summaryrefslogtreecommitdiffstats
path: root/units (follow)
Commit message (Collapse)AuthorAgeFilesLines
* units: add a basic SystemCallFilter (#3471)Topi Miettinen2016-06-0910-0/+10
| | | | | | | Add a line SystemCallFilter=~@clock @module @mount @obsolete @raw-io ptrace for daemons shipped by systemd. As an exception, systemd-timesyncd needs @clock system calls and systemd-localed is not privileged. ptrace(2) is blocked to prevent seccomp escapes.
* units: enable MemoryDenyWriteExecute (#3459)Topi Miettinen2016-06-0810-0/+10
| | | | | Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
* units: wait for plymouth to shut down in rescue.sevice (#3367)Franck Bui2016-06-011-1/+1
| | | | | In the same vein as commit ac59f0c12c117b9bb5b7e17f33987b0107791239 which added the --wait option to the emergency service, this patch makes sure that plymouth has exited before entering into the rescue mode.
* units: restore ConditionNeesUpdate=/etc in ldconfig.service (#3311)Lennart Poettering2016-05-211-0/+1
| | | | | | | | | In order to support stateless systems that support offline /usr updates properly, let's restore the ConditionNeesUpdate=/etc line that makes sure we are run when /usr is updated and this update needs to be propagated to the /etc/ld.so.conf file stored in /etc. This reverts part of #2859, which snuck this change in, but really shouldn't have.
* Create initrd-root-device.target synchronization point (#3239)Daniel Drake2016-05-122-2/+17
| | | | | | | | | Add a synchronization point so that custom initramfs units can run after the root device becomes available, before it is fsck'd and mounted. This is useful for custom initramfs units that may modify the root disk partition table, where the root device is not known in advance (it's dynamically selected by the generators).
* units: make sure that fsck is executed before quotachecktblume2016-05-101-1/+1
| | | | fsck determines wheter an automatic quotacheck should be executed. Hence fsck service needs to run before quotacheck service.
* Stop syslog.socket when entering emergency mode (#3130)Martin Pitt2016-04-271-0/+1
| | | | | | | | | | | | | | | When enabling ForwardToSyslog=yes, the syslog.socket is active when entering emergency mode. Any log message then triggers the start of rsyslog.service (or other implementation) along with its dependencies such as local-fs.target and sysinit.target. As these might fail themselves (e. g. faulty /etc/fstab), this breaks the emergency mode. This causes syslog.socket to fail with "Failed to queue service startup job: Transition is destructive". Add Conflicts=syslog.socket to emergency.service to make sure the socket is stopped when emergency.service is started. Fixes #266
* Merge pull request #3093 from poettering/nspawn-userns-magicLennart Poettering2016-04-261-1/+1
|\ | | | | nspawn automatic user namespaces
| * units: turn on user namespace by default in systemd-nspawn@.serviceLennart Poettering2016-04-251-1/+1
| | | | | | | | | | Now that user namespacing is supported in a pretty automatic way, actually turn it on by default if the systemd-nspawn@.service template is used.
* | machined: add CAP_MKNOD to capabilities to run with (#3116)Lennart Poettering2016-04-251-1/+1
|/ | | | | | Container images from Debian or suchlike contain device nodes in /dev. Let's make sure we can clone them properly, hence pass CAP_MKNOD to machined. Fixes: #2867 #465
* units: order systemd-user-sessions.service after network.targetLennart Poettering2016-04-221-1/+1
| | | | | | | | That way we can be sure that local users are logged out before the network is shut down when the system goes down, so that SSH session should be ending cleanly before the system goes down. Fixes: #2390
* tmp.mount.hm4: After swap.target (#3087)frankheckenbach2016-04-221-0/+1
| | | fix issue #2930
* units: Add "GuessMainPID=no" to compatibility unit for rc-local (#3018)Calvin Owens2016-04-211-0/+1
| | | | | | | With the current "Type=forking", systemd tries to guess the PID it should wait on at reboot (because we have no "PIDFile="). Depending on how wrong the guess is, we can end up hanging forever at reboot. Asking it not to do that eliminates the problem.
* units: run ldconfig.service after we have mounted all local file systemsMichal Sekletar2016-03-171-2/+1
| | | | | | Also drop ConditionNeedsUpdate=|/etc. Regardless if system is updated online or offline, updating dynamic loader cache should always be responsibility of packaging tools/scripts.
