summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.github/CONTRIBUTING.md1
-rw-r--r--HACKING68
-rw-r--r--README.md2
-rw-r--r--TODO2
-rw-r--r--hwdb/60-evdev.hwdb7
-rw-r--r--man/bootctl.xml4
-rw-r--r--man/udev_device_get_syspath.xml8
-rw-r--r--po/it.po45
-rw-r--r--rules/99-systemd.rules.in3
-rw-r--r--src/basic/missing_syscall.h2
-rw-r--r--src/basic/nss-util.h2
-rw-r--r--src/boot/bootctl.c10
-rw-r--r--src/core/cgroup.h1
-rw-r--r--src/core/dbus-cgroup.c1
-rw-r--r--src/core/dbus-execute.c6
-rw-r--r--src/core/execute.c8
-rw-r--r--src/core/execute.h6
-rw-r--r--src/core/manager.c1
-rw-r--r--src/core/namespace.c18
-rw-r--r--src/core/scope.h2
-rw-r--r--src/nspawn/nspawn-mount.c23
-rw-r--r--src/nspawn/nspawn-register.c8
-rw-r--r--src/nspawn/nspawn.c5
-rw-r--r--src/shared/conf-parser.c6
-rwxr-xr-xtest/test-efi-create-disk.sh4
-rw-r--r--units/systemd-nspawn@.service.in4
26 files changed, 164 insertions, 83 deletions
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 4857e94733..8a6db1f629 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -15,6 +15,7 @@ Following these guidelines makes it easier for us to process your issue, and ens
* Make sure to post PRs only relative to a very recent git master.
* Follow our [Coding Style](https://raw.githubusercontent.com/systemd/systemd/master/CODING_STYLE) when contributing code. This is a requirement for all code we merge.
+* Please make sure to test your change before submitting the PR. See [HACKING](https://raw.githubusercontent.com/systemd/systemd/master/HACKING) for details how to do this.
* Make sure to run "make check" locally, before posting your PR. We use a CI system, meaning we don't even look at your PR, if the build and tests don't pass.
* If you need to update the code in an existing PR, force-push into the same branch, overriding old commits with new versions.
* After you have pushed a new version, try to remove the `reviewed/needs-rework` label. Also add a comment about the new version (no notification is sent just for the commits, so it's easy to miss the update without an explicit comment).
diff --git a/HACKING b/HACKING
new file mode 100644
index 0000000000..3ee1c7e340
--- /dev/null
+++ b/HACKING
@@ -0,0 +1,68 @@
+HACKING ON SYSTEMD
+
+We welcome all contributions to systemd. If you notice a bug or a missing
+feature, please feel invited to fix it, and submit your work as a github Pull
+Request (PR):
+
+ https://github.com/systemd/systemd/pull/new
+
+Please make sure to follow our Coding Style when submitting patches. See
+CODING_STYLE for details. Also have a look at our Contribution Guidelines:
+
+ https://github.com/systemd/systemd/blob/master/.github/CONTRIBUTING.md
+
+Please always test your work before submitting a PR. For many of the components
+of systemd testing is straight-forward as you can simply compile systemd and
+run the relevant tool from the build directory.
+
+For some components (most importantly, systemd/PID1 itself) this is not
+possible, however. In order to simplify testing for cases like this we provide
+a set of "mkosi" build files directly in the source tree. "mkosi" is a tool for
+building clean OS images from an upstream distribution in combination with a
+fresh build of the project in the local working directory. To make use of this,
+please acquire "mkosi" from https://github.com/systemd/mkosi first, unless your
+distribution has packaged it already and you can get it from there. After the
+tool is installed it is sufficient to type "mkosi" in the systemd project
+directory to generate a disk image "image.raw" you can boot either in
+systemd-nspawn or in an UEFI-capable VM:
+
+ # systemd-nspawn -bi image.raw
+
+or:
+
+ # qemu-kvm -m 512 -smp 2 -bios /usr/share/edk2/ovmf/OVMF_CODE.fd -hda image.raw
+
+Every time you rerun the "mkosi" command a fresh image is built, incorporating
+all current changes you made to the project tree.
