Merge branch 'notsystemd/postmove' into notsystemd/master

# Conflicts:
#	src/grp-journal/libjournal-core/.gitignore
#	src/grp-system/libcore/include/core/mount.h

5 files changed, 48 insertions, 53 deletions

diff --git a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-write.c b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-write.c
index 31abdc76d2..99b02602ea 100644
--- a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-write.c
+++ b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote-write.c
@@ -76,10 +76,8 @@ Writer* writer_new(RemoteServer *server) {
         memset(&w->metrics, 0xFF, sizeof(w->metrics));
 
         w->mmap = mmap_cache_new();
-        if (!w->mmap) {
-                free(w);
-                return NULL;
-        }
+        if (!w->mmap)
+                return mfree(w);
 
         w->n_ref = 1;
         w->server = server;
@@ -104,9 +102,7 @@ Writer* writer_free(Writer *w) {
         if (w->mmap)
                 mmap_cache_unref(w->mmap);
 
-        free(w);
-
-        return NULL;
+        return mfree(w);
 }
 
 Writer* writer_unref(Writer *w) {
diff --git a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.c b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.c
index b77abfc184..476f4d27a8 100644
--- a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.c
+++ b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.c
@@ -27,10 +27,6 @@
 #include <sys/socket.h>
 #include <unistd.h>
 
-#ifdef HAVE_GNUTLS
-#include <gnutls/gnutls.h>
-#endif
-
 #include <systemd/sd-daemon.h>
 
 #include "journal-core/journald-native.h"
@@ -132,6 +128,10 @@ static int spawn_child(const char* child, char** argv) {
         if (r < 0)
                 log_warning_errno(errno, "Failed to close write end of pipe: %m");
 
+        r = fd_nonblock(fd[0], true);
+        if (r < 0)
+                log_warning_errno(errno, "Failed to set child pipe to non-blocking: %m");
+
         return fd[0];
 }
 
@@ -529,13 +529,12 @@ static int process_http_upload(
                         log_warning("Failed to process data for connection %p", connection);
                         if (r == -E2BIG)
                                 return mhd_respondf(connection,
-                                                    MHD_HTTP_REQUEST_ENTITY_TOO_LARGE,
-                                                    "Entry is too large, maximum is %u bytes.\n",
-                                                    DATA_SIZE_MAX);
+                                                    r, MHD_HTTP_REQUEST_ENTITY_TOO_LARGE,
+                                                    "Entry is too large, maximum is " STRINGIFY(DATA_SIZE_MAX) " bytes.");
                         else
                                 return mhd_respondf(connection,
-                                                    MHD_HTTP_UNPROCESSABLE_ENTITY,
-                                                    "Processing failed: %s.", strerror(-r));
+                                                    r, MHD_HTTP_UNPROCESSABLE_ENTITY,
+                                                    "Processing failed: %m.");
                 }
         }
 
@@ -546,13 +545,14 @@ static int process_http_upload(
 
         remaining = source_non_empty(source);
         if (remaining > 0) {
-                log_warning("Premature EOFbyte. %zu bytes lost.", remaining);
-                return mhd_respondf(connection, MHD_HTTP_EXPECTATION_FAILED,
+                log_warning("Premature EOF byte. %zu bytes lost.", remaining);
+                return mhd_respondf(connection,
+                                    0, MHD_HTTP_EXPECTATION_FAILED,
                                     "Premature EOF. %zu bytes of trailing data not processed.",
                                     remaining);
         }
 
