summaryrefslogtreecommitdiffstats
path: root/src/shared (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #19608 from keszybz/resolved-paholeLennart Poettering2021-05-191-4/+2
|\ | | | | Pahole optimization for resolved's DnsQuery
| * resolved: shorten dns_name_count_labels()Zbigniew Jędrzejewski-Szmek2021-05-141-4/+2
| |
* | Merge pull request #19611 from ↵Yu Watanabe2021-05-192-0/+54
|\ \ | | | | | | | | | | | | yuwata/network-dhcp-server-introduce-server-address network: dhcp-server: introduce ServerAddress= setting
| * | conf-parser: introduce config_parse_in_addr_non_null()Yu Watanabe2021-05-182-0/+54
| | |
* | | meson: use jinja2 for rpm templatesZbigniew Jędrzejewski-Szmek2021-05-192-3/+3
|/ / | | | | | | | | | | | | The naming of variables is very inconsistent. I tried to use more modern style naming (UNDERSCORED_TITLE_CASE), but I didn't change existing names too much. Only SYSTEM_DATA_UNIT_PATH is renamed to SYSTEM_DATA_UNIT_DIR to match SYSTEM_CONFIG_UNIT_DIR.
* | fix bash shebangsJörg Thalheim2021-05-171-1/+1
| |
* | Add crypttab option silentSebastian Blunt2021-05-151-2/+4
| | | | | | | | | | | | Adds a crypttab option 'silent' that enables the AskPasswordFlag ASK_PASSWORD_SILENT. This allows usage of systemd-cryptsetup to default to silent mode, rather than requiring the user to press tab every time.
* | json: make JSON_VARIANT_ARRAY/OBJECT_FOREACH() nestableYu Watanabe2021-05-141-13/+17
| |
* | udev,network: make link_get_type_string() return negative errno on failureYu Watanabe2021-05-142-3/+6
|/ | | | And make net_match_config() propagate the error.
* Merge pull request #19567 from poettering/ipv4-ipv6-lowercaseZbigniew Jędrzejewski-Szmek2021-05-121-7/+4
|\ | | | | various follow-ups to socket-bind logic
| * tree-wide: use af_to_ipv4_ipv6() + af_from_ipv4_ipv6() helpers at various placesLennart Poettering2021-05-111-5/+3
| |
| * socket-bind: use lowercase "ipv4"/"ipv6" spellingLennart Poettering2021-05-111-6/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In most of our codebase when we referenced "ipv4" and "ipv6" on the right-hand-side of an assignment, we lowercases it (on the left-hand-side we used CamelCase, and thus "IPv4" and "IPv6"). In particular all across the networkd codebase the various "per-protocol booleans" use the lower-case spelling. Hence, let's use lower-case for SocketBindAllow=/SocketBindDeny= too, just make sure things feel like they belong together better. (This work is not included in any released version, hence let's fix this now, before any fixes in this area would be API breakage) Follow-up for #17655
* | Merge pull request #18986 from poettering/oomd-varlink-fixZbigniew Jędrzejewski-Szmek2021-05-121-24/+6
|\ \ | | | | | | varlink ref fix
| * | Revert "varlink: avoid using dangling ref in varlink_close_unref()"Lennart Poettering2021-05-111-24/+6
| |/ | | | | | | This reverts commit 39ad3f1c092b5dffcbb4b1d12eb9ca407f010a3c.
* | tree-wide: refuse too long strings earlier in specifier_printf()Yu Watanabe2021-05-125-11/+25
| | | | | | | | | | | | | | | | | | | | | | | | We usually call specifier_printf() and then check the validity of the result. In many cases, validity checkers, e.g. path_is_valid(), refuse too long strings. This makes specifier_printf() refuse such long results earlier. Moreover, unit_full_string() and description field in sysuser now refuse results longer than LONG_LINE_MAX. config_parse() already refuses the line longer than LONG_LINE_MAX. Hence, it should be ok to set the same value as the maximum length of the resolved string.
* | dns-domain: use DNS_LABEL_MAX at one more placeYu Watanabe2021-05-121-1/+1
| |
* | gpt: introduce GPT_LAVEL_MAXYu Watanabe2021-05-122-1/+4
| |
* | specifier: rename variableYu Watanabe2021-05-121-12/+12
| |
* | specifier: use SD_ID128_STRING_MAXYu Watanabe2021-05-121-2/+2
|/
* userdb: initialize .synthesize_root/.synthesize_nobody in generic codeLennart Poettering2021-05-101-4/+2
| | | | | | Let's initialize this at the same place for any iterator allocated. (Yes not all types of iterator objects need this, but it's still nice to share this trivial code at one place).
