summaryrefslogtreecommitdiff
path: root/units
Commit message (Collapse)AuthorAgeFilesLines
* unit: make systemd-udev-trigger.service use --prioritized-subsystemYu Watanabe2022-03-221-2/+1
| | | | Replaces #19637 and #22643.
* spelling: weekday names are capitalizedZbigniew Jędrzejewski-Szmek2022-03-211-1/+1
|
* unit: add units for new "systemd-sysupdate" toolLennart Poettering2022-03-195-0/+108
| | | | | | These unit (if enabled) will try to update the OS in regular intervals. Moreover, every day in the early morning this will attempt to reboot the system if there's a newer version installed than running.
* udev: run the main process, workers, and spawned commands in /udev subcgroupYu Watanabe2022-03-171-0/+1
| | | | | | | | And enable cgroup delegation for udevd. Then, processes invoked through ExecReload= are assigned .control subcgroup, and they are not killed by cg_kill(). Fixes #16867 and #22686.
* units: fix factory-reset.target descriptionVivien Didelot2022-03-141-1/+1
| | | | | | | | | | | | | | | The current description for the factory reset target does not add any value and doesn't respect the definition of the related property as described in systemd.unit(5). Starting the target currently results in the following log: [ 11.139174] systemd[1]: Reached target Target that triggers factory reset. Does nothing by default.. [ OK ] Reached target Target that…set. Does nothing by default.. Simply update the target description to "Factory Reset". Signed-off-by: Vivien Didelot <vivien.didelot@gmail.com>
* units: drop After=systemd-resolved.service from systemd-nspawn@.serviceLennart Poettering2022-02-241-1/+1
| | | | | resolved is now started as part of early boot hence we need no explicit ordering anymore.
* units: move resolved to sysinit.target (from basic.target)Lennart Poettering2022-02-241-2/+2
| | | | | | | | | | | | | | | | | | 79a67f3ca4d32c37b5e754501852a85eae908a6a pulled systemd-resolved.service in from basic.target instead of multi-user.target, i.e. the idea is to make it an early boot service, instead of a regular service. However, early boot services are supposed to be in sysinit.target, not basic.target (the latter is just one that combines the early boot services in sysinit.target, the sockets in sockets.targt, the mounts in local-fs.target and so on into one big target). Also, the comit actually didn't add a synchronization point, i.e. not Before=, so that the whole thing was racy. Let's fix all that. Follow-up for 79a67f3ca4d32c37b5e754501852a85eae908a6a
* unit: escape %Yu Watanabe2022-02-231-1/+1
| | | | Fixes #22601.
* units: drop After=systemd-networkd.service from systemd-resolved.serviceLennart Poettering2022-02-231-1/+1
| | | | | | | | | | | This ordering existed since resolved was first created, but there should not be any need to order the two services against each other, as resolved should be able to pick up networkd DNS metadata either way (as it works with inotify in /run). Let's drop this hence, and not cargo-cult this to eternity Also see: https://github.com/systemd/systemd/pull/22389#issuecomment-1045978403
* units: we need systemd-journald.service from systemd-journal-flush.serviceLennart Poettering2022-02-021-0/+1
| | | | | | | | | | | | This is a follow-up for d5ee050ffc9d413253932d9340ade8c8fb111092, and reintroduces a requirement dep from systemd-journal-flush.service onto systemd-journald.service, but a weaker one than originally: a Wants= one instead of a Requires= one. Why? Simply because the service issues an IPC call to the journald, hence it should pull it in. (Note that socket activation doesn't happen for the Varlink socket it uses, hence we should pull in the service itself.)
* unit: introduce wait-online@.service for specific interfaceYu Watanabe2022-01-282-0/+26
| | | | | | This should be useful when a host has multiple interfaces. Inspired by #22246.
* units: don't install dbus-org.freedesktop.oom1.service aliasMichael Biebl2022-01-121-2/+1
| | | | | | | | | | | The systemd-oomd.service unit contains [Install] WantedBy=multi-user.target Alias=dbus-org.freedesktop.oom1.service which means the symlink is supposed to be created dynamically when the service is enabled.
