summaryrefslogtreecommitdiffstats
path: root/src/core (follow)
Commit message (Collapse)AuthorAgeFilesLines
* build: preserve correct mode when generating files via jinja2Christian Brauner2021-11-081-4/+2
| | | | | | | | | When using "capture : true" in custom_target()s the mode of the source file is not preserved when the generated file is not installed and so needs to be tweaked manually. Switch from output capture to creating the target file and copy the permissions from the input file. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
* exec: Add TTYRows and TTYColumns properties to set TTY dimensionsDaan De Meyer2021-11-056-5/+65
|
* Merge pull request #20138 from keszybz/coding-style-variable-declsLuca Boccassi2021-11-052-7/+18
|\ | | | | A coding style tweak and checking of sd_notify() calls and voidification of pager_open()
| * Make pager_open() return voidZbigniew Jędrzejewski-Szmek2021-11-031-1/+1
| |
| * manager: fix confusion when to send READY=1Zbigniew Jędrzejewski-Szmek2021-11-031-3/+3
| | | | | | | | | | | | | | | | | | | | | | I got the logic reversed in 6d9326595592f98e8126eacb4176acd8c3516d5c. Let's just remove the conditionalization of the status message: if we're sending something, we might just as well always attach READY=1, the extra few bytes don't make much of a difference. FWIW, it seems that this bug didn't cause problems, probably because we'd send READY=1 either from user_manager_send_ready() or from a later call to manager_send_ready().
| * tree-wide: drop "f" from sd_notify() calls with a static stringZbigniew Jędrzejewski-Szmek2021-11-031-3/+3
| | | | | | | | If we don't need to do any formatting, let's optimize things a bit.
| * tree-wide: warn when sd_notify fails with READY=1 or FDSTOREREMOVE=1Zbigniew Jędrzejewski-Szmek2021-11-031-6/+17
| | | | | | | | | | | | | | | | Most sd_notify() calls are like log_info() — the result is only informative and if they fail, it's best ignore this. But if a call with READY=1 fails, the unit may enter a failed state, so we should warn about this. Similarly for FSTOREREMOVE=1: the manager may be left with a stale fd, at least wasting resources.
* | Merge pull request #21030 from DaanDeMeyer/path-skippedLennart Poettering2021-11-0410-29/+74
|\ \ | | | | | | core: Propagate condition failed state from service to path unit.
| * | core: Propagate condition failed state to triggering units.Daan De Meyer2021-11-0310-22/+66
| | | | | | | | | | | | | | | | | | | | | | | | Alternative to https://github.com/systemd/systemd/pull/20531. Whenever a service triggered by another unit fails condition checks, stop the triggering unit to prevent systemd busy looping trying to start the triggered unit.
| * | core: Delay start rate limit check when starting a unitDaan De Meyer2021-10-301-7/+7
| | | | | | | | | | | | | | | | | | | | | Doing start rate limit checks before doing condition checks made condition check failures count towards the start rate limit which broke existing assumptions (see #21025). Run the rate limit checks after the condition checks again to restore the previous behaviour.
| * | core: Move 'r' variable declaration to start of unit_start()Daan De Meyer2021-10-301-1/+2
| | |
* | | tree-wide: always use TAKE_FD() when calling rearrange_stdio()Lennart Poettering2021-11-041-10/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rearrange_stdio() invalidates specified fds even on failure, which means we should always invalidate the fds we pass in no matter what. Let's make this explicit by using TAKE_FD() for that everywhere. Note that in many places we such invalidation doesnt get us much behaviour-wise, since we don't use the variables anymore later. But TAKE_FD() in a way is also documentation, it encodes explicitly that the fds are invalidated here, so I think it's a good thing to always make this explicit here.
* | | tree-wide: port various places to use TAKE_PID()Lennart Poettering2021-11-035-12/+6
| |/ |/|
* | core: ignore failure on setting smack process label when allowedYu Watanabe2021-11-011-1/+1
| |
* | execute: respect selinux_context_ignoreTopi Miettinen2021-11-011-2/+2
|/ | | | | | | | | | When `SELinuxContext=` parameter is prefixed with `-`, the documentation states that any errors determining or changing context should be ignored, but this doesn't actually happen and the service may fail with `229/SELINUX_CONTEXT`. Fix by adding checks to `context->selinux_context_ignore`. Closes: #21057
* Merge pull request #21163 from poettering/scope-no-pidYu Watanabe2021-10-292-20/+27
|\ | | | | pid1: fail scope unit activation if all PIDs to add already died
| * scope: refuse activation of scopes if no PIDs to add are leftLennart Poettering2021-10-272-1/+8
| | | | | | | | | | | | | | | | | | | | If all processes we are supposed to add are gone by the time we are ready to do so, let's fail. THis is heavily based on Cunlong Li's work, who thankfully tracked this down. Replaces: #20577
| * core: normalize 'r' variable handling in unit_attach_pids_to_cgroup() a bitLennart Poettering2021-10-271-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'r' variable is our "go-to" variable for error return codes, all across our codebase. In unit_attach_pids_to_cgroup() it was so far used in a strange way for most of the function: instead of directly storing the error codes of functions we call we'd store it in a local variable 'q' instead, and propagate it to 'r' only in some cases finally we'd return the ultimate result of 'r'. Let's normalize this a bit: let's always store error return values in 'r', and then use 'ret' as the variable to sometimes propagate errors to, and then return that. This also allows us to get rid of one local variable. No actual codeflow changes, just some renaming of variables that allows us to remove one.
