summaryrefslogtreecommitdiffstats
path: root/units (follow)
Commit message (Collapse)AuthorAgeFilesLines
* allow removal of initrd servicesNorbert Lange2020-05-191-10/+10
|
* tree-wide: add size limits for tmpfs mountsTopi Miettinen2020-05-131-1/+1
| | | | | | | | | | | | | | | | | Limit size of various tmpfs mounts to 10% of RAM, except volatile root and /var to 25%. Another exception is made for /dev (also /devs for PrivateDevices) and /sys/fs/cgroup since no (or very few) regular files are expected to be used. In addition, since directories, symbolic links, device specials and xattrs are not counted towards the size= limit, number of inodes is also limited correspondingly: 4MB size translates to 1k of inodes (assuming 4k each), 10% of RAM (using 16GB of RAM as baseline) translates to 400k and 25% to 1M inodes. Because nr_inodes option can't use ratios like size option, there's an unfortunate side effect that with small memory systems the limit may be on the too large side. Also, on an extremely small device with only 256MB of RAM, 10% of RAM for /run may not be enough for re-exec of PID1 because 16MB of free space is required.
* units: change description of systemd-logind.serviceZbigniew Jędrzejewski-Szmek2020-05-051-1/+1
| | | | | | "Login Service" doesn''t explain much, esp. considering that logind is actually is for logins. I think "User Login Management" is better, but not that great either. Suggestions welcome.
* binfmt: also unregister binfmt entries from unitLennart Poettering2020-04-231-0/+1
| | | | | | | | | | | | | | | | | | | | We unregister binfmt_misc twice during shutdown with this change: 1. A previous commit added support for doing that in the final shutdown phase, i.e. when we do the aggressive umount loop. This is the robust thing to do, in case the earlier ("clean") shutdown phase didn't work for some reason. 2. This commit adds support for doing that when systemd-binfmt.service is stopped. This is a good idea so that people can order mounts before the service if they want to register binaries from such mounts, as in that case we'll undo the registration on shutdown again, before unmounting those mounts. And all that, just because of that weird "F" flag the kernel introduced that can pin files... Fixes: #14981
* units: use correct path to refer to plymouthLennart Poettering2020-04-162-2/+2
| | | | | | | | | This doesn't really matter, since in non-/usr-merged systems plymouth needs to be in /bin and on merged ones it doesn't matter, but it is still prettier to insert the right path, and avoid /bin on merged systems, since it's just a compat symlink. Replaces: #15351
* units: make sure systemd-pstore stops at shutdownLennart Poettering2020-04-081-1/+2
| | | | | This doesn't matter too much given that the service doesn't do anything on shutdown, but let's still stop it to make things cleaner.
* units: drop systemd-remount-fs.service dependency from more servicesLennart Poettering2020-04-084-4/+3
| | | | | All services using StateDirectory= don't need the explicit dep anymore, let's hence drop it everywhere.
* units: drop dependency on systemd-remount-fs.service from systemd-pstore.serviceLennart Poettering2020-04-081-2/+0
| | | | | | | | This dependency is now generated automatically given we use StateDirectory=. Moreover the combination of Wants= and After= was too strong anway, as whether remount-fs is pulled in or not should not be up to systemd-pstore.service, and in fact is part of the initial transaction anyway.
* units: pull in systemd-pstore.service from sysinit.targetLennart Poettering2020-04-081-1/+2
| | | | | | | | sysinit.target is the target our early boot services are generally pulled in from, make systemd-pstore.service not an exception of that. Effectively this doesn't mean much, either way our unit is part of the initial transaction.
* units: add ProtectClock=yesTopi Miettinen2020-04-076-0/+8
| | | | | | Add `ProtectClock=yes` to systemd units. Since it implies certain `DeviceAllow=` rules, make sure that the units have `DeviceAllow=` rules so they are still able to access other devices. Exclude timesyncd and timedated.