* units: start systemd-resolved in basic.targetZbigniew Jędrzejewski-Szmek2022-01-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | In the olden days systemd-resolved used dbus and it didn't make sense to start it before dbus which is started fairly late. But we have mostly ported resolved over to varlink. The queries from nss-resolve are done using varlink, so name resolution can work without dbus. resolvectl still uses dbus, so e.g. 'resolvectl query' will not work, but by starting systemd-resolved earlier we're not making this any worse. If systemd-resolved is started after dbus, it registers the name and everything is fine. If it is started before dbus, it'll watch for the dbus socket and connect later. So it should be fine to start systemd-resolved earlier. (If dbus is stopped and restarted, unfortunately systemd-resolved does not reconnect. This seems to be a small bug: since our daemons know how to watch for dbus.socket, they could restart the watch if they ever lose the connection. But this scenario shouldn't happen in normal boot, and restarting dbus is not supported anyway.) Moving the start earlier the following advantages: - name resolution becomes availabe earlier, in particular for synthesized hostnames even before the network is up. - basic.target is part of initrd.target, so systemd-resolved will get started in the initrd if installed. This is required for nfs-root when the server is specified using a name (https://bugzilla.redhat.com/show_bug.cgi?id=2037311).
* homed: stop before stopping dbusMarkus Weippert2022-01-071-1/+1
| | | | | | | | | Otherwise, systemd-homed-active.service will fail to deactivate all homes because homectl can no longer talk to homed if dbus stops first. As a result, /home cannot be umounted. Doing this on systemd-homed-active.service instead works as well, but systemd-homed will exit 1 if dbus is already shut down.
* logind: add a comment with a reminder why we don't use ProtrectProc=Luca Boccassi2021-12-171-0/+1
| | | | Follow-up for https://github.com/systemd/systemd/pull/21785
* logind: allow to read /procLudwig Nussel2021-12-171-1/+0
| | | | | User name and tty are used for wall messages. For that to work logind must be able to poke around in proc entries of other processes.
* units: enable systemd-network-generator by defaultZbigniew Jędrzejewski-Szmek2021-12-161-0/+4
| | | | | | It is used by udevd and networkd. Since udevd is enabled statically, let's also change the preset to "on". networkd is opt-in, so let's pull in the generator when enabling networkd too.
* meson: build network-generator unconditionallyYu Watanabe2021-12-161-1/+1
| | | | The service also generates .link files for udevd.
* unit: run network-generator before starting udevdYu Watanabe2021-12-161-1/+1
| | | | | Otherwise, .link files generated by the service may not be loaded by udevd.
* Bump the max number of inodes for /tmp to a million tooZbigniew Jędrzejewski-Szmek2021-12-091-1/+1
| | | | | | Fixes #21626. (The bug report talks about /run, but the issue is actually with /tmp.) People use /tmp for various things that fit in memory, e.g. unpacking packages, and 400k is not much. Let's raise is a bit.
* units/systemd-udevd: allow bpf() syscallMaciek Borzecki2021-12-071-1/+1
| | | | | | | | | | | | | | | | | Programs run by udev triggers may need to execute the bpf() syscall. Even more so, since on a cgroup v2 system, the only way to set up device access filtering is to install a BPF program on the cgroup in question and one way of passing data to such program is through BPF maps, which can only be access using the bpf() syscall. One such use case was identified in RHBZ#2025264 related to snap-device-helper, and led to RHBZ#2027627 being filed. Unfortunately there is no finer grained control over what gets passed in the syscall, so just enable bpf() and leave fine grained mediation to other security layers (eg. SELinux). Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2027627 Signed-off-by: Maciek Borzecki <maciek.borzecki@gmail.com>
* journal: don't remove the flushed flag when journald is stoppedFranck Bui2021-12-061-1/+0
| | | | | | | | | | | | | | | | | | | Due to the fact that systemd-journal-flush.service has "Requires=systemd-journald.service", this service is stopped too when journald is requested to do so. However stopping systemd-journal-flush.service implies that journald relinquishes /var hence implicitly switching back to the volatile storage mode and removing /run/systemd/journal/flushed. If journald is started afterwards, it will run in volatile storage mode regardless of the value of 'Storage=' as it believes now that /var is not yet ready (because the flushed flag is missing). Because this flag is mainly an indication for journald that the initialization of /var/log/journal (during the boot process) has been done, systemd-journal-flush.service shouldn't be tied to the state of journald itself but to the state of /var/log/journal, hence to the state of the system.
* coredump: analyze object with libdwelf in forked processLuca Boccassi2021-11-301-2/+1
| | | | | | | Parsing objects is risky as data could be malformed or malicious, so avoid doing that from the main systemd-coredump process and instead fork another process, and set it to avoid generating core files itself.
