summaryrefslogtreecommitdiff
path: root/units
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #20902 from tasleson/integritysetup-generatorLennart Poettering2021-10-156-3/+32
|\ | | | | Add stand-alone dm integrity support
| * Add stand-alone dm-integrity supportTony Asleson2021-10-153-0/+29
| | | | | | | | | | | | | | This adds support for dm integrity targets and an associated /etc/integritytab file which is required as the dm integrity device super block doesn't include all of the required metadata to bring up the device correctly. See integritytab man page for details.
| * dm-verity: Remove usage of integrityTony Asleson2021-10-143-3/+3
| | | | | | | | | | | | There is a difference between dm-verity and dm-integrity. Remove usage of integrity from verity documentation in man pages and target files.
* | unit: networkd does not require AF_ALG anymoreYu Watanabe2021-10-151-1/+1
|/ | | | As khash is retired.
* units: run user service managers at OOM score adjustment 100Lennart Poettering2021-10-041-0/+1
| | | | | | | | | | | | | | | | | | | Let's make it slightly more likely that a per-user service manager is killed than any system service. We use a conservative 100 (from a range that goes all the way to 1000). Replaces: #17426 Together with the previous commit this means: system manager and system services are placed at OOM score adjustment 0 (specifically: they inherit kernel default of 0). User service manager (both for root and non-root) are placed at 100. User services for non-root are placed at 200, those for root inherit 100. Note that processes forked off the user *sessions* (i.e. not forked off the per-user service manager) remain at 0 (e.g. the shell process created by a tty or ssh login). This probably should be addressed too one day (maybe in pam_systemd?), but is not covered here.
* tools: shellcheck-ify tool scriptsFrantisek Sumsal2021-09-301-0/+1
|
* unit: install the systemd-bless-boot.service only if we have gnu-efiFrantisek Sumsal2021-09-221-1/+1
| | | | Follow-up to #20591.
* Merge pull request #20690 from DaanDeMeyer/oomd-user-servicesLuca Boccassi2021-09-213-0/+24
|\ | | | | oom: Support for user services
| * oom: Add support for user unit ManagedOOM property updatesDaan De Meyer2021-09-203-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Compared to PID1 where systemd-oomd has to be the client to PID1 because PID1 is a more privileged process than systemd-oomd, systemd-oomd is the more privileged process compared to a user manager so we have user managers be the client whereas systemd-oomd is now the server. The same varlink protocol is used between user managers and systemd-oomd to deliver ManagedOOM property updates. systemd-oomd now sets up a varlink server that user managers connect to to send ManagedOOM property updates. We also add extra validation to make sure that non-root senders don't send updates for cgroups they don't own. The integration test was extended to repeat the chill/bloat test using a user manager instead of PID1.
* | units: hookup systemd-boot-update.serviceLennart Poettering2021-09-201-0/+1
| | | | | | | | | | It was apparently missed to hook this up in 71c8bf28378958a5ab2348e9ec586fbe78c71dfd.
* | boot: don't build bootctl when -Dgnu-efi=false is setMichal Sekletar2021-09-201-1/+1
|/
* unit: systemd-oomd.service requires cgroup memory controllerYu Watanabe2021-09-121-0/+1
|
* homed: add missing capabilities for SMB/CIFS backendLennart Poettering2021-08-311-3/+2
| | | | | | | | | In 2020 mount.cifs started to require a bunch for caps to work. let's add them to the capability bounding set. Also, SMB support obviously needs network access, hence open that up. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1962920
* units: added factory-reset.targetYegor Alexeyev2021-08-102-0/+13
|
* units: make sure systemd-tmpfiles-{setup,clean} don't survive switch-rootZbigniew Jędrzejewski-Szmek2021-08-062-2/+2
| | | | | | | | | | | | | | | Normally, these services are killed because we run isolate. But I booted into emergency mode (because of a futher bug with us timing out improperly on the luks password prompt), and then continuted to the host system by running 'systemctl start systemd-switch-root.service'. My error, but the results are confusing and bad: systemd in the host sees 'systemd-tmpfiles-setup.service' as started successfully, and doesn't restart it, so the setup for /tmp/.X11 is not done and gdm.service fails. So while we wouldn't encounter this during normal successful boot, I think it's good to make this more robust. The dep is added to systemd-tmpfiles-{setup,clean}, because /tmp is not propagated over switch-root. /dev is, so I didn't touch systemd-tmpfiles-setup-dev.service.
