summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #24471 from yuwata/udevadm-wait-periodic-timerYu Watanabe2022-08-301-2/+67
|\ | | | | udevadm-wait: introduce periodic timer for checking devices
| * udevadm-wait: introduce periodic timer for checking devicesYu Watanabe2022-08-291-2/+67
| | | | | | | | | | When --initialized=no is specified, it is not necessary to wait for uevents to be processed by udevd.
* | Merge pull request #23888 from topimiettinen/networkd-netlabel-v2Yu Watanabe2022-08-3018-8/+367
|\ \ | | | | | | network: NetLabel integration
| * | network: NetLabel integrationTopi Miettinen2022-08-2912-1/+219
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directive `NetLabel=` provides a method for integrating static and dynamic network configuration into Linux NetLabel subsystem rules, used by Linux Security Modules (LSMs) for network access control. The label, with suitable LSM rules, can be used to control connectivity of (for example) a service with peers in the local network. At least with SELinux, only the ingress can be controlled but not egress. The benefit of using this setting is that it may be possible to apply interface independent part of NetLabel configuration at very early stage of system boot sequence, at the time when the network interfaces are not available yet, with netlabelctl(8), and the per-interface configuration with systemd-networkd once the interfaces appear later. Currently this feature is only implemented for SELinux. The option expects a single NetLabel label. The label must conform to lexical restrictions of LSM labels. When an interface is configured with IP addresses, the addresses and subnetwork masks will be appended to the NetLabel Fallback Peer Labeling rules. They will be removed when the interface is deconfigured. Failures to manage the labels will be ignored. Example: ``` [DHCPv4] NetLabel=system_u:object_r:localnet_peer_t:s0 ``` With the above rules for interface `eth0`, when the interface is configured with an IPv4 address of 10.0.0.123/8, `systemd-networkd` performs the equivalent of `netlabelctl` operation ``` $ sudo netlabelctl unlbl add interface eth0 address:10.0.0.0/8 label:system_u:object_r:localnet_peer_t:s0 ``` Result: ``` $ sudo netlabelctl -p unlbl list ... interface: eth0 address: 10.0.0.0/8 label: "system_u:object_r:localnet_peer_t:s0" ... ```
| * | sd-netlink: add NetLabel supportTopi Miettinen2022-08-293-7/+52
| | |
| * | basic: generate netmasks for IPv6 and generic IP family addressesTopi Miettinen2022-08-293-0/+96
| | | | | | | | | | | | Added functions to generate netmasks for IPv6 and generic IP family addresses.
* | | homed: don't use stat() data from an unrelated inodeLennart Poettering2022-08-301-1/+1
| | | | | | | | | | | | | | | This doesn't really change anything, since we know the stat data used here also contains S_IFBLK, but it's frickin' confusing.
* | | Merge pull request #24495 from poettering/loopback-block-msgYu Watanabe2022-08-302-3/+3
|\ \ \ | | | | | | | | improve loopback warning message
| * | | loopback: use ERRNO_IS_PRIVILEGE() where appropriateLennart Poettering2022-08-291-1/+1
| | | |
| * | | loop: make 'Failed to configure loopback device' log message clearerLennart Poettering2022-08-292-2/+2
| |/ / | | | | | | | | | | | | We print the very same log message for loopback block devices and for loopback network devices. Let's better be clear what kind it is.
* | | strv: modernize strv_fnmatch() a bitLennart Poettering2022-08-302-8/+21
|/ /
* | scsi_id: retry inquiry ioctl if host_byte is DID_TRANSPORT_DISRUPTEDWenchao Hao2022-08-291-0/+6
| | | | | | | | | | | | | | | | The inquiry is issued to kernel via ioctl, kernelspace would set this inquiry command's retry count to 0 which means the command would not be retried in kernel space even if the LLDs returned a status which need to be retried. So we should take the retry in user space.
* | condition: fix device-tree firmware pathDaniel Braunwarth2022-08-291-2/+2
|/ | | | | | | | | The path /sys/firmware/device-tree doesn't exist. This should be either /proc/device-tree or /sys/firmware/devicetree. The first path is only a link. So lets use the second path. See https://github.com/torvalds/linux/blob/v4.14/drivers/of/base.c#L218.
* udev-util: minor cleanups for on_ac_power()Yu Watanabe2022-08-281-7/+7
| | | | Follow-ups for #24420.
