summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #34834 from yuwata/protect-home-tmpfs-read-onlyYu Watanabe2024-10-232-23/+32
|\ | | | | core/namespace: make ProtectHome=tmpfs makes /home and friends read-only as documented
| * core/namespace: replace MOUNT_PRIVATE_TMP_READ_ONLY with MOUNT_PRIVATE_TMP ↵Yu Watanabe2024-10-231-10/+5
| | | | | | | | with .read_only = true
| * core/namespace: coding style cleanupsYu Watanabe2024-10-231-6/+6
| |
| * core/namespace: honor MountEntry.read_only, .options, and so on in static ↵Yu Watanabe2024-10-232-7/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | entries Otherwise, ProtectHome=tmpfs makes /home/ and friends not read-only. Also, mount options for /run/ specified in MountAPIVFS=yes are not applied. The function append_static_mounts() was introduced in 5327c910d2fc1ae91bd0b891be92b30379c7467b, but at that time, there were neither .read_only nor .options in the struct. But, when later the struct is extended, the function was not updated and they were not copied from the static table. The fields has been used in static tables since e4da7d8c796a1fd11ecfa80fb8a48eac9e823f06, and also in 94293d65cd4125347e21b3e423d0e245226b1be2. Fixes #34825.
* | core: don't forget about fallback_smack_process_labelŁukasz Stelmach2024-10-231-1/+1
|/ | | | | | Call setup_smack() also when only fallback_smack_process_label is set. Fixes: 75689fb2d41f
* refactor: replace sizeof in loop with ELEMENTSOF & FOREACH_ELEMENT (#34863)Integral2024-10-234-15/+12
|
* update TODOLennart Poettering2024-10-231-0/+2
|
* man/network: fix typoYu Watanabe2024-10-231-1/+1
| | | | Follow-up for 1f5a052963464755e87a075f6f4a8867b2199311.
* measure: fix typoYu Watanabe2024-10-231-1/+1
| | | | Follow-up for 0005411352f9bda0d9887c37b9e75a2bce6c1133.
* TEST-55-OOMD: fix typoYu Watanabe2024-10-231-1/+1
| | | | Follow-up for 63d4c4271ca529f8357a84cbc075170fffdb3de8.
* Merge pull request #34850 from poettering/openat-report-new-tweaksLennart Poettering2024-10-2325-200/+180
|\ | | | | openat_report_new() tweaks
| * fs-util: move attempts counter in openat_report_new() into loopLennart Poettering2024-10-221-2/+1
| |
| * label: move label_ops_reset() up a bitLennart Poettering2024-10-222-6/+5
| | | | | | | | | | Let#s move it close to label_ops_set(), since it is somewhat symmetric to it.
| * label: add missing assert() to label_ops_set()Lennart Poettering2024-10-221-0/+3
| |
| * shared: get rid of fileio-label.[ch]Lennart Poettering2024-10-227-47/+29
| | | | | | | | | | | | Move the renaming function to reboot-util.h (since it writes out /run/nologin at shutdown), and let's get rid of fileio-label.[ch] now that it serves no purpose anymore.
| * fileio: port write_string_file_full() to openat_report_new()Lennart Poettering2024-10-221-10/+15
| | | | | | | | | | | | This brings two benefits: we will label the created file only if it is actually created, and we can correctly delete any file we create again on failure.
| * fileio: port write_string_file() to LabelOps, and thus add ↵Lennart Poettering2024-10-2213-74/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | WRITE_STRING_FILE_LABEL flag Given that we have the LabelOps abstraction these days, we can teach write_string_file() to use it, which means we can get rid of fileio-label.[ch] as a separate concept. (The only reason that fileio-label.[ch] exists independently of fileio.[ch] was that the former linekd to libselinux potentially, and thus had to be in src/shared/ while the other always was in src/basic/. But the LabelOps vtable provides us with a nice work-around)
| * fs-util: tweak how openat_report_new() operates when O_CREAT is used on a ↵Lennart Poettering2024-10-223-33/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dangling symlink One of the big mistakes of Linux is that when you create a file with open() and O_CREAT and the file already exists as dangling symlink that the symlink will be followed and the file created that it points to. This has resulted in many vulnerabilities, and triggered the creation of the O_MOFOLLOW flag, addressing the problem. O_NOFOLLOW is less than ideal in many ways, but in particular one: when actually creating a file it makes sense to set, because it is a problem to follow final symlinks in that case. But if the file is already existing, it actually does make sense to follow the symlinks. With openat_report_new() we distinguish these two cases anyway (the whole function exists only to distinguish the create and the exists-already case after all), hence let's do something about this: let's simply never create files "through symlinks". This can be implemented very easily: just pass O_NOFOLLOW to the 2nd openat() call, where we actually create files. And then basically remove 0dd82dab91eaac5e7b17bd5e9a1e07c6d2b78dca again, because we don't need to care anymore, we already will see ELOOP when we touch a symlink. Note that this change means that openat_report_new() will thus start to deviate from plain openat() behaviour in this one small detail: when actually creating files we will *never* follow the symlink. That should be a systematic improvement of security. Fixes: #34088
| * fs-util: always call label post ops in xopenat_full(), in both success and ↵Lennart Poettering2024-10-221-9/+11
| | | | | | | | | | | | | | | | | | | | | | error path For SELinux it is essential that we reset the file creation label both in the success and in the error path, hence do so. Moreover, when calling the label post ops do it if possible with the opened fd of the inode itself, rather than always going via its path, simply to reduce the attack surface.