-        return mhd_respond(connection, MHD_HTTP_ACCEPTED, "OK.\n");
+        return mhd_respond(connection, MHD_HTTP_ACCEPTED, "OK.");
 };
 
 static int request_handler(
@@ -582,19 +582,16 @@ static int request_handler(
                                            *connection_cls);
 
         if (!streq(method, "POST"))
-                return mhd_respond(connection, MHD_HTTP_NOT_ACCEPTABLE,
-                                   "Unsupported method.\n");
+                return mhd_respond(connection, MHD_HTTP_NOT_ACCEPTABLE, "Unsupported method.");
 
         if (!streq(url, "/upload"))
-                return mhd_respond(connection, MHD_HTTP_NOT_FOUND,
-                                   "Not found.\n");
+                return mhd_respond(connection, MHD_HTTP_NOT_FOUND, "Not found.");
 
         header = MHD_lookup_connection_value(connection,
                                              MHD_HEADER_KIND, "Content-Type");
         if (!header || !streq(header, "application/vnd.fdo.journal"))
                 return mhd_respond(connection, MHD_HTTP_UNSUPPORTED_MEDIA_TYPE,
-                                   "Content-Type: application/vnd.fdo.journal"
-                                   " is required.\n");
+                                   "Content-Type: application/vnd.fdo.journal is required.");
 
         {
                 const union MHD_ConnectionInfo *ci;
@@ -604,7 +601,7 @@ static int request_handler(
                 if (!ci) {
                         log_error("MHD_get_connection_info failed: cannot get remote fd");
                         return mhd_respond(connection, MHD_HTTP_INTERNAL_SERVER_ERROR,
-                                           "Cannot check remote address");
+                                           "Cannot check remote address.");
                 }
 
                 fd = ci->connect_fd;
@@ -619,7 +616,7 @@ static int request_handler(
                 r = getpeername_pretty(fd, false, &hostname);
                 if (r < 0)
                         return mhd_respond(connection, MHD_HTTP_INTERNAL_SERVER_ERROR,
-                                           "Cannot check remote hostname");
+                                           "Cannot check remote hostname.");
         }
 
         assert(hostname);
@@ -628,8 +625,7 @@ static int request_handler(
         if (r == -ENOMEM)
                 return respond_oom(connection);
         else if (r < 0)
-                return mhd_respond(connection, MHD_HTTP_INTERNAL_SERVER_ERROR,
-                                   strerror(-r));
+                return mhd_respondf(connection, r, MHD_HTTP_INTERNAL_SERVER_ERROR, "%m");
 
         hostname = NULL;
         return MHD_YES;
@@ -1203,7 +1199,7 @@ static int parse_config(void) {
                 { "Remote",  "TrustedCertificateFile", config_parse_path,             0, &arg_trust      },
                 {}};
 
-        return config_parse_many(PKGSYSCONFDIR "/journal-remote.conf",
+        return config_parse_many_nulstr(PKGSYSCONFDIR "/journal-remote.conf",
                                  CONF_PATHS_NULSTR("systemd/journal-remote.conf.d"),
                                  "Remote\0", config_item_table_lookup, items,
                                  false, NULL);
@@ -1565,7 +1561,7 @@ int main(int argc, char **argv) {
         if (r < 0)
                 log_error_errno(r, "Failed to enable watchdog: %m");
         else
-                log_debug("Watchdog is %s.", r > 0 ? "enabled" : "disabled");
+                log_debug("Watchdog is %sd.", enable_disable(r > 0));
 
         log_debug("%s running as pid "PID_FMT,
                   program_invocation_short_name, getpid());
diff --git a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.conf.xml b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.conf.xml
index 2d345963d9..f7ac8c46e0 100644
--- a/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.conf.xml
+++ b/src/grp-journal/grp-remote/systemd-journal-remote/journal-remote.conf.xml
@@ -45,22 +45,21 @@
   <refnamediv>
     <refname>journal-remote.conf</refname>
     <refname>journal-remote.conf.d</refname>
-    <refpurpose>Journal remote service configuration files</refpurpose>
+    <refpurpose>Configuration files for the service accepting remote journal uploads</refpurpose>
   </refnamediv>
 
