summaryrefslogtreecommitdiffstats
path: root/src/basic (follow)
Commit message (Collapse)AuthorAgeFilesLines
* basic/missing: add short comment about when CLONE_NEWCGROUP is addedYu Watanabe2024-10-261-0/+1
|
* tree-wide: replace for loop with FOREACH_ELEMENT or FOREACH_ARRAY macros ↵Integral2024-10-264-33/+32
| | | | (#34893)
* run0: optionally show superhero emoji on each shell promptLennart Poettering2024-10-252-0/+3
| | | | | This makes use of the infra introduced in 229d4a980607e9478cf1935793652ddd9a14618b to indicate visually on each prompt that we are in superuser mode temporarily. pick ad5de3222f userdbctl: add some basic client-side filtering
* user-util: tighten shell validation a tiny bitLennart Poettering2024-10-242-9/+12
|
* Merge pull request #34799 from YHNdnzj/service-followupsMike Yuan2024-10-244-13/+13
|\ | | | | core: follow-ups for live mount
| * basic/fs-util: move unlink_tempfilep() to tmpfile-utilMike Yuan2024-10-224-13/+13
| |
* | refactor: replace sizeof in loop with ELEMENTSOF & FOREACH_ELEMENT (#34863)Integral2024-10-231-1/+2
| |
* | fs-util: move attempts counter in openat_report_new() into loopLennart Poettering2024-10-221-2/+1
| |
* | label: move label_ops_reset() up a bitLennart Poettering2024-10-222-6/+5
| | | | | | | | | | Let#s move it close to label_ops_set(), since it is somewhat symmetric to it.
* | label: add missing assert() to label_ops_set()Lennart Poettering2024-10-221-0/+3
| |
* | fileio: port write_string_file_full() to openat_report_new()Lennart Poettering2024-10-221-10/+15
| | | | | | | | | | | | This brings two benefits: we will label the created file only if it is actually created, and we can correctly delete any file we create again on failure.
* | fileio: port write_string_file() to LabelOps, and thus add ↵Lennart Poettering2024-10-222-22/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | WRITE_STRING_FILE_LABEL flag Given that we have the LabelOps abstraction these days, we can teach write_string_file() to use it, which means we can get rid of fileio-label.[ch] as a separate concept. (The only reason that fileio-label.[ch] exists independently of fileio.[ch] was that the former linekd to libselinux potentially, and thus had to be in src/shared/ while the other always was in src/basic/. But the LabelOps vtable provides us with a nice work-around)
* | fs-util: tweak how openat_report_new() operates when O_CREAT is used on a ↵Lennart Poettering2024-10-221-30/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dangling symlink One of the big mistakes of Linux is that when you create a file with open() and O_CREAT and the file already exists as dangling symlink that the symlink will be followed and the file created that it points to. This has resulted in many vulnerabilities, and triggered the creation of the O_MOFOLLOW flag, addressing the problem. O_NOFOLLOW is less than ideal in many ways, but in particular one: when actually creating a file it makes sense to set, because it is a problem to follow final symlinks in that case. But if the file is already existing, it actually does make sense to follow the symlinks. With openat_report_new() we distinguish these two cases anyway (the whole function exists only to distinguish the create and the exists-already case after all), hence let's do something about this: let's simply never create files "through symlinks". This can be implemented very easily: just pass O_NOFOLLOW to the 2nd openat() call, where we actually create files. And then basically remove 0dd82dab91eaac5e7b17bd5e9a1e07c6d2b78dca again, because we don't need to care anymore, we already will see ELOOP when we touch a symlink. Note that this change means that openat_report_new() will thus start to deviate from plain openat() behaviour in this one small detail: when actually creating files we will *never* follow the symlink. That should be a systematic improvement of security. Fixes: #34088
* | fs-util: always call label post ops in xopenat_full(), in both success and ↵Lennart Poettering2024-10-221-9/+11
| | | | | | | | | | | | | | | | | | | | | | error path For SELinux it is essential that we reset the file creation label both in the success and in the error path, hence do so. Moreover, when calling the label post ops do it if possible with the opened fd of the inode itself, rather than always going via its path, simply to reduce the attack surface.
