summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* resolved: flush all caches if SIGUSR2 is receivedLennart Poettering2016-06-103-1/+19
|
* networkd: fix bad memory access for routes that are note attached to a link ↵Lennart Poettering2016-06-101-1/+1
| | | | | | | yet (#3499) Corrects: 1b566071 Also see: https://github.com/systemd/systemd/pull/3478#issuecomment-225008542
* core: disable colors when displaying cylon when systemd.log_color=off (#3495)Franck Bui2016-06-101-5/+10
|
* update TODOLennart Poettering2016-06-101-0/+3
|
* core/execute: add the magic character '!' to allow privileged execution (#3493)Alessandro Puccetti2016-06-105-24/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements the new magic character '!'. By putting '!' in front of a command, systemd executes it with full privileges ignoring paramters such as User, Group, SupplementaryGroups, CapabilityBoundingSet, AmbientCapabilities, SecureBits, SystemCallFilter, SELinuxContext, AppArmorProfile, SmackProcessLabel, and RestrictAddressFamilies. Fixes partially https://github.com/systemd/systemd/issues/3414 Related to https://github.com/coreos/rkt/issues/2482 Testing: 1. Create a user 'bob' 2. Create the unit file /etc/systemd/system/exec-perm.service (You can use the example below) 3. sudo systemctl start ext-perm.service 4. Verify that the commands starting with '!' were not executed as bob, 4.1 Looking to the output of ls -l /tmp/exec-perm 4.2 Each file contains the result of the id command. ````````````````````````````````````````````````````````````````` [Unit] Description=ext-perm [Service] Type=oneshot TimeoutStartSec=0 User=bob ExecStartPre=!/usr/bin/sh -c "/usr/bin/rm /tmp/exec-perm*" ; /usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-start-pre" ExecStart=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-start" ; !/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-star-2" ExecStartPost=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-start-post" ExecReload=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-reload" ExecStop=!/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-stop" ExecStopPost=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-stop-post" [Install] WantedBy=multi-user.target] `````````````````````````````````````````````````````````````````
* rules: block - add scm block devices to whitelist (#3494)Lennart Poettering2016-06-101-1/+1
| | | | | | | | Since the introduction of the whitelist in 60-persistent-storage.rules block device symlinks are no longer created for scm block devices. Add scm to the whitelist. Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
* nspawn: introduce --notify-ready=[no|yes] (#3474)Alessandro Puccetti2016-06-105-8/+214
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This the patch implements a notificaiton mechanism from the init process in the container to systemd-nspawn. The switch --notify-ready=yes configures systemd-nspawn to wait the "READY=1" message from the init process in the container to send its own to systemd. --notify-ready=no is equivalent to the previous behavior before this patch, systemd-nspawn notifies systemd with a "READY=1" message when the container is created. This notificaiton mechanism uses socket file with path relative to the contanier "/run/systemd/nspawn/notify". The default values it --notify-ready=no. It is also possible to configure this mechanism from the .nspawn files using NotifyReady. This parameter takes the same options of the command line switch. Before this patch, systemd-nspawn notifies "ready" after the inner child was created, regardless the status of the service running inside it. Now, with --notify-ready=yes, systemd-nspawn notifies when the service is ready. This is really useful when there are dependencies between different contaniers. Fixes https://github.com/systemd/systemd/issues/1369 Based on the work from https://github.com/systemd/systemd/pull/3022 Testing: Boot a OS inside a container with systemd-nspawn. Note: modify the commands accordingly with your filesystem. 