summaryrefslogtreecommitdiffstats
path: root/Makefile.am (follow)
Commit message (Collapse)AuthorAgeFilesLines
* journald: move /dev/log socket to /runLennart Poettering2014-06-041-2/+5
| | | | | | This way we can make the socket also available for sandboxed apps that have their own private /dev. They can now simply symlink the socket from /dev.
* bus-proxy: drop priviliges if we canLennart Poettering2014-06-041-0/+1
| | | | | | Either become uid/gid of the client we have been forked for, or become the "systemd-bus-proxy" user if the client was root. We retain CAP_IPC_OWNER so that we can tell kdbus we are actually our own client.
* resolved: run as unpriviliged "systemd-resolve" userTom Gundersen2014-06-031-0/+1
| | | | | | This service is not yet network facing, but let's prepare nonetheless. Currently all caps are dropped, but some may need to be kept in the future.
* networkd: drop CAP_SYS_MODULETom Gundersen2014-06-031-9/+4
| | | | | | | | | | | | | | | | | | | Rely on modules being built-in or autoloaded on-demand. As networkd is a network facing service, we want to limits its capabilities, as much as possible. Also, we may not have CAP_SYS_MODULE in a container, and we want networkd to work the same there. Module autoloading does not always work, but should be fixed by the kernel patch f98f89a0104454f35a: 'net: tunnels - enable module autoloading', which is currently in net-next and which people may consider backporting if they want tunneling support without compiling in the modules. Early adopters may also use a module-load.d snippet and order systemd-modules-load.service before networkd to force the module loading of tunneling modules. This sholud fix the various build issues people have reported.
* networkd: introduce veth device supportSusant Sahani2014-06-021-0/+1
| | | | | | | | | | | | | | | This patch adds veth device support to networkd. Example conf: File: veth.netdev [NetDev] Name=veth-test Kind=veth [Peer] Name=veth-peer
* networkd: run as unpriviliged "systemd-network" userLennart Poettering2014-06-011-0/+1
| | | | | | This allows us to run networkd mostly unpriviliged with the exception of CAP_NET_* and CAP_SYS_MODULE. I'd really like to get rid of the latter though...
* virt: rework container detection logicLennart Poettering2014-05-281-3/+0
| | | | | | | | | | | | Instead of accessing /proc/1/environ directly, trying to read the $container variable from it, let's make PID 1 save the contents of that variable to /run/systemd/container. This allows us to detect containers without the need for CAP_SYS_PTRACE, which allows us to drop it from a number of daemons and from the file capabilities of systemd-detect-virt. Also, don't consider chroot a container technology anymore. After all, we don't consider file system namespaces container technology anymore, and hence chroot() should be considered a container even less.
* build-sys: bump package and library versionLennart Poettering2014-05-271-3/+3
|
* nspawn: make nspawn robust to container failureDjalal Harouni2014-05-251-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nspawn and the container child use eventfd to wait and notify each other that they are ready so the container setup can be completed. However in its current form the wait/notify event ignore errors that may especially affect the child (container). On errors the child will jump to the "child_fail" label and terminate with _exit(EXIT_FAILURE) without notifying the parent. Since the eventfd is created without the "EFD_NONBLOCK" flag, this leaves the parent blocking on the eventfd_read() call. The container can also be killed at any moment before execv() and the parent will not receive notifications. We can fix this by using cheap mechanisms, the new high level eventfd API and handle SIGCHLD signals: * Keep the cheap eventfd and EFD_NONBLOCK flag. * Introduce eventfd states for parent and child to sync. Child notifies parent with EVENTFD_CHILD_SUCCEEDED on success or EVENTFD_CHILD_FAILED on failure and before _exit(). This prevents the parent from waiting on an event that will never come. * If the child is killed before execv() or before notifying the parent, we install a NOP handler for SIGCHLD which will interrupt blocking calls with EINTR. This gives a chance to the parent to call wait() and terminate in main(). * If there are no errors, parent will block SIGCHLD, restore default handler and notify child which will do execv(), then parent will pass control to process_pty() to do its magic. This was exposed in part by: https://bugs.freedesktop.org/show_bug.cgi?id=76193 Reported-by: Tobias Hunger tobias.hunger@gmail.com
* shared: rename hwclock.[ch] to clock-util.[ch]Kay Sievers2014-05-241-2/+2
|
* build-sys: let libsystemd_network pull in libudev-internal.laKay Sievers2014-05-221-3/+1
| | | | | | | On Thu, May 22, 2014 at 9:53 AM, Jan Engelhardt <jengelh@inai.de> wrote: > > If libsystemd-network.la is relying on that udev function, it ought > to specify libudev(-internal).la in libsystemd_network_la_LIBADD.