* boot: optionally update sd-boot on bootLennart Poettering2021-07-301-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | Boot loaders are software like any other, and hence muse be updated in regular intervals. Let's add a simple (optional) service that updates sd-boot automatically from the host if it is found installed but out-of-date in the ESP. Note that traditional distros probably should invoke "bootctl update" directly from the package scripts whenver they update the sd-boot package. This new service is primarily intended for image-based update systems, i.e. where the rootfs or /usr are atomically updated in A/B style and where the current boot loader should be synced into the ESP from the currently booted image every now and then. It can also act as safety net if the packaging scripts in classic systems are't doing the bootctl update stuff themselves. Since updating boot loaders mit be a tiny bit risky (even though we try really hard to make them robust, by fsck'ing the ESP and mounting it only on demand, by doing updates mostly as single file updates and by fsync()ing heavily) this is an optional feature, i.e. subject to "systemctl enable". However, since it's the right thing to do I think, it's enabled by default via the preset logic. Note that the updating logic is implemented gracefully: i.e. it's a NOP if the boot loader is already new enough, or was never installed.
* meson: use a/b instead of join_paths(a,b)Zbigniew Jędrzejewski-Szmek2021-07-271-5/+5
| | | | It is nicer and shorter.
* homed: allow systemd-homed access to FIDO2 devicesGibeom Gwon2021-07-121-0/+1
| | | | Add DeviceAllow= option for FIDO2 devices in systemd-homed.service.
* units: correct description of final.targetqhill2021-07-021-1/+1
| | | This was updated incorrectly in https://github.com/systemd/systemd/pull/20058/commits/4fd3fc66396026f81fd5b27746f2faf8a9a7b9ee. As https://github.com/systemd/systemd/blob/main/man/systemd.special.xml decribes, this unit is about shutdown rather than boot.
* units: adjust description of systemd-update-utmp.serviceZbigniew Jędrzejewski-Szmek2021-06-302-2/+2
| | | | | "Update about" is not gramatically correct. I also think saying "Record" makes this easier to understand for people who don't necessarilly know what UTMP is.
* units: shorten description of kmod-static-nodes.serviceZbigniew Jędrzejewski-Szmek2021-06-301-1/+1
| | | | | As suggested in https://github.com/systemd/systemd/pull/20058#pullrequestreview-695023490.
* units: adjust Descriptions of various unitsZbigniew Jędrzejewski-Szmek2021-06-3023-23/+23
| | | | | | | | | | In general, it's not very usuful to repeat the unit name as the description. Especially when the word is a common name and if somebody doesn't understand the meaning immediately, they are not going to gain anything from the repeat either, e.g. "halt", "swap". In the status-unit-format=combined output parentheses are used around Description, so avoid using parenthesis in the Description itself.
* logind, units: unit Descriptions should be capitalizedZbigniew Jędrzejewski-Szmek2021-06-302-2/+2
|
* unit: use alias name of man pageYu Watanabe2021-06-1513-13/+13
|
* journald: when journald namespace instances log, they can do so safely to ↵Lennart Poettering2021-06-091-1/+0
| | | | | | the main journald instance Fixes: #18951
* units: stop automount unit when shutting downZbigniew Jędrzejewski-Szmek2021-06-071-0/+1
| | | | | This is currently our only .automount unit. We wouldn't want to trigger it accidentally during shutdown, so let's stop it too.
* units: make sure importd has CAP_LINUX_IMMUTABLE flagLennart Poettering2021-05-221-1/+1
| | | | | | | | Since d8f9686c0f1f276c0a687d9bd69f3adf33f15a95 we use the chattr +i flag for marking containers in directories as reead-only. But to do so we need the cap for it, hence grant it. Fixes: #19115
* units: skip some units in the initrdZbigniew Jędrzejewski-Szmek2021-05-223-0/+3
| | | | | | | | | | | | | | | | | I'm working on building initramfs images directly from normal packages, and it doesn't make sense for those units to be started. Pristine system rpms need to behave correctly as much as possible also in the initrd, and those units are enabled by the rpms. There usually isn't enough time for the timer to actually fire, but starting it gives a line on the console and generally looks confusing and sloppy. Flushing the journal means that its actually lost, since the real /var is not available yet. Another approach would be not enable those units, but right now they are statically enabled, and changing that would be more work, and doesn't really seem necessary, since the condition checks are very quick. Checking for /etc/initrd-release is the standard condition that the initrd units use, so let's do the same here.