* units: run systemd-repart only if there's configuration for itLennart Poettering2020-04-021-0/+4
|
* Revert "units: make systemd-repart.service installable"Lennart Poettering2020-04-022-5/+2
| | | | | | | | | | | | | | | | | | | | This reverts commit 7e1ed1f3b29162df25064b33dc55ac8cf432bb0b. systemd-repart is not a user service that should be something people enable/disable, instead it should just work if there's configuration for it. It's like systemd-tmpfiles, systemd-sysusers, systemd-load-modules, systemd-binfmt, systemd-systemd-sysctl which are NOPs if they have no configuration, and thus don't hurt, but cannot be disabled since they are too deep part of the OS. This doesn't mean people couldn't disable the service if they really want to, there's after all "systemctl mask" and build-time disabling, but those are OS developer facing instead of admin facing, that's how it should be. Note that systemd-repart is in particular an initrd service, and so far enable/disable state of those is not managed anyway via "systemctl enable/disable" but more what dracut decides to package up and what not.
* Merge pull request #15109 from keszybz/units-make-installableZbigniew Jędrzejewski-Szmek2020-04-025-7/+18
|\ | | | | Make homed/userdbd/repart services installable (to allow uninstalling)
| * units: make systemd-userdbd.{socket,service} installableZbigniew Jędrzejewski-Szmek2020-03-313-2/+7
| | | | | | | | | | | | | | | | It's lightweight and generally useful, so it should be enabled by default. But users might want to disable it for whatever reason, and things should be fine without it, so let's make it installable so it can be disabled if wanted. Fixes #15175.
| * units: make systemd-homed.service installableZbigniew Jędrzejewski-Szmek2020-03-312-2/+5
| | | | | | | | Fixes #15083. Users might want to disable homed if not used to save resources.
| * units: make systemd-repart.service installableZbigniew Jędrzejewski-Szmek2020-03-312-3/+6
| | | | | | | | | | | | This essentially adds another layer of configurability: build disable, this, presence of configuration. The default is set to enabled, because the service does nothing w/o config.
* | units: do not pull in home.mount from systemd-homed.serviceLennart Poettering2020-03-311-1/+1
|/ | | | | | | | | /home is posibly a remote file system. it makes sense to order homed after it, so that we can properly enumerate users in it, but we probably shouldn't pull it in ourselves, and leave that to users to configure otherwise. Fixes: #15102
* systemd-network-generator.service: network-pre.target is a passive target unitFranck Bui2020-03-271-1/+2
|
* units: Don't mount tracefs in LXCBalint Reczey2020-03-231-0/+1
| | | | | | | Mounting tracefs fails in unprivileged LXC containers and latest LXD (3.23) bind mounts tracefs already. Fixes https://github.com/lxc/lxd/issues/7059
* homed: replace "home directory" with "home area" in a few placesZbigniew Jędrzejewski-Szmek2020-03-111-1/+1
|
* Merge pull request #15022 from keszybz/make-units-remain-after-exitYu Watanabe2020-03-062-0/+2
|\ | | | | Make units remain after exit
| * units: make systemd-network-generator.service stay aroundZbigniew Jędrzejewski-Szmek2020-03-051-0/+1
| | | | | | | | Once done, its done, and shouldn't be run again.
| * units: restore RemainAfterExit=yes in systemd-vconsole-setup.serviceZbigniew Jędrzejewski-Szmek2020-03-051-0/+1
| | | | | | | | | | | | | | | | | | | | This reverts the second part of 8125e8d38e3aa099c7dce8b0161997b8842aebdc. The first part was reverted in 750e550eba362096d56a35104c6a32631aa67b8e. The problem starts when s-v-s.s is pulled in by something that is then pulled in by sysinit.target. Every time a unit is started, systemd recursively checks all dependencies, and since sysinit.target is pull in by almost anything, we'll start s-v-s.s over and over. In particular, plymouth-start.service currently has Wants=s-v-s.s and After=s-v-s.s.
* | units: skip modprobe@.service if the unit appears to be already loadedZbigniew Jędrzejewski-Szmek2020-03-051-0/+1
| | | | | | | | | | | | | | | | Possible alternative to #14819. For me, setting RemainAfterExit=yes would be OK, but if people think that it might cause issues, then this could be a reasonable alternative that still let's us skip the invocation of the separate binary.
