summaryrefslogtreecommitdiffstats
path: root/units (follow)
Commit message (Collapse)AuthorAgeFilesLines
* units: drop dependencies of soft-reboot.target from systemd-journald@.serviceYu Watanabe2024-05-171-5/+0
| | | | | | | | The service deos not have DefaultDependencies=no. Hence it has dependencies of shutdown.target, and dependencies of soft-reboot.target are not necessary. Follow-up for f89985ca494b79b2beed47e1f10d46ef2d59ce3e.
* journal: explicitly sync namespaced journals before stopping socket unitsYu Watanabe2024-05-022-0/+25
| | | | | | | | | | | | | Otherwise, if a service unit that requests LogNamespace= stopped before systemd-journald@.service is started, logs generated by the service will be lost, as systemd-journald@.socket is stopped and systemd-journald@.service will never started. To prevent the issue, let's introduce another implicit dependency to a oneshot service that explicitly synchronizes a namespaced journal file when the log namespace is not needed anymore. Fixes #32604.
* treewide: fix a few typos in NEWS, docs, comments, and log messagesDmitry V. Levin2024-04-271-1/+1
|
* units: add Before=shutdown.target to systemd-networkd-persistent-storage.serviceLuca Boccassi2024-04-261-0/+1
| | | | | | | | It's ordered with networkd, but just in case. Lintian complains: W: systemd: systemd-service-file-shutdown-problems [usr/lib/systemd/system/systemd-networkd-persistent-storage.service] Follow-up for 91676b645886382328c261efd5e83490d16e75cf
* units: merge two After= linesLennart Poettering2024-04-221-2/+1
|
* tpm2-setup-early: order against pcrphase-initrdLennart Poettering2024-04-221-1/+1
| | | | | | | | | | | | | | | | | | Right now systemd-tpm2-setup-early and systemd-pcrphase-initrd.service are not ordered against each other. However, they require the same slow resource to operate: the TPM2. If we allow them to access the device simultaneously, the kernel resource manager like has to save/restore TPM state while they operate, slowing things down further. hence, let's avoid all this mess, and just order them against each other so that the shared resource is first used in full by one and then by the other. I opted to order systemd-pcrphase-initrd before systemd-tpm2-setup-early, since there's value in having the former as early as possible in userspace, to be a good marker for the transition from kernel to first userspace. I can see no benefit in the opposite order however.
* units: introduce systemd-udev-load-credentials.serviceYu Watanabe2024-04-163-0/+31
|
* units: order repart after systemd-tpm2-setup-early.serviceLennart Poettering2024-04-151-1/+1
| | | | | | | | | | | | | This mimics what we do for systemd-cryptsetup@.service (see src/shared/generator.c), and makes sense since repart might lock up the root volume against a TPM, which ideally has its SRK already set up by then. More importantly though, this ensures that we ordered correctly after tpm2.target (which systemd-tpm2-setup-early.service has a dependency on), for systems where the TPM drivers are not compiled into the kernel. See: https://lists.freedesktop.org/archives/systemd-devel/2024-April/050201.html
* units/systemd-boot-check-no-failures.service: drop unneeded dep on ↵Mike Yuan2024-04-101-2/+0
| | | | shutdown.target
* mountfsd: add new systemd-mountfsd componentLennart Poettering2024-04-063-0/+76
|
* nsresourced: add new daemon for granting clients user namespaces and ↵Lennart Poettering2024-04-063-0/+78
| | | | | | | | | | | | | | | | | | | | | | | | assigning resources to them This adds a small, socket-activated Varlink daemon that can delegate UID ranges for user namespaces to clients asking for it. The primary call is AllocateUserRange() where the user passes in an uninitialized userns fd, which is then set up. There are other calls that allow assigning a mount fd to a userns allocated that way, to set up permissions for a cgroup subtree, and to allocate a veth for such a user namespace. Since the UID assignments are supposed to be transitive, i.e. not permanent, care is taken to ensure that users cannot create inodes owned by these UIDs, so that persistancy cannot be acquired. This is implemented via a BPF-LSM module that ensures that any member of a userns allocated that way cannot create files unless the mount it operates on is owned by the userns itself, or is explicitly allowelisted. BPF LSM program with contributions from Alexei Starovoitov.
