summaryrefslogtreecommitdiff
path: root/src/journal-remote/journal-remote-main.c
Commit message (Collapse)AuthorAgeFilesLines
* journal-remote: make specified output file absoluteYu Watanabe2023-03-281-2/+5
| | | | | | | | | | | | After f12b399dd6362a03379cb769954ebfb9972236ed, the output path is also used to determine the directory to be vacuumed. And if a filename only path is specified, `writer_new()` fails since the commit. This makes the specified path is always made absolute. This should not change any behavior before the offending commit, as `journal_open()` opens the specified journal file with `AT_FDCWD`. Fixes #27012.
* journal-remote: add missing log message for failure in ↵Yu Watanabe2023-03-281-1/+1
| | | | journal_remote_get_writer()
* conf: replace config_parse_many_nulstr() with config_parse_config_file()Franck Bui2023-03-141-8/+3
| | | | | | | | | | | | | | | | | All daemons use a similar scheme to read their main config files and theirs drop-ins. The main config files are always stored in /etc/systemd directory and it's easy enough to construct the name of the drop-in directories based on the name of the main config file. Hence the new helper does that internally, which allows to reduce and simplify the args passed previously to config_parse_many_nulstr(). Besides the overall code simplification it results: 16 files changed, 87 insertions(+), 159 deletions(-) it allows to identify clearly the locations in the code where configuration files are parsed.
* tree-wide: use FORK_REARRANGE_STDIO and FORK_CLOSE_ALL_FDSYu Watanabe2023-02-211-9/+4
|
* tree-wide: set FORK_RLIMIT_NOFILE_SAFE flagYu Watanabe2023-02-071-3/+1
| | | | No functional changes, just refactoring.
* journal-remote: fix initialization of vacuum metricsLuca Boccassi2022-12-181-1/+1
| | | | | | | Follow-up for f12b399dd6362a03379cb769954ebfb9972236ed from https://github.com/systemd/systemd/pull/25076 CID#1501551
* vacuum journal remote (#25076)berenddeschouwer2022-12-171-5/+20
| | | | | * Support vacuuming for journal-remote Co-authored-by: Berend De Schouwer <berend@deschouwer.co.za>
* Rename def.h to constants.hZbigniew Jędrzejewski-Szmek2022-11-081-1/+1
| | | | | | The name "def.h" originates from before the rule of "no needless abbreviations" was established. Let's rename the file to clarify that it contains a collection of various semi-related constants.
* basic: move version() to build.h+cZbigniew Jędrzejewski-Szmek2022-11-081-0/+1
|
* tree-wide: use ASSERT_PTR moreDavid Tardon2022-09-131-3/+1
|
* tree-wide: add a space after if, switch, for, and whileYu Watanabe2022-04-011-1/+1
|
* journal-file: merge compress/seal bool args into a single flags paramLennart Poettering2022-03-251-4/+7
| | | | | | | Just some modernization/refactoring. No change in behaviour, just let's do how we do things these days: use flags param instead of list of bools.
* journal-remote: refuse to specify --trust option when gnutls is disabledYu Watanabe2022-03-241-5/+8
| | | | | | and check_permission() should not be called in that case. Replaces #22847.
* strv: make iterator in STRV_FOREACH() declaread in the loopYu Watanabe2022-03-191-1/+0
| | | | This also avoids multiple evaluations in STRV_FOREACH_BACKWARDS()
* journal-remote: use MHD_HTTP_CONTENT_TOO_LARGE as MHD_HTTP_PAYLOAD_TOO_LARGE ↵Yu Watanabe2021-12-201-1/+1
| | | | is deprecated since 0.9.74
* tree-wide: always use TAKE_FD() when calling rearrange_stdio()Lennart Poettering2021-11-031-2/+2
| | | | | | | | | | | | rearrange_stdio() invalidates specified fds even on failure, which means we should always invalidate the fds we pass in no matter what. Let's make this explicit by using TAKE_FD() for that everywhere. Note that in many places we such invalidation doesnt get us much behaviour-wise, since we don't use the variables anymore later. But TAKE_FD() in a way is also documentation, it encodes explicitly that the fds are invalidated here, so I think it's a good thing to always make this explicit here.
* alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhereLennart Poettering2021-10-141-2/+2
| | | | | | | | | | | | | Let's define two helpers strdupa_safe() + strndupa_safe() which do the same as their non-safe counterparts, except that they abort if called with allocations larger than ALLOCA_MAX. This should ensure that all our alloca() based allocations are subject to this limit. afaics glibc offers three alloca() based APIs: alloca() itself, strndupa() + strdupa(). With this we have now replacements for all of them, that take the limit into account.
* tree-wide: mark set-but-not-used variables as unused to make LLVM happyFrantisek Sumsal2021-09-151-1/+1
| | | | | | | | | | | | | | LLVM 13 introduced `-Wunused-but-set-variable` diagnostic flag, which trips over some intentionally set-but-not-used variables or variables attached to cleanup handlers with side effects (`_cleanup_umask_`, `_cleanup_(notify_on_cleanup)`, `_cleanup_(restore_sigsetp)`, etc.): ``` ../src/basic/process-util.c:1257:46: error: variable 'saved_ssp' set but not used [-Werror,-Wunused-but-set-variable] _cleanup_(restore_sigsetp) sigset_t *saved_ssp = NULL; ^ 1 error generated. ```
* Drop the text argument from assert_not_reached()Zbigniew Jędrzejewski-Szmek2021-08-031-1/+1
| | | | | | | | | | | | | | | | | In general we almost never hit those asserts in production code, so users see them very rarely, if ever. But either way, we just need something that users can pass to the developers. We have quite a few of those asserts, and some have fairly nice messages, but many are like "WTF?" or "???" or "unexpected something". The error that is printed includes the file location, and function name. In almost all functions there's at most one assert, so the function name alone is enough to identify the failure for a developer. So we don't get much extra from the message, and we might just as well drop them. Dropping them makes our code a tiny bit smaller, and most importantly, improves development experience by making it easy to insert such an assert in the code without thinking how to phrase the argument.
* tree-wide: use UINT64_MAX or friendsYu Watanabe2021-03-051-1/+1
|
* journal-remote: inline one more iterator variable declarationZbigniew Jędrzejewski-Szmek2021-02-171-4/+2
|
* journal-remote: convert to parse_boolean_argument() and fix type confusionZbigniew Jędrzejewski-Szmek2021-02-171-21/+9
| | | | | | | | | We were passing a reference to 'int arg_seal' to config_parse_bool(), which expects a 'bool *'. Luckily, this would work, because 'bool' is smaller than 'int', so config_parse_bool() would set the least-significant byte of arg_seal. At least I think so. But let's use consistent types ;) Also, modernize style a bit and don't use integers in boolean context.
* tree-wide: propagate error code from _from_string() functionsZbigniew Jędrzejewski-Szmek2021-02-101-4/+2
| | | | Now that we know we have something useful, no need to make an answer up.
* log: make tools also read the kernel command line when run as a serviceYu Watanabe2021-02-011-1/+1
| | | | | | | | This effectively reverts 41d1f469cf10f5f3e9cb4f4853ace9b0cfe5beae. Before this, e.g., `networkctl reload` invoked by `systemctl reload systemd-networkd.service` does not produce debugging logs even if systemd.log-level=debug is set. This fixes the issue.
* tree-wide: Drop custom formatting for print() help messagesDaan De Meyer2021-01-311-4/+3
| | | | | | | | | | | | I think this formatting was originally used because it simplified adding new options to the help messages. However, these days, most tools their help message end with "\nSee the %s for details.\n" so the final line almost never has to be edited which eliminates the benefit of the custom formatting used for printf() help messages. Let's make things more consistent and use the same formatting for printf() help messages that we use everywhere else. Prompted by https://github.com/systemd/systemd/pull/18355#discussion_r567241580
* journal-remote: use hashmap_ensure_putSusant Sahani2021-01-171-4/+2
|
* fileio: teach read_full_file_full() to read from offset/with maximum sizeLennart Poettering2020-12-011-3/+11
|
* journal-remote: use READ_FULL_FILE_SECURE|READ_FULL_FILE_WARN_WORLD_READABLE ↵Lennart Poettering2020-12-011-1/+5
| | | | | | when reading PEM secret key It's secret data, hence use the appropriate flags.
