summaryrefslogtreecommitdiffstats
path: root/src/core (follow)
Commit message (Collapse)AuthorAgeFilesLines
* core: if the start command vanishes during runtime don't hit an assertLennart Poettering2016-10-211-1/+9
| | | | | | | This can happen when the configuration is changed and reloaded while we are executing a service. Let's not hit an assert in this case. Fixes: #4444
* journald,core: add short comments we we keep reopening /dev/console all the timeLennart Poettering2016-10-201-0/+5
| | | | | | | | | Just to make sure the next one reading this isn't surprised that the fd isn't kept open. SAK and stuff... Fix suggested: https://github.com/systemd/systemd/pull/4366#issuecomment-253659162
* Merge pull request #4417 from keszybz/man-and-rlimitLennart Poettering2016-10-202-4/+4
|\ | | | | Two unrelated patches: man page tweaks and rlimit log levels
| * pid1: downgrade some rlimit warningsZbigniew Jędrzejewski-Szmek2016-10-202-4/+4
| | | | | | | | | | | | | | Since we ignore the result anyway, downgrade errors to warning. log_oom() will still emit an error, but that's mostly theoretical, so it is not worth complicating the code to avoid the small inconsistency
* | core: let's upgrade the log level for service processes dying of signal (#4415)Lennart Poettering2016-10-201-1/+8
| | | | | | | | As suggested in https://github.com/systemd/systemd/pull/4367#issuecomment-253670328
* | core/exec: add a named-descriptor option ("fd") for streams (#4179)Luca Bruno2016-10-187-27/+282
|/ | | | | | | | | | This commit adds a `fd` option to `StandardInput=`, `StandardOutput=` and `StandardError=` properties in order to connect standard streams to externally named descriptors provided by some socket units. This option looks for a file descriptor named as the corresponding stream. Custom names can be specified, separated by a colon. If multiple name-matches exist, the first matching fd will be used.
* Merge pull request #4392 from keszybz/running-timersLennart Poettering2016-10-171-0/+2
|\ | | | | Fix for display of elapsed timers
| * core/timer: reset next_elapse_*time when timer is not waitingZbigniew Jędrzejewski-Szmek2016-10-171-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When the unit that is triggered by a timer is started and running, we transition to "running" state, and the timer will not elapse again until the unit has finished running. In this state "systemctl list-timers" would display the previously calculated next elapse time, which would now of course be in the past, leading to nonsensical values. Simply set the next elapse to infinity, which causes list-timers to show n/a. We cannot specify when the next elapse will happen, possibly never. Fixes #4031.
* | pid1: do not use mtime==0 as sign of masking (#4388)Zbigniew Jędrzejewski-Szmek2016-10-171-8/+12
| | | | | | | | | | | | | | It is allowed for unit files to have an mtime==0, so instead of assuming that any file that had mtime==0 was masked, use the load_state to filter masked units. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1384150.
* | tree-wide: introduce free_and_replace helperZbigniew Jędrzejewski-Szmek2016-10-173-22/+6
| | | | | | | | | | | | It's a common pattern, so add a helper for it. A macro is necessary because a function that takes a pointer to a pointer would be type specific, similarly to cleanup functions. Seems better to use a macro.
* | tree-wide: use mfree moreZbigniew Jędrzejewski-Szmek2016-10-175-16/+7
|/
* core: make settings for unified cgroup hierarchy supersede the ones for ↵Tejun Heo2016-10-151-31/+29
| | | | | | | | | | | | | | legacy hierarchy (#4269) There are overlapping control group resource settings for the unified and legacy hierarchies. To help transition, the settings are translated back and forth. When both versions of a given setting are present, the one matching the cgroup hierarchy type in use is used. Unfortunately, this is more confusing to use and document than necessary because there is no clear static precedence. Update the translation logic so that the settings for the unified hierarchy are always preferred. systemd.resource-control man page is updated to reflect the change and reorganized so that the deprecated settings are at the end in its own section.
* core: make sure to dump ProtectKernelModules= valueDjalal Harouni2016-10-121-0/+2
|
* core: check protect_kernel_modules and private_devices in order to setup NNPDjalal Harouni2016-10-121-0/+2
|
* core:sandbox: lets make /lib/modules/ inaccessible on ProtectKernelModules=Djalal Harouni2016-10-123-23/+56
| | | | | | | | | | | Lets go further and make /lib/modules/ inaccessible for services that do not have business with modules, this is a minor improvment but it may help on setups with custom modules and they are limited... in regard of kernel auto-load feature. This change introduce NameSpaceInfo struct which we may embed later inside ExecContext but for now lets just reduce the argument number to setup_namespace() and merge ProtectKernelModules feature.