* | Merge pull request #15023 from keszybz/network-generator-manYu Watanabe2020-03-051-0/+1
|\ \ | | | | | | Man page for systemd-network-generator
| * | man: add systemd-network-generator.service(8)Zbigniew Jędrzejewski-Szmek2020-03-051-0/+1
| |/ | | | | | | | | It's a bit bare-bones, but it should be enough to point the reader in the right direction.
* / units: do not ignore return value from systemd --userZbigniew Jędrzejewski-Szmek2020-03-041-1/+1
|/ | | | | | | | | | | | | | | | | | | This minus has been there since the unit was added in d42d27ead91e470cb12986d928441e56c0f543ca. I think the idea was not cause things to fail if the user instance doesn't work. But ignoring the return value doesn't seem to be the right way to approach the problem. In particular, if the program fails to run, we'll get a bogus fail state, see https://bugzilla.redhat.com/show_bug.cgi?id=1727895#c1: with the minus: $ systemctl start user@1002 Job for user@1002.service failed because the service did not take the steps required by its unit configuration. See "systemctl status user@1002.service" and "journalctl -xe" for details. without the minus: $ systemctl start user@1002 Job for user@1002.service failed because the control process exited with error code. See "systemctl status user@1002.service" and "journalctl -xe" for details.
* RequireMountsFor in systemd-nspawn should wait for machine mountKevin P. Fleming2020-03-021-1/+1
| | | | | This patch modifies the RequireMountsFor setting in systemd-nspawn@.service to wait for the machine instance directory to be mounted, not just /var/lib/machines. Closes #14931
* units: disable ProtectKernelLogs for machinedGuillaume Douézan-Grard2020-03-021-1/+0
| | | | | | | | | | | machined needs access to the host mount namespace to propagate bind mounts created with the "machinectl bind" command. However, the "ProtectKernelLogs" directive relies on mount namespaces to make the kernel ring buffer inaccessible. This commit removes the "ProtectKernelLogs=yes" directive from machined service file introduced in 6168ae5. Closes #14559.
* pstore: Don't start systemd-pstore.service in containersBalint Reczey2020-02-271-0/+1
| | | | | Usually it is not useful and can also fail making boot-and-services autopkgtest fail.
* units: add mount for tracefsNorbert Lange2020-02-262-0/+25
| | | | | | | | | | | Kernel 4.1 separated the tracing system from the debugfs, actual documentation already points to a different path that needs this new mount to exist. the old sysfs path will still be an automount in the debugfs, created by the kernel (for now). Signed-off-by: Norbert Lange <nolange79@gmail.com>
* units: drop OnFailure= from .target unitsZbigniew Jędrzejewski-Szmek2020-02-055-10/+0
| | | | | | See c80a9a33d04fb4381327a69ce929c94a9f1d0e6c, target units can't fail. I guess we need to figure out some replacement functionality, but at least let's avoid the warning from systemd for now.
* Merge pull request #14398 from poettering/mount-prepZbigniew Jędrzejewski-Szmek2020-02-042-0/+14
|\
| * units: introduce blockdev@.target for properly ordering mounts/swaps against ↵Lennart Poettering2020-01-212-0/+14
| | | | | | | | | | | | | | | | | | cryptsetup Let's hook it into both cryptsetup-generator and gpt-auto-generator with a shared implementation in generator.c Fixes: #8472
* | units: define RuntimeDirectory= in systemd-journald.serviceLennart Poettering2020-01-311-0/+2
| | | | | | | | | | It doesn't get us much, but makes the differences between the templated and non-templated versions a bit smaller.
* | units: sort settings in systemd-journald.service againLennart Poettering2020-01-311-1/+1
| |
* | journald: add ability to activate by varlink socketLennart Poettering2020-01-313-2/+21
| | | | | | | | | | | | | | | | | | If we have exit on idle, then operations such as "journalctl --namespace=foo --rotate" should work even if the journal daemon is currently not running. (Note that we don't do activation by varlink for the main instance of journald, I am not sure the deadlocks it might introduce are worth it)
* | journald: add exit on idleLennart Poettering2020-01-311-2/+0
| |
* | units: add unit files for instantiated journal daemonsLennart Poettering2020-01-313-0/+72
| |
* | home: add new systemd-homed service that can manage LUKS homesLennart Poettering2020-01-282-0/+38
| | | | | | | | Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
* | unit: add AF_ALG to systemd-networkd.serviceYu Watanabe2020-01-281-1/+1
| | | | | | | | networkd uses khash, and khash requires AF_ALG.