| * fs-util: don't second guess openat_report_new() return valuesLennart Poettering2024-10-221-11/+0
| | | | | | | | | | | | | | If openat_report_new() fails, then 'made_file' will be false, as no file was created, hence there's no need to skip the unlinkat() explicitly early, given that we check for 'made_file' anyway in the error path. The extra error code checks are hence entirely redundant.
| * label: tweak LabelOps post() hook to take "created" booleanLennart Poettering2024-10-226-15/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | We have two distinct implementations of the post hook. 1. For SELinux we just reset the selinux label we told the kernel earlier to use for new inodes. 2. For SMACK we might apply an xattr to the specified file. The two calls are quite different: the first call we want to call in all cases (failure or success), the latter only if we actually managed to create an inode, in which case it is called on the inode.
| * fs-util: always go through the unlink cleanup paths in xopenat_full()Lennart Poettering2024-10-221-5/+3
| | | | | | | | We didn't go through it at all if label_ops_post() failed.
| * fs-util: remove misplaced RET_NERRNO()Lennart Poettering2024-10-221-1/+1
| |
* | network: adjust log message about DNRRonan Pigott2024-10-231-4/+4
| | | | | | | | | | The only possible error return in this position is -ENODATA, which is not interesting.
* | Merge pull request #34861 from poettering/can-idleLennart Poettering2024-10-234-8/+57
|\ \ | | | | | | logind: introduce CanIdle/CanLock properties on logind session dbus objects
| * | logind: also check session class in session_get_idle_hint()Lennart Poettering2024-10-221-0/+3
| | |
| * | logind: use RET_GATHER() at one more placeLennart Poettering2024-10-221-4/+1
| | |
| * | logind: add CanIdle + CanLock dbus properties to session objectLennart Poettering2024-10-223-4/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clients should be able to know if the idle logic is available on a session without secondary knowledge about the session class. Let's hence expose a property for that. Similar for the screen lock concept. Fixes: #34844
* | | mkosi: update debian commit referenceLuca Boccassi2024-10-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 07a294d0c6 Do not mask systemd-gpt-auto-generator in upstream CI builds * 5636398bf7 Backport patch to fix test failures with tzdata 2024b-1 * 354ded4946 Update changelog for 256.7-2 release * e38c7c5345 Backport fixes for upstream autopkgtest suite * 249676834c Disable utmp support, not y2038 safe * 822d44da42 initramfs-tools: support missing /etc/udev/udev.conf * ad71ebf700 systemd-boot: depend on systemd for kernel-install * 5bf7008ef8 d/systemd.postinst: do not restart systemd-binfmt.service if masked * 58d5aa1b41 d/rules: mask systemd-gpt-auto-generator on Ubuntu * 481987d85c Update changelog for 256.7-1 release * ce7f3d4b43 Revert "autopkgtest: skip TEST-64-UDEV-STORAGE due to qemu crash" * 7007e73b22 Mark dependencies on clang and bpftool as :native * 0e120cf704 Update upstream source from tag 'upstream/256.7' |\ | * 914aae055c New upstream version 256.7 * fcea89cb00 d/t/upstream: honor /etc/apt configured by autopkgtest
* | | Merge pull request #34860 from enr0n/varlinkctl-fixesMike Yuan2024-10-221-4/+6
|\ \ \ | | | | | | | | Fix varlinkctl output with `--more`
| * | | varlinkctl: set SD_JSON_FORMAT_FLUSH when --more is setNick Rosbrook2024-10-221-2/+2
| | | | | | | | | | | | | | | | This makes it possible to process continuous replies with jq etc.
| * | | varlinkctl: do not clobber format flags in verb_callNick Rosbrook2024-10-221-2/+4
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, when SD_JSON_FORMAT_OFF is set in verb_call, the json format flags are set to SD_JSON_FORMAT_PRETTY_AUTO|SD_JSON_FORMAT_COLOR_AUTO, rather than or'ing those flags in. This means that other flags that may have been set, e.g. SD_JSON_FORMAT_SEQ when --more is set, will be clobbered. Fix this by masking SD_JSON_FORMAT_OFF out, and then or'ing the new flags in.