* | fs-util: don't second guess openat_report_new() return valuesLennart Poettering2024-10-221-11/+0
| | | | | | | | | | | | | | If openat_report_new() fails, then 'made_file' will be false, as no file was created, hence there's no need to skip the unlinkat() explicitly early, given that we check for 'made_file' anyway in the error path. The extra error code checks are hence entirely redundant.
* | label: tweak LabelOps post() hook to take "created" booleanLennart Poettering2024-10-223-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | We have two distinct implementations of the post hook. 1. For SELinux we just reset the selinux label we told the kernel earlier to use for new inodes. 2. For SMACK we might apply an xattr to the specified file. The two calls are quite different: the first call we want to call in all cases (failure or success), the latter only if we actually managed to create an inode, in which case it is called on the inode.
* | fs-util: always go through the unlink cleanup paths in xopenat_full()Lennart Poettering2024-10-221-5/+3
| | | | | | | | We didn't go through it at all if label_ops_post() failed.
* | fs-util: remove misplaced RET_NERRNO()Lennart Poettering2024-10-221-1/+1
|/
* Merge pull request #34403 from poettering/askpw-per-userLennart Poettering2024-10-212-10/+16
|\ | | | | modernize the ask-password logic, and add unpriv askpw agents to the concept
| * ask-password-api: don't accidentally create a dir, when we don't want oneLennart Poettering2024-10-212-10/+16
| | | | | | | | | | | | | | | | | | | | | | Previously, we were using touch(), which usually works fine, because the path should always refer to an existing directory, in which case it just updates the timestamp. However, if the dir does not exist yet (which shouldn't happen), it would be created as regular file, which is just wrong. Hence, let's instead create the dir as dir if it is missing, and then update its timestamp.
* | varlinkctl: respect $COLUMNS when rebreaking lines and we are not connected ↵Lennart Poettering2024-10-212-9/+21
|/ | | | | | | | | | to a TTY Let's provide a mechanism to select the number of screen columns for rebreaking comments in Varlink IDL connected to a TTY, by honouring the $COLUMNS env var then too. Previously we'd only honour when connected to a TTY, but it's also useful otherwise for rebreaking ridiculously long comments, hence honour it in this case too.
* fs-util: Introduce symlinkat_idempotentAdrian Vovk2024-10-182-4/+7
|
* GREEDY_REALLOC_APPEND: Make more type safeAdrian Vovk2024-10-181-1/+4
| | | | | | | Previously, GREEDY_REALLOC_APPEND would compile perfectly fine and cause subtle memory corruption if the caller messes up the type they're passing in (i.e. by forgetting to pass-by-reference when appending a Type* to an array of Type*). Now this will lead to compilation failure
* Bump kernel recommended baseline to v5.4Mike Yuan2024-10-161-1/+1
|
* pidref: fix typoYu Watanabe2024-10-161-1/+1
| | | | Follow-up for de34ec188c4d4f682a337445aa7753259cd7f821.
* Merge pull request #34781 from poettering/write-string-rename-fullYu Watanabe2024-10-152-15/+11
|\ | | | | fileio: write_string_file() naming clean-ups
| * fileio: clean up write_string_file() namingLennart Poettering2024-10-152-15/+11
| | | | | | | | | | | | | | | | | | let's rename the "_ts" flavour of these calls "_full" instead, exposing the full functionality. And then keep two more minimal versions around: one "_at" (which has the ts parameter suppressed, but keeps the dir_fd one). And one without suffix (which supresses both). Do the same for the label versions of these calls.
* | pidref: add explicit concept of "remote" PidRefLennart Poettering2024-10-152-13/+77
|/ | | | | | | | | | This PidRef just track some data, but cannot be used for any active operation. Background: for https://github.com/systemd/systemd/pull/34703 it makes sense to track explicitly if some PidRef is not a local one, so that we never attempt to for example "kill a remote process" and thus acccidentally hit the wrong process (i.e. a local one by the same PID).