+
+Alternatively, you may install the systemd version from your git check-out
+directly on top of your host system's directory tree. This mostly works fine,
+but of course you should know what you are doing as you might make your system
+unbootable in case of a bug in your changes. Also, you might step into your
+package manager's territory with this. Be careful!
+
+And never forget: most distributions provide very simple and convenient ways to
+install all development packages necessary to build systemd. For example, on
+Fedora the following command line should be sufficient to install all of
+systemd's build dependencies:
+
+ # dnf builddep systemd
+
+Putting this all together, here's a series of commands for preparing a patch
+for systemd (this example is for Fedora):
+
+ $ git clone https://github.com/systemd/systemd.git
+ $ cd systemd
+ $ vim src/core/main.c # or wherever you'd like to make your changes
+ $ dnf builddep systemd # install build dependencies
+ $ ./autogen.sh c # configure the source tree
+ $ make -j `nproc` # build it locally, see if everything compiles fine
+ $ sudo mkosi # build a test image
+ $ sudo systemd-nspawn -bi image.raw # boot up the test image
+ $ git add -p # interactively put together your patch
+ $ git commit # commit it
+ $ ...
+
+And after that, please submit your branch as PR to systemd via github.
+
+Happy hacking!
diff --git a/README.md b/README.md
index dc628e8003..35ab9663ca 100644
--- a/README.md
+++ b/README.md
@@ -11,6 +11,8 @@ Information about build requirements are provided in the [README file](../master
Consult our [NEWS file](../master/NEWS) for information about what's new in the most recent systemd versions.
+Please see the [HACKING file](../master/HACKING) for information how to hack on systemd and test your modifications.
+
Please see our [Contribution Guidelines](../master/.github/CONTRIBUTING.md) for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our [Coding Style Guidelines](../master/CODING_STYLE).
diff --git a/TODO b/TODO
index 06659ee50d..ef25ef578e 100644
--- a/TODO
+++ b/TODO
@@ -69,6 +69,8 @@ Features:
* expose the "privileged" flag of ExecCommand on the bus, and open it up to
transient units
+* allow attaching additional journald log fields to cgroups
+
* rework fopen_temporary() to make use of open_tmpfile_linkable() (problem: the
kernel doesn't support linkat() that replaces existing files, currently)
diff --git a/hwdb/60-evdev.hwdb b/hwdb/60-evdev.hwdb
index eceaddbd01..d4cd61c24d 100644
--- a/hwdb/60-evdev.hwdb
+++ b/hwdb/60-evdev.hwdb
@@ -219,6 +219,13 @@ evdev:name:SynPS/2 Synaptics TouchPad:dmi:*svnLENOVO*:pn*ThinkPad*X230*
EVDEV_ABS_01=::100
EVDEV_ABS_36=::100
+# Lenovo Y700-14ISK
+evdev:name:AlpsPS/2 ALPS GlidePoint:dmi:*svnLENOVO:*pvrLenovoideapadY700-14ISK*
+ EVDEV_ABS_00=::27
+ EVDEV_ABS_01=::29
+ EVDEV_ABS_35=::27
+ EVDEV_ABS_36=::29
+
#########################################
# Samsung
#########################################
diff --git a/man/bootctl.xml b/man/bootctl.xml
index ebd58750d3..6e835c037f 100644
--- a/man/bootctl.xml
+++ b/man/bootctl.xml
@@ -74,14 +74,14 @@
<para><command>bootctl update</command> updates all installed
versions of systemd-boot, if the current version is newer than the
version installed in the EFI system partition. This also includes
- the EFI default/fallback loader at /EFI/Boot/boot*.efi. A
+ the EFI default/fallback loader at /EFI/BOOT/BOOT*.EFI. A
systemd-boot entry in the EFI boot variables is created if there
is no current entry. The created entry will be added to the end of
the boot order list.</para>
<para><command>bootctl install</command> installs systemd-boot into
the EFI system partition. A copy of systemd-boot will be stored as
- the EFI default/fallback loader at /EFI/Boot/boot*.efi. A systemd-boot
+ the EFI default/fallback loader at /EFI/BOOT/BOOT*.EFI. A systemd-boot
entry in the EFI boot variables is created and added to the top
of the boot order list.</para>
diff --git a/man/udev_device_get_syspath.xml b/man/udev_device_get_syspath.xml
index b54749ed56..014f43b21c 100644
--- a/man/udev_device_get_syspath.xml
+++ b/man/udev_device_get_syspath.xml
@@ -184,10 +184,10 @@
to such a parent device. On failure, <constant>NULL</constant>
is returned.</para>
- <para>On success, <function>udev_device_get_is_initialized()</function>
- returns either <constant>1</constant> or <constant>0</constant>,
- depending on whether the passed device is initialized or not. On
- failure, a negative error code is returned.</para>
+ <para>On success, <function>udev_device_get_is_initialized()</function> returns either <constant>1</constant> or
+ <constant>0</constant>, depending on whether the passed device has already been initialized by udev or not. On
+ failure, a negative error code is returned. Note that devices for which no udev rules are defined are never