* Don't escape the name of the container in instances ofElias Probst2016-02-261-2/+2
| | | | | | | | When using `%I` for instances of `systemd-nspawn@.service`, the result will be `systemd-nspawn` trying to launch a container named e.g. `fedora/23` instead of `fedora-23`. Using `%i` instead prevents escaping `-` in a container name and uses the unmodified container name from the machine store.
* Merge pull request #2664 from zonque/bootchart-removalLennart Poettering2016-02-232-21/+0
|\ | | | | Remove systemd-bootchart
| * Remove systemd-bootchartDaniel Mack2016-02-232-21/+0
| | | | | | | | | | | | | | This commit rips out systemd-bootchart. It will be given a new home, outside of the systemd repository. The code itself isn't actually specific to systemd and can be used without systemd even, so let's put it somewhere else.
* | man: link some unit files to their online bus API documentationLennart Poettering2016-02-232-0/+4
|/
* remove bus-proxydDaniel Mack2016-02-126-66/+0
| | | | | | | | | | As kdbus won't land in the anticipated way, the bus-proxy is not needed in its current form. It can be resurrected at any time thanks to the history, but for now, let's remove it from the sources. If we'll have a similar tool in the future, it will look quite differently anyway. Note that stdio-bridge is still available. It was restored from a version prior to f252ff17, and refactored to make use of the current APIs.
* Merge pull request #2581 from evverx/dev-mqueue-condLennart Poettering2016-02-111-0/+1
|\ | | | | units: don't try to mount the mqueue fs if we lack the privileges for it
| * units: don't try to mount the mqueue fs if we lack the privileges for itEvgeny Vereshchagin2016-02-111-0/+1
| | | | | | | | See https://github.com/systemd/systemd/pull/2576#discussion-diff-52592680
* | units: don't try to mount the FUSE fs if we lack the privileges for itLennart Poettering2016-02-101-0/+1
|/ | | | | | See: https://lists.freedesktop.org/archives/systemd-devel/2016-February/035740.html
* coredump: rework coredumping logicLennart Poettering2016-02-103-0/+42
| | | | | | | | | | | | | | | | This reworks the coredumping logic so that the coredump handler invoked from the kernel only collects runtime data about the crashed process, and then submits it for processing to a socket-activate coredump service, which extracts a stacktrace and writes the coredump to disk. This has a number of benefits: the disk IO and stack trace generation may take a substantial amount of resources, and hence should better be managed by PID 1, so that resource management applies. This patch uses RuntimeMaxSec=, Nice=, OOMScoreAdjust= and various sandboxing settings to ensure that the coredump handler doesn't take away unbounded resources from normally priorized processes. This logic is also nice since this makes sure the coredump processing and storage is delayed correctly until /var/systemd/coredump is mounted and writable. Fixes: #2286
* Merge pull request #2565 from poettering/fix-2315Zbigniew Jędrzejewski-Szmek2016-02-101-3/+6
|\
| * units: downgrade dependency on /tmp in basic.target to Wants=Lennart Poettering2016-02-091-4/+6
|/ | | | | | | Now that requiring of a masked unit results in failure again, downgrade the dependency on /tmp to Wants= again, so that our suggested way to disable /tmp-on-tmpfs by masking doesn't result in a failing boot. References: #2315
* Fix typo in rescue shellIndrajit Raychaudhuri2016-02-051-1/+1
|
* Merge pull request #2331 from yuwata/journal-remote-unit-v2Daniel Mack2016-01-221-0/+1
|\ | | | | journal-remote: add SupplementaryGroups to systemd-journal-upload.service
| * journal-remote: add SupplementaryGroups to systemd-journal-upload.serviceYu Watanabe2016-01-151-0/+1
| |
* | units: don't fail if /root doesn't exist for shell unitsLennart Poettering2016-01-173-3/+3
|/ | | | | | As discussed on the ML: http://lists.freedesktop.org/archives/systemd-devel/2016-January/035594.html
* kmod-static-nodes: don't run if module list is emptyMartin Pitt2016-01-111-1/+1
| | | | | | | | | | With this kmod commit, modules.devname will be empty by default instead of containing just a comment: https://git.kernel.org/cgit/utils/kernel/kmod/kmod.git/commit/?id=4c30a11d5f Refine the startup condition of kmod-static-nodes.service to not run needlessly if the list is empty.
* journal-remote: add documents in the unit filesYu Watanabe2015-12-154-0/+4
|
* Set user@.service TasksMax=infinityJan Alexander Steffens (heftig)2015-11-221-0/+1
| | | | | | | | The user manager is still limited by its parent slice user-UID.slice, which defaults to 4096 tasks. However, it no longer has an additional limit of 512 tasks. Fixes #1955.
