summaryrefslogtreecommitdiffstats
path: root/man/systemd-analyze.xml (follow)
Commit message (Collapse)AuthorAgeFilesLines
* tpm2-util: show loaded libraries in 'systemd-analyze has-tpm2'Yu Watanabe2024-09-301-1/+4
| | | | | | | | | | | | | | | After 3b16e9f41983f697bc38c40bb8e7119c1bb4f7c8, even the libraries are documented in the man page, it is useful to mention which libraries are checked in the command output. Of course, the dependencies are kind of implementation detail, and may be changed in the future version, but that's especially why I think showing the library deps in the output is useful. systemd-analyze is a debugging tool, and already shows many internal states. I think there is nothing to prevent from showing the deps. Prompted by #34477.
* man/systemd-analyze: mention required libraries for TPM2 supportYu Watanabe2024-09-191-1/+3
| | | | Closes #34477.
* analyze: move "has-tpm2" from systemd-creds to systemd-analyzeLennart Poettering2024-09-121-0/+40
| | | | | | The verb s not really specific to credential management, it was always a bit misplaced. Hence move it to systemd-analyze, where we already have some general TPM related verbs such as "srk" and "pcrs"
* analyze: introduce --instance= option to control instance name for template ↵Yu Watanabe2024-08-181-2/+20
| | | | | | | | | | | | | | | | | | units Note, `systemd-analyze foo@.service --instance=hoge` is equivalent to `systemd-analyze foo@hoge.service`. But, the option may be useful when e.g. passing multiple template units that have restriction on their instance name: ``` $ ls template_aaa@.service template_bbb@.service template_ccc@.service $ systemd-analyze ./template_* --instance=hoge ``` Without the option, we need to embed an instance name into each unit name, so cannot use globs. Prompted by #33681.
* systemd-analyze: Add svg scaling optionsrajmohan r2024-08-051-0/+18
| | | | | | | + Scale the x-axis of the resulting plot by a factor (default 1.0) + Add activation timestamps to each bar Signed-off-by: rajmohan r <rajmohan.r@kpit.com>
* analyze: capability: add support for decoding capability masksIvan Shapovalov2024-07-241-2/+41
| | | | | | | | | | | | | | | | | This adds support in `systemd-analyze capability` for decoding capability masks (sets), e.g.: ```console $ systemd-analyze capability --mask 0000000000003c00 NAME NUMBER cap_net_bind_service 10 cap_net_broadcast 11 cap_net_admin 12 cap_net_raw 13 ``` This is intended as a convenience tool for pretty-printing capability values as found in e.g. `/proc/$PID/status`.
* analyze: add verb for dumping SMBIOS Type #11 dataLennart Poettering2024-06-121-0/+25
| | | | | | I find myself wanting to check this data with a quick command, and browsing through /sys/ manually getting binary data sucks. Hence let's do add a nice little analysis tool.
* man: fix incorrect XML in man pageSam Leonard2024-04-151-1/+1
|
* analyze-dot: also show BindsTo= in --requireMike Yuan2024-03-231-10/+6
|
* analyze: always recommend saving the output to a fileZbigniew Jędrzejewski-Szmek2024-02-201-3/+9
| | | | | | | | The command will refuse to write to a TTY, so give a strong hint that redirecting to a file is recommended. This makes the synopsis, man page text, and --help output consistent. Also drop the space after the redirection operator everywhere.
* analyze: clarify that `security --offline=true` requires an argumentAntonio Alvarez Feijoo2024-01-111-4/+8
| | | | | | | | | | Without `--root` or `--image`, the `security` command inspects all currently loaded service units if no unit name is specified. But with `--root` or `--image` with `--offline=true`, the `security` command exits silently if no unit name is specified. Also, fixed description of `--root` and `--image` in the man page, and added missing `--unit` option to help text.
