipped. Add a new StartUnitWithFlags that changes the behaviour of the JobRemoved signal to list 'done' or 'skipped'. Fixes #21520
* | | Merge pull request #20522 from yuwata/cgroup-fixZbigniew Jędrzejewski-Szmek2021-12-071-12/+43
|\ \ \ | | | | | | | | core/cgroup: fix io.weight and blkio.weight
| * | | core/cgroup: use helper macro for bfq conversionZbigniew Jędrzejewski-Szmek2021-11-111-18/+16
| | | | | | | | | | | | | | | | As suggested in https://github.com/systemd/systemd/pull/20522#discussion_r696699984.
| * | | core/cgroup: set bfq.weight first, and fixes blkio.weight valueYu Watanabe2021-11-111-11/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes issues introduced by 29eb0eefd14afc9a2424781a28b376db47c3c570. This also fixes the value sets to blkio.weight, that is, "default" is dropped. Moreover, This also changes the logic for mapping weight -> bfq.weight, to always matches the min, max, and default values. Fixes #20519 and #21187.
* | | | Merge pull request #21646 from mrc0mmand/lgtm-followupsLuca Boccassi2021-12-071-0/+1
|\ \ \ \ | | | | | | | | | | LGTM follow-ups
| * | | | core: check for NULL in one more placeFrantisek Sumsal2021-12-061-0/+1
| | | | |
* | | | | core: use correct level for CPU time log messageChristian Göttsche2021-12-061-2/+2
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | raise_level() takes the info condition as second argument and the notice one as third. For the consumed CPU time these conditions are swapped. Fixes: 37109b856aeb ("pid1: use LOG_DEBUG/INFO/NOTICE for unit resource consumption message")
* | | | fix DirectoryNotEmpty when it comes to a Non-directory fileyangmingtai2021-12-071-1/+1
| | | |
* | | | tree-wide: check for NULLs in more placesFrantisek Sumsal2021-12-064-0/+16
| | | | | | | | | | | | | | | | | | | | Fixes issues pointed out by the `cpp/inconsistent-null-check` LGTM query.
* | | | Merge pull request #21583 from bluca/bpf_assertYu Watanabe2021-12-021-1/+4
|\ \ \ \ | | | | | | | | | | cgroup: don't emit BPF firewall warning when manager is in test mode
| * | | | cgroup: don't emit BPF firewall warning when manager is in test modeLuca Boccassi2021-12-011-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support for BPF might not have been checked, since it's not necessary in test mode (eg: running offline analysis of units). This causes an assert: Assertion '(_error) != 0' failed at src/core/bpf-firewall.c:914, function emit_bpf_firewall_warning(). Aborting. Export SYSTEMD_LOG_LEVEl=debug in TEST-65-ANALYZE is enough to trigger this assert while doing an offline analysis of a unit that has some firewall/network restrictions set. Skip the warning if the manager is in test mode.
* | | | | Merge pull request #21591 from yuwata/core-bpf-firewall-unsupported-reasonLuca Boccassi2021-12-013-20/+30
|\ \ \ \ \ | |/ / / / |/| | | | core/bpf-firewall: make bpf_firewall_supported() always set unsupport…
| * | | | core/bpf-firewall: make bpf_firewall_supported() always set unsupported ↵Yu Watanabe2021-12-011-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | reason when BPF_FIREWALL_UNSUPPORTED is returned Otherwise, log_unit_full_errno() in emit_bpf_firewall_warning() will trigger an assertion.
| * | | | core/cgroup: propagate errors on detecting supported featuresYu Watanabe2021-12-011-0/+10
| | | | |
| * | | | core/restrict-netif: make restrict_network_interfaces_supported() return ↵Yu Watanabe2021-12-011-18/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | negative errno only when critical error Other errors are handled as the functionality is not supported. This also drops unnecessary SYNTHETIC_ERRNO().
* | | | | core: add Condition[Memory/CPU/IO]PressureLuca Boccassi2021-12-011-0/+6
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By default checks PSI on /proc/pressure, and causes a unit to be skipped if the threshold is above the given configuration for the avg300 measurement. Also allow to pass a custom timespan, and a particular slice unit to check under. Fixes #20139
* | | | tree-wide: use ERRNO_IS_TRANSIENT()Yu Watanabe2021-11-303-17/+17
| | | |
* | | | unit: add jobs that were skipped because of ratelimit back to run_queueMichal Sekletar2021-11-301-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Assumption in edc027b was that job we first skipped because of active ratelimit is still in run_queue. Hence we trigger the queue and dispatch it in the next iteration. Actually we remove jobs from run_queue in job_run_and_invalidate() before we call unit_start(). Hence if we want to attempt to run the job again in the future we need to add it back to run_queue. Fixes #21458
* | | | namespace: allow ProcSubset=pid with some ProtectKernel optionsTopi Miettinen2021-11-271-8/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case `/proc` is successfully mounted with pid tree subset only due to `ProcSubset=pid`, the protective mounts for `ProtectKernelTunables=yes` and `ProtectKernelLogs=yes` to non-pid `/proc` paths are failing because the paths don't exist. But the pid only option may have failed gracefully (for example because of ancient kernel), so let's try the mounts but it's not fatal if they don't succeed.
* | | | json: add new JSON_BUILD_CONST_STRING() macroLennart Poettering2021-11-251-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This macro is like JSON_BUILD_STRING() but uses our json library's ability to use literal strings directly as JsonVariant objects. The changes all our codebase to use this new macro whenever we build JSON objects from literal strings. (I tried to make this automatic, i.e. to detect in JSON_BUILD_STRING() whether something is a literal string nicely and thus do this stuff automatically, but I couldn't find a way.) This should reduce memory usage of our JSON code a bit. Constant strings we use very often will now be shared and mapped directly from the ELF image.