* nspawn: set TasksMax= for containers to 8192 by defaultLennart Poettering2015-11-161-0/+1
|
* core: remove SmackFileSystemRootLabel= againLennart Poettering2015-11-121-3/+0
| | | | | | | | Apparently, util-linux' mount command implicitly drops the smack-related options anyway before passing them to the kernel, if the kernel doesn't know SMACK, hence there's no point in duplicating this in systemd. Fixes #1696
* units: fix system.slice to require -.slice, instead of just want itLennart Poettering2015-11-111-1/+1
|
* journal: restore watchdog supportLennart Poettering2015-11-031-0/+1
|
* Merge pull request #1726 from teg/networkd-2Daniel Mack2015-11-031-1/+1
|\ | | | | networkd: (de)serialize more state and support expiring routes
| * networkd: route - track routesTom Gundersen2015-10-301-1/+1
| |
* | journald: never block when sending messages on NOTIFY_SOCKET socketLennart Poettering2015-11-011-1/+0
|/ | | | | | | | | | | | | | Otherwise we might run into deadlocks, when journald blocks on the notify socket on PID 1, and PID 1 blocks on IPC to dbus-daemon and dbus-daemon blocks on logging to journald. Break this cycle by making sure that journald never ever blocks on PID 1. Note that this change disables support for event loop watchdog support, as these messages are sent in blocking style by sd-event. That should not be a big loss though, as people reported frequent problems with the watchdog hitting journald on excessively slow IO. Fixes: #1505.
* core: rename SmackFileSystemRoot= to SmackFileSystemRootLabel=Lennart Poettering2015-10-261-1/+1
| | | | | | That way it's in sync with the other SMACK label settings. https://github.com/systemd/systemd/pull/1664#issuecomment-150891270
* units: add 'SmackFileSystemRoot=*' option into tmp.mountSangjung Woo2015-10-241-0/+3
| | | | | | | | | | If SMACK is enabled, 'smackfsroot=*' option should be specified when /tmp is mounted since many non-root processes use /tmp for temporary usage. If not, /tmp is labeled as '_' and smack denial occurs when writing. In order to do that, 'SmackFileSystemRoot=*' is newly added into tmp.mount.
* units: also whitelist "blkext" block devices for nspawn serviceLennart Poettering2015-10-221-0/+1
| | | | | | | /dev/loop*p* block devices are of the "blkext" subsystem, not of loop, hence whitelist this too. Fixes #1446
* Revert "units: add 'smackfsroot=*' option into tmp.mount when SMACK is enabled"Kay Sievers2015-10-181-3/+1
| | | | | | | This reverts commit 409c2a13fd65692c611b7bcaba12e908ef7cf1e5. It breaks the bootup of systems which enable smack at compile time, but have no smack enabled in the kernel. This needs a different solution.
* units: .gitignore: units - ignore tmp.mountTom Gundersen2015-10-151-0/+1
| | | | This is a follow-up to 409c2a13fd656.
* Merge pull request #1572 from again4you/devel/tmp-smackLennart Poettering2015-10-151-1/+3
|\ | | | | units: add 'smackfsroot=*' option into tmp.mount when SMACK is enabled
| * units: add 'smackfsroot=*' option into tmp.mount when SMACK is enabledSangjung Woo2015-10-151-1/+3
| | | | | | | | | | | | | | If SMACK is enabled, 'smackfsroot=*' option should be specified in tmp.mount file since many non-root processes use /tmp for temporary usage. If not, /tmp is labeled as '_' and smack denial occurs when writing.
* | unit: remove [Install] section from the user exit.target unitLennart Poettering2015-10-141-3/+0
|/ | | | | | | There's no concept of ctrl-alt-del for user systemd instances, hence don't suggest it woud make sense to symlink the unit to it. Fixes #1525.
* Merge pull request #1468 from poettering/fdnamesTom Gundersen2015-10-061-1/+1
|\ | | | | Add support for naming fds for socket activation and more
| * unit: give systemd-networkd.socket a better descriptionLennart Poettering2015-10-061-1/+1
| | | | | | | | | | | | Usually we try to properly uppercase first characters in the description, do so here, too. Also, keep it close to the string used in systemd-networkd.service.
* | nspawn: fix --image= when nspawn is run as serviceLennart Poettering2015-10-031-0/+5
|/ | | | | | | nspawn needs access to /dev/loop to implement --image=, hence grant that in the service file. Fixes #1446.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 05:17:08 +0100