summaryrefslogtreecommitdiffstats
path: root/tmpfiles.d/systemd-resolve.conf (unfollow)
Commit message (Collapse)AuthorFilesLines
3 daysbash-completion/creds: generate suggestions by systemd-creds itselfYu Watanabe1-6/+5
Follow-ups for 783f794e89996ae7f2ae1872d65c515a672437fa.
3 dayscreds: support --transcode=help and --with-key=helpYu Watanabe2-20/+72
3 daysstring-table: make DUMP_STRING_TABLE() returns 0Yu Watanabe1-2/+3
Then, we can use it as === return DUMP_STRING_TABLE(...); ===
3 daystpm2-util: allow to control if legend and/or footer shown by tpm2_list_devices()Yu Watanabe8-9/+11
3 daysci: enable linter for generate-sym-test.pyYu Watanabe1-3/+3
3 daystest: also generate list of symbols from header filesYu Watanabe1-0/+74
To make the generated tests able to detect issues like #35554.
3 daystest: modernize generate-sym-test.pyYu Watanabe1-40/+67
3 dayssd-json: properly export sd_json_variant_type_from_string() and _to_string()Yu Watanabe2-1/+3
These exist in the header file, but were not exporeted. Continuation of e11f5aa7226253bf31b2ed61be8599bb213c1819.
3 daystest: rename README.testsuite -> README.mdYu Watanabe2-1/+1
3 daysREADME: drop CentOS CI badgesYu Watanabe1-3/+0
CentOS CIs are disabled after ead814a0b0f64c572282b9e27a0a995893f10cf0.
3 daystest: add more coverage for extensions and verityLuca Boccassi2-0/+8
3 dayscore: fix loading verity settings for MountImages=Luca Boccassi2-0/+11
The MountEntry logic was refactored to store the verity settings, and updated for ExtensionImages=, but not for MountImages=. Follow-up for a1a40297dbfa5bcd926d1a19320deb73c033c6f5
3 daysshell completion: add systemd-credsLuca Boccassi2-0/+186
3 dayssemaphore: skip some testsLuca Boccassi1-0/+3
semaphore CI runs are always very close to the limit of 1hr, and often time out when it's particularly oversubscribed. Skip some low-value test cases to shorten the runtime.
3 daysexec-util: use strv_from_stdarg_alloca()Yu Watanabe3-19/+1
No functional change, just refactoring.
3 daysexec-util: use open_terminal() in fork_agent() for safetyYu Watanabe1-2/+2
3 daysexec-util: drop handling of ENXIO in opening /dev/ttyYu Watanabe1-22/+16
This effectively reverts 0bcf1679007e71d1d37666c10ab1f8d46de8d570. The handling is not necessary anymore after 61242b1f0f9cac399deb67c88c3b62d38218dba3.
3 daysexec-util: split out common checks before fork_agent() to can_fork_agent()Yu Watanabe4-20/+22
No functional change, just refactoring.
3 dayspolkit-agent: modernize code a bitYu Watanabe1-10/+8
- Use _cleanup_close_pair_ attribute for the pipe FDs, - Return earlier on failure in forking polkit agent.
3 daysexec-util: allow to invoke polkit/ask-password agent even if STDIN is not a ttyYu Watanabe3-21/+18
Closes #35018.
3 dayssystemd-cryptenroll.xml: fix typoCarlo Teubner1-1/+1
3 daysman: update example in systemd-measure.xml (#35506)cvlc121-0/+1
In the example from systemd-measure(1), do not bind to PCR 7 in addition to the PCR policy. As long as this is still done by default, see #35280.
3 daysRevert "run: disable --expand-environment by default for --scope"Mike Yuan3-37/+19
This reverts commit 8167c56bfa97525a7b12e7c5685576657364e3cf. We've announced the breaking change during v254-v257. Let's actually apply it for v258.
4 dayscgroup-util: introduce cg_get_cgroupid_at()Mike Yuan2-32/+26
Suggested in https://github.com/systemd/systemd/pull/35242#discussion_r1862658163
4 daysnsresourced: drop unneeded REMOVE_PHYSICAL flag for rm_rf()Mike Yuan1-1/+1
Even without REMOVE_PHYSICAL, rm_rf() permits cgroupfs.
