| Commit message (Collapse) | Author | Files | Lines |
|---|
|
We create subdirectories for each major release, but not for point releases
so strip the suffix if it is present
|
|
Let's make use of libcryptsetup's new crypt_token_set_external_path()
API in place of the interposition stuff we have been doing before. Let's
kill it entirely, given that this was a developer feature only anyway
(and guarded by an appropriate ifdef).
Fixes: #30098
|
|
Login shells are supposed to marked via a dash as first char. We follow
that logic, but right now we simply overwrite the first char of the
shell. That might not be the right choice, given that this turns
"zsh" into "-sh", which suggests some bourne shell process.
Hence, let's correct things, and instead prefix a dash, which should be
safer.
Inspired by findings on https://github.com/systemd/systemd/issues/34153#issuecomment-2338104907
|
|
Some tabs snuck in here, but we don't like tabs in our codebase. Fix
them.
|
|
Indicates whether the ATA read look-ahead feature is supported
and enabled.
Signed-off-by: Tomas Bzatek <tbzatek@redhat.com>
|
|
Instead, let's define them once, and pass them through as parameters
everywhere.
|
|
This iterates through the .profile sections a UKI provides and uses it
to generate multiple menu entries from them, one for each .profile
section.
|
|
|
|
unmanaged
Follow-up for 2cf9b1a0eed7bcd85543e19ba6f0d26767fe1163.
|
|
Then, the Link object for the peer interface can have a reference to the
corresponding NetDev object.
|
|
|
|
Then, Link object for an L2TP session can have reference to the
corresponding NetDev object.
|
|
|
|
Also, use log_section_warning_errno() where applicable.
|
|
Then, the Link object for the peer interface can have a reference to the
corresponding NetDev object.
|
|
|
|
netdev vtable
Currently no vtable sets these functions, but will be used later.
|
|
Preparation for later commits.
|
|
No functional change, just refactoring and preparation for later
commits.
|
|
netdev_load_one()
No functional change, just refactoring and preparation for later
commits.
|
|
Then, it is not necessary to free NetDev.ifname when a conflicting
.netdev file is already loaded.
This also split out netdev_detach_name() and netdev_detach_impl().
No functional change, just refactoring.
|
|
This also makes netdev_enter_failed() called on caller side.
No functional change, just refactoring.
|
|
For safety. No functional change, just refactoring and preparation for
later commits.
|
|
|
|
to Link
Even when a NetDev object with the same name found, its iftype or kind
may be different. For safety, let's also check them.
|
|
|
|
type in the same UKI ("Multi-Profile UKIs")
This adds a ability to add alternative sections of a specific type in
the same UKI. The primary usecase is for supporting multiple different
kernel cmdlines that are baked into a UKI.
The mechanism is relatively simple (I think), in order to make it robust.
1. A new PE section ".profile" is introduced, that is a lot like
".osrel", but contains information about a specific "profile" to
boot. The ".profile" section can appear multiple times in the same
PE, and acts as delimiter indicating where a new profile starts.
Everything before the first ".profile" is called the "base profile",
and is shared among all other profiles, which can then override or
add addition PE sections on top.
2. An UKI's command line can be prefixed with an argument such as "@0" or
"@1" or "@2" which indicates the "profile" to boot. If no argument is
specified the default is profile 0. Also, a UKI that lacks any
.profile section is treated like one with only a profile 0, but with
no data in that profile section.
3. The stub will first search for its usual set of PE sections
(hereafter called "base sections"), and stop at the first .profile PE
section if any. It will then find the .profile matching the selected
profile by its index, and any sections found as part of that profile
on top of the base sections.
And that's already it.
Example: let's say a distro wants to provide a single UKI that can be
invoked in one of three ways:
1. The regular profile that just boots the system
2. A profile that boots into storagetm
3. A profile that initiates factory reset and reboots.
For this it would define a classic UKI with sections .linux, .initrd,
.cmdline, and whatever else it needs. The .cmdline section would contain
the kernel command line for the regular profile.
It would then insert one ".profile" section, with a contents like the
following:
ID=regular
This is the profile for profile 0. It would immediately afterwards add
another ".profile" section:
ID=storagetm
TITLE=Boot into Storage Target Mode
This would then followed with a .cmdline section that is just like the
basic one, but with "rd.systemd.unit=storage-target-mode.target"
suffixed. Then, another .profile section would be added:
ID=factory-reset
TITLE=Factory Reset
Which is then followed by one last PE section: a .cmdline one with
"systemd.unit=factory-reset.target" suffixed to te regular command line.
i.e. expressed in tabular form the above would be:
The base profile:
.linux
.initrd
.cmdline
.osrel
The regular boot profile:
.profile
The storagetm profile:
.profile
.cmdline
The factory reset profile:
.profile
.cmdline
You might wonder why the first .cmdline in the list above is placed in
the base profile rather than in the regular boot profile, given that it
is overriden in all other profiles anyway. And you are right. The only
reason I'd place it in the base profile is that it makes the UKI more
nicely extensible if later profiles are added that want to replace
something else instead of the .cmdline, for example .ucode or so. But it
really doesn't matter much.