+ reported initialized.</para>
</refsect1>
<refsect1>
diff --git a/po/it.po b/po/it.po
index 24504da42b..7afa5c3b9c 100644
--- a/po/it.po
+++ b/po/it.po
@@ -1,14 +1,14 @@
# Italian translations for systemd package
# Traduzione in italiano per il pacchetto systemd
# This file is distributed under the same license as the systemd package.
-# Daniele Medri <dmedri@gmail.com>, 2013-2015.
+# Daniele Medri <dmedri@gmail.com>, 2013-2016.
#
msgid ""
msgstr ""
"Project-Id-Version: systemd\n"
-"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2016-05-07 04:45+0200\n"
-"PO-Revision-Date: 2016-05-07 04:55+0200\n"
+"Report-Msgid-Bugs-To: https://github.com/systemd/systemd/issues\n"
+"POT-Creation-Date: 2016-07-15 13:11+0200\n"
+"PO-Revision-Date: 2016-07-20 10:54+0200\n"
"Last-Translator: Daniele Medri <dmedri@gmail.com>\n"
"Language-Team: Italian\n"
"Language: it\n"
@@ -63,7 +63,7 @@ msgstr ""
#: ../src/core/org.freedesktop.systemd1.policy.in.in.h:9
msgid "Reload the systemd state"
-msgstr "Riavvia lo stato di systemd"
+msgstr "Ricarica lo stato di systemd"
#: ../src/core/org.freedesktop.systemd1.policy.in.in.h:10
msgid "Authentication is required to reload the systemd state."
@@ -292,7 +292,7 @@ msgstr ""
#: ../src/login/org.freedesktop.login1.policy.in.h:27
msgid "Power off the system"
-msgstr "Spegni il sistema (power off)"
+msgstr "Spegni il sistema"
#: ../src/login/org.freedesktop.login1.policy.in.h:28
msgid "Authentication is required for powering off the system."
@@ -300,7 +300,7 @@ msgstr "Autenticazione richiesta per spegnere il sistema."
#: ../src/login/org.freedesktop.login1.policy.in.h:29
msgid "Power off the system while other users are logged in"
-msgstr "Spegni il sistema (power off) mentre altri utenti sono connessi"
+msgstr "Spegni il sistema mentre altri utenti sono connessi"
#: ../src/login/org.freedesktop.login1.policy.in.h:30
msgid ""
@@ -312,9 +312,7 @@ msgstr ""
#: ../src/login/org.freedesktop.login1.policy.in.h:31
msgid "Power off the system while an application asked to inhibit it"
-msgstr ""
-"Spegni il sistema (power off) mentre un'applicazione chiede di inibirne "
-"l'azione"
+msgstr "Spegni il sistema mentre un'applicazione chiede di inibirne l'azione"
#: ../src/login/org.freedesktop.login1.policy.in.h:32
msgid ""
@@ -326,7 +324,7 @@ msgstr ""
#: ../src/login/org.freedesktop.login1.policy.in.h:33
msgid "Reboot the system"
-msgstr "Riavvia il sistema (reboot)"
+msgstr "Riavvia il sistema"
#: ../src/login/org.freedesktop.login1.policy.in.h:34
msgid "Authentication is required for rebooting the system."
@@ -334,7 +332,7 @@ msgstr "Autenticazione richiesta per riavviare il sistema."
