summaryrefslogtreecommitdiffstats
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
| * network/route: forget IPv4 non-local routes when an interface went downYu Watanabe2024-11-113-0/+35
| | | | | | | | | | | | | | When an interface went down, IPv4 non-local routes are removed by the kernel without any notifications. Let's forget the routes in that case. Fixes #35047.
| * network/nexthop: forget dependent routes without trying to removeYu Watanabe2024-11-113-12/+16
| | | | | | | | | | | | When a nexthop is removed, routes depend on the removed nexthop are already removed. It is not necessary to remove them, as already commented. Let's forget them without trying to remove.
| * network/nexthop: do not remove depending nexthops when a nexthop is removedYu Watanabe2024-11-111-13/+3
| | | | | | | | | | Previously, when a nexthop is removed, depending nexthops were removed, but that's not necessary, as the kernel keeps them, at least with v6.11.
| * network/route: update reference of the route from nexthopYu Watanabe2024-11-111-0/+2
| | | | | | | | | | | | Follow-up for 6f09031e4d04727cc72164fefcbc763e37556493. The function has been introduced by the commit, but it has never been used...
* | Introduce systemd-keyutil to do various key/certificate operations (#35095)Lennart Poettering2024-11-115-149/+310
|\ \ | |/ |/| | | | | | | | | Let's gather generic key/certificate operations in a new tool systemd-keyutil instead of spreading them across various special purpose tools. Fixes #35087
| * Introduce systemd-keyutil to do various key/certificate operationsDaan De Meyer2024-11-085-149/+310
| | | | | | | | | | | | | | | | Let's gather generic key/certificate operations in a new tool systemd-keyutil instead of spreading them across various special purpose tools. Fixes #35087
* | network: further rework for reconfiguring interfaces (#35059)Luca Boccassi2024-11-119-94/+177
|\ \ | | | | | | | | | | | | Follow-ups for #35035. Split-out of #34989. Fixes #35092.
| * | network: make 'networkctl reconfigure' work safely even when ↵Yu Watanabe2024-11-117-57/+99
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | KeepConfiguration=dhcp or yes Previously, even if KeepConfiguration=dhcp or yes is specified in the new .network file, dynamic configurations like DHCP address and routes were dropped when 'networkctl reconfigure INTERFACE' is invoked. If the setting is specified, let's gracefully handle the dynamic configurations. Then, 'networkctl reconfigure' can be also used for an interface that has critical connections.
| * | network: drop static configs laterYu Watanabe2024-11-111-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | Follow-up for dd6d53a8dc58c5e6e310b09ba7f7a22600a87ba9. Unnecessary static configs will be anyway dropped later in link_configure() -> link_drop_unmanaged_config(). Hence, even if we are reconfiguring an interface cleanly, it is not necessary to drop static configs here.
| * | network/dhcp-pd: do not remove unreachable route when reconfiguring ↵Yu Watanabe2024-11-114-23/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | non-upstream interface Unreachable routes are not owned by any interfaces, and its ifindex is zero. Previously, if a non-upstream interface is reconfigured, all routes including unreachable routes configured by the upstream interface are removed. This makes unreachable routes are always handled by the upstream interface, and only removed when the delegated prefixes are changed or lost.
| * | network: reorder dropping dynamic configurationYu Watanabe2024-11-111-2/+2
| | | | | | | | | | | | Follow-up for 451c2baf30f50b95d73e648058c7c2348dbf0c31.
| * | network: reset 'configured' flags even if we keep DHCP lease and friends on ↵Yu Watanabe2024-11-111-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | reconfigure Follow-up for 451c2baf30f50b95d73e648058c7c2348dbf0c31. With the commits, reloading .network files does not release previously acquired DHCP lease and friends if possible. If previously a DHCP client was configured as not requesting DNS servers or so, then the previously acquired lease might not contain any DNS servers. In that case, if the new .network file enables UseDNS=, then the interface should enter the configured state after a new lease is acquired. To achieve that, we need to reset the flags. With this change, the workaround applied to the test by the commit 451c2baf30f50b95d73e648058c7c2348dbf0c31 can be dropped.
| * | network: drop unnecessary size specifierYu Watanabe2024-11-111-1/+1
| | | | | | | | | | | | It does not save any memory usage but increase code complexity.
| * | netwrok: call link_drop_unmanaged_config() earlier in link_configure()Yu Watanabe2024-11-111-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Otherwise, even if a link enters the configuring state at the beginning of link_configure(), link_check_ready() may be called before link_drop_unmanaged_config() is called, and the link may enter the configured state. Fixes #35092.