While the primary usecase is of course multiple alternative command
lines, the concept is more powerful than that: for various usecases it
might be valuable to offer multiple choices of devicetree, ucode or
initrds.
The .profile contents is also passed to the invoked kernel as a file in
/.extra/profile (via a synthetic initrd). Thus, this functionality can
even be useful without overriding any section at all, simply by means of
reading that file from userspace.
Design choices:
1. On purposes I used a special command line marker (i.e. the "@" thing,
which maybe we should call the "profile selector"), that doesn't look
like a regular kernel command line option. This is because this is
really not a regular kernel command line option – we process it in
the stub, then remove it as prefix, and measure the unprefixed
command line only after that. The kernel will not see the profile
selector either. I think these special semantics are best
communicated by making it look substantially different from regular
options.
2. This moves around measurements a bit. Previously we measured our UKI
sections right after finding them. Now we first parse the profile
number from the command line, then search for the profile's sections,
and only then measure the sections we actually end up using for this
profile. I think that this logic makes most sense: measure what we
are using, not what we are overriding. Or in other words, if you boot
profile @3, then we'll measure .cmdline (assuming it exists) of
profile 3, and *not* measure .cmdline of the base profile. Also note
that if the user passes in a custom kernel command line via command
line arguments we'll strip off the profile selector (i.e. the initial
"@X" thing) before we pass it on.
3. The .profile stuff is supposed to be generic and extensible. For
example we could use it in future to mark "dangerous" options such as
factory reset, so that boot menus can ask for confirmation before
booting into it. Or we could introduce match expressions against
SMBIOS or other system identifiers, to filter out profiles on
specific hw.
Note btw, that PE allows defining multiple sections that point to the
same offsets in the file. This allows sharing payload under different
names. For example, if profile @4 and @7 shall carry the same .ucode
section, they can define .ucode in each profile and then make it point to
the same offset.
Also note that that one can even "mask" a base section in a profile, by
inserting an empty section. For example, if the base .dtb section should
not be used for profile @4, then add a section .dtb right after the
fourth .profile with a zero size to the UKI, and you will get your wish
fulfilled.
This code only contains changes to sd-stub. A follow-up commit will
teach sd-boot to also find this profile PE sections to synthesize
additional menu entries from a single UKI.
A later commit will add support for gnerating this via ukify.
Fixes: #24539
|
|
This adds helpers for:
1. Returning the PE section table of open PE files or memory
2. Scanning PE section tables for the sections that belong to a specific
profile
|
|
userspace
|
|
Also, don't abuse RET_GATHER in verb_cat(), where the failures
are most likely unrelated to each other.
Closes #34281
|
|
|
|
|
|
|
|
|
|
Follow-up for dc3223919f663b7c8b8d8d1d6072b4487df7709b.
Addresses https://github.com/systemd/systemd/pull/34067#discussion_r1748061156.
Error codes other than ENOSYS may not come here, but if it comes, still
there is nothing we can do here, so let's not log the failure loudly.
|
|
Follow-up for dc3223919f663b7c8b8d8d1d6072b4487df7709b.
Addresses https://github.com/systemd/systemd/pull/34067#discussion_r1748592958.
Otherwise, containers started with and without --keep-unit option run in
different device policies.
|
|
Let's put a time-out on this syncing.
Inspired-by: #34289 #34283
|
|
This is preparation for reusing the logic for syncing DM and other
devices with a timeout applied.
|
|
Let's make sure "no" is an acceptable setting for these paths.
|
|
and welcome messages
|
|
|
|
This configures an indentity mapping similar to
systemd-nspawn --private-users=identity.
|
|
|
|
It's a long long list of verbs we support now, let's make it easier to
digest, like we did in systemctl --help and elsewhere.
|
|
Do this like we usually do these days.
|
|
In mkosi, I want to add a sysupdate verb to wrap systemd-sysupdate.
The definitions will be picked up from mkosi.sysupdate/ and passed
to systemd-sysupdate. I want users to be able to write transfer
definitions that are independent of the output directory used by
mkosi. To make this possible, it should be possible to specify the
directory that transfer sources should be looked up in on the sysupdate
command line. Let's allow this via a new --transfer-source= option.
Additionally, transfer sources that want to take advantage of this
feature should specify PathRelativeTo=directory to indicate the configured
Path= is interpreted relative to the tranfer source directory specified
on the CLI.
This allows for the following transfer definition to be put in
mkosi.sysupdate:
"""
[Transfer]
ProtectVersion=%A
[Source]
Type=regular-file
Path=/
PathRelativeTo=directory
MatchPattern=ParticleOS_@v.usr-%a.@u.raw
[Target]
Type=partition
Path=auto
MatchPattern=ParticleOS_@v
MatchPartitionType=usr
PartitionFlags=0
ReadOnly=1
"""
|
|
Let's allow splitting the partitions from an existing disk image
by initializing split_name_format when using --copy-from=.
|
|
Now, we have copy of vm_sockets.h, hence these definitions are not
necessary anymore.
|
|
Now we have ipv6.h, hence the definition is not necessary anymore.
|
|
|