* units: introduce systemd-hibernate-clear.service that clearsMike Yuan2024-04-032-0/+29
| | | | | | | | | | | | | | | | | | | | | stale HibernateLocation EFI variable Currently, if the HibernateLocation EFI variable exists, but we failed to resume from it, the boot carries on without clearing the stale variable. Therefore, the subsequent boots would still be waiting for the device timeout, unless the variable is purged manually. There's no point to keep trying to resume after a successful switch-root, because the hibernation image state would have been invalidated by then. OTOH, we don't want to clear the variable prematurely either, i.e. in initrd, since if the resume device is the same as root one, the boot won't succeed and the user might be able to try resuming again. So, let's introduce a unit that only runs after switch-root and clears the var. Fixes #32021
* units: remove implicit RequiresMountsFor=Mike Yuan2024-04-011-1/+0
|
* Merge pull request #31951 from bluca/resolve_reloadYu Watanabe2024-03-261-1/+1
|\ | | | | resolved: support reloading configuration at runtime
| * resolved: support reloading configuration at runtimeLuca Boccassi2024-03-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | Drop connections and caches and reload config from files, to allow for low-interruptions updates, and hook up to the usual SIGHUP and ExecReload=. Mark servers and services configured directly via D-Bus so that they can be kept around, and only the configuration file settings are dropped and reloaded. Fixes https://github.com/systemd/systemd/issues/17503 Fixes https://github.com/systemd/systemd/issues/20604
* | units: sort lists in meson.buildMike Yuan2024-03-262-3/+3
|/
* Merge pull request #29721 from poettering/systemd-projectZbigniew Jędrzejewski-Szmek2024-03-265-0/+64
|\ | | | | New capsule@.service feature
| * units: add systemd-capsule@.serviceLennart Poettering2024-03-145-0/+64
| |
* | units: add one more equivalency of '-' in '_' on kernel cmdlineZbigniew Jędrzejewski-Szmek2024-03-191-0/+1
| | | | | | | | | | | | | | | | c0aeff4b999318d4da48328fff0ea93c8c457ace added this in one unit file, but the same problem occurs here. (There are no other files where this would apply.) I think we should solve this systematically somehow, but it's not clear how to do that, so until we have that better solution, let's apply the manual solution so that our units work as expected.
* | unit/network: use ProtectSystem=strict againYu Watanabe2024-03-191-2/+1
| | | | | | | | | | | | | | Now, networkd accesses the state directory through the file descriptor passed from systemd-networkd-persistent-storage.service. Hence, the networkd itself does not need to access the state directory through its path, and we can use more stronger mode for ProtectSystem=.
* | tpm2-setup: Add --gracefulDaan De Meyer2024-03-172-2/+2
| | | | | | | | | | | | | | Currently the associated units fail if full tpm support is not available on the system. Similar to systemd-pcrextend, let's add a --graceful option that exits gracefully if no full TPM support is detected and use it in both units.
* | units: Accept modules_load and rd.modules_load in systemd-modules-load.serviceDaan De Meyer2024-03-171-0/+2
| | | | | | | | | | The service will use either, so let's make sure either of them starts the service as well.
* | units: use relative pathYu Watanabe2024-03-155-6/+6
| |
* | Merge pull request #31777 from keszybz/unit-retitling-and-commentsZbigniew Jędrzejewski-Szmek2024-03-1529-29/+29
|\ \ | | | | | | Unit retitling and comments
| * | units: retitle systemd-bootctl*.{service,socket}Zbigniew Jędrzejewski-Szmek2024-03-142-2/+2
| | | | | | | | | | | | | | | | | | "Starting Boot Control…" would be a fairly confusing message in the boot logs. Use "… Service" to mirror what we have in other services like systemd-{hostnamed,timedated,portabled,machined,…}.service.
| * | units: drop "(Varlink)"Zbigniew Jędrzejewski-Szmek2024-03-1411-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We generally don't specify the protocol implementation in unit descriptions. For journald, we have: $ git grep Description 'units/*journald*' units/systemd-journald-audit.socket:Description=Journal Audit Socket units/systemd-journald-dev-log.socket:Description=Journal Socket (/dev/log) units/systemd-journald-varlink@.socket:Description=Journal Varlink Socket for Namespace %i units/systemd-journald.service.in:Description=Journal Service units/systemd-journald.socket:Description=Journal Sockets units/systemd-journald@.service.in:Description=Journal Service for Namespace %i units/systemd-journald@.socket:Description=Journal Sockets for Namespace %i so we need to keep "Varlink" in the name. But also use "Sockets" (plural) for the "main" socket unit, since it opens multiple sockets.