1. Create a filesystem where you can boot an OS. 2. sudo systemd-nspawn -D ${HOME}/distros/fedora-23/ sh 2.1. Create the unit file /etc/systemd/system/sleep.service inside the container (You can use the example below) 2.2. systemdctl enable sleep 2.3 exit 3. sudo systemd-run --service-type=notify --unit=notify-test ${HOME}/systemd/systemd-nspawn --notify-ready=yes -D ${HOME}/distros/fedora-23/ -b 4. In a different shell run "systemctl status notify-test" When using --notify-ready=yes the service status is "activating" for 20 seconds before being set to "active (running)". Instead, using --notify-ready=no the service status is marked "active (running)" quickly, without waiting for the 20 seconds. This patch was also test with --private-users=yes, you can test it just adding it at the end of the command at point 3. ------ sleep.service ------ [Unit] Description=sleep After=network.target [Service] Type=oneshot ExecStart=/bin/sleep 20 [Install] WantedBy=multi-user.target ------------ end ------------
* Merge pull request #3428 from toanju/networkd/brvlanLennart Poettering2016-06-1011-2/+486
|\ | | | | networkd: add support to configure VLAN on bridge ports
| * networkd: add support to configure VLAN on bridge portsTobias Jungel2016-06-1010-1/+466
| |
| * networkd-link: parse linkinfo to get kindTobias Jungel2016-06-092-1/+20
| |
* | l10n: update belarusian translation (#3482)Viktar Vaŭčkievič2016-06-104-116/+249
| |
* | networkd: fix dbus matchmac interface (#3485)Andrew Jeddeloh2016-06-101-1/+1
|/ | | | | Fix issue where the *Network passed via userdata is being offset by offsetof(Network, matchmac) leading to incorrect values being exposed in dbus.
* Merge pull request #3456 from poettering/ipv6-ra-renameTom Gundersen2016-06-094-10/+13
|\ | | | | networkd: rename IPv6AcceptRouterAdvertisements to IPv6AcceptRA
| * networkd: rename IPv6AcceptRouterAdvertisements to IPv6AcceptRALennart Poettering2016-06-074-10/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | The long name is just too hard to type. We generally should avoid using acronyms too liberally, if they aren't established enough, but it appears that "RA" is known well enough. Internally we call the option "ipv6_accept_ra" anyway, and the kernel also exposes it under this name. Hence, let's rename the IPv6AcceptRouterAdvertisements= setting and the [IPv6AcceptRouterAdvertisements] section to IPv6AcceptRA= and [IPv6AcceptRA]. The old setting IPv6AcceptRouterAdvertisements= is kept for compatibility with older configuration. (However the section [IPv6AcceptRouterAdvertisements] is not, as it was never available in a published version of systemd.
* | networkd: clean up vlan handling a bit (#3478)Lennart Poettering2016-06-096-13/+117
| | | | | | | | | | | | | | | | | | Let's add a generic parser for VLAN ids, which should become handy as preparation for PR #3428. Let's also make sure we use uint16_t for the vlan ID type everywhere, and that validity checks are already applied at the time of parsing, and not only whne we about to prepare a netdev. Also, establish a common definition VLANID_INVALID we can use for non-initialized VLAN id fields.
* | Updated Turkish translation (#3477)Muhammet Kara2016-06-091-49/+61
| |
* | bus_util: add support to map double (#3479)Susant Sahani2016-06-091-0/+13
| | | | | | | | | | Now we don't support parsing double at map_basic. when trying to use bus_message_map_all_properties with a double this fails. Let's add it.