* journal-remote: erase secret PEM key from memory after useLennart Poettering2020-12-011-1/+3
|
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* fileio: beef up READ_FULL_FILE_CONNECT_SOCKET to allow setting sender socket ↵Lennart Poettering2020-11-031-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | name This beefs up the READ_FULL_FILE_CONNECT_SOCKET logic of read_full_file_full() a bit: when used a sender socket name may be specified. If specified as NULL behaviour is as before: the client socket name is picked by the kernel. But if specified as non-NULL the client can pick a socket name to use when connecting. This is useful to communicate a minimal amount of metainformation from client to server, outside of the transport payload. Specifically, these beefs up the service credential logic to pass an abstract AF_UNIX socket name as client socket name when connecting via READ_FULL_FILE_CONNECT_SOCKET, that includes the requesting unit name and the eventual credential name. This allows servers implementing the trivial credential socket logic to distinguish clients: via a simple getpeername() it can be determined which unit is requesting a credential, and which credential specifically. Example: with this patch in place, in a unit file "waldo.service" a configuration line like the following: LoadCredential=foo:/run/quux/creds.sock will result in a connection to the AF_UNIX socket /run/quux/creds.sock, originating from an abstract namespace AF_UNIX socket: @$RANDOM/unit/waldo.service/foo (The $RANDOM is replaced by some randomized string. This is included in the socket name order to avoid namespace squatting issues: the abstract socket namespace is open to unprivileged users after all, and care needs to be taken not to use guessable names) The services listening on the /run/quux/creds.sock socket may thus easily retrieve the name of the unit the credential is requested for plus the credential name, via a simpler getpeername(), discarding the random preifx and the /unit/ string. This logic uses "/" as separator between the fields, since both unit names and credential names appear in the file system, and thus are designed to use "/" as outer separators. Given that it's a good safe choice to use as separators here, too avoid any conflicts. This is a minimal patch only: the new logic is used only for the unit file credential logic. For other places where we use READ_FULL_FILE_CONNECT_SOCKET it is probably a good idea to use this scheme too, but this should be done carefully in later patches, since the socket names become API that way, and we should determine the right amount of info to pass over.
* Rename strv_split_extract() to strv_split_full()Zbigniew Jędrzejewski-Szmek2020-09-091-1/+1
| | | | | Now that _full() is gone, we can rename _extract() to have the usual suffix we use for the more featureful version.
* tree-wide: use READ_FULL_FILE_CONNECT_SOCKET at various placesLennart Poettering2020-07-211-3/+3
| | | | | | | | | | | Let's use the new flag wherever we read key material/passphrases/hashes off disk, so that people can plug in their own IPC service as backend if they like, easily. (My main goal was actually to support this for crypttab key files — i.e. that you can specify AF_UNIX sockets as third column in crypttab — but that's harder to implement, since the keys are read via libcryptsetup's API, not ours.)
* various daemons: emit Stopping... notification before destructing the ↵Zbigniew Jędrzejewski-Szmek2020-07-021-1/+1
| | | | | | | | manager object This is mostly cosmetic, but let's reorder the destructors so that we do the final sd_notify() call before we run the destructor for the manager object.
* Fix build with µhttpd 0.9.71Zbigniew Jędrzejewski-Szmek2020-07-011-1/+1
| | | | The return type of callbacks was changed from int to an enum.
* log: introduce log_parse_environment_cli() and log_setup_cli()Filipe Brandenburger2020-06-241-1/+1
| | | | | | | | | | | | | | | | Presently, CLI utilities such as systemctl will check whether they have a tty attached or not to decide whether to parse /proc/cmdline or EFI variable SystemdOptions looking for systemd.log_* entries. But this check will be misleading if these tools are being launched by a daemon, such as a monitoring daemon or automation service that runs in background. Make log handling of CLI tools uniform by never checking /proc/cmdline or EFI variables to determine the logging level. Furthermore, introduce a new log_setup_cli() shortcut to set up common options used by most command-line utilities.
* conf-parser: return mtime in config_parse() and friendsLennart Poettering2020-06-021-4/+8
| | | | | | | | | | | | | This is a follow-up for 9f83091e3cceb646a66fa9df89de6d9a77c21d86. Instead of reading the mtime off the configuration files after reading, let's do so before reading, but with the fd we read the data from. This is not only cleaner (as it allows us to save one stat()), but also has the benefit that we'll detect changes that happen while we read the files. This also reworks unit file drop-ins to use the common code for determining drop-in mtime, instead of reading system clock for that.
* journal-remote: fix description of optionZbigniew Jędrzejewski-Szmek2020-03-311-1/+1
| | | | We use whatever compression is configured, most often not XZ.