#: ../src/login/org.freedesktop.login1.policy.in.h:35
msgid "Reboot the system while other users are logged in"
-msgstr "Riavvia il sistema (reboot) mentre altri utenti sono connessi"
+msgstr "Riavvia il sistema mentre altri utenti sono connessi"
#: ../src/login/org.freedesktop.login1.policy.in.h:36
msgid ""
@@ -346,9 +344,7 @@ msgstr ""
#: ../src/login/org.freedesktop.login1.policy.in.h:37
msgid "Reboot the system while an application asked to inhibit it"
-msgstr ""
-"Riavvia il sistema (reboot) mentre un'applicazione chiede di inibirne "
-"l'azione"
+msgstr "Riavvia il sistema mentre un'applicazione chiede di inibirne l'azione"
#: ../src/login/org.freedesktop.login1.policy.in.h:38
msgid ""
@@ -360,7 +356,7 @@ msgstr ""
#: ../src/login/org.freedesktop.login1.policy.in.h:39
msgid "Suspend the system"
-msgstr "Sospendi il sistema (suspend)"
+msgstr "Sospendi il sistema"
#: ../src/login/org.freedesktop.login1.policy.in.h:40
msgid "Authentication is required for suspending the system."
@@ -368,7 +364,7 @@ msgstr "Autenticazione richiesta per sospendere il sistema."
#: ../src/login/org.freedesktop.login1.policy.in.h:41
msgid "Suspend the system while other users are logged in"
-msgstr "Sospendi il sistema (suspend) mentre altri utenti sono connessi"
+msgstr "Sospendi il sistema mentre altri utenti sono connessi"
#: ../src/login/org.freedesktop.login1.policy.in.h:42
msgid ""
@@ -380,9 +376,7 @@ msgstr ""
#: ../src/login/org.freedesktop.login1.policy.in.h:43
msgid "Suspend the system while an application asked to inhibit it"
-msgstr ""
-"Sospendi il sistema (suspend) mentre un'applicazione chiede di inibirne "
-"l'azione"
+msgstr "Sospendi il sistema mentre un'applicazione chiede di inibirne l'azione"
#: ../src/login/org.freedesktop.login1.policy.in.h:44
msgid ""
@@ -394,7 +388,7 @@ msgstr ""
#: ../src/login/org.freedesktop.login1.policy.in.h:45
msgid "Hibernate the system"
-msgstr "Iberna il sistema (hibernate)"
+msgstr "Iberna il sistema"
#: ../src/login/org.freedesktop.login1.policy.in.h:46
msgid "Authentication is required for hibernating the system."
@@ -402,7 +396,7 @@ msgstr "Autenticazione richiesta per ibernare il sistema."
#: ../src/login/org.freedesktop.login1.policy.in.h:47
msgid "Hibernate the system while other users are logged in"
-msgstr "Iberna il sistema (hibernate) mentre altri utenti sono connessi"
+msgstr "Iberna il sistema mentre altri utenti sono connessi"
#: ../src/login/org.freedesktop.login1.policy.in.h:48
msgid ""
@@ -414,9 +408,7 @@ msgstr ""
#: ../src/login/org.freedesktop.login1.policy.in.h:49
msgid "Hibernate the system while an application asked to inhibit it"
-msgstr ""
-"Iberna il sistema (hibernate) mentre un'applicazione chiede di inibirne "
-"l'azione"
+msgstr "Iberna il sistema mentre un'applicazione chiede di inibirne l'azione"
#: ../src/login/org.freedesktop.login1.policy.in.h:50
msgid ""
@@ -448,8 +440,7 @@ msgstr "Autenticazione richiesta per bloccare o sbloccare le sessioni attive."