* | udev-builtin-blkid: fix GPT_FLAG_NO_AUTO check for ESP (#3450)Lennart Poettering2016-06-091-5/+5
| | | | | | | | | | | | | | | | | | | | The flags check was accidentally placed in the ESP if block, but should be in the root if block. This corrects: 0238d4c660e732dd03ba0cdb54a29ec5870ee849 Fixes: #3440 Also see: #3441
* | load-fragment: don't try to do a template instance replacement if we are not ↵Lennart Poettering2016-06-091-1/+1
| | | | | | | | | | | | | | an instance (#3451) Corrects: 7aad67e7 Fixes: #3438
* | Merge pull request #3432 from poettering/resolved-ll-ipv6Martin Pitt2016-06-0914-45/+236
|\ \ | | | | | | resolved: support IPv6 DNS servers on the local link
| * | resolved: also rewrite private /etc/resolv.conf when configuration is ↵Lennart Poettering2016-06-064-15/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | changed via bus calls This also moves log message generation into manager_write_resolv_conf(), so that it is shorter to invoke the function, given that we have to invoke it at a couple of additional places now. Fixes: #3225
| * | resolved: support IPv6 DNS servers on the local linkLennart Poettering2016-06-0612-30/+198
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure we can parse DNS server addresses that use the "zone id" syntax for local link addresses, i.e. "fe80::c256:27ff:febb:12f%wlp3s0", when reading /etc/resolv.conf. Also make sure we spit this out correctly again when writing /etc/resolv.conf and via the bus. Fixes: #3359
| * | Two CODING_STYLE additionsLennart Poettering2016-06-061-0/+17
| | |
* | | execute: check whether the specified fd is a tty before chowning/chmoding ↵Lennart Poettering2016-06-091-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | it (#3457) Let's add an extra safety check before we chmod/chown a TTY to the right user, as we might end up having connected something to STDIN/STDOUT that is actually not a TTY, even though this might have been requested, due to permissive StandardInput= settings or transient service activation with fds passed in. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=85255
* | | Update spanish po file (#3463)Pablo Lezaeta Reyes [pˈaβ̞lo lˌe̞θaˈeta rˈejɛ]2016-06-091-45/+36
| | |
* | | units: add a basic SystemCallFilter (#3471)Topi Miettinen2016-06-0910-0/+10
| | | | | | | | | | | | | | | | | | | | | Add a line SystemCallFilter=~@clock @module @mount @obsolete @raw-io ptrace for daemons shipped by systemd. As an exception, systemd-timesyncd needs @clock system calls and systemd-localed is not privileged. ptrace(2) is blocked to prevent seccomp escapes.
* | | Merge pull request #3431 from poettering/network-fixesTom Gundersen2016-06-0810-80/+161
|\ \ \ | | | | | | | | put limits on addresses and routers per link and per network
| * | | networkd: constify more thingsLennart Poettering2016-06-034-25/+41
| | | |
| * | | networkd: also enforce limit on total number of address/routesLennart Poettering2016-06-033-34/+63
| | | | | | | | | | | | | | | | This covers the address/routers acquire dynamically.
| * | | networkd: drop weird "const" usage in function parametersLennart Poettering2016-06-033-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | We generally only use "const" to constify the destination of pointers, but not the pointers themselves, as they are copied anyway during C function invocation. Hence, drop this usage of "const".
| * | | sd-netlink: fix sd_netlink_inc_rcvbuf() prototypeLennart Poettering2016-06-032-2/+5
| | | | | | | | | | | | | | | | Drop weird "const" usage, and use size_t for sizes.
| * | | networkd: enforce a limit on the number of statically assigned ↵Lennart Poettering2016-06-034-14/+47
| | | | | | | | | | | | | | | | | | | | | | | | addresses/routes/fdb entries We should put a limit on everything, hence also on these resources.
* | | | Merge pull request #3470 from fbuihuu/logind-fix-ignore-inhibitLennart Poettering2016-06-081-2/+2
|\ \ \ \ | | | | | | | | | | Logind: fix handling of *KeyIgnoreInhibited options in logind.conf
| * | | | logind: minor cleanup and use IN_SET() in manager_handle_action()Franck Bui2016-06-081-1/+1
| | | | |
| * | | | logind: really handle *KeyIgnoreInhibited options in logind.confFranck Bui2016-06-081-1/+1
|/ / / /
* | | | units: enable MemoryDenyWriteExecute (#3459)Topi Miettinen2016-06-0810-0/+10
| | | | | | | | | | | | | | | | | | | | Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
* | | | sysv-generator: remove more dead code (#3462)Lennart Poettering2016-06-081-16/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The changes in 788d2b088b13a2444b9eb2ea82c0cc57d9f0980f weren't complete, only half the code that dealt with K links was removed. This is a follow-up patch that removes the rest too. No functional changes.