* fs-util: make readlink_malloc() inlineYu Watanabe2024-10-152-6/+4
|
* Merge pull request #34723 from poettering/machined-pidref-moreLennart Poettering2024-10-154-10/+22
|\ | | | | machined: switch remaining Varlink overs over to use json_dispatch_pidref() and friends
| * sd-json: drop sd_json_dispatch_pid() again, as we prefer ↵Lennart Poettering2024-10-141-5/+0
| | | | | | | | | | | | | | | | json_dispatch_pidref() now The calls are now unused, and we generally prefer if people send a PID triplet rather than a single PID, hence stop supporting a high-level dispacher for pid_t.
| * pidref: hookup PID_AUTOMATIC special pid_t value with PidRefLennart Poettering2024-10-144-5/+22
| | | | | | | | | | | | The PID_AUTOMATIC value is now properly recognized by the PidRef logic too. This needed some massaging of header includes, to ensure pidref.h can access process-util.h's definitions and vice versa.
* | Merge pull request #34736 from yuwata/network-mtuYu Watanabe2024-10-152-0/+29
|\ \ | | | | | | network: wait for IPv6 MTU being synced to link MTU
| * | sysctl-util: introduce sysctl_read_ip_property_int() and _uint32()Yu Watanabe2024-10-142-0/+29
| |/ | | | | | | Currently not used, but will be used later.
* | basic/stat-util: use xopenat() where appropriateMike Yuan2024-10-151-19/+3
| |
* | Fix some typos in socket-util.hMichiel2024-10-141-2/+2
|/
* Merge pull request #34700 from yuwata/network-conf-parserYu Watanabe2024-10-112-3/+3
|\ | | | | network: several cleanups for conf parsers
| * in-addr-util: rename in_addr_prefix_from_string_auto_internal() -> _full()Yu Watanabe2024-10-112-3/+3
| | | | | | | | | | The function is also used in other source files. Hence, not internal. No functional change, just refactoring.
* | time-util: use saturate_add for usec_add()Mike Yuan2024-10-111-5/+1
|/
* sd-json: add sd_json_dispatch_pid()Ivan Kruglov2024-10-101-0/+11
|
* sd-json: add sd_json_dispatch_signal()Ivan Kruglov2024-10-101-0/+1
|
* Merge pull request #34675 from poettering/dupfd-queryLuca Boccassi2024-10-083-10/+57
|\ | | | | fd-util: use F_DUPFD_QUERY for same_fd()
| * fd-util: use F_DUPFD_QUERY for same_fd()Lennart Poettering2024-10-082-10/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Catch up with the nice little toys the kernel fs developers have added for us. Preferably, let's make use of the new F_DUPFD_QUERY fcntl() call that checks whether two fds are just duplicates of each other (duplicates as in dup(), not as in open() of the same inode, i.e. whether they share a single file offset and so on). This API is much nicer, since it is a core kernel feature, unlike the kcmp() call we so far used, which is part of the (optional) checkpoint/restore stuff. F_DUPFD_QUERY is available since kernel 6.10.
| * fd-util: introduce fd_validate() helperLennart Poettering2024-10-082-0/+11
| | | | | | | | | | It just uses F_GETFD to validate an fd. it's a bit easier to read though, and handles the < 0 case internally.
* | Merge pull request #34674 from yuwata/reallocarrayLuca Boccassi2024-10-081-18/+7
|\ \ | | | | | | tree-wide: replace reallocarray() with GREEDY_REALLOC()
| * | prioq: use GREEDY_REALLOC() and structured initializerYu Watanabe2024-10-081-18/+7
| |/ | | | | | | No functional change, just refactoring.
* | time-util: copy input string before fork()Yu Watanabe2024-10-081-0/+8
| | | | | | | | Fixes #34670.
* | time-util: fix parsing timestamp with NZ timezoneYu Watanabe2024-10-081-2/+6
|/ | | | Fixes a bug caused by ef658a63f8163607d9e04f710cd26c0d36ff68ce.
* tree-wide: drop doubled empty linesYu Watanabe2024-10-076-6/+0
|
* path-lookup: move from basic/ to libsystemd/Mike Yuan2024-10-063-973/+0
| | | | | So that sd_path_lookup() can be utilized to replace duplicate functions.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 07:13:24 +0100