* units: generate ReadWritePaths= in the templateZbigniew Jędrzejewski-Szmek2021-05-191-1/+4
|
* meson: drop unnecessary listificationZbigniew Jędrzejewski-Szmek2021-05-191-1/+1
|
* units: strip out the developer comment in .service unit againZbigniew Jędrzejewski-Szmek2021-05-191-3/+3
| | | | | | | The comment talks about upstream development steps and doesn't make sense for users. We used special '## ' syntax to strip it out during build, but it got inadvertently reformatted as a normal comment in 3982becc92197b920d86f03c3c52ae085e26ca60.
* meson: use jinja2 for unit templatesZbigniew Jędrzejewski-Szmek2021-05-1964-159/+127
| | | | | | | | | We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
* meson: revert the change to unquote commands in add_install_scriptZbigniew Jędrzejewski-Szmek2021-05-141-1/+1
| | | | | | | | | Old meson fails with: Element not a string: [<Holder: <ExternalProgram 'sh' -> ['/bin/sh']>>, '-c', 'test -n "$DESTDIR" || /bin/journalctl --update-catalog'] I'm doing it as a revert so that it's easy to undo the revert when we require newer meson. The effect is not so bad, maybe a dozen or so lines about finding 'sh'.
* meson: call find_program() once and reuse the variable everywhereZbigniew Jędrzejewski-Szmek2021-05-141-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Meson 0.58 has gotten quite bad with emitting a message every time a quoted command is used: Program /home/zbyszek/src/systemd-work/tools/meson-make-symlink.sh found: YES (/home/zbyszek/src/systemd-work/tools/meson-make-symlink.sh) Program sh found: YES (/usr/bin/sh) Program sh found: YES (/usr/bin/sh) Program sh found: YES (/usr/bin/sh) Program sh found: YES (/usr/bin/sh) Program sh found: YES (/usr/bin/sh) Program sh found: YES (/usr/bin/sh) Program xsltproc found: YES (/usr/bin/xsltproc) Configuring custom-entities.ent using configuration Message: Skipping bootctl.1 because ENABLE_EFI is false Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Message: Skipping journal-remote.conf.5 because HAVE_MICROHTTPD is false Message: Skipping journal-upload.conf.5 because HAVE_MICROHTTPD is false Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Message: Skipping loader.conf.5 because ENABLE_EFI is false Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) Program ln found: YES (/usr/bin/ln) ... Let's suffer one message only for each command. Hopefully we can silence even this when https://github.com/mesonbuild/meson/issues/8642 is resolved.
* userdbd: also listen on a varlink socket io.systemd.DropInLennart Poettering2021-05-101-1/+1
| | | | | Let's explicitly support looking things up via dropin as a varlink service.
* Revert "sysusers/firstboot: temporarily disable LoadCredential"Luca Boccassi2021-05-032-14/+10
| | | | | | | | This reverts commit 7c20dd4b6ef6e69862576722ac69b895d7a92dc9. Debian has now been updated to patch the issue, so SemaphoreCI should no longer fail. The fix has also been backported to the affected stable branches.
* systemd-coredump: Add conflict with shutdown.targetAlexander Sverdlin2021-04-291-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Otherwise a coredump started at the inconvinient moment can stop shutdown.target leaving the system in a halfway-down state: Pulling in shutdown.target/start from systemd-poweroff.service/start Added job shutdown.target/start to transaction. ... Keeping job shutdown.target/start because of systemd-poweroff.service/start ... [ OK ] Stopped target Remote File Systems. shutdown.target: starting held back, waiting for: systemd-networkd.socket sysinit.target: stopping held back, waiting for: remount_tmp.service systemd-coredump.socket: Incoming traffic ... systemd-coredump@0-243-0.service: Trying to enqueue job systemd-coredump@0-243-0.service/start/replace Added job systemd-coredump@0-243-0.service/start to transaction. Pulling in systemd-journald.socket/start from systemd-coredump@0-243-0.service/start Added job systemd-journald.socket/start to transaction. Pulling in system.slice/start from systemd-journald.socket/start Added job system.slice/start to transaction. Pulling in -.slice/start from system.slice/start Added job -.slice/start to transaction. Pulling in system-systemd\x2dcoredump.slice/start from systemd-coredump@0-243-0.service/start Added job system-systemd\x2dcoredump.slice/start to transaction. Pulling in system.slice/start from system-systemd\x2dcoredump.slice/start Pulling in shutdown.target/stop from system-systemd\x2dcoredump.slice/start Added job shutdown.target/stop to transaction. ... Keeping job systemd-poweroff.service/stop because of umount.target/stop Keeping job shutdown.target/stop because of systemd-coredump@0-243-0.service/start
* units: fix repart conditions to run if definitions exist in /sysroot + /sysusrLennart Poettering2021-04-211-0/+5
| | | | | The systemd-repart code was already smart enough to look for definitions there, but the unit file conditions made that pointless. Let's fix that.