* Merge pull request #24475 from yuwata/devpathLuca Boccassi2022-08-2824-279/+311
|\ | | | | sd-device: introduce two helper functions for devnum
| * tree-wide: use devpath_from_devnum() and device_open_from_devnum()Yu Watanabe2022-08-2812-158/+67
| | | | | | | | Fixes #24465.
| * sd-device: skip to check diskseq if device is not initializedYu Watanabe2022-08-281-4/+11
| |
| * sd-device: introduce device_open_from_devnum()Yu Watanabe2022-08-282-0/+33
| |
| * sd-device: introduce devpath_from_devnum()Yu Watanabe2022-08-286-1/+70
| |
| * devnum-util: split-out device_path_make_inaccessible()Yu Watanabe2022-08-282-17/+21
| |
| * sd-device: rename device-util.c -> device-filter.cYu Watanabe2022-08-286-8/+18
| | | | | | | | The functions provided by the file are only used in sd-device.
| * growfs,repart: fix misuse of sd_device_get_devpath()Yu Watanabe2022-08-282-5/+5
| | | | | | | | | | | | Follow-up for 0f79b3469f167583033d17f9a6fa0e4341a68003. To obtain device node, sd_device_get_devname() must be used.
* | network: drop unused timestampYu Watanabe2022-08-283-12/+0
| |
* | udevadm: replace find_device_from_path() with sd_device_new_from_path()Yu Watanabe2022-08-281-19/+3
| |
* | udev: do not kill workers when requested to set the same log level currently ↵Yu Watanabe2022-08-281-0/+10
| | | | | | | | | | | | assigned Also refuse invalid log level.
* | udev/net: drop unused timestampYu Watanabe2022-08-281-1/+0
|/
* tree-wide: fix typoYu Watanabe2022-08-281-2/+2
|
* loop-util: use filter provided by sd_device_enumeratorYu Watanabe2022-08-271-28/+7
|
* Merge pull request #23764 from enr0n/oomd-allow-managed-oom-preferenceYu Watanabe2022-08-274-68/+149
|\ | | | | oomd: allow ManagedOOMPreference on all cgroups
| * oomd: fix off-by-one when dumping kill candidatesNick Rosbrook2022-08-261-2/+2
| | | | | | | | | | | | | | When we kill a cgroup that is towards the end of the sorted candidate list (i.e. when we have to resort to killing a candidate with ManagedOOMPreference=avoid), this cgroup is not logged in the candidate list. This is due to an off-by-one error when assigning dump_until.
| * oomd: add tests for oomd_fetch_cgroup_oom_preferenceNick Rosbrook2022-08-261-45/+83
| | | | | | | | | | | | | | Add a new test function, test_oomd_fetch_cgroup_oom_preference, to test the ManagedOOMPreference logic. For starters, cut the relevant tests out of test_oomd_cgroup_context_acquire_and_insert, and add them to the new function. Then, expand these tests to cover the new behavior.
| * oomd: loosen the restriction on ManagedOOMPreferenceNick Rosbrook2022-08-262-19/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ManagedOOMPreference property is only honored on cgroups which are owned by root. This precludes anyone from setting ManagedOOMPreference on cgroups managed by user managers. Loosen this restriction in the following way: when processing a monitored cgroup for kill candidates, honor the ManagedOOMPreference setting if the monitored cgroup and cgroup candidate are owned by the same user. This allows unprivileged users to configure ManagedOOMPreference on their cgroups without affecting the kill priority of ancestor cgroups. N.B. that since swap kill operates globally to kill the largest candidate, it is not appropriate to apply this logic to the swap kill scenario. Therefore, the existing restriction on ManagedOOMPreference will remain when calculating candidates for swap kill. Add a new function, oomd_fetch_cgroup_oom_preference, to assist with this new logic. To simplify things, move the `user.oomd_{avoid,omit}` xattr reads to this function so that the xattr reads and uid checks are performed all at once.
| * core/cgroup: allow setting oomd xattrs from user managerNick Rosbrook2022-08-261-2/+3
| | | | | | | | | | | | | | The extended attributes 'user.oomd_avoid' and 'user.oomd_omit' are used to store the setting of the ManagedOOMPrefernce property. Since these are user extended attributes, the access permissions are defined by the file permissions, and there is no need to guard this from user managers.
* | systemd-growfs: use sd_device_new_from_devnum()Devendra Tewari2022-08-263-67/+46
| | | | | | | | | | Use sd_device_new_from_devnum() instead of device_path_make_major_minor_sysfs().
