summaryrefslogtreecommitdiffstats
path: root/units (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* journal: bump RLIMIT_NOFILE when journal files to 16K (if possible)Lennart Poettering2015-01-083-1/+11
| | | | | | | | | | | When there are a lot of split out journal files, we might run out of fds quicker then we want. Hence: bump RLIMIT_NOFILE to 16K if possible. Do these even for journalctl. On Fedora the soft RLIMIT_NOFILE is at 1K, the hard at 4K by default for normal user processes, this code hence bumps this up for users to 4K. https://bugzilla.redhat.com/show_bug.cgi?id=1179980
* units: make resolved pull in its own .busname unit, but only on kdbus systemsLennart Poettering2015-01-072-0/+10
| | | | | The daemon requires the busname unit to operate, since it contains the policy that allows it to acquire its service name.
* units: improve Description= for systemd's own busname unitLennart Poettering2015-01-071-1/+1
|
* journald: allow restarting journald without losing stream connectionsLennart Poettering2015-01-061-0/+1
| | | | | | Making use of the fd storage capability of the previous commit, allow restarting journald by serilizing stream state to /run, and pushing open fds to PID 1.
* units: rework systemd-nspawn@.service unitLennart Poettering2014-12-292-3/+22
| | | | | | | | | | | - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container
* units: make graphical.target dependencies more complete and similar to those ↵Lennart Poettering2014-12-291-2/+2
| | | | of multi-user.target
* machined/machinectl: add logic to show list of available imagesLennart Poettering2014-12-191-1/+1
| | | | | | | | | This adds a new bus call to machined that enumerates /var/lib/container and returns all trees stored in it, distuingishing three types: - GPT disk images, which are files suffixed with ".gpt" - directory trees - btrfs subvolumes
* systemd-hwdb: introduce new toolTom Gundersen2014-12-182-3/+3
| | | | | | | | This pulls out the hwdb managment from udevadm into an independent tool. The old code is left in place for backwards compatibility, and easy of testing, but all documentation is dropped to encourage use of the new tool instead.
* build-sys: remove commented-out m4 from user@.serviceMantas Mikulėnas2014-12-141-4/+0
| | | | | | | | | | | Otherwise this actually remains in the generated unit in /usr/lib. If you want to keep it commented out, a m4-compatible way would be: m4_ifdef(`HAVE_SMACK', dnl Capabilities=cap_mac_admin=i dnl SecureBits=keep-caps )
* build-sys: turn off SMACK capabilities stuff for now, since it is ↵Lennart Poettering2014-12-101-4/+4
| | | | incompatible with nspawn
* gitignore: hide some more filesLennart Poettering2014-12-101-0/+2
|
* bus-proxy: cloning smack labelPrzemyslaw Kedzierski2014-12-092-1/+5
| | | | | | | | | | | | | | | | | | | | | | When dbus client connects to systemd-bus-proxyd through Unix domain socket proxy takes client's smack label and sets for itself. It is done before and independent of dropping privileges. The reason of such soluton is fact that tests of access rights performed by lsm may take place inside kernel, not only in userspace of recipient of message. The bus-proxyd needs CAP_MAC_ADMIN to manipulate its label. In case of systemd running in system mode, CAP_MAC_ADMIN should be added to CapabilityBoundingSet in service file of bus-proxyd. In case of systemd running in user mode ('systemd --user') it can be achieved by addition Capabilities=cap_mac_admin=i and SecureBits=keep-caps to user@.service file and setting cap_mac_admin+ei on bus-proxyd binary.
* units: make sure container-getty@.service stops restarting when the pts ↵Lennart Poettering2014-12-091-0/+1
| | | | | | | | | device it is bound to is gone We only want to restart the getty as long as the pts device is still around. As soon as it is gone, the service should be removed to. http://lists.freedesktop.org/archives/systemd-devel/2014-December/026048.html
* gitignore: ignore generated systemd-bootchart.serviceWaLyong Cho2014-12-041-0/+1
|
* units: skip mounting /dev/hugepages if we don't have CAP_SYS_ADMINMichal Sekletar2014-12-041-0/+1
| | | | | Preparation for allowing systemd to run gracefully in containers lacking CAP_SYS_ADMIN.
* bootchart: add standalone bootchart serviceWaLyong Cho2014-12-041-0/+20
|
* machine-id-commit: add unit fileDidier Roche2014-12-032-0/+22
| | | | | The unit file only active the machine-id-commit helper if /etc is mounted writable and /etc/machine-id is an independant mount point (should be a tmpfs).