#: ../src/login/org.freedesktop.login1.policy.in.h:55
msgid "Allow indication to the firmware to boot to setup interface"
msgstr ""
-"Permette indicazioni per il firmware per avviare l'interfaccia di "
-"configurazione"
+"Permette indicazioni al firmware per avviare l'interfaccia di configurazione"
#: ../src/login/org.freedesktop.login1.policy.in.h:56
msgid ""
diff --git a/rules/99-systemd.rules.in b/rules/99-systemd.rules.in
index fb4517606d..ca52cf165b 100644
--- a/rules/99-systemd.rules.in
+++ b/rules/99-systemd.rules.in
@@ -56,8 +56,7 @@ SUBSYSTEM=="backlight", TAG+="systemd", IMPORT{builtin}="path_id", ENV{SYSTEMD_W
SUBSYSTEM=="leds", KERNEL=="*kbd_backlight", TAG+="systemd", IMPORT{builtin}="path_id", ENV{SYSTEMD_WANTS}+="systemd-backlight@leds:$name.service"
# Pull in rfkill save/restore for all rfkill devices
-
-SUBSYSTEM=="rfkill", IMPORT{builtin}="path_id"
+SUBSYSTEM=="rfkill", ENV{SYSTEMD_RFKILL}="1", IMPORT{builtin}="path_id"
SUBSYSTEM=="misc", KERNEL=="rfkill", TAG+="systemd", ENV{SYSTEMD_WANTS}+="systemd-rfkill.socket"
# Asynchronously mount file systems implemented by these modules as soon as they are loaded.
diff --git a/src/basic/missing_syscall.h b/src/basic/missing_syscall.h
index e102083684..e6fd67cb9d 100644
--- a/src/basic/missing_syscall.h
+++ b/src/basic/missing_syscall.h
@@ -279,6 +279,8 @@ static inline key_serial_t request_key(const char *type, const char *description
# define __NR_copy_file_range 391
# elif defined __aarch64__
# define __NR_copy_file_range 285
+# elif defined __powerpc__
+# define __NR_copy_file_range 379
# else
# warning "__NR_copy_file_range not defined for your architecture"
# endif
diff --git a/src/basic/nss-util.h b/src/basic/nss-util.h
index bf7c4854fc..e7844fff96 100644
--- a/src/basic/nss-util.h
+++ b/src/basic/nss-util.h
@@ -137,7 +137,7 @@ enum nss_status _nss_##module##_getpwnam_r( \
struct passwd *pwd, \
char *buffer, size_t buflen, \
int *errnop) _public_; \
-enum nss_status _nss_mymachines_getpwuid_r( \
+enum nss_status _nss_##module##_getpwuid_r( \
uid_t uid, \
struct passwd *pwd, \
char *buffer, size_t buflen, \
diff --git a/src/boot/bootctl.c b/src/boot/bootctl.c
index 0d42948720..7cb2259717 100644
--- a/src/boot/bootctl.c
+++ b/src/boot/bootctl.c
@@ -288,7 +288,7 @@ static int status_binaries(const char *esp_path, sd_id128_t partition) {
else if (r < 0)
return r;
- r = enumerate_binaries(esp_path, "EFI/Boot", "boot");
+ r = enumerate_binaries(esp_path, "EFI/BOOT", "boot");
if (r == 0)
log_error("No default/fallback boot loader installed in ESP.");
else if (r < 0)
@@ -548,7 +548,7 @@ static int mkdir_one(const char *prefix, const char *suffix) {
static const char *efi_subdirs[] = {
"EFI",
"EFI/systemd",
- "EFI/Boot",
+ "EFI/BOOT",
"loader",
"loader/entries"
};
@@ -579,7 +579,7 @@ static int copy_one_file(const char *esp_path, const char *name, bool force) {
char *v;
/* Create the EFI default boot loader name (specified for removable devices) */
- v = strjoina(esp_path, "/EFI/Boot/BOOT", name + strlen("systemd-boot"));
+ v = strjoina(esp_path, "/EFI/BOOT/BOOT", name + strlen("systemd-boot"));
strupper(strrchr(v, '/') + 1);
k = copy_file(p, v, force);
@@ -781,7 +781,7 @@ static int remove_boot_efi(const char *esp_path) {
struct dirent *de;
int r, c = 0;
- p = strjoina(esp_path, "/EFI/Boot");
+ p = strjoina(esp_path, "/EFI/BOOT");
d = opendir(p);
if (!d) {
if (errno == ENOENT)
@@ -797,7 +797,7 @@ static int remove_boot_efi(const char *esp_path) {
if (!endswith_no_case(de->d_name, ".efi"))
continue;
- if (!startswith_no_case(de->d_name, "Boot"))
+ if (!startswith_no_case(de->d_name, "boot"))
continue;
fd = openat(dirfd(d), de->d_name, O_RDONLY|O_CLOEXEC);
diff --git a/src/core/cgroup.h b/src/core/cgroup.h
index f21409bd5d..a57403e79f 100644
--- a/src/core/cgroup.h
+++ b/src/core/cgroup.h