* | | Rename src/partition to src/repartZbigniew Jędrzejewski-Szmek2024-11-1111-8/+8
| | |
* | | Move growfs+makefs to src/growfs/Zbigniew Jędrzejewski-Szmek2024-11-104-8/+12
|/ / | | | | | | | | Those two programs are used together and it makes sense to keep them together. makefs is smaller, so name the directory after growfs.
* | Various multi-dt fixes and CHID test (#35056)Yu Watanabe2024-11-109-10/+131
|\ \ | | | | | | Part of #34158
| * | fundamental: Fix buffer size in get_chidanonymix0072024-11-071-2/+2
| | | | | | | | | | | | NUL byte should not be hashed
| * | fundamental: Fix iteration count in chid_calculateanonymix0072024-11-071-1/+2
| | |
| * | fundamental: move string includes from chid-fundamental.c to headeranonymix0072024-11-072-2/+6
| | |
| * | test: Add chid-fundamental testanonymix0072024-11-073-0/+108
| | |
| * | fundamental: Add userspace efi_guid_equalanonymix0072024-11-071-0/+7
| | |
| * | boot: Fix .dtbauto section number for error reportinganonymix0072024-11-071-1/+1
| | |
| * | boot: Fix overflow check for FDT_PROP in devicetree_get_compatibleanonymix0072024-11-071-1/+2
| | |
| * | boot: Drop const modifier for smbios_fields and fix smbios_info_doneanonymix0072024-11-071-3/+3
| | |
* | | login: fix session_kill(..., KILL_LEADER,...) (#35105)12paper2024-11-101-3/+13
| | | | | | | | | | | | | | | | | | `loginctl kill-session --kill-whom=leader <N>` (or the D-Bus equivalent) doesn't work because logind ends up calling `KillUnit(..., "main", ...)` on a scope unit and these don't have a `MainPID` property. Here, I just make it send a signal to the `Leader` directly.
* | | ukify: Fix broken assert when building a signed addonValentin David2024-11-091-2/+1
| | | | | | | | | | | | | | | | | | | | | An assert always expected a kernel when signature key was present in command line. That prevented building signed addons. Fixes #35041
* | | sysupdate: Bug fixes for target enumeration (#35052)Luca Boccassi2024-11-091-7/+19
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes a couple of bugs with systemd-sysupdated's target enumeration. See commit messages for details. <!-- devel-freezer = {"comment-id":"2460494553","freezing-tag":"v257-rc1"} -->
| * | | sysupdated: Make sure targets we skip are skippedAdrian Vovk2024-11-061-7/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We'd log that we're skipping the target, but it would never actually get removed from the manager's list. Thus, we'd advertise targets that don't actually exist to clients. In the original version of the sysupdated PR, this was handled by removing the target from the manager's list in target_free, and using a _cleanup_ attribute to free the target when skipping. However, this changed at some point during review. So, this commit takes the alternative approach
* | | | udev: skipping empty udev rules file while collecting the statsLidong Zhong2024-11-091-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To keep align with the logic used in udev_rules_parse_file(), we also should skip the empty udev rules file while collecting the stats during manager reload. Otherwise all udev rules files will be parsed again whenever reloading udev manager with an empty udev rules file. It's time consuming and the following uevents will fail with timeout.
* | | | uid-classification: properly classify *all* container UIDsLennart Poettering2024-11-093-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A bit confusingly CONTAINER_UID_BASE_MAX is just the maximum *base* UID for a container. Thus, with the usual 64K UID assignments, the last actual container UID is CONTAINER_UID_BASE_MAX+0xFFFF. To make this less confusing define CONTAINER_UID_MIN/MAX that add the missing extra space. Also adjust two uses where this was mishandled so far, due to this confusion. With this change the UID ranges we default to should properly match what is documented on https://systemd.io/UIDS-GIDS/.
* | | | mount-util: make path_get_mount_info() work arbitrary inodeYu Watanabe2024-11-083-41/+106
| |_|/ |/| | | | | | | | | | | | | | Follow-up for d49d95df0a260aaca9a3fdd1e6ce535592a53bca. Replaces 9a032ec55a9820a0424309670fe551c99203e5f1. Fixes #35075.
* | | fs-util: add comment about XO_NOCOWLennart Poettering2024-11-081-0/+2
| | |
* | | sd-varlink: allow that method handles call sd_varlink_close()Lennart Poettering2024-11-071-0/+3
| | | | | | | | | | | | | | | It's fine if a method handler closes the connection, deal with it gracefully.
* | | ukify: Introduce --certificate-provider= optionDaan De Meyer2024-11-072-48/+61
| | | | | | | | | | | | | | | This translates to --certificate-source=provider:<provider> for signing tools invoked by ukify.