* userdb: return ESRCH if we didn't find a single varlink serviceLennart Poettering2021-05-101-1/+1
| | | | | | | | | Clearly communicate to callers that we didn't find a single varlink service, when a lookup is attempted. Note that the fallback's to NSS, drop-ins and synthesis might eat up this error again, but we should really make this case reasonably recognizable, in particular as our various tools already handle this condition correctly and print a nice message then.
* userdbd: also listen on a varlink socket io.systemd.DropInLennart Poettering2021-05-101-0/+1
| | | | | Let's explicitly support looking things up via dropin as a varlink service.
* userdb: optionally read user/group/membership "dropins", tooLennart Poettering2021-05-105-70/+614
|
* Merge pull request #19542 from yuwata/unit-after-socketZbigniew Jędrzejewski-Szmek2021-05-101-3/+4
|\ | | | | network, timesync, resolve: check bus is ready before emitting property change or signal
| * local-addresses: wrap long commentYu Watanabe2021-05-081-3/+4
| | | | | | | | Follow-up for 54e6f97bc9931679aa9b895546621b15e0f464a4.
* | Merge pull request #19298 from bluca/cryptsetup_nopassLuca Boccassi2021-05-094-45/+113
|\ \ | | | | | | cryptsetup: add 'headless' parameter to skip password/pin query, allow pin-less enroll on FIDO2, support user presence/verification flags
| * | FIDO2: if defined, check for FIDO_ERR_UV_BLOCKEDLuca Boccassi2021-05-071-0/+10
| | | | | | | | | | | | | | | Newer libfido versions added this error, so check for it since it can help the user with a more specific message
| * | FIDO2: ask and record whether user verification was used to lock the volumeLuca Boccassi2021-05-072-2/+42
| | | | | | | | | | | | | | | | | | Some tokens support authorization via fingerprint or other biometric ID. Add support for "user verification" to cryptenroll and cryptsetup. Disable by default, as it is still quite uncommon.
| * | FIDO2: ask and record whether user presence was used to lock the volumeLuca Boccassi2021-05-072-46/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In some cases user presence might not be required to get _a_ secret out of a FIDO2 device, but it might be required to the get actual secret that was used to lock the volume. Record whether we used it in the LUKS header JSON metadata. Let the cryptenroll user ask for the feature, but bail out if it is required by the token and the user disabled it. Enabled by default.
| * | FIDO2: support pin-less LUKS enroll/unlockLuca Boccassi2021-05-072-5/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes: https://github.com/systemd/systemd/issues/19246 Some FIDO2 devices allow the user to choose whether to use a PIN or not and will HMAC with a different secret depending on the choice. Some other devices (or some device-specific configuration) can instead make it mandatory. Allow the cryptenroll user to choose whether to use a PIN or not, but fail immediately if it is a hard requirement. Record the choice in the JSON-encoded LUKS header metadata so that the right set of options can be used on unlock.
| * | cryptsetup: add 'headless' parameter to skip password/pin queryLuca Boccassi2021-05-072-3/+6
| | | | | | | | | | | | | | | | | | On headless setups, in case other methods fail, asking for a password/pin is not useful as there are no users on the terminal, and generates unwanted noise. Add a parameter to /etc/crypttab to skip it.
* | | tree-wide: fix typoYu Watanabe2021-05-091-1/+1
| |/ |/|
* | Merge pull request #19438 from poettering/nspawn-uidmapLennart Poettering2021-05-084-24/+156
|\ \ | | | | | | nspawn: add support for kernel 5.12 ID mapping mounts
| * | dissect-image: add support for optionally mounting images with idmapping onLennart Poettering2021-05-072-23/+48
| | |
| * | mount-util: add a helper that can add an idmap to an existing mountLennart Poettering2021-05-072-1/+86
| | | | | | | | | | | | | | | | | | This makes use of the new kernel 5.12 APIs to add an idmap to a mount point. It does so by cloning the mountpoint, changing it, and then unmounting the old mountpoint, replacing it later with the new one.
| * | mount-util: add helper that ensures something is a mount pointLennart Poettering2021-05-072-0/+22
| |/
* | userdbd: simplify logic for generating NSS listingsLennart Poettering2021-05-071-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | So far we basically had two ways to iterate through NSS records: one via the varlink IPC and one via the userdb.[ch] infra, with slightly different implementations. Let's clean this up, and always use userdb.[ch] also when resolving via userdbd. The different codepaths for the NameServiceSwitch and the Multiplexer varlink service now differ only in the different flags passed to the userdb lookup. Behaviour shouldn't change by this. This is mostly refactoring, reducing redundant codepaths.