@@ -119,7 +119,6 @@ struct CGroupContext {
bool delegate;
};
-#include "cgroup-util.h"
#include "unit.h"
void cgroup_context_init(CGroupContext *c);
diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
index 27bbe2d26d..6167ce92cd 100644
--- a/src/core/dbus-cgroup.c
+++ b/src/core/dbus-cgroup.c
@@ -960,6 +960,7 @@ int bus_cgroup_set_property(
while ((r = sd_bus_message_read(message, "(ss)", &path, &rwm)) > 0) {
if ((!startswith(path, "/dev/") &&
+ !startswith(path, "/run/systemd/inaccessible/") &&
!startswith(path, "block-") &&
!startswith(path, "char-")) ||
strpbrk(path, WHITESPACE))
diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
index b2ef3db491..307c3d8e7a 100644
--- a/src/core/dbus-execute.c
+++ b/src/core/dbus-execute.c
@@ -695,9 +695,9 @@ const sd_bus_vtable bus_exec_vtable[] = {
SD_BUS_PROPERTY("Group", "s", NULL, offsetof(ExecContext, group), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("SupplementaryGroups", "as", NULL, offsetof(ExecContext, supplementary_groups), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("PAMName", "s", NULL, offsetof(ExecContext, pam_name), SD_BUS_VTABLE_PROPERTY_CONST),
- SD_BUS_PROPERTY("ReadWriteDirectories", "as", NULL, offsetof(ExecContext, read_write_paths), SD_BUS_VTABLE_PROPERTY_CONST),
- SD_BUS_PROPERTY("ReadOnlyDirectories", "as", NULL, offsetof(ExecContext, read_only_paths), SD_BUS_VTABLE_PROPERTY_CONST),
- SD_BUS_PROPERTY("InaccessibleDirectories", "as", NULL, offsetof(ExecContext, inaccessible_paths), SD_BUS_VTABLE_PROPERTY_CONST),
+ SD_BUS_PROPERTY("ReadWriteDirectories", "as", NULL, offsetof(ExecContext, read_write_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
+ SD_BUS_PROPERTY("ReadOnlyDirectories", "as", NULL, offsetof(ExecContext, read_only_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
+ SD_BUS_PROPERTY("InaccessibleDirectories", "as", NULL, offsetof(ExecContext, inaccessible_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
SD_BUS_PROPERTY("ReadWritePaths", "as", NULL, offsetof(ExecContext, read_write_paths), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("ReadOnlyPaths", "as", NULL, offsetof(ExecContext, read_only_paths), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("InaccessiblePaths", "as", NULL, offsetof(ExecContext, inaccessible_paths), SD_BUS_VTABLE_PROPERTY_CONST),
diff --git a/src/core/execute.c b/src/core/execute.c
index 05dc1aaec1..7c178b97c3 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -290,10 +290,10 @@ static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
}
static int connect_logger_as(
+ Unit *unit,
const ExecContext *context,
ExecOutput output,
const char *ident,
- const char *unit_id,
int nfd,
uid_t uid,
gid_t gid) {
@@ -329,7 +329,7 @@ static int connect_logger_as(
"%i\n"
"%i\n",
context->syslog_identifier ? context->syslog_identifier : ident,
- unit_id,
+ unit->id,
context->syslog_priority,
!!context->syslog_level_prefix,
output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
@@ -544,7 +544,7 @@ static int setup_output(
case EXEC_OUTPUT_KMSG_AND_CONSOLE:
case EXEC_OUTPUT_JOURNAL:
case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
- r = connect_logger_as(context, o, ident, unit->id, fileno, uid, gid);
+ r = connect_logger_as(unit, context, o, ident, fileno, uid, gid);
if (r < 0) {
log_unit_error_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
r = open_null_as(O_WRONLY, fileno);
@@ -3062,7 +3062,7 @@ int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
return r;
if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
- if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
+ if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, (*rt)->netns_storage_socket) < 0)
return -errno;
}
diff --git a/src/core/execute.h b/src/core/execute.h
index 73b8a119b0..189c4d0999 100644