* | Merge pull request #20321 from bluca/state_dir_symlinkLennart Poettering2021-10-288-83/+496
|\ \ | | | | | | core: add [State|Runtime|Cache|Logs]DirectorySymlink
| * | core: add [State|Runtime|Cache|Logs]Directory symlink as second parameterLuca Boccassi2021-10-286-89/+415
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When combined with a tmpfs on /run or /var/lib, allows to create arbitrary and ephemeral symlinks for StateDirectory or RuntimeDirectory. This is especially useful when sharing these directories between different services, to make the same state/runtime directory 'backend' appear as different names to each service, so that they can be added/removed to a sharing agreement transparently, without code changes. An example (simplified, but real) use case: foo.service: StateDirectory=foo bar.service: StateDirectory=bar foo.service.d/shared.conf: StateDirectory= StateDirectory=shared:foo bar.service.d/shared.conf: StateDirectory= StateDirectory=shared:bar foo and bar use respectively /var/lib/foo and /var/lib/bar. Then the orchestration layer decides to stop this sharing, the drop-in can be removed. The services won't need any update and will keep working and being able to store state, transparently. To keep backward compatibility, new DBUS messages are added.
| * | core: make DynamicUser=1 and StateDirectory= work with ↵Luca Boccassi2021-10-273-3/+90
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | TemporaryFileSystem=/var/lib The /var/lib/private/foo -> /var/lib/foo symlink for StateDirectory and DynamicUser is set up on the host filesystem, before the mount namespacing is brought up. If an empty /var/lib is used, to ensure the service does not see other services data, the symlink is then not available despite /var/lib/private being set up as expected. Make a list of symlinks that need to be set up, and create them after all the namespaced filesystems have been created, but before any eventual read-only switch is flipped.
* | Merge pull request #20609 from DaanDeMeyer/recursive-templateLennart Poettering2021-10-282-0/+94
|\ \ | | | | | | core: Try to prevent infinite recursive template instantiation
| * | core: Try to prevent infinite recursive template instantiationDaan De Meyer2021-10-282-0/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To prevent situations like in #17602 from happening, let's drop direct recursive template dependencies. These will almost certainly lead to infinite recursion so let's drop them immediately to avoid instantiating potentially thousands of irrelevant units. Example of a template that would lead to infinite recursion which is caught by this check: notify@.service: ``` [Unit] Wants=notify@%n.service ```
* | | core: correct SELinux label of service credential directoryChristian Göttsche2021-10-281-0/+2
| |/ |/| | | | | | | | | | | Label the service root credential directory so write_credential() will create entries with the label of their parent directory. Resolves: #21134
* | conf-parse: make config_parse_many() optionally save 'struct stat' for each fileYu Watanabe2021-10-271-8/+10
| | | | | | | | Fixes #21113.
* | varlink: don't try to talk to oomd from unit testsLennart Poettering2021-10-251-0/+3
| | | | | | | | | | | | | | | | Talking to external daemons we ourselves maintain is a job for the integration tests, not the unit tests. This communication is likely to fail hence don#t even bother. This makes our tests a bit cleaner.
* | cgroup: handle gracefully if we can't read oom_kill cgroup attributeLennart Poettering2021-10-251-5/+8
| |
* | process-util: move sync() out of freeze()Lennart Poettering2021-10-221-0/+1
|/ | | | | | | | We are using this for creating userns namespaces, and we really shouldn't try to sync there. Moreover the use of free() in shutdown code doesn't need it anyway, since it just sync()ed right before anyway. Only the third user of freeze() we have actually needs the syc(), hence do it there and nowhere else.
* Typos found by codespellDimitri Papadopoulos2021-10-201-1/+1
|
* utmp: remove /dev from lineVincent Bernat2021-10-191-2/+6
| | | | | | utmp(5) says `ut_line` is the device name minus the leading "/dev/". Therefore, remove it. Without that, when using UtmpMode=user, we get `/dev/tty` in the output of `last`/`w`.
* bpf: fix SPDX short identifier for LGPL-2.1-or-laterZbigniew Jędrzejewski-Szmek2021-10-181-1/+1
|
* alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhereLennart Poettering2021-10-144-8/+8
| | | | | | | | | | | | | Let's define two helpers strdupa_safe() + strndupa_safe() which do the same as their non-safe counterparts, except that they abort if called with allocations larger than ALLOCA_MAX. This should ensure that all our alloca() based allocations are subject to this limit. afaics glibc offers three alloca() based APIs: alloca() itself, strndupa() + strdupa(). With this we have now replacements for all of them, that take the limit into account.