* core:sandbox: remove CAP_SYS_RAWIO on PrivateDevices=yesDjalal Harouni2016-10-121-1/+1
| | | | | The rawio system calls were filtered, but CAP_SYS_RAWIO allows to access raw data through /proc, ioctl and some other exotic system calls...
* core:sandbox: Add ProtectKernelModules= optionDjalal Harouni2016-10-125-1/+61
| | | | | | | | | This is useful to turn off explicit module load and unload operations on modular kernels. This option removes CAP_SYS_MODULE from the capability bounding set for the unit, and installs a system call filter to block module system calls. This option will not prevent the kernel from loading modules using the module auto-load feature which is a system wide operation.
* Allow block and char classes in DeviceAllow bus properties (#4353)Zbigniew Jędrzejewski-Szmek2016-10-121-3/+1
| | | | | | | | | | Allowed paths are unified betwen the configuration file parses and the bus property checker. The biggest change is that the bus code now allows "block-" and "char-" classes. In addition, path_startswith("/dev") was used in the bus code, and startswith("/dev") was used in the config file code. It seems reasonable to use path_startswith() which allows a slightly broader class of strings. Fixes #3935.
* core/main: get rid from excess check of ACTION_TEST (#4350)0xAX2016-10-111-4/+3
| | | | | | | | | If `--test` command line option was passed, the systemd set skip_setup to true during bootup. But after this we check again that arg_action is test or help and opens pager depends on result. We should skip setup in a case when `--test` is passed, but it is also safe to set skip_setup in a case of `--help`. So let's remove first check and move skip_setup = true to the second check.
* core: chown() any TTY used for stdin, not just when StandardInput=tty is ↵Lennart Poettering2016-10-111-1/+1
| | | | | | | | | | | | | | used (#4347) If stdin is supplied as an fd for transient units (using the StandardInputFileDescriptor pseudo-property for transient units), then we should also fix up the TTY ownership, not just when we opened the TTY ourselves. This simply drops the explicit is_terminal_input()-based check. Note that chown_terminal() internally does a much more appropriate isatty()-based check anyway, hence we can drop this without replacement. Fixes: #4260
* Merge pull request #4067 from poettering/invocation-idZbigniew Jędrzejewski-Szmek2016-10-1121-9/+273
|\ | | | | Add an "invocation ID" concept to the service manager
| * core: add "invocation ID" concept to service managerLennart Poettering2016-10-0721-9/+273
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a new invocation ID concept to the service manager. The invocation ID identifies each runtime cycle of a unit uniquely. A new randomized 128bit ID is generated each time a unit moves from and inactive to an activating or active state. The primary usecase for this concept is to connect the runtime data PID 1 maintains about a service with the offline data the journal stores about it. Previously we'd use the unit name plus start/stop times, which however is highly racy since the journal will generally process log data after the service already ended. The "invocation ID" kinda matches the "boot ID" concept of the Linux kernel, except that it applies to an individual unit instead of the whole system. The invocation ID is passed to the activated processes as environment variable. It is additionally stored as extended attribute on the cgroup of the unit. The latter is used by journald to automatically retrieve it for each log logged message and attach it to the log entry. The environment variable is very easily accessible, even for unprivileged services. OTOH the extended attribute is only accessible to privileged processes (this is because cgroupfs only supports the "trusted." xattr namespace, not "user."). The environment variable may be altered by services, the extended attribute may not be, hence is the better choice for the journal. Note that reading the invocation ID off the extended attribute from journald is racy, similar to the way reading the unit name for a logging process is. This patch adds APIs to read the invocation ID to sd-id128: sd_id128_get_invocation() may be used in a similar fashion to sd_id128_get_boot(). PID1's own logging is updated to always include the invocation ID when it logs information about a unit. A new bus call GetUnitByInvocationID() is added that allows retrieving a bus path to a unit by its invocation ID. The bus path is built using the invocation ID, thus providing a path for referring to a unit that is valid only for the current runtime cycleof it. Outlook for the future: should the kernel eventually allow passing of cgroup information along AF_UNIX/SOCK_DGRAM messages via a unique cgroup id, then we can alter the invocation ID to be generated as hash from that rather than entirely randomly. This way we can derive the invocation race-freely from the messages.
