summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #22939 from yuwata/tree-wide-spaceYu Watanabe2022-04-0157-82/+88
|\ | | | | tree-wide: add space after if, switch, for, and while
| * tree-wide: add a space after if, switch, for, and whileYu Watanabe2022-04-0156-81/+87
| |
| * test: add space between argumentsYu Watanabe2022-04-011-1/+1
| |
* | tree-wide: fix typoYu Watanabe2022-04-012-2/+2
| |
* | udev: add /dev/disk/by-diskseq symlink for block devicesLennart Poettering2022-04-011-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds another symlink for block devices: /dev/disk/by-diskseq/<number> where the number is the diskseq number as exposed by the kernel. It's useful for apps because they can use it to open a device by diskseq, in a way that is safe against device node reuse. I.e. if a device node path like this is passed to an app it could open the device node via the symlink and also parse the diskseq from the path. Once the device is opened it could compare the parsed diskseq with the one returned by BLKGETDISKSEQ on the open node, and if it matches they know they are talking to the right device. Fixes: #22906
* | Merge pull request #22926 from bluca/analyze_offline_filterYu Watanabe2022-04-012-7/+10
|\ \ | | | | | | analyze: fix offline checks for syscall filter and 'native' architecture
| * | analyze: fix offline check for syscal filterLuca Boccassi2022-04-011-1/+1
| | | | | | | | | | | | | | | | | | | | | The deny/allow list check was inverted, if we are deny listing and the hashmap contains the syscall then that's good Fixes https://github.com/systemd/systemd/issues/22914
| * | analyze: fix offline check for 'native' syscall architectureLuca Boccassi2022-04-012-6/+9
| | | | | | | | | | | | Enum values are stored in the set, not strings
* | | Merge pull request #22921 from poettering/uid-range-tweaksLennart Poettering2022-04-017-43/+389
|\ \ \ | | | | | | | | userns uid range tweaks: taint systemd if assigned userns uid range too short, and show userns uid range in userdbctl output
| * | | userdbctl: also show available UID range in current usernsLennart Poettering2022-04-011-14/+206
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Containers generally have a smaller UID range assigned than host systems. Let's visualize this in the user/group tables. We insert markers for unavailable regions. This way display is identical to status quo ante on host systems, but in containers unavailable ranges will be shown as that. And while we are at it, also hide well-known UID ranges when they are outside of userns uid_map range. This is mostly about the "container" range. It's pointless showing the cotnainer range (i.e. a range UID > 65535) if that range isn#t available in the container anyway.
| * | | update TODOLennart Poettering2022-04-011-2/+0
| | | |
| * | | pid1: add taint flag if uid/gid userns range too smallLennart Poettering2022-04-011-6/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will taint systemd if invoked in containers that do not have the full 16bit range of UIDs defined. we pretty much need uid root…nobody to be defined for a variety of purposes, hence let's add this taint flag. Of course taints are graceful, but it at least communicates the mess in some way...
| * | | uid-range: replace uid_range_contains() by more generalized uid_range_covers()Lennart Poettering2022-04-013-5/+31
| | | | | | | | | | | | | | | | | | | | | | | | The former checks if one UID is inside the uid range set. The latter checks if a full UID range is inside the uid range set. The former is hence a special case of the latter.
| * | | uid-range: add some overflow checksLennart Poettering2022-04-011-0/+6
| | | |
| * | | uid-range: add new uid_range_load_userns() for loading /proc/self/uid_mapLennart Poettering2022-04-013-0/+98
| | | |
| * | | test: port test-uid-range to tests.hLennart Poettering2022-04-011-3/+4
| | | |
| * | | uid-range: use size_t for array sizeLennart Poettering2022-04-014-16/+16
| | | |
* | | | path-util: use STR_IN_SET() where appropriateLennart Poettering2022-04-011-3/+4
| | | |
* | | | notify: remove spurious whitespaceLennart Poettering2022-04-011-1/+1
| |_|/ |/| |
* | | Merge pull request #22934 from poettering/tls-test-fix-rootLennart Poettering2022-04-012-9/+38
|\ \ \ | | | | | | | | tests: make test-resolved-stream suceed even when run as root with restrictive access mode on build tree dir
| * | | test-resolved-stream: before entering user/network namespaces check if ↵Lennart Poettering2022-04-011-3/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | that's safe I regularly run my tests also as root, since some of the tested code uses privileged APIs. The test-resolved-stream so far tried to run its tests in a user/network namespace if that can be allocated. This caused the tests to fail on my system where once the user namespace is opened access to the build tree in my $HOME is prohibited (due to restricted access modes on my home dir). Let's add a check for that: before actually isolating the test in a user/network namespace, let's see if that would make it impossible for us to access the build tree (which we need to do load the TLS certificates the test requires). This should make the test pass when run as root from a build tree with restrictive access mode.
| * | | tests: modernize load_testdata_env() a bitLennart Poettering2022-04-011-6/+9
| |/ / | | | | | | | | | | | | | | | | | | | | | Let's add assert() around everyhing we don't expect to fail. Port to path_extract_directory(). Log errrors from load_env_file_pairs() which we ignore.