* rc-local: drop SysVStartPriority= field which is now obsoleteLennart Poettering2014-12-021-1/+0
|
* bus-proxy: automatically detect scope of bus and derive which XML snippets ↵Lennart Poettering2014-11-282-2/+2
| | | | to load from that
* nspawn: Add try-{host,guest} journal link modesMartin Pitt2014-11-211-1/+1
| | | | | | | | | | | | | | | | | --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
* units: make sure rfkill service is bount to the actual hardwareLennart Poettering2014-11-211-0/+1
|
* Revert "systemd-logind.service: set Type=notify"Lennart Poettering2014-11-211-1/+0
| | | | | | | | | | | This reverts commit a4962513c555fe3ac4b5bebf97a71701361a45b0. logind.service is a D-Bus service, hence we should use the dbus name as indication that we are up. Type=dbus is implied if BusName= is specified, as it is in this case. This removes a warning that is printed because a BusName= is specified for a Type=notify unit.
* systemd-logind.service: set Type=notifyDave Reisner2014-11-191-0/+1
| | | | | | The code already calls sd_notify("READY=1"), so we may as well take advantage of the startup behavior in the unit. The same was done for the journal in a87a38c20.
* sd-bus: sync with kdbus upstream (ABI break)Daniel Mack2014-11-132-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kdbus has seen a larger update than expected lately, most notably with kdbusfs, a file system to expose the kdbus control files: * Each time a file system of this type is mounted, a new kdbus domain is created. * The layout inside each mount point is the same as before, except that domains are not hierarchically nested anymore. * Domains are therefore also unnamed now. * Unmounting a kdbusfs will automatically also detroy the associated domain. * Hence, the action of creating a kdbus domain is now as privileged as mounting a filesystem. * This way, we can get around creating dev nodes for everything, which is last but not least something that is not limited by 20-bit minor numbers. The kdbus specific bits in nspawn have all been dropped now, as nspawn can rely on the container OS to set up its own kdbus domain, simply by mounting a new instance. A new set of mounts has been added to mount things *after* the kernel modules have been loaded. For now, only kdbus is in this set, which is invoked with mount_setup_late().
* units: restore job timeouts for poweroff and rebootZbigniew Jędrzejewski-Szmek2014-11-062-0/+4
| | | | | | | | It seems that there actually aren't any long running tasks which are performed at shutdown. If it turns out that there actually are, this should be revisited. This reverts most of commit 038193efa6.
* units: disable job timeoutsZbigniew Jędrzejewski-Szmek2014-11-063-7/+0
| | | | | | | | | | | | | For boot, we might kill fsck in the middle, with likely catastrophic consequences. On shutdown there might be other jobs, like downloading of updates for installation, and other custom jobs. It seems better to schedule an individual timeout on each one separately, when it is known what timeout is useful. Disable the timeouts for now, until we have a clearer picture of how we can deal with long-running jobs.
* core: introduce new Delegate=yes/no property controlling creation of cgroup ↵Lennart Poettering2014-11-052-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine.
* units: make systemd-journald.service Type=notifyMichal Schmidt2014-11-041-0/+1
| | | | | | | | | | | It already calls sd_notify(), so it looks like an oversight. Without it, its ordering to systemd-journal-flush.service is non-deterministic and the SIGUSR1 from flushing may kill journald before it has its signal handlers set up. https://bugs.freedesktop.org/show_bug.cgi?id=85871 https://bugzilla.redhat.com/show_bug.cgi?id=1159641
* units: make ReceiveBuffer= line more readable by using M suffixLennart Poettering2014-11-031-1/+1
|
* core: introduce ConditionSecurity=auditLennart Poettering2014-11-031-0/+1
| | | | And conditionalize journald audit support with it
* journald: if available pull audit messages from the kernel into journal logsLennart Poettering2014-11-032-3/+21
|
* units: order sd-journal-flush after sd-remount-fsZbigniew Jędrzejewski-Szmek2014-11-031-0/+1
| | | | | | | | Otherwise we could attempt to flush the journal while /var/log/ was still ro, and silently skip journal flushing. The way that errors in flushing are handled should still be changed to be more transparent and robust.
* unit: do not order timers.target before basic.targetZbigniew Jędrzejewski-Szmek2014-11-022-1/+7
| | | | | | | | | | | | | | | | | | | | | | Since commit 19f8d037833f2 'timer: order OnCalendar units after timer-sync.target if DefaultDependencies=no' timers might get a dependency on time-sync.target, which does not really belong in early boot. If ntp is enabled, time-sync.target might be delayed until a network connection is established. It turns out that majority of timer units found in the wild do not need to be started in early boot. Out of the timer units available in Fedora 21, only systemd-readahead-done.timer and mdadm-last-resort@.timer should be started early, but they both have DefaultDependencies=no, so are not part of timers.target anyway. All the rest look like they will be fine with being started a bit later (and the majority even much later, since they run daily or weekly). Let timers.target be pulled in by basic.target, but without the temporal dependency. This means timer units are started on a "best effort" schedule. https://bugzilla.redhat.com/show_bug.cgi?id=1158206
* systemd-journal-flush.service: remove "trigger" from descriptionZbigniew Jędrzejewski-Szmek2014-11-011-1/+1
| | | | This service is now synchronous, so "trigger" is misleading.