* | | | Merge pull request #21503 from poettering/ioprio-fixYu Watanabe2021-11-253-9/+12
|\ \ \ \ | | | | | | | | | | work around linux 5.15 ioprio API breakage
| * | | | core: normalize ioprio values we acquire from kernelLennart Poettering2021-11-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux 5.15 broke API in ioprio_get(): instead of returning IOPRIO_CLASS_NONE when that's set it now returns IOPRIO_CLASS_BE, which is what this actually is (the former is just an alias for the latter with a priority value of 4). Let's hide the differences between old and new kernels here, and always normalize to what the new kernels do.
| * | | | ioprio: normalize io priority values in configurationLennart Poettering2021-11-242-4/+4
| | | | | | | | | | | | | | | | | | | | Let's always say IOPRIO_CLASS_BE when IOPRIO_CALSS_NONE is set.
| * | | | ioprio-util: add macro for default ioprio settingsLennart Poettering2021-11-242-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IOPRIO_CLASS_NONE with any priority value actually is an alias for IOPRIO_CLASS_BE with priority value 4 – which is the default ioprio for all processes. We got this right at one place, but wrong at three others (where we assumed the default value was 0, not 4). Let's add a macro that encodes this properly, and use it everywhere.
| * | | | shared: split out ioprio related stuff into ioprio-util.[ch]Lennart Poettering2021-11-243-0/+3
| | | | | | | | | | | | | | | | | | | | No actual code changes, just some splitting out.
* | | | | Merge pull request #21508 from poettering/conn-count-fixYu Watanabe2021-11-253-28/+37
|\ \ \ \ \ | | | | | | | | | | | | pid1: fix connection counting
| * | | | | socket: various modernizationsLennart Poettering2021-11-251-12/+13
| | | | | |
| * | | | | socket: always pass socket, fd and SocketPeer ownership to service togetherLennart Poettering2021-11-253-16/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per-connection socket instances we currently maintain three fields related to the socket: a reference to the Socket unit, the connection fd, and a reference to the SocketPeer object that counts socket peers. Let's synchronize their lifetime, i.e. always set them all three together or unset them together, so that their reference counters stay synchronous. THis will in particuar ensure that we'll drop the SocketPeer reference whenever we leave an active state of the service unit, i.e. at the same time we close the fd for it. Fixes: #20685
* | | | | | build: fix build without seccompDominique Martinet2021-11-251-23/+23
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - execute.c: bpf functions were in the middle of an #if HAVE_SECCOMP block for no reason - test-fd-util.c: make seccomp-util.h includable without depending on <seccomp.h>, and make is_seccomp_available() hardcoded to returning false in this case. Also fix a stray DEFINED() -- HAVE_SECCOMP is defined as 0, so normal #if should be used like everywhere else.
* | | | | unit_is_bound_by_inactive: fix return pointer checkDominique Martinet2021-11-241-1/+1
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | *ret_culprit should be set if ret_culprit has been passed a non-null value, checking the previous *ret_culprit value does not make sense. This would cause the culprit to not properly be assigned, leading to pid1 crash when a unit could not be stopped. Fixes: #21476
* | | | bpf: fix memleak in restrict_fs_bpfJulia Kartseva2021-11-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Memory allocated in bpf skeleton is not freed. Wrap ptr in _cleanup_. Fixes: #21471
* | | | extension-release.d/: add a new field SYSEXT_SCOPE= for clarifying what a ↵Lennart Poettering2021-11-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | system extension is for This should make things a bit more robust since it ensures system extension can only applied to the right environments. Right now three different "scopes" are defined: 1. "system" (for regular OS systems, after the initrd transition) 2. "initrd" (for sysext images that apply to the initrd environment) 3. "portable" (for sysext images that apply to portable images) If not specified we imply a default of "system portable", i.e. any image where the field is not specified is implicitly OK for application to OS images and for portable services – but not for initrds.
* | | | core/automount: Add ExtraOptions fieldAndrew Stone2021-11-234-3/+39
| | | |
* | | | core: prefix functions to avoid identical static function namesChristian Göttsche2021-11-201-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function name `method_reload` is used both in dbus-unit.c and dbus-manager.c for static functions. With the previous addition of adding the function name to the audit information on SELinux denials, rename the one (and its relatives) in dbus-unit.c as most of the functions in src/core/dbus-unit.c are already prefixed with `bus_unit_`.
* | | | selinux: name mac_selinux_generic_access_check as internal functionChristian Göttsche2021-11-202-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | `mac_selinux_generic_access_check()` should not be called directly, only via the wrapper macros `mac_selinux_access_check` and `mac_selinux_unit_access_check`.
* | | | selinux: improve debug log formatChristian Göttsche2021-11-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | path might be NULL when checking against the system permissions, so wrap with strna(). The command line might not be available over D-Bus and thus cl might be empty. Print "n/a" instead of the empty string.
* | | | selinux: add function name to audit dataChristian Göttsche2021-11-202-7/+17
| | | | | | | | | | | | | | | | | | | | | | | | Include the systemd C function name in the audit message to improve the debug ability on denials. Similar like kernel denial messages include the syscall name.
* | | | tree-wide: port various places over to open_mkdir_at()Lennart Poettering2021-11-171-7/+10
| | | |
View Lorry Controller Status