* | Merge pull request #4337 from poettering/exit-codeZbigniew Jędrzejewski-Szmek2016-10-116-28/+31
|\ \ | | | | | | Fix for #4275 and more
| * | core: simplify if branches a bitLennart Poettering2016-10-101-3/+4
| | | | | | | | | | | | | | | We do the same thing in two branches, let's merge them. Let's also add an explanatory comment, while we are at it.
| * | core: make use of IN_SET() in various places in mount.cLennart Poettering2016-10-101-18/+21
| | |
| * | core: when determining whether a process exit status is clean, consider ↵Lennart Poettering2016-10-105-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | whether it is a command or a daemon SIGTERM should be considered a clean exit code for daemons (i.e. long-running processes, as a daemon without SIGTERM handler may be shut down without issues via SIGTERM still) while it should not be considered a clean exit code for commands (i.e. short-running processes). Let's add two different clean checking modes for this, and use the right one at the appropriate places. Fixes: #4275
| * | core: lower exit status "level" at one placeLennart Poettering2016-10-101-1/+1
| | | | | | | | | | | | | | | | | | When we print information about PID 1's crashdump subprocess failing. In this case we *know* that we do not generate LSB exit codes, as it's basically PID 1 itself that exited there.
| * | exit-status: kill is_clean_exit_lsb(), move logic to sysv-generatorLennart Poettering2016-10-101-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's get rid of is_clean_exit_lsb(), let's move the logic for the special handling of the two LSB exit codes into the sysv-generator by writing out appropriate SuccessExitStatus= lines if the LSB header exists. This is not only semantically more correct, bug also fixes a bug as the code in service.c that chose between is_clean_exit_lsb() and is_clean_exit() based this check on whether a native unit files was available for the unit. However, that check was bogus since a long time, since the SysV generator was introduced and native SysV script support was removed from PID 1, as in that case a unit file always existed.
* | | main: use strdup instead of free_and_strdup to initialize default unit (#4335)0xAX2016-10-101-3/+3
|/ / | | | | | | | | | | | | Previously we've used free_and_strdup() to fill arg_default_unit with unit name, If we didn't pass default unit name through a kernel command line or command line arguments. But we can use just strdup() instead of free_and_strdup() for this, because we will start fill arg_default_unit only if it wasn't set before.
* | tree-wide: pass return value of make_null_stdio() to warning instead of ↵0xAX2016-10-101-2/+3
| | | | | | | | | | errno (#4328) as @poettering suggested in the #4320
* | main: initialize default unit little later (#4321)0xAX2016-10-101-8/+10
| | | | | | | | | | | | | | | | | | | | systemd fills arg_default_unit during startup with default.target value. But arg_default_unit may be overwritten in parse_argv() or parse_proc_cmdline_item(). Let's check value of arg_default_unit after calls of parse_argv() and parse_proc_cmdline_item() and fill it with default.target if it wasn't filled before. In this way we will not spend unnecessary time to for filling arg_default_unit with default.target.
* | tree-wide: print warning in a failure case of make_null_stdio() (#4320)0xAX2016-10-101-1/+2
|/ | | | The make_null_stdio() may fail. Let's check its result and print warning message instead of keeping silence.
* core: only warn on short reads on signal fdZbigniew Jędrzejewski-Szmek2016-10-071-5/+8
|
* manager: tighten incoming notification message checksLennart Poettering2016-10-071-2/+8
| | | | | | | | | Let's not accept datagrams with embedded NUL bytes. Previously we'd simply ignore everything after the first NUL byte. But given that sending us that is pretty ugly let's instead complain and refuse. With this change we'll only accept messages that have exactly zero or one NUL bytes at the very end of the datagram.
* manager: be stricter with incomining notifications, warn properly about too ↵Lennart Poettering2016-10-071-2/+2
| | | | | | | | | | | | large ones Let's make the kernel let us know the full, original datagram size of the incoming message. If it's larger than the buffer space provided by us, drop the whole message with a warning. Before this change the kernel would truncate the message for us to the buffer space provided, and we'd not complain about this, and simply process the incomplete message as far as it made sense.
* manager: don't ever busy loop when we get a notification message we can't ↵Lennart Poettering2016-10-071-7/+6
| | | | | | | | | | | | | | | | | | | | | process If the kernel doesn't permit us to dequeue/process an incoming notification datagram message it's still better to stop processing the notification messages altogether than to enter a busy loop where we keep getting notified but can't do a thing about it. With this change, manager_dispatch_notify_fd() behaviour is changed like this: - if an error indicating a spurious wake-up is seen on recvmsg(), ignore it (EAGAIN/EINTR) - if any other error is seen on recvmsg() propagate it, thus disabling processing of further wakeups - if any error is seen on later code in the function, warn about it but do not propagate it, as in this cas we're not going to busy loop as the offending message is already dequeued.