| * | units/systemd-machine-id-commit: retitleZbigniew Jędrzejewski-Szmek2024-03-141-1/+1
| | | | | | | | | | | | | | | Our docs say that the Description should be capitalized. Also, change "commit" to "save" to make this more accessible.
| * | units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPMZbigniew Jędrzejewski-Szmek2024-03-1419-19/+19
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I was looking at the logs in some bug and saw this: Mar 13 15:55:12 fedora systemd[1]: systemd-pcrmachine.service - TPM2 PCR Machine ID Measurement was skipped because of an unmet condition check (ConditionSecurity=measured-uki). Mar 13 15:55:12 fedora systemd[1]: Starting systemd-remount-fs.service - Remount Root and Kernel File Systems... Mar 13 15:55:12 fedora systemd[1]: systemd-tpm2-setup-early.service - TPM2 SRK Setup (Early) was skipped because of an unmet condition check (ConditionSecurity=measured-uki). This is overly technical, for most units we don't provide this level of detail about the implementation. So retitle the units to be more accessible. Also, the fact that it's a v. 2 of the TPM is not that important. We don't support TPM 1.2, but computers without TPM v2 are getting rare. For other units we don't advertise the version of hardware, and let's not do this here, to reduce some complexity.
* | ssh-generator: introduce ssh-access.targetLennart Poettering2024-03-142-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | This new passive target is supposed to be pulled in by SSH implementations and should be reached when remote SSH access is possible. The idea is that this target can be used as indicator for other components to determine if and when SSH access is possible. One specific usecase for this is the new sd_notify() logic in PID 1 that sends its own supervisor notifications whenever target units are reached. This can be used to precisely schedule SSH connections from host to VM/container, or just to identify systems where SSH is even available.
* | units: make systemd-journald@.socket installableMike Yuan2024-03-141-0/+3
|/
* units: Bump various oneshot unit timeouts to 90sDaan De Meyer2024-03-132-2/+2
| | | | | | | In mkosi, we've been having CI failures caused by systemd-machine-id-commit.service timing out. Let's bump the timeout for it and systemd-rfkill.service to 90s which we also use for other oneshot services to avoid transient failures on slower systems.
* unit: do not trigger automount for /boot and/or /efiYu Watanabe2024-03-131-0/+1
| | | | | | | | | | | | | ProtectSystem=full remounts /boot and/or /efi read-only, but that may trigger automount for the paths and delay the service being started. === systemd[1]: boot.automount: Got automount request for /boot, triggered by 720 ((networkd)) === The service does not need to access the paths, so let's hide them. Follow-up for f90eb086270f0aea8efcbff5a5e4c338d178cfd4. Fixes #31742.
* unit: sort optionYu Watanabe2024-03-131-1/+1
|
* networkctl: introduce "persistent-storage" commandYu Watanabe2024-03-113-1/+32
| | | | | | | | | | | | | Then, this introduces systemd-networkd-persistent-storage.service. systemd-networkd.service is an early starting service. So, at the time it is started, the persistent storage for the service may not be ready, and we cannot use StateDirectory=systemd/network in systemd-networkd.service. The newly added systemd-networkd-persistent-storage.service creates the state directory for networkd, and notify systemd-networkd that the directory is usable.
* network/varlink: introduce io.systemd.Network.SetPersistentStorage methodYu Watanabe2024-03-111-1/+1
| | | | | | And make the networkd use state directory. Currently, the state directory and the method are not used, but will be used later.
* units: make quota services bind to corresponding mount unitsMike Yuan2024-03-102-2/+3
| | | | | | Follow-up for a628d933cc67cc8b183dc809ba1451aa5b2996e5 systemd-growfs@.service does the same.
* units: make templates for quotaon and systemd-quotacheck serviceThomas Blume2024-03-096-9/+69
|
* tree-wide: use "_" rather than "-" as separator in kernel cmdline optionsLennart Poettering2024-02-281-1/+1
| | | | | | | | | | | Most of our kernel cmdline options use underscores as word separators in kernel cmdline options, but there were some exceptions. Let's fix those, and also use underscores. Since our /proc/cmdline parsers don't distinguish between the two characters anyway this should not break anything, but makes sure our own codebase (and in particular docs and log messages) are internally consistent.