* analyze: man and --help fixesAntonio Alvarez Feijoo2024-01-091-5/+5
| | | | | | | | | | | | man: - `verify` requires an argument - `security` does not require an argument - `fdstore` requires an argument - `image-policy` requires an argument `--help` text: - missing `image-policy` command - `cat-config` requires NAME or PATH
* analyze: fix -q optionAntonio Alvarez Feijoo2024-01-091-0/+1
| | | | Follow-up to 52117f5af831a816c47ceebb83c8244ee93b72fe
* man: use same version in public and system ident.David Tardon2023-12-251-1/+1
|
* man: drop output redir. from cmd. synopsisDavid Tardon2023-12-251-1/+1
| | | | | <cmdsynopsis> doesn't allow inline content, like the redir. operator here. And std. output is not an argument anyway...
* man: use <simplelist> for 'See also' sectionsDavid Tardon2023-12-231-4/+4
| | | | | This is just a slight markup improvement; there should be no difference in rendering.
* analyze: add "architectures" verb that lists all known architecturesLennart Poettering2023-12-061-0/+32
|
* analyze: add "srk" verb to extract current srk from TPM2 chipLennart Poettering2023-11-091-0/+15
| | | | | | This is pretty low-level functionality, hence placed in systemd-analyze. This is useful for working with systemd-cryptenroll --tpm2-device-key=, as it acquires the SRK without requiring the full tpm2-tss tool set.
* man: more hyperlinks and other fixesZbigniew Jędrzejewski-Szmek2023-11-061-1/+1
| | | | Closes https://github.com/systemd/systemd/issues/29814.
* analyze: handle CAP_BPF supportPeter Hutterer2023-11-011-0/+3
|
* analyze/cat-config: add switch to print only "interesting" parts of config filesZbigniew Jędrzejewski-Szmek2023-10-241-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | When looking at configuration, often a user wants to suppress the comments and just look at the parts that actually configure something, roughly equivalent to systemd-analyze cat-config … | rg -v '^(#|;|$) This switch implements this natively, skipping lines that start with a comment character or only contain whitespace. For formats that have section headers, section headers are skipped, if only followed by stuff that would be skipped. (The last section header is printed when we're about to print some actual output.) Note that the caller doesn't know if the format has headers or not. We do format type detection in pretty-print.c. So the caller only specifies tldr=true|false, and conf_files_cat() figures out if the format has headers and whether those should be handled specially. The comments that show the file name are always printed, even if all of the file is suppressed. This is a partial answer to the discussions in https://github.com/systemd/systemd/pull/28919, https://github.com/systemd/systemd/pull/29248. If the default config is shown in config files, the user can conveniently use '--tldr' to show the relevant parts.
* man: add version infoAbderrahim Kitouni2023-08-291-22/+66
| | | | | | | | This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
* analyze: add new "pcrs" verbLennart Poettering2023-06-281-0/+43
| | | | | It shows the PCRs we know about along with their name strings and current values.
* man/analyze: drop paths from output examplesZbigniew Jędrzejewski-Szmek2023-05-301-3/+4
| | | | | They are not useful for the user but make the examples wider than necessary.
* man/analyze: reword description of malloc and fix linkZbigniew Jędrzejewski-Szmek2023-05-301-3/+6
|
* manager: restrict Dump*() to privileged callers or ratelimitLuca Boccassi2023-05-191-1/+1
| | | | | | | | | | | Dump*() methods can take quite some time due to the amount of data to serialize, so they can potentially stall the manager. Make them privileged, as they are debugging tools anyway. Use a new 'dump' capability for polkit, and the 'reload' capability for SELinux, as that's also non-destructive but slow. If the caller is not privileged, allow it but rate limited to 10 calls every 10 minutes.
