summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* core: add new RestrictNamespaces= unit file settingLennart Poettering2016-11-0415-23/+534
| | | | | | | | | | | | | | | | | This new setting permits restricting whether namespaces may be created and managed by processes started by a unit. It installs a seccomp filter blocking certain invocations of unshare(), clone() and setns(). RestrictNamespaces=no is the default, and does not restrict namespaces in any way. RestrictNamespaces=yes takes away the ability to create or manage any kind of namspace. "RestrictNamespaces=mnt ipc" restricts the creation of namespaces so that only mount and IPC namespaces may be created/managed, but no other kind of namespaces. This setting should be improve security quite a bit as in particular user namespacing was a major source of CVEs in the kernel in the past, and is accessible to unprivileged processes. With this setting the entire attack surface may be removed for system services that do not make use of namespaces.
* kernel-install: use exit instead of return (#4565)Yu Watanabe2016-11-041-2/+2
| | | | | /bin/kernel-install: line 143: return: can only `return' from a function or sourced script https://bugzilla.redhat.com/show_bug.cgi?id=1391829
* man: update kernel-install(8) to match reality (#4563)Zbigniew Jędrzejewski-Szmek2016-11-041-4/+5
|
* Merge pull request #4548 from keszybz/seccomp-helpZbigniew Jędrzejewski-Szmek2016-11-047-62/+151
|\ | | | | systemd-analyze syscall-filter
| * analyze: fix build w/o seccompZbigniew Jędrzejewski-Szmek2016-11-031-0/+8
| |
| * seccomp-util, analyze: export comments as a help stringZbigniew Jędrzejewski-Szmek2016-11-034-19/+23
| | | | | | | | Just to make the whole thing easier for users.
| * seccomp-util: move @default to the first positionZbigniew Jędrzejewski-Szmek2016-11-032-19/+20
| | | | | | | | Now that the list is user-visible, @default should be first.
| * analyze: add syscall-filter verbZbigniew Jędrzejewski-Szmek2016-11-035-25/+101
| | | | | | | | | | This should make it easier for users to understand what each filter means as the list of syscalls is updated in subsequent systemd versions.
* | doc: clarify NoNewPrivileges (#4562)Kees Cook2016-11-041-4/+4
| | | | | | | | Setting no_new_privs does not stop UID changes, but rather blocks gaining privileges through execve(). Also fixes a small typo.
* | build-sys: link test-seccomp against seccomp libs (#4560)Martin Pitt2016-11-031-1/+2
| | | | | | | | | | | | Fixes build error on recent toolchains: ../src/test/test-seccomp.c:35: error: undefined reference to 'seccomp_arch_native' collect2: error: ld returned 1 exit status
* | Merge pull request #4510 from keszybz/tree-wide-cleanupsLennart Poettering2016-11-0391-331/+336
|\ \ | | | | | | Tree wide cleanups
| * | nspawn: use the return value from asprintf instead of checking the pointerZbigniew Jędrzejewski-Szmek2016-10-231-13/+7
| | | | | | | | | | | | | | | | | | If allocation fails, the value of the point is "undefined". In practice this matters very little, but for consistency with rest of the code, let's check the return value.
| * | test-copy: wrap assignments in function call in parenthesesZbigniew Jędrzejewski-Szmek2016-10-231-6/+6
| | |
| * | tree-wide: drop NULL sentinel from strjoinZbigniew Jędrzejewski-Szmek2016-10-2389-194/+215
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes strjoin and strjoina more similar and avoids the useless final argument. spatch -I . -I ./src -I ./src/basic -I ./src/basic -I ./src/shared -I ./src/shared -I ./src/network -I ./src/locale -I ./src/login -I ./src/journal -I ./src/journal -I ./src/timedate -I ./src/timesync -I ./src/nspawn -I ./src/resolve -I ./src/resolve -I ./src/systemd -I ./src/core -I ./src/core -I ./src/libudev -I ./src/udev -I ./src/udev/net -I ./src/udev -I ./src/libsystemd/sd-bus -I ./src/libsystemd/sd-event -I ./src/libsystemd/sd-login -I ./src/libsystemd/sd-netlink -I ./src/libsystemd/sd-network -I ./src/libsystemd/sd-hwdb -I ./src/libsystemd/sd-device -I ./src/libsystemd/sd-id128 -I ./src/libsystemd-network --sp-file coccinelle/strjoin.cocci --in-place $(git ls-files src/*.c) git grep -e '\bstrjoin\b.*NULL' -l|xargs sed -i -r 's/strjoin\((.*), NULL\)/strjoin(\1)/' This might have missed a few cases (spatch has a really hard time dealing with _cleanup_ macros), but that's no big issue, they can always be fixed later.
| * | nss-systemd: remove useless defineZbigniew Jędrzejewski-Szmek2016-10-231-8/+0
| | | | | | | | | | | | We always define those two in configure, so no need to provide a fallback.
| * | tree-wide: use startswith return value to avoid hardcoded offsetZbigniew Jędrzejewski-Szmek2016-10-223-114/+112
| | | | | | | | | | | | | | | | | | | | | I think it's an antipattern to have to count the number of bytes in the prefix by hand. We should do this automatically to avoid wasting programmer time, and possible errors. I didn't any offsets that were wrong, so this change is mostly to make future development easier.