* units: change order of settings to match order in other similar unitLennart Poettering2021-04-201-1/+1
|
* fstab-generator: if usr= is specified, mount it to /sysusr/usr/ firstLennart Poettering2021-04-205-4/+22
| | | | | | | | | | | | | | | This changes the fstab-generator to handle mounting of /usr/ a bit differently than before. Instead of immediately mounting the fs to /sysroot/usr/ we'll first mount it to /sysusr/usr/ and then add a separate bind mount that mounts it from /sysusr/usr/ to /sysroot/usr/. This way we can access /usr independently of the root fs, without for waiting to be mounted via the /sysusr/ hierarchy. This is useful for invoking systemd-repart while a root fs doesn't exist yet and for creating it, with partition data read from the /usr/ hierarchy. This introduces a new generic target initrd-usr-fs.target that may be used to generically order services against /sysusr/ to become available.
* systemd-networkd.socket: Add conflict with shutdown.target (#19348)sverdlin2021-04-191-1/+2
| | | | | | | systemd-networkd.socket can re-start systemd-networkd.service in shutdown and by doing this even stop shutdown.target leaving the system in halfway-down state. Fixes #4955.
* units: install dbus-org.freedesktop.oom1.service aliasAnita Zhang2021-04-101-1/+2
| | | | Fixes: #18469
* man: document system-systemd\x2dcryptsetup.sliceZbigniew Jędrzejewski-Szmek2021-04-091-1/+1
| | | | | | As discussed in https://github.com/systemd/systemd/pull/14235/commits/1dc85eff1d0dff18aaeaae530c91bf53f34b726e#r606821495, follow-up for commit 1dc85eff1d0dff18aaeaae530c91bf53f34b726e.
* sysusers/firstboot: temporarily disable LoadCredentialLuca Boccassi2021-04-062-10/+14
| | | | | | | | | Single-param LoadCredential= in units causes systemd v247/v248 to assert when parsing. Disable it for now, until the fix is merged in the stable trees, released and available (eg: in Debian for the CI) See: https://github.com/systemd/systemd/issues/19178
* Merge pull request #18971 from poettering/sysusers-credsLennart Poettering2021-03-312-1/+19
|\ | | | | let's read LoadCredentials=/SetCredentials= style cred in sysusers/firstboot and when asking for passwords
| * firstboot: allow provisioning of firstboot params via creds tooLennart Poettering2021-03-261-0/+11
| |
| * units: make sure to query console settings before we apply themLennart Poettering2021-03-261-1/+1
| |
| * sysusers: read passwords from the credentials logicLennart Poettering2021-03-261-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's make use of our own credentials infrastructure in our tools: let's hook up systemd-sysusers with the credentials logic, so that the root password can be provisioned this way. This is really useful when working with stateless systems, in particular nspawn's "--volatile=yes" switch, as this works now: # systemd-nspawn -i foo.raw --volatile=yes --set-credential=passwd.plaintext-password:foo For the first time we have a nice, non-interactive way to provision the root password for a fully stateless system from the container manager. Yay!
* | units: make locale directory writable for systemd-localedChristian Hesse2021-03-291-1/+1
|/ | | | | | | | With 8f20232fcb52dbe6255f3df6101fc057af90bcfa systemd-localed supports generating locales when required. This fails if the locale directory is read-only, so make it writable. Closes #19138
* units: add Conditions for systemd-oomd.serviceAnita Zhang2021-02-231-0/+4
| | | | | | | | Prompted by https://bugzilla.redhat.com/show_bug.cgi?id=1927148 and https://bugzilla.redhat.com/show_bug.cgi?id=1931181. Adds condition check for cgroups v2 and PSI, which systemd-oomd cannot start without.
View Lorry Controller Status