* man: document image policy syntax and semantics, and the hooks in the ↵Lennart Poettering2023-04-051-0/+41
| | | | various components
* analyze: add new fdstore verbLennart Poettering2023-03-291-0/+35
|
* man: add two missing commands to synopsysLennart Poettering2023-02-241-0/+11
|
* analyze: add 'malloc' verb to dump malloc_info()Luca Boccassi2023-02-231-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | Gets the memory state of the manager: root@image:~# systemd-analyze malloc <malloc version=1> <heap nr=0> <sizes> <size from=33 to=33 total=396 count=12/> <unsorted from=20385 to=20385 total=20385 count=1/> </sizes> <total type=fast count=0 size=0/> <total type=rest count=14 size=36589/> <system type=current size=1691648/> <system type=max size=1839104/> <aspace type=total size=1691648/> <aspace type=mprotect size=1691648/> </heap> <total type=fast count=0 size=0/> <total type=rest count=14 size=36589/> <total type=mmap count=0 size=0/> <system type=current size=1691648/> <system type=max size=1839104/> <aspace type=total size=1691648/> <aspace type=mprotect size=1691648/> </malloc>
* tree-wide: fix typoYu Watanabe2023-01-201-2/+2
|
* systemd-analyze: Update man/systemd-analyze.xml with Plot JSON and tablejoshuazivkovic2023-01-181-3/+28
|
* man: explain what kind of data is actually included in "systemd-analyze ↵Lennart Poettering2023-01-111-0/+7
| | | | | | plot" output Prompted by: https://lists.freedesktop.org/archives/systemd-devel/2023-January/048736.html
* tree-wide: replace "plural(s)" by "plurals"Zbigniew Jędrzejewski-Szmek2022-10-171-4/+4
| | | | | | | | (s) is just ugly with a vibe of DOS. In most cases just using the normal plural form is more natural and gramatically correct. There are some log_debug() statements left, and texts in foreign licenses or headers. Those are not touched on purpose.
* analyze: extend the dump command to accept patternsFranck Bui2022-10-131-3/+6
| | | | | | | | | | The new function DumpPatterns() can be used to limit (drastically) the size of the data returned by PID1. Hence the optimization of serializing data into a file descriptor should be less relevant than having the possibility to limit the data when communicating with the service manager remotely. NB: when passing patterns, the dump command omits the version of the manager as well as the features and the timestamps.
* tree-wide: also settle on "initrd" instead of "initial RAM disk"Lennart Poettering2022-09-231-4/+4
| | | | | With this the concept is now called the same way everywhere except where historical info is relevant or where the other names are API.
* man: similar → similarlyZbigniew Jędrzejewski-Szmek2022-08-231-1/+1
| | | | | | | | | Something *is* similar Something *works* similarly Something does something, similarly to how something else does something See https://sites.ulethbridge.ca/roussel/2017/11/29/similar-and-similarly-are-they-similar/ for a clear explanation.
* analyze: add compare-versionsZbigniew Jędrzejewski-Szmek2022-05-191-2/+60
| | | | | | | | | | | The interface, output, and exit status convention are all taken directly from rpmdev-vercmp and dpkg --compare-versions. The implementation is different though. See test-string-util for a list of known cases where we compare strings incompatibly. The idea is that this string comparison function will be declared as "the" method to use for boot entry ordering in the specification and similar uses. Thus it's nice to allow users to compare strings.
* analyze: Fix verify exit status regressionDaan De Meyer2022-04-061-4/+6
| | | | | | | | | | | Previously, systemd-analyze verify would return 0 even if warnings were raised during analysis of the specified units or their dependencies. With 3cc3dc7, verify was changed to return 1 when warnings were raised. This commit changes the default mode to _RECURSIVE_ERRORS_INVALID so that verify returns zero again by default when warnings are raised.
* man/systemd-analyze: split out example to a separate sectionZbigniew Jędrzejewski-Szmek2022-02-231-61/+65
| | | | | | It turns out we can't have an Example nested in a list, and every combination of nesting I tried looked bad either in troff or in html. The whole example is moved to a separate section.