* | | Revert "sd-bus: use PRIu64 instead of casting" (#4556)v232Zbigniew Jędrzejewski-Szmek2016-11-031-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 75ead2b753cb9586f3f208326446081baab70da1. Follow up for #4546: > @@ -848,8 +848,7 @@ static int bus_kernel_make_message(sd_bus *bus, struct kdbus_msg *k) { if (k->src_id == KDBUS_SRC_ID_KERNEL) bus_message_set_sender_driver(bus, m); else { - xsprintf(m->sender_buffer, ":1.%llu", - (unsigned long long)k->src_id); + xsprintf(m->sender_buffer, ":1.%"PRIu64, k->src_id); This produces: src/libsystemd/sd-bus/bus-kernel.c: In function ‘bus_kernel_make_message’: src/libsystemd/sd-bus/bus-kernel.c:851:44: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 4 has type ‘__u64 {aka long long unsigned int}’ [-Wformat=] xsprintf(m->sender_buffer, ":1.%"PRIu64, k->src_id); ^
* | | hwdb update for 232 (#4557)Lennart Poettering2016-11-034-2256/+6651
| | |
* | | final NEWS update for 232 (#4558)Lennart Poettering2016-11-031-2/+2
| | | | | | | | | let's get this out today!
* | | Merge pull request #4543 from ↵Djalal Harouni2016-11-036-13/+47
|\ \ \ | | | | | | | | | | | | | | | | endocode/djalal/fix-dynamicuser-supplementary-groups core: intialize user aux groups and SupplementaryGroups= when DynamicUser= is set
| * | | test: test DynamicUser= with SupplementaryGroups=Djalal Harouni2016-11-033-0/+10
| | | |
| * | | test: test DynamicUser= with a fixed userDjalal Harouni2016-11-034-0/+25
| | | |
| * | | core: intialize user aux groups and SupplementaryGroups= when DynamicUser= ↵Djalal Harouni2016-11-031-13/+12
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | is set Make sure that when DynamicUser= is set that we intialize the user supplementary groups and that we also support SupplementaryGroups= Fixes: https://github.com/systemd/systemd/issues/4539 Thanks Evgeny Vereshchagin (@evverx)
* | | Merge pull request #4547 from keszybz/two-testsuite-tweaksLennart Poettering2016-11-032-4/+13
|\ \ \ | | | | | | | | Two testsuite tweaks
| * | | parse_hwdb: add import fallback for python2Zbigniew Jędrzejewski-Szmek2016-11-031-2/+8
| | | |
| * | | test-compression: allow the file to compress to be specifiedZbigniew Jędrzejewski-Szmek2016-10-311-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I'm seeing strange decompression errors with lz4, which might be content-dependent. Extend test-compression to allow testing specific content. (Edit: PEBKAC: lzcat and lz4cat are not the same beast. Nevertheless, the test might still be useful in the future.)
* | | | Merge pull request #4546 from keszybz/xsprintf-revertLennart Poettering2016-11-038-26/+36
|\ \ \ \ | |_|_|/ |/| | | xsprintf revert
| * | | udev/udev-watch: calculate the real buffer sizes neededZbigniew Jędrzejewski-Szmek2016-11-032-5/+5
| | | |
| * | | Do not raise in switch root if paths are too longZbigniew Jędrzejewski-Szmek2016-11-031-7/+18
| | | | | | | | | | | | | | | | | | | | | | | | If we encounter the (unlikely) situation where the combined path to the new root and a path to a mount to be moved together exceed maximum path length, we shouldn't crash, but fail this path instead.
| * | | sd-bus: use PRIu64 instead of castingZbigniew Jędrzejewski-Szmek2016-11-031-4/+2
| | | |
| * | | Revert some uses of xsprintfZbigniew Jędrzejewski-Szmek2016-11-034-10/+11
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | This reverts some changes introduced in d054f0a4d4. xsprintf should be used in cases where we calculated the right buffer size by hand (using DECIMAL_STRING_MAX and such), and never in cases where we are printing externally specified strings of arbitrary length. Fixes #4534.