* | userdb: add new flag for excluding varlink data in lookupsLennart Poettering2021-05-072-0/+4
| | | | | | | | This is useful to later-on use the userdb infra for only some sources.
* | userdb: rename userdb lookup flags a bitLennart Poettering2021-05-072-23/+26
|/ | | | | | | | | | | | | Let's use "exclude" for flags that really exclude records from our lookup. Let's use "avoid" referring to concepts that when flag is set we'll not use but we have a fallback path for that should yield the same result. Let' use "suppress" for suppressing partial info, even if we return the record otherwise. So far we used "avoid" for all these cases, which was confusing. Whiel we are at it, let's reassign the bits a bit, leaving some space for bits follow-up commits are going to add.
* Merge pull request #18863 from keszybz/cmdline-escapingLennart Poettering2021-05-072-2/+2
|\ | | | | Escape command lines properly
| * Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicitZbigniew Jędrzejewski-Szmek2021-04-012-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | I want to tweak behaviour further, and that'll be easier when "style" is converted to a bitfield. Some callers used ESCAPE_BACKSLASH_ONELINE, and others not. But the ones that didn't, simply didn't care, because the argument was assumed to be one-line anyway (e.g. a service name). In environment-generator, this could make a difference. But I think it's better to escape the newlines there too. So newlines are now always escaped, to simplify the code and the test matrix.
* | Merge pull request #19134 from poettering/outbound-special-hostnameZbigniew Jędrzejewski-Szmek2021-05-072-2/+185
|\ \ | | | | | | introduce a new synthetic hostname "_outbound" that maps to "the" local IP address
| * | local-addresses: add helper for determining local "outbound" IP addressesLennart Poettering2021-04-232-2/+185
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a small helper, similar in style to local_addresses() and local_gateways() that determines the local "outbound" addresses. What's an "outbound" address supposed to be? The local IP addresses that are the most likely used for outbound communication. It's determined by using connect() towards the default gws on an UDP socket, and then reading the address of the socket this caused it to be bound to. This is not the "public" or "external" IP address of the local system, and is not supposed to be. It's just the local IP addresses that are likely the ones going to be used by the local IP stack for communication with other hosts.
* | | Merge pull request #19391 from poettering/dissect-growZbigniew Jędrzejewski-Szmek2021-05-075-15/+93
|\ \ \ | | | | | | | | optionally, grow file systems to partition size when mounting them via GPT auto-discovery
| * | | gpt-auto-generator: pull in systemd-growfs@.service if new GPT growfs ↵Lennart Poettering2021-04-231-2/+6
| | | | | | | | | | | | | | | | partition flag is set
| * | | repart: add GrowFileSystem= setting to set new GPT partition flag for newly ↵Lennart Poettering2021-04-232-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | created partitions And set it to on by default, except if partition is marked read-only.
| * | | dissect-image: optionally, grow file systems on mountLennart Poettering2021-04-232-0/+42
| | | | | | | | | | | | | | | | | | | | The new GPT partition flag the previous commits added is now honoured on mount.
| * | | dissect: look for new GPT partition flag marking partitions for growingLennart Poettering2021-04-233-13/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | systemd-repart can grow partitions dynamically at boot, but it won't grow the file systems inside them. In /etc/fstab you can request that via x-systemd.growfs. So far we didn't have a nice scheme for images with GPT auto-discovery however, and that meant in particular in tools such as systemd-nspawn the file systems couldn't be grown automatically. Let's address this: let's define a new GPT partition flag that can be set for our partition types. If set it indicates that the file system should be grown to the partition size on mount. This commit adds the flag and adds code to discover it when dissecting images. There's no code yet to actually do something about it.
* | | | userdb: honour USERDB_AVOID_SHADOW flag also when iteratingLennart Poettering2021-05-061-18/+30
| | | |
* | | | userdb: fix typo in commentLennart Poettering2021-05-061-1/+1
| | | |
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-30 05:49:48 +0100