| Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
|
|
|
|
|
|
Fixes: #27260
|
|
This extends the test framework a bit, and allows adding additional
initrds to the qemu invocation, which we use here to place credentials
in the new /run/systemd/@initrd/ credentials dir which are then passed
to the host.
|
|
acquire_encrypted_credential_directory()
Let's unify these very similar functions, and port them to the new
mount_credentials_fs() call.
While we are at it, if we detect that the credentials dir already is a
mount point, remount it writable so that we can actually write to it.
|
|
Let's add two new helpers: mount_credentials_fs() and
credentials_fs_mount_flags(). The former mounts a file system suitable
for storing of unencrypted credentials at runtime (i.e. a ramfs or
tmpfs). The latter determines the right mount flags to use for such a
mount.
Both functions mostly just take code from execute.c, but make two
changes:
1. If the kernel supports it we'll use a tmpfs with the new "noswap"
mount option instead of ramfs. Was added in kernel 6.4, hence is very
recent, but tmpfs is so much less crappy than ramfs, hence worth it.
2. We'll set MS_NOSYMFOLLOW on the mounts if supported. These file
systems should only contain regulra files, hence no need to allow
symlinks.
|
|
Let's make things easier to debug: provide an overview what has been
passed, during boot.
|
|
Let's hook up one more thing with credentials: the machine ID to use
when none is initialized yet.
This requires some reordering of initialization steps in PID 1: we need
to import credentials first, and only then initialize the machine ID.
|
|
Now that we have the infra in place, make PID 1 pick up encrypted
credentials too.
(While we are at it, split this out into its own helper)
|
|
This is just like read_credential() but also looks into the encrypted
credential directory, not just the regular one.
Normally, we decrypt credentials at the moment we pass them to services.
From service PoV all credentials are hence decrypted credentials.
However, when we want to access credentials in a generator this logic
does not apply: here we have the regular and the encrypted credentials
directory. So far we didn't attempt to make use of credentials in
generators hence.
Let's address and add helper that looks into both directories, and talks
to the TPM if necessary to decrypt the credentials.
|
|
credentials to host
|
|
When the credential dir is backed by an fs that supports ACLs we must be
more careful with adjusting the 'x' bit of the directory, as any chmod()
call on the dir will reset the mask entry of the ACL entirely which we
don't want. Hence, do a manual set of ACL changes, that only add/drop
the 'x' bit but otherwise leave the ACL as it is.
This matters if we use tmpfs rather than ramfs to store credentials.
|
|
|
|
|
|
|
|
The NEWS file was simply wrong. Let's also improve the --help text on
this.
Fixes: #28221
|
|
This log message is shown pretty regular at boot in various scenarios
(such as CI builds), and it's not a reason for any concern, it's just the
immediate effect of explicit configuration. Hence let's downgrade from
LOG_NOTICE to LOG_INFO so that it is still usually in the boot output,
but not particularly highlighted, since there's really no reason to.
|
|
|
|
Since 6e8477edd3 TEST-75 started failing with:
[ 571.468298] testsuite-75.sh[46]: + for addr in "${DNS_ADDRESSES[@]}"
[ 571.468298] testsuite-75.sh[46]: + run delv @fd00:dead:beef:cafe::1 -t A mail.signed.test
[ 571.468899] testsuite-75.sh[562]: + tee /tmp/tmp.qKlHPbCCJZ
[ 571.469317] testsuite-75.sh[561]: + delv @fd00:dead:beef:cafe::1 -t A mail.signed.test
[ 571.501381] testsuite-75.sh[562]: ;; network unreachable resolving 'mail.signed.test/A/IN': fd00:dead:beef:cafe::1#53
[ 571.501564] testsuite-75.sh[562]: ;; resolution failed: SERVFAIL
[ 571.515457] testsuite-75.sh[46]: + grep -qF '; fully validated' /tmp/tmp.qKlHPbCCJZ
Let's wait for the dns0 interface to become routable again after
re-enabling IPv6 to, hopefully, mitigate this.
|
|
This could probably be extended to include many more invalid uri
|
|
dhcp6_option_parse_string is intended to clear strings with length 0,
for consistency. The data assert is too strict for this purpose, so we
will allow data || data_len == 0, similar to other dhcp6_option_parse*
helpers.
Fixes: fde788601be8 ("dhcp6-client: parse RFC8910 captive portal dhcp6 option")
|
|
|
|
Let's condition the service so that it doesn't run where we aren't
directly run on baremetal, or where no power sources are discovered at
all.
|
|
SERVICE_AUTO_RESTART_QUEUED
Follow-up for #28215
We can now correctly distinguish enqueued auto-restarts
from those that are still pending. Let's take advantage
of that.
|
|
|
|
This new job mode will enqueue a start job for a unit, and all units
depending on the unit will get a restart job enqueued. This is then used
for automatic sevice restarts: the unit itself is only started, the
depending units restarted. This way the unit will not go down
unnecessarily, triggering OnSuccess= needlessly.
This also introduces a new state SERVICE_AUTO_RESTART_QUEUED that is
entered once the restart jobs are enqueued. Previously we'd stay in
SERVICE_AUTO_RESTART, but that's problematic, since we'd lose
information whether we still need to enqueue the restart job during a
serialization/deserialization cycle or not. By having an explicit state
for this we know exactly whether we still need to enqueue the job or
not. It's also good since when we are in SERVICE_AUTO_RESTART_QUEUED we
want to act on unit_start(), but on SERVICE_AUTO_RESTART we want to wait
for the holdoff time to pass before we act on unit_start().
Fixes: #27722
|
|
|
|
This allows the correct, gracious, error handling to follow up in the
ndisc handler. Otherwise, an internal error is assumed and the interface
disabled.
Fixes: 9747955d2d60 ("ndisc: parse RFC8910 captive portal ipv6ra option")
|
|
|
|
This value was freed but erroneously never cleared, leading to
use-after-free.
Fixes: 9747955d2d60 ("ndisc: parse RFC8910 captive portal ipv6ra option")
|
|
This adds possible reproducer for issue #28009 (though, the issue is
highly racy, hence this may not trigger the issue reliably).
|
|
|
|
When we request an address that already exists and is under removing,
we need to wait for the address being removed. Otherwise, configuration
of a route whose preferred source is the address will fail.
Fixes #28009.
Replaces #28088.
|
|
|
|
Correct the SOUND_FORM_FACTOR property for Steelseries Arctis headsets.
The USB IDs were all gathered from HeadsetControl[1].
[1]: https://github.com/Sapd/HeadsetControl
|
|
Resolves:
- CID#1490777
- CID#1498366
- CID#1508639
- CID#1509084
- CID#1509086
- CID#1509087
|
|
Resolves: CID#1509244
|
|
As `v` gets overwritten by the following detect_vm_cpuid() call.
Resolves: CID#1509247
|
|
In some places, "<n> bits" is used when more appropriate.
|
|
Unused since 788c2d9523.
Resolves: CID#1509248
|
|
|
|
|
|
|
|
Accepts a boolean. When enabled retains captive portal configuration
advertised by the router.
|
|
Acepts a boolean. When enabled requests and retains captive portal
configuration from the DHCPv6 server.
|
|
Accepts a boolean. When enabled, UseCaptivePortal will request and
retain the captive portal configuration from the DHCP server.
|
|
|
|
|