4 dayssd-varlink: properly export sd_varlink_reset_fds()Lennart Poettering2-3/+9
This function was listed in the public sd-varlink.h header, but not actually made public. Fix that. It's quite useful, the comment in it describes the usecase nicely. Fixes: #35554
4 daystest-bpf-restrict-fs: Migrate to new assertion macrosDaan De Meyer1-9/+9
4 dayscondition: add new ConditionKernelModuleLoaded=Lennart Poettering6-0/+104
This introduces a new unit condition check: that matches if a specific kmod module is allowed. This should be generally useful, but there's one usecase in particular: we can optimize modprobe@.service with this and avoid forking out a bunch of modprobe requests during boot for the same kmods. Checking if a kernel module is loaded is more complicated than just checking if /sys/module/$MODULE/ exists, since kernel modules typically take a while to initialize and we must check that this is complete (by checking if the sysfs attr "initstate" is "live").
4 daysFixing VLAN ranges in man systemd.network.andrejpodzimek1-1/+1
Otherwise it doesn't hold that VLANs 100-400 are allowed (because 201-299 are disallowed).
4 daysprofile.d: don't bail if $SHELL_* variables are unsetTobias Klauser1-3/+3
If - for whatever reason - a script uses set -u (nounset) and includes /etc/profile.d/70-systemd-shell-extra.sh (e.g. transitively via /etc/profile) the script would fail with: /etc/profile.d/70-systemd-shell-extra.sh: line 15: SHELL_PROMPT_PREFIX: unbound variable For example: $ cat > foo.sh <<EOF #!/bin/sh set -u source /etc/profile EOF $ chmod 700 foo.sh $ ./foo.sh /etc/profile.d/70-systemd-shell-extra.sh: line 15: SHELL_PROMPT_PREFIX: unbound variable Fix this by using shell parameter substitution[^1] (which is a POSIX shell concept) to set the $SHELL_* variables to the empty string if undefined. [^1]: https://pubs.opengroup.org/onlinepubs/9699919799.2018edition/utilities/V3_chap02.html
4 daysvirt: drop userns detection heuristicLennart Poettering1-61/+2
Now that we have an explicit userns check we can drop the heuristic for it, given that it's kinda wrong (because mapping the full host UID range into a userns is actually a thing people do). Hence, just delete the code and only keep the userns inode check in place.
4 daysvirt: dont check for cgroupns anymoreLennart Poettering1-84/+0
Now that we have a reliable pidns check I don't think we really should look for cgroupns anymore, it's too weak a check. I mean, if I myself would implement a desktop app sandbox (like flatpak) I'd always enable cgroupns, simply to hide the host cgroup hierarchy. Hence drop the check. I suggested adding this 4 years ago here: https://github.com/systemd/systemd/pull/17902#issuecomment-745548306
4 daysuserdbctl: use ansi_highlight_green_red() where appropriateMike Yuan1-1/+1
4 daysformat-table: drop pointless table_data_rgap_color() funcMike Yuan1-7/+1
Follow-up for aab79f52784b4778ae0534452757d9fbf608076a
4 daysformat-table: minor modernizationMike Yuan1-10/+10
4 daysman: document unprivileged is not for reading propertiesKatariina Lounento1-0/+3
Document the fact that read-only properties may not have the flag SD_BUS_VTABLE_UNPRIVILEGED as that is not obvious especially given the flag is accepted for writable properties. Based on the check in `add_object_vtable_internal` called by `sd_bus_add_object_vtable` (as of the current tip of the main branch f7f5ba019206cacd486b0892fec76f70f525e04d): case _SD_BUS_VTABLE_PROPERTY: { [...] if ([...] || [...] (v->flags & SD_BUS_VTABLE_UNPRIVILEGED && v->type == _SD_BUS_VTABLE_PROPERTY)) { r = -EINVAL; goto fail; } (where `_SD_BUS_VTABLE_PROPERTY` means read-only property whereas `_SD_BUS_VTABLE_WRITABLE_PROPERTY` maps to writable property). This was implemented in the commit adacb9575a09981fcf11279f2f661e3fc21e58ff ("bus: introduce "trusted" bus concept and encode access control in object vtables") where `SD_BUS_VTABLE_UNPRIVILEGED` was introduced: Writable properties are also subject to SD_BUS_VTABLE_UNPRIVILEGED and SD_BUS_VTABLE_CAPABILITY() for controlling write access to them. Note however that read access is unrestricted, as PropertiesChanged messages might send out the values anyway as an unrestricted broadcast.
4 daysjournalctl: make --invocation and --list-invocations accept unit name with globYu Watanabe4-8/+36
Previously, journalctl -I -u GLOB was not supported, while journalctl -u GLOB works fine. Let's make them consistent.