   <refsynopsisdiv>
     <para><filename>/etc/systemd/journal-remote.conf</filename></para>
-    <para><filename>/etc/systemd/journald.conf.d/*.conf</filename></para>
-    <para><filename>/run/systemd/journald.conf.d/*.conf</filename></para>
-    <para><filename>/usr/lib/systemd/journald.conf.d/*.conf</filename></para>
+    <para><filename>/etc/systemd/journal-remote.conf.d/*.conf</filename></para>
+    <para><filename>/run/systemd/journal-remote.conf.d/*.conf</filename></para>
+    <para><filename>/usr/lib/systemd/journal-remote.conf.d/*.conf</filename></para>
   </refsynopsisdiv>
 
   <refsect1>
     <title>Description</title>
 
-    <para>These files configure various parameters of the systemd-remote-journal
-    application,
-    <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+    <para>These files configure various parameters of
+    <citerefentry><refentrytitle>systemd-journal-remote.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
   </refsect1>
 
   <xi:include href="standard-conf.xml" xpointer="main-conf" />
diff --git a/src/grp-journal/grp-remote/systemd-journal-remote/systemd-journal-remote.service.in b/src/grp-journal/grp-remote/systemd-journal-remote/systemd-journal-remote.service.in
index fdf3da4b64..753dd6c158 100644
--- a/src/grp-journal/grp-remote/systemd-journal-remote/systemd-journal-remote.service.in
+++ b/src/grp-journal/grp-remote/systemd-journal-remote/systemd-journal-remote.service.in
@@ -11,15 +11,20 @@ Documentation=man:systemd-journal-remote(8) man:journal-remote.conf(5)
 Requires=systemd-journal-remote.socket
 
 [Service]
-ExecStart=@rootlibexecdir@/systemd-journal-remote \
-          --listen-https=-3 \
-          --output=/var/log/journal/remote/
+ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/
 User=systemd-journal-remote
 Group=systemd-journal-remote
+WatchdogSec=3min
 PrivateTmp=yes
 PrivateDevices=yes
 PrivateNetwork=yes
-WatchdogSec=3min
+ProtectSystem=full
+ProtectHome=yes
+ProtectControlGroups=yes
+ProtectKernelTunables=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 
 [Install]
 Also=systemd-journal-remote.socket
diff --git a/src/grp-journal/grp-remote/systemd-journal-remote/systemd-journal-remote.xml b/src/grp-journal/grp-remote/systemd-journal-remote/systemd-journal-remote.xml
index 3899f175d4..ee2d5c2486 100644
--- a/src/grp-journal/grp-remote/systemd-journal-remote/systemd-journal-remote.xml
+++ b/src/grp-journal/grp-remote/systemd-journal-remote/systemd-journal-remote.xml
@@ -121,8 +121,8 @@
         <replaceable>ADDRESS</replaceable>. This URL should refer to the
         root of a remote
         <citerefentry><refentrytitle>systemd-journal-gatewayd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-        instance (e.g. <ulink>http://some.host:19531/</ulink> or
-        <ulink>https://some.host:19531/</ulink>).</para></listitem>
+        instance, e.g. http://some.host:19531/ or
+        https://some.host:19531/.</para></listitem>
       </varlistentry>
     </variablelist>
 
@@ -250,20 +250,19 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>--compress</option></term>
-        <term><option>--no-compress</option></term>
+        <term><option>--compress</option> [<replaceable>BOOL</replaceable>]</term>
 
-        <listitem><para>Compress or not, respectively, the data in the
-        journal using XZ.</para></listitem>
+        <listitem><para>If this is set to <literal>yes</literal> then compress
+        the data in the journal using XZ. The default is <literal>yes</literal>.
+        </para></listitem>
       </varlistentry>
 
       <varlistentry>
-        <term><option>--seal</option></term>
-        <term><option>--no-seal</option></term>
+        <term><option>--seal</option> [<replaceable>BOOL</replaceable>]</term>
 
-        <listitem><para>Periodically sign or not, respectively, the
-        data in the journal using Forward Secure Sealing.
-        </para></listitem>
+        <listitem><para>If this is set to <literal>yes</literal> then
+        periodically sign the data in the journal using Forward Secure Sealing.
+        The default is <literal>no</literal>.</para></listitem>
       </varlistentry>
 
       <varlistentry>