* | | measure: Add pcrpkey verbDaan De Meyer2024-11-071-0/+89
| | | | | | | | | | | | | | | | | | | | | | | | This verb writes a public key to stdout extracted from either a public key path, from a certificate (path or provider) or from a private key (path, engine, provider). We'll use this in ukify to get rid of the use of the python cryptography module to convert a private key or certificate to a public key.
* | | tree-wide: Introduce --certificate-source= optionDaan De Meyer2024-11-078-46/+295
| | | | | | | | | | | | | | | | | | | | | This allows loading the X.509 certificate from an OpenSSL provider instead of a file system path. This allows loading certficates directly from hardware tokens instead of having to export them to a file on disk first.
* | | openssl-util: Set expected object type to private keysDaan De Meyer2024-11-071-0/+3
| | | | | | | | | | | | | | | Configures the store to only try to fetch private keys and nothing else.
* | | bootctl: Validate private key pathDaan De Meyer2024-11-071-0/+6
| |/ |/|
* | Rename src/boot/efi to just src/bootZbigniew Jędrzejewski-Szmek2024-11-0778-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I very much dislike the approach in which we were mixing Linux and UEFI C code in the same subdirectory. No code was shared between two environments. This layout was created in e7dd673d1e0acfe5420599588c559fd85a3a9e8f, with the justification of "being more consistent with the rest of systemd", but I don't see how it's supposed to be so. Originally, when the C code was just a single bootctl.c file, this wasn't so bad. But over time the userspace code grew quite a bit. With the moves done in previuos commits, the intermediate subdirectory is now empty except for the efi/ subdir, and this additional subdirectory level doesn't have a good justification. The components is called "systemd-boot", not "systemd-efi", and we can remove one level of indentation.
* | Move systemd-sbsign to its own source subdirectoryZbigniew Jędrzejewski-Szmek2024-11-073-0/+0
| | | | | | | | | | It's already two files, and I expect that more will come. It's nicer to give its own subdirectory to maintain consistent structure.
* | Move systemd-measure to its own source subdirectoryZbigniew Jędrzejewski-Szmek2024-11-073-10/+14
| | | | | | | | | | | | We have other subdirectories with just a single C file. And I expect that systemd-measure will only grow over time, adding new functionality. It's nicer to give its own subdirectory to maintain consistent structure.
* | Move bless-boot components to their own source subdirectoryZbigniew Jędrzejewski-Szmek2024-11-075-33/+37
| |
* | Move bootctl to its own source subdirectoryZbigniew Jędrzejewski-Szmek2024-11-0720-22/+26
| | | | | | | | | | It's been split into a bunch of files and deserves its own subdirectory similarly to systemctl.
* | test: fix assertion on build systemLuca Boccassi2024-11-071-1/+0
| | | | | | | | | | | | | | | | | | /* test_path_is_network_fs_harder */ src/test/test-mount-util.c:541: Assertion failed: expected "path_is_network_fs_harder("/")" to succeed but got the following error: Invalid argument https://buildd.debian.org/status/fetch.php?pkg=systemd&arch=all&ver=257%7Erc1-1&stamp=1730945197&raw=0 Follow-up for d49d95df0a260aaca9a3fdd1e6ce535592a53bca
* | sbsign: remove unimplemented optionsAntonio Alvarez Feijoo2024-11-071-1/+1
|/
* Introduce systemd-sbsign to do secure boot signing (#35021)Daan De Meyer2024-11-0613-399/+1151
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently in mkosi and ukify we use sbsigntools to do secure boot signing. This has multiple issues: - sbsigntools is practically unmaintained, sbvarsign is completely broken with the latest gnu-efi when built without -fshort-wchar and upstream has completely ignored my bug report about this. - sbsigntools only supports openssl engines and not the new providers API. - sbsigntools doesn't allow us to cache hardware token pins in the kernel keyring like we do nowadays when we sign stuff ourselves in systemd-repart or systemd-measure There are alternative tools like sbctl and pesign but these do not support caching hardware token pins in the kernel keyring either. To get around the issues with sbsigntools, let's introduce our own tool systemd-sbsign to do secure boot signing. This allows us to take advantage of our own openssl infra so that hardware token pins are cached in the kernel keyring as expected and we get openssl provider support as well.
| * ukify: Add --signing-provider= optionDaan De Meyer2024-11-061-7/+29
| |
| * ukify: Add support for systemd-sbsignDaan De Meyer2024-11-061-4/+41
| |
| * sbsign: Add validate-key verbDaan De Meyer2024-11-061-2/+37
| | | | | | | | This verb checks that we can load the specified private key.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-01 23:46:04 +0100