* homed: Create & advertise blob directoryAdrian Vovk2024-02-191-0/+1
| | | | | | | | | This ensures that a user-specific blob directory exists in /var/cache/systemd/homed for as long as the user exists, and gets deleted if the user gets deleted. It also advertises this blob directory via the user record, so that clients can find and use it.
* Merge pull request #31218 from CodethinkLabs/vmspawn/journal_forwardingLuca Boccassi2024-02-161-1/+2
|\ | | | | vmspawn: support journal forwarding
| * journald: implement socket forwardingSam Leonard2024-02-151-1/+2
| | | | | | | | | | | | | | | | | | | | | | This commit adds a new way of forwarding journal messages - forwarding over a socket. The socket can be any of AF_INET, AF_INET6, AF_UNIUX or AF_VSOCK. The address to connect to is retrieved from the "journald.forward_address" credential. It can also be specified in systemd-journald's unit file with ForwardAddress=
* | logind-user: track user started/stopping state through user-runtime-dir@.serviceMike Yuan2024-02-152-2/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before #30884, the user state is tied to user@.service (user service manager). However, #30884 introduced sessions that need no manager, and we can no longer rely on that. Consider the following situation: 1. A 'background-light' session '1' is created (i.e. no user service manager is needed) 2. Session '1' scope unit pulls in user-runtime-dir@.service 3. Session '1' exits. A stop job is enqueued for user-runtime-dir@.service due to StopWhenUnneeded=yes 4. At the same time, another session '2' which requires user manager is started. However, session scope units have JobMode=fail, therefore the start job for user-runtime-dir@.service that was pulled in by session '2' scope job is deleted as it conflicts with the stop job. We want session scope units to continue using JobMode=fail, but we still need the dependencies to be started correctly, i.e. explicitly requested by logind beforehand. Therefore, let's stop using StopWhenUnneeded=yes for user-runtime-dir@.service, and track users' `started` and `stopping` state based on that when user@.service is not needed. Then, for every invocation of user_start(), we'll recheck if we need the service manager and start it if so. Also, the dependency type on user-runtime-dir@.service from user@.service is upgraded to `BindsTo=`, in order to ensure that when logind stops the former, the latter is stopped as well.
* bootctl: add a Varlink interfaceLennart Poettering2024-02-143-0/+50
| | | | | For now, just super basic functionality: return the list of boot menu entries, and read/write the reboot to firmware flag
* vmspawn: add template unit to start systemd-vmspawn -MSam Leonard2024-02-132-0/+38
|
* Merge pull request #31233 from poettering/pcrlock-varlinkLennart Poettering2024-02-123-0/+55
|\ | | | | pcrlock: add simple Varlink API + some varlinkctl tweaks
| * pcrlock: add basic Varlink interfaceLennart Poettering2024-02-123-0/+55
| | | | | | | | | | This can be used to make or delete a PCR policy via Varlink. It can also be used to query the current event log in CEL format.
* | units: enable MaxConnectionsPerSocket= for all our Accept=yes unitsLennart Poettering2024-02-124-0/+4
|/ | | | | | | | | | | Let's make sure that user's cannot DoS services for other users so easily, and enable MaxConnectionsPerSocket= by default for all of them. Note that this is mostly paranoia for systemd-pcrextend.socket and systemd-sysext.socket: the socket is only accessible to root anyway, hence the accounting shouldn#t change anything. But this is just a safety net, in preparation that we open up some functionality of these services sooner or later.
* units: drop userdbd from homed's Also=Zbigniew Jędrzejewski-Szmek2024-02-061-1/+1
| | | | | | Also= lists units which should be enabled/disabled together with the first unit. But userdbd is independent of homed, we shouldn't e.g. disable it even if homed is disabled.
* units: Order pcrlock services after systemd-remounts-fs.serviceDaan De Meyer2024-01-267-2/+7
| | | | | These write to /var and as such need to wait until after the rootfs has been remounted read-write.
* unit: systemd-creds.socket is statically enabled, hence drop [Install]Lennart Poettering2024-01-231-3/+0
| | | | This is statically enabled, hence needs to [Install] section.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 01:27:20 +0100