* | Merge pull request #24456 from yuwata/network-tcp-congctlLuca Boccassi2022-08-264-1/+58
|\ \ | |/ |/| network: introduce TCPCongestionControlAlgorithm=
| * network: introduce TCPCongestionControlAlgorithm=Yu Watanabe2022-08-263-0/+57
| | | | | | | | Closes #24432.
| * sd-netlink: fix attribute type for RTAX_CC_ALGOYu Watanabe2022-08-261-1/+1
| |
* | Merge pull request #24459 from poettering/tmpfiles-graceful-copyLennart Poettering2022-08-261-8/+15
|\ \ | | | | | | tmpfiles: make absent source of "C" copy lines graceful
| * | tmpfiles: move validation/normalization of path before we use itLennart Poettering2022-08-261-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | We need to normalize/validate the path (i.e. first column) of tmpfiles.d/ lines before we start using the path, otherwise we'll use it before it's known to be good. This matters since for some line types the path is mangled into the argument column (i.e. sevents column), and we should only do that once we know it's in a good state.
| * | tmpfiles: in C lines, make missing source graceful errorLennart Poettering2022-08-261-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I don't see where it would ever be a good thing that file copies done via tmpfiles.d/ C lines cause the tmpfiles operation to fail if their source happens to be missing. It's a problem if we can't set up the destination properly (which is the job of systemd-tmpfiles after all), but if the source is simply missing (NB: setting up the source is the job of of the rules writer) this shouldn't be a problem. This is useful for copying stuff into place if it happens to exist. For example, if systemd-stub passes additional data into the initrd's /.extra/ directory, we can copy it into a better place (e.g. /run/) with this, where it will survive the initrd→host transition. This mirrors behaviour of the recently added "^" line modifier which may be used source "w" lines from credentials – there two the behaviour is to simply skip the line if the source is missing.
* | | cpio: don't claim we measured anything if we weren't even askedLennart Poettering2022-08-261-1/+1
| | | | | | | | | | | | | | | | | | This is a bugfix. Follow-up for 599fe002a135570406504998dbb7a42dabc963da
* | | cpio: split out cpio TPM measurement logic from pack_cpio()Lennart Poettering2022-08-261-24/+45
| | | | | | | | | | | | | | | No code change, just some refactoring, so that we can reuse the measurement logic later elsewhere.
* | | test: don't accept failure as succesLennart Poettering2022-08-261-7/+7
| | |
* | | condition: check for last not first ')' in firmware test expressionsLennart Poettering2022-08-261-2/+2
|/ / | | | | | | | | | | | | | | I possess a machine with ')' in its BIOS version string, which will cause the current parser to mistake it as the closing ')' of the smbios-fields() expression. Let's make sure we always fo for the last, not the first ')', hence.
* | test-sd-device: run subsystem filter test several timesYu Watanabe2022-08-261-3/+40
|/ | | | | | | The test is quite racy. Let's wait for all queued udev events to be processed, and run the test several times. Fixes #24400.
* resolve: control system hostname synthesis via environment variableJacek Migacz2022-08-261-0/+6
|
* sleep: freeze and thaw user.slice to save resource while suspendSonali Srivastava2022-08-261-0/+31
|
* tree-wide: change --kill-who to --kill-whomZbigniew Jędrzejewski-Szmek2022-08-265-35/+35
| | | | | | | | | | | getopt allows non-ambiguous abbreviations, so backwards-compat is maintained, and people can use --kill-who (or even shorter abbreviations). English is flexible, so in common speach people would use both forms, even if "whom" is technically more correct. The advantage of using the longer form in the code is that we effectively allow both forms, so we stop punishing people who DTGCT¹, but still allow people to use the spoken form if they prefer. 1. Do the gramatically correct thing
* journal: rename special journal field _SYSTEM_CONTEXT= → _RUNTIME_SCOPE=Lennart Poettering2022-08-251-5/+1
| | | | | | | | | | | | | | | | | | Previously the field "_SYSTEM_CONTEXT" knew he values "initrd" + "main". Let's change this to "_RUNTIME_SCOPE" and "initrd" + "system". Why? The sysext logic has a very similar concept of "scopes", declaring whether a sysext image is intended for the initrd or the main system. Let's thus use the same naming for both. sysext's extension-release files hence know SYSEXT_SCOPE=initrd|system, and the journal messages know _RUNTIME_SCOPE=initrd|system, which makes this reasonably systematic. Follow-up for: cae8edd93ca2ef90c41cb9b6322b6908d12947b5 (This is not an API break, since no version with this commit has ever been released.)
* pid1: extend "ConditionFirmware=" for checking SMBIOS system identification ↵Daniel Braunwarth2022-08-252-15/+238
| | | | information
View Lorry Controller Status