4 daysjournalctl: move get_possible_units() to journalctl-util.cYu Watanabe3-70/+77
No functional change. Preparation for the next commit.
4 daysjournalctl: make --invocation and --list-invocations accept unit name ↵Yu Watanabe2-5/+25
without suffix Fixes #35538.
4 dayslibfido2-util: show also verity features when listing FIDO2 devicesAntonio Alvarez Feijoo1-7/+36
This way, users don't have to check those features using an external program, or wait for later failure when trying to enroll using an unsupported feature.
4 daysmkosi: use inetutils package instead of hostname for ArchlinuxLuca Boccassi5-1/+4
In Arch the hostname binary is in a different package Follow-up for cf48bde7aea52b18ac3fa218d3f60fd3d533ef66
4 daysmailmap: fix entries for Tobias KlauserTobias Klauser1-4/+4
Map all previous, no longer used e-mail addresses to my current e-mail address.
4 daysprocess-util: make sure we don't report ppid == 0Mike Yuan1-8/+9
Previously, if pid == 0 and we're PID 1, get_process_ppid() would set ret to getppid(), i.e. 0, which is inconsistent when pid is explicitly set to 1. Ensure we always handle such case by returning -EADDRNOTAVAIL.
4 daysprocess-util: use our usual tristate semantics for is_main_thread()Mike Yuan1-4/+4
While at it, _unlikely_ is dropped, as requested in https://github.com/systemd/systemd/pull/35242#discussion_r1880096233
4 daystest-fd-util: compare FDs to /bin/sh instead of /dev/nullLuca Boccassi1-2/+2
/dev/null is a character device, so same_fd() in the fallback path that compares fstat will fail, as that bails out if the fd refers to a char device. This happens on kernels without F_DUPFD_QUERY and without kcmp. /* test_same_fd */ Assertion 'same_fd(d, e) > 0' failed at src/test/test-fd-util.c:111, function test_same_fd(). Aborting. Fixes #35552
4 daystest-fd-util: skip test when lacking privileges to create a new namespaceLuca Boccassi1-0/+2
To reproduce, as an unprivileged user start a docker container and build and run the unit tests inside it: $ docker run --rm -ti debian:bookworm bash ... /* test_close_all_fds */ Successfully forked off '(caf-plain)' as PID 10496. Skipping PR_SET_MM, as we don't have privileges. (caf-plain) succeeded. Failed to fork off '(caf-noproc)': Operation not permitted Assertion 'r >= 0' failed at src/test/test-fd-util.c:392, function test_close_all_fds(). Aborting. Partially fixes #35552
4 daystest-capability: CAP_LINUX_IMMUTABLE is not available in unprivileged containersLuca Boccassi1-0/+7
have ambient caps: yes Capabilities:cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep Failed to drop auxiliary groups list: Operation not permitted Failed to change group ID: Operation not permitted Capabilities:cap_dac_override,cap_net_raw=ep Capabilities:cap_dac_override=ep Successfully forked off '(getambient)' as PID 12505. Skipping PR_SET_MM, as we don't have privileges. Ambient capability cap_linux_immutable requested but missing from bounding set, suppressing automatically. Assertion 'x < 0 || FLAGS_SET(c, UINT64_C(1) << CAP_LINUX_IMMUTABLE)' failed at src/test/test-capability.c:273, function test_capability_get_ambient(). Aborting. (getambient) terminated by signal ABRT. src/test/test-capability.c:258: Assertion failed: expected "r" to succeed, but got error: Protocol error Partially fixes #35552
4 daystest: set nsec3-salt-length=8 in knot.confNick Rosbrook1-0/+1
TEST-75-RESOLVED fails on Ubuntu autopkgtest due to this warning from knot: notice: config, policy 'auto_rollover_nsec3' depends on default nsec3-salt-length=8, since version 3.5 the default becomes 0 Explicitly set nsec3-salt-length=8 to silence.
4 dayslogind: define flags enum for manager_is_inhibited()Zbigniew Jędrzejewski-Szmek5-14/+24
The most common case of block=true, ignore_inactive=false is mapped to flags=0. For https://github.com/systemd/systemd/issues/34091.
4 dayslogind: drop one duplicate param in manager_is_inhibited()Zbigniew Jędrzejewski-Szmek5-13/+20
In the review in https://github.com/systemd/systemd/pull/30307#pullrequestreview-2255002732 removal of the excessive boolean parameters was requested. We don't need a separate boolean param here, since we always pass true with a uid and false otherwise.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-15 09:20:49 +0100