* units: delay binfmt processing until after local-fs.targetZbigniew Jędrzejewski-Szmek2021-11-161-0/+1
| | | | | | | | | Users may use rules that refer to binaries e.g. in /opt or /usr/local, and those directories may be separate mount points. We don't need the binfmt rules in early boot, so let's delay the service so that we can rely on the full local filesystem being visible. Fixes #21178.
* units: relax sandbox so that uidmap stuff can workLennart Poettering2021-11-161-2/+2
| | | | | | | The uidmap suff requires additional caps and userns to work in some cases. Allow it. Follow-up for: 1147c538bbb6a2d3d5ba2e40f1437bcbeb22b33e
* fsck: no emergency.target on nofail mountsScott Lamb2021-11-101-0/+2
| | | | | Also describe failure behavior more precisely in the manpage. Fixes #20237.
* build: preserve correct mode when generating files via jinja2Christian Brauner2021-11-081-2/+1
| | | | | | | | | When using "capture : true" in custom_target()s the mode of the source file is not preserved when the generated file is not installed and so needs to be tweaked manually. Switch from output capture to creating the target file and copy the permissions from the input file. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
* getty: Pass tty to use by agetty via stdinDaan De Meyer2021-11-054-4/+12
| | | | | | | If the tty arg is set to "-", agetty uses the stdin fd as the tty. Let's pass the tty this way so that we keep an fd open to the tty at all times. If all fd's to a tty are closed, the kernel might reset the tty which we want to avoid.
* Merge pull request #20902 from tasleson/integritysetup-generatorLennart Poettering2021-10-156-3/+32
|\ | | | | Add stand-alone dm integrity support
| * Add stand-alone dm-integrity supportTony Asleson2021-10-153-0/+29
| | | | | | | | | | | | | | This adds support for dm integrity targets and an associated /etc/integritytab file which is required as the dm integrity device super block doesn't include all of the required metadata to bring up the device correctly. See integritytab man page for details.
| * dm-verity: Remove usage of integrityTony Asleson2021-10-143-3/+3
| | | | | | | | | | | | There is a difference between dm-verity and dm-integrity. Remove usage of integrity from verity documentation in man pages and target files.
* | unit: networkd does not require AF_ALG anymoreYu Watanabe2021-10-151-1/+1
|/ | | | As khash is retired.
* units: run user service managers at OOM score adjustment 100Lennart Poettering2021-10-041-0/+1
| | | | | | | | | | | | | | | | | | | Let's make it slightly more likely that a per-user service manager is killed than any system service. We use a conservative 100 (from a range that goes all the way to 1000). Replaces: #17426 Together with the previous commit this means: system manager and system services are placed at OOM score adjustment 0 (specifically: they inherit kernel default of 0). User service manager (both for root and non-root) are placed at 100. User services for non-root are placed at 200, those for root inherit 100. Note that processes forked off the user *sessions* (i.e. not forked off the per-user service manager) remain at 0 (e.g. the shell process created by a tty or ssh login). This probably should be addressed too one day (maybe in pam_systemd?), but is not covered here.
* tools: shellcheck-ify tool scriptsFrantisek Sumsal2021-09-301-0/+1
|
* unit: install the systemd-bless-boot.service only if we have gnu-efiFrantisek Sumsal2021-09-221-1/+1
| | | | Follow-up to #20591.
* Merge pull request #20690 from DaanDeMeyer/oomd-user-servicesLuca Boccassi2021-09-213-0/+24
|\ | | | | oom: Support for user services
| * oom: Add support for user unit ManagedOOM property updatesDaan De Meyer2021-09-203-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Compared to PID1 where systemd-oomd has to be the client to PID1 because PID1 is a more privileged process than systemd-oomd, systemd-oomd is the more privileged process compared to a user manager so we have user managers be the client whereas systemd-oomd is now the server. The same varlink protocol is used between user managers and systemd-oomd to deliver ManagedOOM property updates. systemd-oomd now sets up a varlink server that user managers connect to to send ManagedOOM property updates. We also add extra validation to make sure that non-root senders don't send updates for cgroups they don't own. The integration test was extended to repeat the chill/bloat test using a user manager instead of PID1.