* core: add possibility to set action for ctrl-alt-del burst (#4105)Lukáš Nykrýn2016-10-074-14/+57
| | | | | | For some certification, it should not be possible to reboot the machine through ctrl-alt-delete. Currently we suggest our customers to mask the ctrl-alt-delete target, but that is obviously not enough. Patching the keymaps to disable that is really not a way to go for them, because the settings need to be easily checked by some SCAP tools.
* user-util: rework maybe_setgroups() a bitLennart Poettering2016-10-061-4/+6
| | | | | | | | | | | | | | | Let's drop the caching of the setgroups /proc field for now. While there's a strict regime in place when it changes states, let's better not cache it since we cannot really be sure we follow that regime correctly. More importantly however, this is not in performance sensitive code, and there's no indication the cache is really beneficial, hence let's drop the caching and make things a bit simpler. Also, while we are at it, rework the error handling a bit, and always return negative errno-style error codes, following our usual coding style. This has the benefit that we can sensible hanld read_one_line_file() errors, without having to updat errno explicitly.
* core: leave PAM stub process around with GIDs updatedLennart Poettering2016-10-061-2/+8
| | | | | | | | | | | | | | | In the process execution code of PID 1, before 096424d1230e0a0339735c51b43949809e972430 the GID settings where changed before invoking PAM, and the UID settings after. After the change both changes are made after the PAM session hooks are run. When invoking PAM we fork once, and leave a stub process around which will invoke the PAM session end hooks when the session goes away. This code previously was dropping the remaining privs (which were precisely the UID). Fix this code to do this correctly again, by really dropping them else (i.e. the GID as well). While we are at it, also fix error logging of this code. Fixes: #4238
* core: do not fail in a container if we can't use setgroupsGiuseppe Scrivano2016-10-061-1/+1
| | | | It might be blocked through /proc/PID/setgroups
* Fix typoGiuseppe Scrivano2016-10-051-1/+1
|
* tree-wide: remove consecutive duplicate words in commentsStefan Schweter2016-10-042-2/+2
|
* automount: make sure the expire event is restarted after a daemon-reload (#4265)Michael Olbrich2016-10-041-0/+5
| | | | | | | | | | | If the corresponding mount unit is deserialized after the automount unit then the expire event is set up in automount_trigger_notify(). However, if the mount unit is deserialized first then the automount unit is still in state AUTOMOUNT_DEAD and automount_trigger_notify() aborts without setting up the expire event. Explicitly call automount_start_expire() during coldplug to make sure that the expire event is set up as necessary. Fixes #4249.
* core: do not try to create /run/systemd/transient in test modeZbigniew Jędrzejewski-Szmek2016-10-011-3/+5
| | | | | | This prevented systemd-analyze from unprivileged operation on older systemd installations, which should be possible. Also, we shouldn't touch the file system in test mode even if we can.
* core: complain if Before= dep on .device is declaredZbigniew Jędrzejewski-Szmek2016-10-011-0/+5
| | | | | | | | | | | | [Unit] Before=foobar.device [Service] ExecStart=/bin/true Type=oneshot $ systemd-analyze verify before-device.service before-device.service: Dependency Before=foobar.device ignored (.device units cannot be delayed)
* core: update warning messageZbigniew Jędrzejewski-Szmek2016-10-011-1/+1
| | | | | | "closing all" might suggest that _all_ fds received with the notification message will be closed. Reword the message to clarify that only the "unused" ones will be closed.
* core: get rid of unneeded state variableZbigniew Jędrzejewski-Szmek2016-10-011-11/+4
| | | | No functional change.
* pid1: more informative error message for ignored notificationsZbigniew Jędrzejewski-Szmek2016-09-291-2/+8
| | | | | It's probably easier to diagnose a bad notification message if the contents are printed. But still, do anything only if debugging is on.
* pid1: process zero-length notification messages againZbigniew Jędrzejewski-Szmek2016-09-291-9/+6
| | | | | | | | This undoes 531ac2b234. I acked that patch without looking at the code carefully enough. There are two problems: - we want to process the fds anyway - in principle empty notification messages are valid, and we should process them as usual, including logging using log_unit_debug().
* pid1: don't return any error in manager_dispatch_notify_fd() (#4240)Franck Bui2016-09-291-4/+9
| | | | | | | If manager_dispatch_notify_fd() fails and returns an error then the handling of service notifications will be disabled entirely leading to a compromised system. For example pid1 won't be able to receive the WATCHDOG messages anymore and will kill all services supposed to send such messages.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-12 08:47:30 +0100