* tree-wide: port all calls to alloca() to alloca_safe()Lennart Poettering2021-10-141-1/+1
|
* core: allow "off" as special watchdog time to be specifiedLennart Poettering2021-10-133-8/+12
| | | | | | | | Right now we already understand "default" as special string for enabling the watchdog but not reconfiguring its timeout (it is internally mapped to USEC_MAX). To be systematic this adds "off" as special string for disabling the watchdog logic (it is internally mapped to 0, which is how this behaviour was previously requested).
* Merge pull request #20787 from fbuihuu/watchdog-more-reworkLennart Poettering2021-10-134-26/+63
|\ | | | | Watchdog more rework
| * watchdog: rename special string "infinity" taken by the watchdog timeout ↵Franck Bui2021-10-133-9/+45
| | | | | | | | options to "default"
| * core: introduce systemd.watchdog_sec=<sec> optionFranck Bui2021-10-131-0/+11
| |
| * watchdog: passing 0 to watchdog_setup now closes the watchdogFranck Bui2021-10-132-22/+12
| | | | | | | | | | | | | | | | | | | | | | Passing 0 meant "disable the watchdog although still kept it opened". However this case didn't seem to be useful especially since PID1 closes the device if it is passed the nul timeout. Hence let's change the meaning of watchdog_setup(0) to match PID1's behavior which allows to simplify the code a bit. Hence this patch also drops enable_watchdog().
* | core/bpf-firewall: add missing oom checkYu Watanabe2021-10-131-1/+3
| | | | | | | | Fixes CID#1464627.
* | core: serialize device cgroup bpf progs across daemon-reload/reexecAnita Zhang2021-10-131-0/+4
| | | | | | | | | | | | Follows what was done in b57d75232615f98aefcf41cb145ec2ea3262857d and adds a test that verifies the device BPF program is not detached during reload/reexec.
* | core: remove refcount for bpf programalexlzhu2021-10-126-44/+38
| | | | | | | | | | | | | | | | | | | | | | | | Currently ref count of bpf-program is kept in user space. However, the kernel already implements its own ref count. Thus the ref count we keep for bpf-program is redundant. This PR removes ref count for bpf program as part of a task to simplify bpf-program and remove redundancies, which will make the switch to code-compiled BPF programs easier. Part of #19270
* | tree-wide: use C99 __func__ rather than obsolete __FUNCTION__Lennart Poettering2021-10-111-1/+1
| | | | | | | | | | We use __func__ almost everywhere, but there are some holdouts. Fix that.
* | kmod-setup: port from nftw() to recurse_dir()Lennart Poettering2021-10-071-19/+37
| |
* | Merge pull request #20935 from unusual-thoughts/fix-empty-argvYu Watanabe2021-10-062-0/+20
|\ \ | | | | | | Fix #20933
| * | core/service: also check path in exec commandsYu Watanabe2021-10-061-1/+7
| | |
| * | core: fix SIGABRT on empty exec command argvHenri Chain2021-10-052-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This verifies that the argv part of any exec_command parameters that are sent through dbus is not empty at deserialization time. There is an additional check in service.c service_verify() that again checks if all exec_commands are correctly populated, after the service has been loaded, whether through dbus or otherwise. Fixes #20933.
* | | core: add dbus RestrictFileSystems= propertiesIago López Galeiras2021-10-061-0/+100
| | |
* | | core: add RestrictFileSystems= fragment parserIago López Galeiras2021-10-065-0/+140
| | | | | | | | | | | | | | | It takes an allow or deny list of filesystems services should have access to.
* | | core: use LSM BPF functions to implement RestrictFileSystems=Iago Lopez Galeiras2021-10-066-1/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It attaches the LSM BPF program when the system manager starts up. It populates the hash of maps BPF map when services that have RestrictFileSystems= set start. It cleans up the hash of maps when the unit cgroup is pruned. To pass the file descriptor of the BPF map we add it to the keep_fds array.
* | | core: add BPF LSM functionsIago Lopez Galeiras2021-10-066-0/+363
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds 6 functions to implement RestrictFileSystems= * lsm_bpf_supported() checks if LSM BPF is supported. It checks that cgroupv2 is used, that BPF LSM is enabled, and tries to load the BPF LSM program which makes sure BTF and hash of maps are supported, and BPF LSM programs can be loaded. * lsm_bpf_setup() loads and attaches the LSM BPF program. * lsm_bpf_unit_restrict_filesystems() populates the hash of maps BPF map with the cgroupID and the set of allowed or denied filesystems. * lsm_bpf_cleanup() removes a cgroupID entry from the hash of maps. * lsm_bpf_map_restrict_fs_fd() is a helper function to get the file descriptor of the BPF map. * lsm_bpf_destroy() is a wrapper around the destroy function of the BPF skeleton file.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-01 23:59:00 +0100