* | units: hookup systemd-boot-update.serviceLennart Poettering2021-09-201-0/+1
| | | | | | | | | | It was apparently missed to hook this up in 71c8bf28378958a5ab2348e9ec586fbe78c71dfd.
* | boot: don't build bootctl when -Dgnu-efi=false is setMichal Sekletar2021-09-201-1/+1
|/
* unit: systemd-oomd.service requires cgroup memory controllerYu Watanabe2021-09-121-0/+1
|
* homed: add missing capabilities for SMB/CIFS backendLennart Poettering2021-08-311-3/+2
| | | | | | | | | In 2020 mount.cifs started to require a bunch for caps to work. let's add them to the capability bounding set. Also, SMB support obviously needs network access, hence open that up. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1962920
* units: added factory-reset.targetYegor Alexeyev2021-08-102-0/+13
|
* units: make sure systemd-tmpfiles-{setup,clean} don't survive switch-rootZbigniew Jędrzejewski-Szmek2021-08-062-2/+2
| | | | | | | | | | | | | | | Normally, these services are killed because we run isolate. But I booted into emergency mode (because of a futher bug with us timing out improperly on the luks password prompt), and then continuted to the host system by running 'systemctl start systemd-switch-root.service'. My error, but the results are confusing and bad: systemd in the host sees 'systemd-tmpfiles-setup.service' as started successfully, and doesn't restart it, so the setup for /tmp/.X11 is not done and gdm.service fails. So while we wouldn't encounter this during normal successful boot, I think it's good to make this more robust. The dep is added to systemd-tmpfiles-{setup,clean}, because /tmp is not propagated over switch-root. /dev is, so I didn't touch systemd-tmpfiles-setup-dev.service.
* boot: optionally update sd-boot on bootLennart Poettering2021-07-301-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | Boot loaders are software like any other, and hence muse be updated in regular intervals. Let's add a simple (optional) service that updates sd-boot automatically from the host if it is found installed but out-of-date in the ESP. Note that traditional distros probably should invoke "bootctl update" directly from the package scripts whenver they update the sd-boot package. This new service is primarily intended for image-based update systems, i.e. where the rootfs or /usr are atomically updated in A/B style and where the current boot loader should be synced into the ESP from the currently booted image every now and then. It can also act as safety net if the packaging scripts in classic systems are't doing the bootctl update stuff themselves. Since updating boot loaders mit be a tiny bit risky (even though we try really hard to make them robust, by fsck'ing the ESP and mounting it only on demand, by doing updates mostly as single file updates and by fsync()ing heavily) this is an optional feature, i.e. subject to "systemctl enable". However, since it's the right thing to do I think, it's enabled by default via the preset logic. Note that the updating logic is implemented gracefully: i.e. it's a NOP if the boot loader is already new enough, or was never installed.
* meson: use a/b instead of join_paths(a,b)Zbigniew Jędrzejewski-Szmek2021-07-271-5/+5
| | | | It is nicer and shorter.
* homed: allow systemd-homed access to FIDO2 devicesGibeom Gwon2021-07-121-0/+1
| | | | Add DeviceAllow= option for FIDO2 devices in systemd-homed.service.
* units: correct description of final.targetqhill2021-07-021-1/+1
| | | This was updated incorrectly in https://github.com/systemd/systemd/pull/20058/commits/4fd3fc66396026f81fd5b27746f2faf8a9a7b9ee. As https://github.com/systemd/systemd/blob/main/man/systemd.special.xml decribes, this unit is about shutdown rather than boot.
* units: adjust description of systemd-update-utmp.serviceZbigniew Jędrzejewski-Szmek2021-06-302-2/+2
| | | | | "Update about" is not gramatically correct. I also think saying "Record" makes this easier to understand for people who don't necessarilly know what UTMP is.
* units: shorten description of kmod-static-nodes.serviceZbigniew Jędrzejewski-Szmek2021-06-301-1/+1
| | | | | As suggested in https://github.com/systemd/systemd/pull/20058#pullrequestreview-695023490.
* units: adjust Descriptions of various unitsZbigniew Jędrzejewski-Szmek2021-06-3023-23/+23
| | | | | | | | | | In general, it's not very usuful to repeat the unit name as the description. Especially when the word is a common name and if somebody doesn't understand the meaning immediately, they are not going to gain anything from the repeat either, e.g. "halt", "swap". In the status-unit-format=combined output parentheses are used around Description, so avoid using parenthesis in the Description itself.
View Lorry Controller Status