* | units: add unit file for systemd-repart to automatically run at bootLennart Poettering2020-01-202-0/+27
|/
* units: drop full paths for utilities in $PATHZbigniew Jędrzejewski-Szmek2020-01-2026-77/+65
| | | | | | | This makes things a bit simpler and the build a bit faster, because we don't have to rewrite files to do the trivial substitution. @rootbindir@ is always in our internal $PATH that we use for non-absolute paths, so there should be no functional change.
* userdbd: add new service that can merge userdb queries from multiple clientsLennart Poettering2020-01-153-0/+63
|
* units: tweaks to modprobe@.serviceLennart Poettering2020-01-071-1/+4
| | | | | | | | | | | | Let's use uppercase wording in the description string, like we usually do. Let's allow using this service in early boot. If it's pulled into the initial transaction it's better to finish loading this before sysinit.target. Don't bother with this in containers that lack CAP_SYS_MODULE
* units: Split modprobing out into a separate service unitIain Lane2020-01-074-5/+21
| | | | | | | | | | | | | | | | | | | | | | | | Devices referred to by `DeviceAllow=` sandboxing are resolved into their corresponding major numbers when the unit is loaded by looking at `/proc/devices`. If a reference is made to a device which is not yet available, the `DeviceAllow` is ignored and the unit's processes cannot access that device. In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe` in `ExecStartPre=` to load some kernel modules. Those kernel modules cause device nodes to become available when they are loaded: the device nodes may not exist when the unit itself is loaded. This means that the unit's processes will not be able to access the device since the `DeviceAllow=` will have been resolved earlier and denied it. One way to fix this would be to re-evaluate the available devices and re-apply the policy to the cgroup, but this cannot work atomically on cgroupsv1. So we fall back to a second approach: instead of running `modprobe` via `ExecStartPre`, we move this out to a separate unit and order it before the units which want the module. Closes #14322. Fixes: #13943.
* network: bump netlink receive buffer size to 128MYu Watanabe2020-01-021-1/+1
| | | | Prompted by #14417.
* Revert "Drop dbus activation stub service"Lennart Poettering2019-12-201-0/+3
| | | | | | | | | | | | | | | This reverts commit 07125d24eedb71693b3bf2b1f0730cd01aaac2dd. In contrast to what is claimed in #13396 dbus-broker apparently does care for the service file to be around, and otherwise will claim "Service Not Activatable" in the time between systemd starting up the broker and connecting to it, which the stub service file is supposed to make go away. Reverting this makes the integration test suite pass again on host with dbus-broker (i.e. current Fedora desktop). Tested with dbus-broker-21-6.fc31.x86_64.
* Revert "cryptsetup: umount encrypted devices before detaching it during ↵Zbigniew Jędrzejewski-Szmek2019-12-192-2/+0
| | | | | | | | | | | | | shutdown" This reverts commit 362c378291e85df3e00aaad491d1e08233ad127f. This commit introduced an ordering loop: remote-cryptsetup.target was both before and after remote-fs-pre.target. It also globally ordered all cryptsetup volumes before all mounts. Such global ordering is problematic if people have stacked storage. Let's look for a different solution. See https://github.com/systemd/systemd/pull/14378#discussion_r359460109.
* initrd: make udev cleanup service confict trigger and settle tooDimitri John Ledkov2019-12-171-2/+2
| | | | | | | | Otherwise, systemd-udev-trigger|settle.service that ran in the initrd may ramain active, and never re-run again from the system root. This is observed by forexample examining ESP with udevadm info, which in the initrd has all the ID_* variables, and none of them in fully booted system.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 12:32:38 +0100