* | | process-util: refactor APIs for reading /proc/self/xyz symlinksLennart Poettering2022-04-013-35/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The three functions for reading cwd, exe and root symlinks of processes already share a common core: get_process_link_contents(). Let's refactor that a bit, and move formatting of the /proc/self/ path into this helper function instead of doing that in the caller, thus sharing more code. While we are at it, make the return parameters optional, in case the information if the links are readable is interesting, but the contents is not. (This also means safe_getcwd() and readlinkat_malloc() are updated to make the return parameter optional, as these are called by the relevant three functions)
* | | Merge pull request #22872 from yuwata/udevadm-waitYu Watanabe2022-04-0122-167/+781
|\ \ \ | |/ / |/| | udevadm: introduce 'wait' command
| * | udev: use sd_device_open() where appropriateYu Watanabe2022-04-015-52/+39
| | |
| * | test: add test for sd_device_open()Yu Watanabe2022-04-011-0/+7
| | |
| * | sd-device: introduce sd_device_open()Yu Watanabe2022-04-013-0/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We usually open() device node obtained by sd_device_get_devname(). However, the device node corresponds to the sd-device object may be already removed, and another device node with the same path may be created, hence an unexpected device may be opened. The sd_device_open() opens device node, and checks the devnum and diskseq of opened devnum, to avoid the above possibility. Prompted by https://github.com/systemd/systemd/issues/22906#issuecomment-1082736443.
| * | fd-util: rename loop_get_diskseq() -> fd_get_diskseq()Yu Watanabe2022-04-013-24/+26
| | | | | | | | | | | | And move it from loop-util.[ch] -> fd-util.[ch]
| * | basic/missing: move BLKGETDISKSEQ to missing_fs.hYu Watanabe2022-04-013-5/+5
| | | | | | | | | | | | As it is defined at linux/fs.h.
| * | test: replace helper_wait_for_dev() with 'udevadm wait'Yu Watanabe2022-04-011-45/+4
| | |
| * | udevadm: introduce new 'wait' commandYu Watanabe2022-04-017-18/+495
| | | | | | | | | | | | | | | | | | | | | | | | Prompted by https://github.com/systemd/systemd/pull/22717#issuecomment-1067348496. The new command 'udevadm wait' waits for device or device symlink being created. This may be useful to wait for a device is processed by udevd after e.g. formatting or partitioning the device.
| * | test: add more tests for sd_device_new_from_xxx()Yu Watanabe2022-04-011-24/+95
| | |
| * | sd-device: introduce sd_device_new_from_devname()Yu Watanabe2022-04-013-0/+44
| |/ | | | | | | and sd_device_new_from_path() which takes devname or syspath.
* / update TODOLennart Poettering2022-04-011-0/+11
|/
* systemctl: show tainted stateLennart Poettering2022-03-313-7/+22
|
* pid1: check for kernels older than baselineLennart Poettering2022-03-313-1/+20
| | | | Let's make this detectable explicitly.
* Merge pull request #22923 from poettering/userns-check-refactorLuca Boccassi2022-03-311-23/+18
|\ | | | | virt: minor running_in_userns() modernizations
| * virt: use read_virtual_file() for reading /proc/self/setgroupsLennart Poettering2022-03-311-8/+7
| |
| * virt: simplify userns_has_mapping() by using fscanf() instead of scanf()Lennart Poettering2022-03-311-15/+11
| | | | | | | | | | And while we are at it, also fix propagation of an uninitialized errno error.
* | Merge pull request #22919 from poettering/cryptsetup-tweaksLennart Poettering2022-03-317-52/+109
|\ \ | |/ |/| various minor tweaks to cryptsetup/veritysetup/integritysetup
| * integritysetup: also validate volume nameLennart Poettering2022-03-311-0/+6
| | | | | | | | Exactly like for veritysetup/cryptsetup
| * integritysetup: also port to mangle_none()Lennart Poettering2022-03-311-2/+2
| | | | | | | | | | Let's make the tool work more like veritysetup/cryptsetup in this regard too.
| * integritysetup: log when attempted to detach already detached volumeLennart Poettering2022-03-311-1/+3
| | | | | | | | To make the tool behave more like cryptsetup/veritysetup
| * integritysetup: rename action → verb, to match other codeLennart Poettering2022-03-311-5/+5
| |
| * tree-wide: unify some code that looks for --help in the command lineLennart Poettering2022-03-316-12/+36
| |
| * veritysetup: do some superficial checking on volume nameLennart Poettering2022-03-311-0/+6
| | | | | | | | cryptsetup does this too, so let's better be safe here, too.
| * veritysetup: mangle option strings like in cryptsetupLennart Poettering2022-03-311-2/+2
| |
| * veritysetup: give command line parameters proper namesLennart Poettering2022-03-311-15/+28
| | | | | | | | | | | | | | | | Accessing the various arguments always through argv[] is nasty, since it's not obvious what we are talking about here. Let's give things nice names. We did the same in cryptsetup a while back.
| * cryptsetup: adjust some log levelsLennart Poettering2022-03-311-7/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | Let's upgrade log levels of some noteworthy messages from LOG_DEBUG to LOG_NOTICE. These messages contain information that previous log messages in the error path didn't say, namely that we'll now fall back to traditional unlocking. Note that this leaves similar log messages for cases where TPM2/PKCS#11/FIDO2 support is disabled at build at LOG_DEBUG, since in that case nothing really failed, we just systematically can't do TPM2/PKCS#11/FIDO2 and hence it is pointless and not actionable for users to do anything about it...
| * cryptsetup: add helper for mangling "none" option stringsLennart Poettering2022-03-312-2/+7
| | | | | | | | | | let's unify some code here, and let's do so in cryptsetup-util.h so that we can later reuse this in integritysetup/veritysetup
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-09 07:57:38 +0100