* build-sys: do not run symbol list export test for compat-only libsKay Sievers2014-05-221-54/+0
| | | | | | The verbose link-time deprecation warnings are annoying. These libs will never change or be extended; there is no need to test the list of exported symbols.
* build-sys: fix linking orderKay Sievers2014-05-221-7/+10
| | | | | | | ./.libs/libsystemd-network.a(libsystemd_network_la-network-internal.o): network-internal.c:function net_get_unique_predictable_data: error: undefined reference to 'udev_device_get_property_value' collect2: error: ld returned 1 exit status
* Makefile.am: fix whitespaceKay Sievers2014-05-221-13/+13
|
* build: put missing KMOD_CFLAGS into MakefileJan Engelhardt2014-05-221-0/+8
| | | | The build fails if kmod is not in a default location.
* logind: don't apply RemoveIPC= to system usersLennart Poettering2014-05-211-1/+3
| | | | | | | | | | | | | | We shouldn't destroy IPC objects of system users on logout. http://lists.freedesktop.org/archives/systemd-devel/2014-April/018373.html This introduces SYSTEM_UID_MAX defined to the maximum UID of system users. This value is determined compile-time, either as configure switch or from /etc/login.defs. (We don't read that file at runtime, since this is really a choice for a system builder, not the end user.) While we are at it we then also update journald to use SYSTEM_UID_MAX when we decide whether to split out log data for a specific client.
* resolved: add daemon to manage resolv.confTom Gundersen2014-05-191-11/+48
| | | | Also remove the equivalent functionality from networkd.
* network: always take possession of host side of nspawn veth tunnels and do ↵Lennart Poettering2014-05-181-1/+2
| | | | IPv4LL on them
* timesyncd: run timesyncd as unpriviliged user "systemd-timesync" (but still ↵Lennart Poettering2014-05-181-0/+1
| | | | with CAP_SYS_TIME)
* networkd: manager - read fallback DNS servers from config fileTom Gundersen2014-05-161-12/+21
| | | | We will still use the compiled-in defaults if no DNS entry exists in the config file.
* network: fix build failure, missing KMOD_XXX flagsCristian Rodríguez2014-05-151-4/+17
| | | | | | - Add KMOD_CFLAGS and KMOD_LIBS where appropiate - networkd now requires kmod. make --disable-kmod --enable-networkd to raise an error.
* readahead: add test to show fs_on_ssd() resultZbigniew Jędrzejewski-Szmek2014-05-151-0/+13
|
* sd-bus: introduce sd_bus_slot objects encapsulating callbacks or vtables ↵Lennart Poettering2014-05-151-0/+2
| | | | | | | | | | | attached to a bus connection This makes callback behaviour more like sd-event or sd-resolve, and creates proper object for unregistering callbacks. Taking the refernce to the slot is optional. If not taken life time of the slot will be bound to the underlying bus object (or in the case of an async call until the reply has been recieved).
* shared: add ring bufferDavid Herrmann2014-05-131-0/+9
| | | | | | | New "struct ring" object that implements a basic ring buffer for arbitrary byte-streams. A new basic runtime test is also added. This will be needed for our pty helpers for systemd-console and friends.
* networkd: introduce ipip tunnelSusant Sahani2014-05-121-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch enables basic ipip tunnel support. It works with kernel module ipip example conf: file: ipip.netdev [NetDev] Name=ipip-tun Kind=ipip MTUBytes=1480 [Tunnel] Local=192.168.223.238 Remote=192.169.224.239 TTL=64 file: ipip.network [Match] Name=em1 [Network] Tunnel=ipip-tun [tomegun: - drop unused variable - take ref when enslaving]
* timesyncd: only run when the system has a carrier on a network interfaceTom Gundersen2014-05-081-0/+1
| | | | | As the operational state detection in sd-network is still too primitive, timesyncd will likely try to connect a bit early, so the first attempt will fail.
* timesyncd: hook up systemd-timesyncd with systemd-timedatedLennart Poettering2014-05-061-0/+4
| | | | | | Later on we will probably remove support for controlling any other NTP implementations but systemd-timesyncd, but for now, let's keep things generic
* timesyncd: read server settings from a configuration fileLennart Poettering2014-05-061-2/+27
| | | | | Also, allow compiling in a default server list via a configure command line item.
* timesyncd: lookup name server via sd-resolve, support IPv6, react to ↵Lennart Poettering2014-05-051-0/+1
| | | | SIGINT/SITERM
* build-sys: move async.[ch] to src/sharedLennart Poettering2014-05-051-3/+3
| | | | So that we can use it at multiple places.