* units: don't order journal flushing afte remote-fs.targetLennart Poettering2014-10-311-1/+2
| | | | | | | Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
* udev hwdb: Support shipping pre-compiled database in system imagesMartin Pitt2014-10-281-0/+3
| | | | | | | | | | | | | | | | In some cases it is preferable to ship system images with a pre-generated binary hwdb database, to avoid having to build it at runtime, avoid shipping the source hwdb files, or avoid storing large binary files in /etc. So if hwdb.bin does not exist in /etc/udev/, fall back to looking for it in UDEVLIBEXECDIR. This keeps the possibility to add files to /etc/udev/hwdb.d/ and re-generating the database which trumps the one in /usr/lib. Add a new --usr flag to "udevadm hwdb --update" which puts the database into UDEVLIBEXECDIR. Adjust systemd-udev-hwdb-update.service to not generate the file in /etc if we already have it in /usr.
* units: define appropriate job timeout actions when boot or shutdown timeouts ↵Lennart Poettering2014-10-283-0/+6
| | | | | | | | | | | are hit Using the new JobTimeoutAction= setting make sure we power off the machine after basic.target is queued for longer than 15min but not executed. Similar, if poweroff.target is queued for longer than 30min but does not complete, forcibly turn off the system. Similar, if reboot.target is queued for longer than 30min but does not complete, forcibly reboot the system.
* units: tmpfiles-setup-dev - allow unsafe file creation to happen in /dev at bootTom Gundersen2014-10-271-1/+1
| | | | This will allow us to mark static device nodes with '!' to indicate that they should only be created at early boot.
* units: run firstboot before sysusers, so that firstboot can initialize the ↵Lennart Poettering2014-10-231-2/+2
| | | | root password
* journalctl: add new --flush command and make use of it in ↵Lennart Poettering2014-10-231-2/+3
| | | | | | | | | | systemd-journal-flush.service This new command will ask the journal daemon to flush all log data stored in /run to /var, and wait for it to complete. This is useful, so that in case of Storage=persistent we can order systemd-tmpfiles-setup afterwards, to ensure any possibly newly created directory in /var/log gets proper access mode and owners.
* journald: add CAP_MAC_OVERRIDE in journald for SMACK issueJuho Son2014-10-221-1/+1
| | | | | | | | | | | | | | | | | | | systemd-journald check the cgroup id to support rate limit option for every messages. so journald should be available to access cgroup node in each process send messages to journald. In system using SMACK, cgroup node in proc is assigned execute label as each process's execute label. so if journald don't want to denied for every process, journald should have all of access rule for all process's label. It's too heavy. so we could give special smack label for journald te get all accesses's permission. '^' label. When assign '^' execute smack label to systemd-journald, systemd-journald need to add CAP_MAC_OVERRIDE capability to get that smack privilege. so I want to notice this information and set default capability to journald whether system use SMACK or not. because that capability affect to only smack enabled kernel
* systemd-hibernate-resume@.service: remove unnecessary orderingIvan Shapovalov2014-10-101-1/+1
| | | | | | | | They were left from an early review iteration, when hibernate-resume functionality was intended to work also outside of initramfs. Now this is not the case, and these dependencies became redundant as systemd-fsck-root.service can never be part of initramfs, and systemd-remount-fs.service makes little sense in it.
* logind: mount per-user tmpfs with 'smackfsroot=*' for smack enabled systemsLukasz Skalski2014-10-091-1/+1
|
* consoled: add a unit fileTom Gundersen2014-10-042-0/+16
| | | | | The unit file is statically enabled, but still requires --enable-terminal to actually get installed.
* readahead: wipe out readaheadDaniel Buch2014-09-2529-143/+19
|
* units: networkd - order after udevTom Gundersen2014-09-081-1/+3
| | | | | This way we are sure that /dev/net/tun has been given the right permissions before we try to connect to it. Ideally, we should create tun/tap devices over netlink, and then this whole issue would go away.
* initrd-parse-etc.service: ignore return code of daemon-reloadHarald Hoyer2014-09-031-1/+1
| | | | | | It seems the return code of systemctl daemon-reload can be !=0 in some circumstances, which causes a failure of the unit and breaks booting in the initrd.
* units: update rescue.service and emergency.serviceZbigniew Jędrzejewski-Szmek2014-08-312-2/+2
| | | | | ^D works in emergency.service too. One needs to log in when in rescue mode too.
* units: m4 is not needed for rescue.serviceZbigniew Jędrzejewski-Szmek2014-08-312-1/+0
|
* units: make emergency.service conflict with rescue.serviceZbigniew Jędrzejewski-Szmek2014-08-311-0/+1
| | | | | | | | They both use StandardInput=tty-force so they cannot be run concurrently. https://bugs.freedesktop.org/show_bug.cgi?id=82778 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=757072
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 11:09:38 +0100