* | | Merge pull request #4481 from poettering/perpetualZbigniew Jędrzejewski-Szmek2016-11-0315-110/+213
|\ \ \ | | | | | | | | Add "perpetual" unit concept, sysctl fixes, networkd fixes, systemctl color fixes, nspawn discard.
| * | | core: change mount_synthesize_root() return to intLennart Poettering2016-11-021-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's propagate the error here, instead of eating it up early. In a later change we should probably also change mount_enumerate() to propagate errors up, but that would mean we'd have to change the unit vtable, and thus change all unit types, hence is quite an invasive change.
| * | | networkd: flush DNSSL/RDNSS lists when we lose carrierLennart Poettering2016-11-023-3/+14
| | | | | | | | | | | | | | | | Fixes: #3870
| * | | netword: minor memory leak fixLennart Poettering2016-11-021-2/+2
| | | |
| * | | nspawn: if we set up a loopback device, try to mount it with "discard"Lennart Poettering2016-11-021-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | Let's make sure that our loopback files remain sparse, hence let's set "discard" as mount option on file systems that support it if the backing device is a loopback.
| * | | systemctl: tweak the "systemctl list-units" output a bitLennart Poettering2016-11-021-14/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make the underlining between the header and the body and between the units of different types span the whole width of the table. Let's never make the table wider than necessary (which is relevant due the above). When space is limited and we can't show the full ID or description string prefer showing the full ID over the full description. The ID is after all something people might want to copy/paste, while the description is mostly just helpful decoration.
| * | | systemctl: properly turn off color after active columnLennart Poettering2016-11-021-2/+2
| | | | | | | | | | | | | | | | | | | | If we turn on red color for the active column and it is not combined with underlining, then we need to turn it off explicitly afterwards. Do that.
| * | | sysctl: minor simplificationLennart Poettering2016-11-021-2/+2
| | | | | | | | | | | | | | | | Let's place only one ternary operator.
| * | | sysctl: no need to check for eof twiceLennart Poettering2016-11-021-1/+1
| | | | | | | | | | | | | | | | | | | | Let's only check for eof once after the fgets(). There's no point in checking EOF before the first read, and twice in each loop.
| * | | sysctl: when failing to process a config line, show line nrLennart Poettering2016-11-021-2/+5
| | | |
| * | | sysctl: split out condition check into its own functionLennart Poettering2016-11-021-12/+20
| | | | | | | | | | | | | | | | This way, we can get rid of a label/goto.
| * | | sysctl: do not fail systemd-sysctl.service if /proc/sys is mounted read-onlyLennart Poettering2016-11-021-5/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's make missing write access to /proc/sys non-fatal to the sysctl service. This is a follow-up to 411e869f497c7c7bd0688f1e3500f9043bc56e48 which altered the condition for running the sysctl service to check for /proc/sys/net being writable, accepting that /proc/sys might be read-only. In order to ensure the boot-up stays clean in containers lower the log level for the EROFS errors generated due to this.
| * | | unit: unify some code with new unit_new_for_name() callLennart Poettering2016-11-027-42/+28
| | | |
| * | | core: make the root mount perpetual tooLennart Poettering2016-11-022-15/+69
| | | | | | | | | | | | | | | | | | | | Now that have a proper concept of "perpetual" units, let's make the root mount one too, since it also cannot go away.
| * | | core: rework the "no_gc" unit flag to become a more generic "perpetual" flagLennart Poettering2016-11-025-19/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | So far "no_gc" was set on -.slice and init.scope, to units that are always running, cannot be stopped and never exist in an "inactive" state. Since these units are the only users of this flag, let's remodel it and rename it "perpetual" and let's derive more funcitonality off it. Specifically, refuse enqueing stop jobs for these units, and report that they are "unstoppable" in the CanStop bus property.
* | | | Merge pull request #4542 from poettering/v232prepZbigniew Jędrzejewski-Szmek2016-11-034-3/+56
|\ \ \ \ | | | | | | | | | | preparation for 232
| * | | | build-sys: bump package and library version in preparation for v232Lennart Poettering2016-11-022-3/+3
| | | | |
| * | | | add two additional entries to NEWSLennart Poettering2016-11-021-0/+9
| | | | |
| * | | | NEWS: add contributor list to news fileLennart Poettering2016-11-022-0/+44
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | Unfortunately, github drops the original commiter when a PR is "squashed" (even if it is only a single commit) and replaces it with some rubbish github-specific user id. Thus, to make the contributors list somewhat useful, update the .mailmap file and undo all the weirdness github applied there.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-23 12:25:43 +0100