* build-sys: fix linking order for networkd-wait-onlyKay Sievers2014-04-291-1/+3
|
* sd-resolve: rework sd-resolve to be callback based, similar in style to ↵Lennart Poettering2014-04-291-7/+10
| | | | sd-bus and sd-event
* networkd: fix distcheckTom Gundersen2014-04-291-1/+2
|
* timesyncd: add unit and man pageKay Sievers2014-04-291-1/+7
|
* rename timedate-sntp to timesyncKay Sievers2014-04-281-23/+19
|
* libnetworkd: add link local testsUmut Tezduyar Lindskog2014-04-271-1/+13
| | | | | | | | - Also only allow positive ifindex on both dhcp and ipv4ll [tomegun: the kernel always sets a positive ifindex, but some APIs accept ifindex=0 with various meanings, so we should protect against accidentally passing ifindex=0 along.]
* networkd-wait-online: drop config file and add commandline options insteadTom Gundersen2014-04-261-9/+1
|
* errno: make sure to handle the 3 errnos that are aliases for others properlyLennart Poettering2014-04-241-2/+2
|
* networkd-wait-online: improve interoptability and enable by defaultTom Gundersen2014-04-241-4/+17
| | | | | | | | | | | | | | | | | | | | | | | | | To make sure we don't delay boot on systems where (some) network links are managed by someone else we don't block if something else has successfully brought up a link. We will still block until all links we are aware of that are managed by networkd have been configured, but if no such links exist, and someone else have configured a link sufficiently that it has a carrier, it may be that the link is ready so we should no longer block. Note that in all likelyhood the link is not ready (no addresses/routes configured), so whatever network managment daemon configured it should provide a similar wait-online service to block network-online.target until it is ready. The aim is to block as long as we know networking is not fully configured, but no longer. This will allow systemd-networkd-wait-online.service to be enabled on any system, even if we don't know whether networkd is the main/only network manager. Even in the case networking is fully configured by networkd, the default behavior may not be sufficient: if two links need to be configured, but the first is fully configured before the second one appears we will assume the network is up. To work around that, we allow specifying specific devices to wait for before considering the network up. This unit is enabled by default, just like systemd-networkd, but will only be pulled in if anyone pulls in network-online.target.
* remove bus-driverd, the interface is now handled natively by bus-proxydKay Sievers2014-04-221-28/+0
|
* nss-myhostname: port to sd-rtnlTom Gundersen2014-04-191-0/+4
|
* build-sys: do not try to build test-rtnl-manual w/o kmodZbigniew Jędrzejewski-Szmek2014-04-181-1/+5
|
* build-sys: add libkmod flags for test_rtnl_manualŁukasz Stelmach2014-04-181-1/+5
|
* udev: remove seqnum API and all assumptions about seqnumsKay Sievers2014-04-141-2/+4
| | | | | | | | | | | | The way the kernel namespaces have been implemented breaks assumptions udev made regarding uevent sequence numbers. Creating devices in a namespace "steals" uevents and its sequence numbers from the host. It confuses the "udevadmin settle" logic, which might block until util a timeout is reached, even when no uevent is pending. Remove any assumptions about sequence numbers and deprecate libudev's API exposing these numbers; none of that can reliably be used anymore when namespaces are involved.
* bus: update kdbus.hKay Sievers2014-04-101-1/+1
|
* cgls: fix running with -M optionLukas Nykryn2014-04-101-0/+1
| | | | | systemd-machined doesn't store cgroup path in a state file anymore. Let's figure it out from the scope.
* build-sys: remove no longer needed user/org.freedesktop.DBus.busnameKay Sievers2014-04-021-4/+2
|
* sd-rtnl: rework rtnl type systemTom Gundersen2014-03-281-0/+2
| | | | | | | | | | | | Use a static table with all the typing information, rather than repeated switch statements. This should make it a lot simpler to add new types. We need to keep all the type info to be able to create containers without exposing their implementation details to the users of the library. As a freebee we verify the types of appended/read attributes. The API is extended to nicely deal with unions of container types.
* build-sys: update "linkcheck"Kay Sievers2014-03-261-1/+1
| | | | | | | | <kay> ssuominen: and drop --no-as-needed from the linkcheck? <kay> ssuominen: i expect it all triggers without the gc-sections thing alone <ssuominen> if the intention is to make it strict as possible, to catch undefined references caused by missing -lfoo in linker line, then LDFLAGS="-Wl,-fuse-ld=gold -Wl,--as-needed -Wl,--no-gc-sections"
* build-sys: rename "check-broken" to "linkcheck"Kay Sievers2014-03-261-2/+2
|
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-01 23:45:24 +0100