* analyze: add inspect-elf verb to parse package metadataLuca Boccassi2021-12-011-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Parses and prints package metadata from executables, libraries and core files $ systemd-analyze inspect-elf /tmp/core ../fsverity-utils/fsverityb /bin/bash --json=off --no-pager __________________________ path: /tmp/core elfType: coredump elfArchitecture: AMD x86-64 module name: /tmp/crash type: deb name: hello version: 1.0 architecture: amd64 os: debian osVersion: 11 buildId: b33541096a09c29a0ba4ec5c69364a2711b7c269 module name: /usr/lib/x86_64-linux-gnu/libc-2.31.so type: deb name: hello version: 1.0 architecture: amd64 os: debian osVersion: 11 buildId: 54eef5ce96cf37cb175b0d93186836ca1caf470c module name: /usr/lib/x86_64-linux-gnu/ld-2.31.so type: deb name: hello version: 1.0 architecture: amd64 os: debian osVersion: 11 buildId: 32438eb3b034da54caf58c7a65446639f7cfe274 __________________________________________________________________ path: /home/luca/git/systemd/../fsverity-utils/fsverity elfType: executable elfArchitecture: AMD x86-64 type: deb name: fsverity-utils version: 1.3-1 architecture: amd64 os: debian debugInfoUrl: https://debuginfod.debian.net buildId: 05b899e6ee0d3653e20458719b202ed3ca8d566f _________________________ path: /bin/bash elfType: executable elfArchitecture: AMD x86-64 buildId: 4fef260f60e257d2dbd4126bf8add83837aea190 $ $ systemd-analyze inspect-elf /tmp/core ../fsverity-utils/fsverity /bin/bash /tmp/core.test-condition.1000.f9b9a84a9fd1482c9702d6afa6f6934b.37640.1637083078000000 --json=pretty --no-pager { "elfType" : "coredump", "elfArchitecture" : "AMD x86-64", "/home/bluca/git/fsverity-utils/fsverity" : { "type" : "deb", "name" : "fsverity-utils", "version" : "1.3-1", "buildId" : "7c895ecd2a271f93e96268f479fdc3c64a2ec4ee" }, "/home/bluca/git/fsverity-utils/libfsverity.so.0" : { "type" : "deb", "name" : "fsverity-utils", "version" : "1.3-1", "buildId" : "b5e428254abf14237b0ae70ed85fffbb98a78f88" } } { "elfType" : "executable", "elfArchitecture" : "AMD x86-64", "/home/bluca/git/systemd/../fsverity-utils/fsverity" : { "type" : "deb", "name" : "fsverity-utils", "version" : "1.3-1", "buildId" : "7c895ecd2a271f93e96268f479fdc3c64a2ec4ee" } } { "elfType" : "executable", "elfArchitecture" : "AMD x86-64", "/bin/bash" : { "buildId" : "3313b4cb119dcce16927a9b6cc61dcd97dfc4d59" } } { "elfType" : "coredump", "elfArchitecture" : "AMD x86-64" }
* analyze: add --profile switch to security verbLuca Boccassi2021-11-261-0/+9
| | | | | | | Allows to pass a portable profile when doing offline analysis of units. Especially useful for analyzing portable images, since a lot of the security-relevant settings in those cases come from the profiles, but they are not shipped in the portable images.
* analyze: add --quiet optionZbigniew Jędrzejewski-Szmek2021-11-161-0/+6
| | | | | This is useful for shell completion, but also for users who don't care about the extra output.
* implement aliasing for systemd-analyze verifyAlbert Brox2021-11-081-1/+23
|
* analyze: allow a custom policy to skip a check with weight=0Luca Boccassi2021-11-051-1/+2
| | | | | | In some cases an offline analysis should ignore some fields, for example a portable service in an image will never list RootImage/RootDirectory, as they are added at runtime, and thus can be skipped.