* | | | hwdb: selinuxify a bit (#3460)Evgeny Vereshchagin2016-06-071-2/+6
| |_|/ |/| | | | | | | | | | | | | | | | | | | | -bash-4.3# rm /etc/udev/hwdb.bin -bash-4.3# systemd-hwdb update -bash-4.3# ls -Z /etc/udev/hwdb.bin system_u:object_r:systemd_hwdb_etc_t:s0 /etc/udev/hwdb.bin Fixes: #3458
* | | Merge pull request #3394 from poettering/triple-tstampLennart Poettering2016-06-0733-684/+2246
|\ \ \ | | | | | | | | timestamping improvements and IPv6 RA revamp
| * | | network: beef up ipv6 RA support considerablyLennart Poettering2016-06-0617-557/+1911
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reworks sd-ndisc and networkd substantially to support IPv6 RA much more comprehensively. Since the API is extended quite a bit networkd has been ported over too, and the patch is not as straight-forward as one could wish. The rework includes: - Support for DNSSL, RDNSS and RA routing options in sd-ndisc and networkd. Two new configuration options have been added to networkd to make this configurable. - sd-ndisc now exposes an sd_ndisc_router object that encapsulates a full RA message, and has direct, friendly acessor functions for the singleton RA properties, as well as an iterative interface to iterate through known and unsupported options. The router object may either be retrieved from the wire, or generated from raw data. In many ways the sd-ndisc API now matches the sd-lldp API, except that no implicit database of seen data is kept. (Note that sd-ndisc actually had a half-written, but unused implementaiton of such a store, which is removed now.) - sd-ndisc will now collect the reception timestamps of RA, which is useful to make sd_ndisc_router fully descriptive of what it covers. Fixes: #1079
| * | | network: use inet_ntop() rather than SD_NDISC_ADDRESS_FORMAT_VAL() when ↵Lennart Poettering2016-06-061-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | serializing Let's use the usual libc API for serializing IPv6 addresses, instead of the NDISC-specific macro we should get rid of anyway.
| * | | util: make it easier to check whether in_addr or in6_addr addresses are NULLLennart Poettering2016-06-062-6/+17
| | | |
| * | | util-lib: add accessors for unaligned native endian wordsLennart Poettering2016-06-062-0/+42
| | | |
| * | | exit-status: update comments a bitLennart Poettering2016-06-061-6/+10
| | | |
| * | | lldp: include sys/types.h in sd-lldp.hLennart Poettering2016-06-061-0/+1
| | | | | | | | | | | | | | | | After all, we use clockid_t which is defined there.
| * | | lldp: minor coding style improvementLennart Poettering2016-06-061-4/+3
| | | |
| * | | lldp: add sd_lldp_get_event() callLennart Poettering2016-06-062-0/+7
| | | | | | | | | | | | | | | | sd-ndisc has something like this, let's add this for sd-lldp, too.
| * | | lldp: deal properly with recv() returning EAGAIN/EINTRLennart Poettering2016-06-061-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | It might very well return EAGAIN in case of packet checksum problems and suchlike, hence let's better handle this nicely, the same way as we do it in the other sd-network libraries for incoming datagrams.
| * | | lldp: pass correct neighbor object to REMOVED callbackLennart Poettering2016-06-061-2/+1
| | | |
| * | | lldp: rename TLV accessor pseudo-macrosLennart Poettering2016-06-062-9/+8
| | | | | | | | | | | | | | | | | | | | Let's make sure the inline functions for retrieving TLV data actually carry TLV in the name, so that we don#t assume they retrieve the whole, raw packet data.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-10 20:47:56 +0100