* util-lib: move things that parse ifnames to shared/Zbigniew Jędrzejewski-Szmek2020-01-111-0/+1
| | | | | | | | | In subsequent commits, calls to if_nametoindex() will be replaced by a wrapper that falls back to alternative name resolution over netlink. netlink support requires libsystemd (for sd-netlink), and we don't want to add any functions that require netlink in basic/. So stuff that calls if_nametoindex() for user supplied interface names, and everything that depends on that, needs to be moved.
* journal-remote: reduce scope of variableZbigniew Jędrzejewski-Szmek2019-10-211-1/+2
| | | | https://github.com/systemd/systemd/pull/11953/files#r264188513
* Rename EXTRACT_QUOTES to EXTRACT_UNQUOTEZbigniew Jędrzejewski-Szmek2019-06-281-1/+1
| | | | | | Whenever I see EXTRACT_QUOTES, I'm always confused whether it means to leave the quotes in or to take them out. Let's say "unquote", like we say "cunescape".
* Replace the legacy ULONG_LONG_MAX with the C99 ULLONG_MAXAdrian Bunk2019-05-171-2/+2
|
* journal-remote: do not request Content-Length if Transfer-Encoding is chunkedYu Watanabe2019-03-111-14/+27
| | | | | | This fixes a bug introduced by 7fdb237f5473cb8fc2129e57e8a0039526dcb4fd. Closes #11571.
* journal-remote: set a limit on the number of fields in a messageZbigniew Jędrzejewski-Szmek2019-01-091-2/+5
| | | | | | | | | Existing use of E2BIG is replaced with ENOBUFS (entry too long), and E2BIG is reused for the new error condition (too many fields). This matches the change done for systemd-journald, hence forming the second part of the fix for CVE-2018-16865 (https://bugzilla.redhat.com/show_bug.cgi?id=1653861).
* journal-remote: verify entry length from headerZbigniew Jędrzejewski-Szmek2019-01-091-10/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Calling mhd_respond(), which ulimately calls MHD_queue_response() is ineffective at point, becuase MHD_queue_response() immediately returns MHD_NO signifying an error, because the connection is in state MHD_CONNECTION_CONTINUE_SENT. As Christian Grothoff kindly explained: > You are likely calling MHD_queue_repsonse() too late: once you are > receiving upload_data, HTTP forces you to process it all. At this time, > MHD has already sent "100 continue" and cannot take it back (hence you > get MHD_NO!). > > In your request handler, the first time when you are called for a > connection (and when hence *upload_data_size == 0 and upload_data == > NULL) you must check the content-length header and react (with > MHD_queue_response) based on this (to prevent MHD from automatically > generating 100 continue). If we ever encounter this kind of error, print a warning and immediately abort the connection. (The alternative would be to keep reading the data, but ignore it, and return an error after we get to the end of data. That is possible, but of course puts additional load on both the sender and reciever, and doesn't seem important enough just to return a good error message.) Note that sending of the error does not work (the connection is always aborted when MHD_queue_response is used with MHD_RESPMEM_MUST_FREE, as in this case) with libµhttpd 0.59, but works with 0.61: https://src.fedoraproject.org/rpms/libmicrohttpd/pull-request/1
* journal-remote: define main through macroYu Watanabe2018-12-081-38/+45
| | | | Also, this fixes memleaks on failure.
* journal-remote: destroy RemoteServer object by using _cleanup_ attributeYu Watanabe2018-12-081-3/+1
|
* tree-wide: invoke rlimit_nofile_safe() before various exec{v,ve,l}() invocationsLennart Poettering2018-12-011-0/+2
| | | | | | | | | | | | | | | | Whenever we invoke external, foreign code from code that has RLIMIT_NOFILE's soft limit bumped to high values, revert it to 1024 first. This is a safety precaution for compatibility with programs using select() which cannot operate with fds > 1024. This commit adds the call to rlimit_nofile_safe() to all invocations of exec{v,ve,l}() and friends that either are in code that we know runs with RLIMIT_NOFILE bumped up (which is PID 1 and all journal code for starters) or that is part of shared code that might end up there. The calls are placed as early as we can in processes invoking a flavour of execve(), but after the last time we do fd manipulations, so that we can still take benefit of the high fd limits for that.
* journal-remote: shorten code a bit by using strcspn()Lennart Poettering2018-11-261-8/+3
|
* tree-wide: port various places over to STARTSWITH_SET()Lennart Poettering2018-11-261-4/+3
|
View Lorry Controller Status