* analyze: explain how the weight/range policy fields are usedLuca Boccassi2021-11-051-3/+7
|
* man: document systemd-analyze filesystemsIago López Galeiras2021-10-061-0/+14
|
* systemd-analyze: add new option to generate JSON output of security analysis ↵Maanya Goenka2021-09-061-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | table The new option --json= works with the 'security' verb and takes in one of three format flags. These are off which is the default, pretty and short which use JSON format flags for output. When set to true, it generates a JSON formatted output of the security analysis table. The format is a JSON array with objects containing the following fields: set which indicates if the id has been set or not, name which is what is used to refer to the id, json_field which is the equivalent JSON formatted id name only used for JSON outputs, description which is an outline of the id state, and exposure which is an unsigned integer in the range 0.0..10.0, where a higher value corresponds to a higher security threat. The JSON version of the table is printed on the standard output file. Example Run: The unit file testfile.service was created to test the --json= option maanya-goenka@debian:~/systemd (json-security)$ cat <<EOF >testfile.service > [Service] > ExecStart = echo hello > PrivateNetwork = yes > PrivateMounts = yes > PrivateDevices = yes > EOF Both the JSON output and the security analysis table below have been truncated to increase readability. 1. Testing for when --json=off maanya-goenka@debian:~/systemd (json-security)$ sudo build/systemd-analyze security --json=off --root= --offline=true testfile.service --no-pager /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. /home/maanya-goenka/systemd/foo.service:2: Unknown key name 'foo' in section 'Unit', ignoring. NAME DESCRIPTION EXPOSURE ✓ PrivateNetwork= Service has no access to the host's network ✗ User=/DynamicUser= Service runs as root user 0.4 ✗ CapabilityBoundingSet=~CAP_SET(UID|GID|PCAP) Service may change UID/GID identities/capabilities 0.3 ✗ CapabilityBoundingSet=~CAP_NET_ADMIN Service has administrator privileges 0.3 → Overall exposure level for testfile.service: 8.3 EXPOSED 🙁 2. Testing for when --json=pretty maanya-goenka@debian:~/systemd (json-security)$ sudo build/systemd-analyze security --json=pretty --root= --offline=true testfile.service /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. /home/maanya-goenka/systemd/foo.service:2: Unknown key name 'foo' in section 'Unit', ignoring. [ { "set" : true, "name" : "PrivateNetwork=", "json-field" : "PrivateNetwork", "description" : "Service has no access to the host's network", "exposure" : null }, { "set" : false, "name" : "User=/DynamicUser=", "json-field" : "UserOrDynamicUser", "decsription" : "Service runs as root user", "exposure" : "0.4" }, { "set" : false, "name" : "CapabilityBoundingSet=~CAP_SET(UID|GID|PCAP)", "json_field" : "CapabilityBoundingSet_CAP_SET_UID_GID_PCAP", "description" : "Service may change UID/GID identities/capabilities", "exposure" : "0.3" }, { "set" : false, "name" : "CapabilityBoundingSet=~CAP_NET_ADMIN", "json_field" : "CapabilityBoundingSet_CAP_NET_ADMIN", "description" : "Service has administrator privileges", "exposure" : "0.3" }, ... ] 3. Testing for when --json=short maanya-goenka@debian:~/systemd (json-security)$ sudo build/systemd-analyze security --json=short --root= --offline=true testfile.service /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. /home/maanya-goenka/systemd/foo.service:2: Unknown key name 'foo' in section 'Unit', ignoring. [{"set":true,"name":"PrivateNetwork=", "json_field":"PrivateNetwork", "description":"Service has no access to the host's network","exposure":null}, ...]
* systemd-analyze: use config value in RestrictNamespaces id (#20645)Kyle Laker2021-09-061-7/+7
| | | | | | For most fields, the text shown by `.id` is the value that should be set in the unit file; however, for RestrictNamespaces, it is not. Changing this to show the actual text makes it more clear to a user what the actual change that needs to be made to the unit file is.
* mkosi: Add zsh to Arch packagesDaan De Meyer2021-09-011-0/+14
| | | | Useful for testing zsh completion changes.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 07:00:57 +0100