* / / logind: allow read/write to char-hvc devicesLuca Boccassi2024-10-221-0/+1
|/ / | | | | | | | | virtio console uses /dev/hvc* so we need access to write wall messages
* | Merge pull request #34848 from ↵Lennart Poettering2024-10-225-48/+42
|\ \ | | | | | | | | | | | | yuwata/network-dhcpv6-do-not-request-ia-pd-on-info-req network/dhcp6: do not request IA_PD on information requesting mode
| * | man: suggest to use DHCPv6Client= when upstream provides RA with the Managed ↵Yu Watanabe2024-10-211-4/+10
| | | | | | | | | | | | | | | | | | bit unset Follow-up for daf9f42f9183c206c0f8308efece019797e95e89.
| * | network/dhcp6: do not request IA_PD when running in the other-information modeYu Watanabe2024-10-214-44/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts the following commits: - 180cc5421d9712fb95a6bbc725dc8ba459360c8b "sd-dhcp6-client: allow to request IA_PD on information requesting mode" - cf7a403e470368049165ecff7ac7686928778d7c "sd-dhcp6-lease: adjust information refresh time with lifetime of IA_PD" - 1918eda30d12e1ba3ee55921c18ec53267463e24 "network/dhcp6: process hostname and IA_PD on information requesting mode" As per discussion in #34299, https://github.com/systemd/systemd/issues/34299#issuecomment-2425153221 the offending commits violate RFC 8415 section 18.2.6: > The client uses an Information-request message to obtain > configuration information without having addresses and/or delegated > prefixes assigned to it.
* | | resolved: validate noerror response for CNAMEsRonan Pigott2024-10-222-10/+2
| |/ |/| | | | | | | | | | | | | | | CNAME doesn't exist at the zone apex. When we get an unsigned noerror response to a direct query for a CNAME record, we don't yet know if this name is zone apex. We already request the correct DS record in this case, but previously skipped it at validation time, causing the answer to appear bogus. Make sure to also consider the DS record for the query name for negative replies.
* | Merge pull request #34851 from DaanDeMeyer/mediumDaan De Meyer2024-10-221-5/+15
|\ \ | | | | | | bus-util: Return ENOMEDIUM if XDG_RUNTIME_DIR is unset
| * | bus-util: Fix bus_log_connect_error()Daan De Meyer2024-10-221-3/+3
| | |
| * | bus-util: Special case when DBUS_SESSION_BUS_ADDRESS is set and ↵Daan De Meyer2024-10-221-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | XDG_RUNTIME_DIR isn't We noticed some failures because we have code that connects to user managers by setting DBUS_SESSION_BUS_ADDRESS without setting XDG_RUNTIME_DIR. If that's the case, connect to the user session bus instead of the private manager bus as we can't connect to the latter if XDG_RUNTIME_DIR is not set.
| * | bus-util: Return ENOMEDIUM if XDG_RUNTIME_DIR is unsetDaan De Meyer2024-10-221-1/+1
| |/ | | | | | | bus_log_connect_error() checks for ENOMEDIUM, not ENXIO.
* | Merge pull request #34761 from ikruglov/ikruglov/io-systemd-Machine-GetAddressesLennart Poettering2024-10-226-17/+184
|\ \ | | | | | | machine: add Addresses, OSRelease, and UIDShift fields in varlink io.systemd.Machine.List output
| * | machine: add tests for Addresses/OSRelease/UIDShift fields in ↵Ivan Kruglov2024-10-211-0/+16
| | | | | | | | | | | | io.systemd.Machine.List output
| * | machine: use AcquireMetadata in io.systemd.MachineImage.List methodIvan Kruglov2024-10-213-10/+23
| | |
| * | machine: add Addresses field in varlink io.systemd.Machine.List outputIvan Kruglov2024-10-212-2/+60
| | | | | | | | | | | | This is equivalent to DBus implementation of GetMachineAddresses.
| * | machine: add OSRelease and UIDShift fields in varlink ↵Ivan Kruglov2024-10-212-8/+64
| | | | | | | | | | | | | | | | | | | | | | | | io.systemd.Machine.List output This commit adds support of the above mentioned fields. This is equivalent to DBus implementation of: - GetMachineOSRelease - GetMachineUIDShift
| * | machine: enum AcquireMetadataIvan Kruglov2024-10-213-0/+24
| | |
* | | Merge pull request #30952 from rpigott/resolved-dnrLennart Poettering2024-10-2246-123/+2028
|\ \ \ | | | | | | | | RFC9463: Discovery of Network-designated Resolvers
| * | | resolve: move sd-* api into libsystemd-networkRonan Pigott2024-10-219-6/+41
| | | | | | | | | | | | | | | | | | | | This duplicates the svc param constants for the benefit of the resolved-core library.
| * | | ndisc: implement ndisc_option_build_encrypted_dnsRonan Pigott2024-10-211-0/+140
| | | | | | | | | | | | | | | | This is only used by the fuzzer so far.
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-30 02:48:29 +0100