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -30,6 +30,7 @@ typedef struct ExecParameters ExecParameters;
#include <stdio.h>
#include <sys/capability.h>
+#include "cgroup-util.h"
#include "fdset.h"
#include "list.h"
#include "missing.h"
@@ -203,9 +204,6 @@ struct ExecContext {
bool no_new_privileges_set:1;
};
-#include "cgroup-util.h"
-#include "cgroup.h"
-
struct ExecParameters {
char **argv;
char **environment;
@@ -236,6 +234,8 @@ struct ExecParameters {
int stderr_fd;
};
+#include "unit.h"
+
int exec_spawn(Unit *unit,
ExecCommand *command,
const ExecContext *context,
diff --git a/src/core/manager.c b/src/core/manager.c
index c69b797430..a0181e2138 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -64,7 +64,6 @@
#include "manager.h"
#include "missing.h"
#include "mkdir.h"
-#include "mkdir.h"
#include "parse-util.h"
#include "path-lookup.h"
#include "path-util.h"
diff --git a/src/core/namespace.c b/src/core/namespace.c
index 722538caf1..52a2505d94 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -291,16 +291,15 @@ static int apply_mount(
* inaccessible path. */
umount_recursive(m->path, 0);
- r = lstat(m->path, &target);
- if (r != 0) {
+ if (lstat(m->path, &target) < 0) {
if (m->ignore && errno == ENOENT)
return 0;
return -errno;
}
what = mode_to_inaccessible_node(target.st_mode);
- if (what == NULL) {
- log_debug("File type not supported. Note that symlinks are not allowed");
+ if (!what) {
+ log_debug("File type not supported for inaccessible mounts. Note that symlinks are not allowed");
return -ELOOP;
}
break;
@@ -331,12 +330,10 @@ static int apply_mount(
if (r >= 0) {
log_debug("Successfully mounted %s to %s", what, m->path);
return r;
- }
- else {
+ } else {
if (m->ignore && errno == ENOENT)
return 0;
- log_debug("Failed mounting %s to %s: %s", what, m->path, strerror(errno));
- return -errno;
+ return log_debug_errno(errno, "Failed to mount %s to %s: %m", what, m->path);
}
}
@@ -350,7 +347,8 @@ static int make_read_only(BindMount *m) {
else if (IN_SET(m->mode, READWRITE, PRIVATE_TMP, PRIVATE_VAR_TMP, PRIVATE_DEV)) {
r = bind_remount_recursive(m->path, false);
if (r == 0 && m->mode == PRIVATE_DEV) /* can be readonly but the submounts can't*/
- r = mount(NULL, m->path, NULL, MS_REMOUNT|DEV_MOUNT_OPTIONS|MS_RDONLY, NULL);
+ if (mount(NULL, m->path, NULL, MS_REMOUNT|DEV_MOUNT_OPTIONS|MS_RDONLY, NULL) < 0)
+ r = -errno;
} else
r = 0;
@@ -644,7 +642,7 @@ int setup_netns(int netns_storage_socket[2]) {
}
fail:
- lockf(netns_storage_socket[0], F_ULOCK, 0);
+ (void) lockf(netns_storage_socket[0], F_ULOCK, 0);
return r;
}
diff --git a/src/core/scope.h b/src/core/scope.h
index 94e9807bff..eaf8e8b447 100644
--- a/src/core/scope.h
+++ b/src/core/scope.h
@@ -21,7 +21,9 @@
typedef struct Scope Scope;
+#include "cgroup.h"
#include "kill.h"
+#include "unit.h"
typedef enum ScopeResult {
SCOPE_SUCCESS,
diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c
index 9f4903c842..85e2c943e3 100644
--- a/src/nspawn/nspawn-mount.c
+++ b/src/nspawn/nspawn-mount.c
@@ -297,18 +297,19 @@ int mount_all(const char *dest,
} MountPoint;
static const MountPoint mount_table[] = {
- { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true, true, false },
- { "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND, true, true, false }, /* Bind mount first */
- { NULL, "/proc/sys", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, true, true, false }, /* Then, make it r/o */
- { "tmpfs", "/sys", "tmpfs", "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV, true, false, true },
- { "sysfs", "/sys", "sysfs", NULL, MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, true, false, false },
- { "tmpfs", "/dev", "tmpfs", "mode=755", MS_NOSUID|MS_STRICTATIME, true, false, false },
- { "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true, false, false },
- { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true, false, false },
- { "tmpfs", "/tmp", "tmpfs", "mode=1777", MS_STRICTATIME, true, false, false },
+ { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true, true, false },
+ { "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND, true, true, false }, /* Bind mount first ...*/
+ { "/proc/sys/net", "/proc/sys/net", NULL, NULL, MS_BIND, true, true, true }, /* (except for this) */
+ { NULL, "/proc/sys", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, true, true, false }, /* ... then, make it r/o */
+ { "tmpfs", "/sys", "tmpfs", "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV, true, false, true },
+ { "sysfs", "/sys", "sysfs", NULL, MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, true, false, false },
+ { "tmpfs", "/dev", "tmpfs", "mode=755", MS_NOSUID|MS_STRICTATIME, true, false, false },
+ { "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true, false, false },
+ { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true, false, false },
+ { "tmpfs", "/tmp", "tmpfs", "mode=1777", MS_STRICTATIME, true, false, false },
#ifdef HAVE_SELINUX
- { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND, false, false, false }, /* Bind mount first */
- { NULL, "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, false, false, false }, /* Then, make it r/o */
+ { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND, false, false, false }, /* Bind mount first */
+ { NULL, "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, false, false, false }, /* Then, make it r/o */
#endif
};
diff --git a/src/nspawn/nspawn-register.c b/src/nspawn/nspawn-register.c
index 20103c5e88..7fd711b8a4 100644
--- a/src/nspawn/nspawn-register.c
+++ b/src/nspawn/nspawn-register.c
@@ -112,7 +112,7 @@ int register_machine(
* systemd-nspawn@.service, to keep the device
* policies in sync regardless if we are run with or
* without the --keep-unit switch. */
- r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 9,
+ r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 11,
/* Allow the container to
* access and create the API
* device nodes, so that
@@ -132,7 +132,11 @@ int register_machine(
* container to ever create
* these device nodes. */
"/dev/pts/ptmx", "rw",
- "char-pts", "rw");
+ "char-pts", "rw",
+ /* Allow /run/systemd/inaccessible/{chr,blk}
+ * devices inside the container */
+ "/run/systemd/inaccessible/chr", "rwm",
+ "/run/systemd/inaccessible/blk", "rwm");
if (r < 0)
return bus_log_create_error(r);
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index e4be0a2251..6c8263d3d5 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -101,9 +101,11 @@
#include "util.h"
/* Note that devpts's gid= parameter parses GIDs as signed values, hence we stay away from the upper half of the 32bit
- * UID range here */
+ * UID range here. We leave a bit of room at the lower end and a lot of room at the upper end, so that other subsystems
+ * may have their own allocation ranges too. */
#define UID_SHIFT_PICK_MIN ((uid_t) UINT32_C(0x00080000))
#define UID_SHIFT_PICK_MAX ((uid_t) UINT32_C(0x6FFF0000))
+
/* nspawn is listening on the socket at the path in the constant nspawn_notify_socket_path
* nspawn_notify_socket_path is relative to the container
* the init process in the container pid can send messages to nspawn following the sd_notify(3) protocol */
@@ -277,7 +279,6 @@ static void help(void) {
, program_invocation_short_name);
}
-
static int custom_mounts_prepare(void) {
unsigned i;
int r;
diff --git a/src/shared/conf-parser.c b/src/shared/conf-parser.c
index 83be79a4f5..d85ab5441e 100644
--- a/src/shared/conf-parser.c
+++ b/src/shared/conf-parser.c
@@ -708,6 +708,7 @@ int config_parse_strv(const char *unit,
void *userdata) {
char ***sv = data;
+ int r;
assert(filename);
assert(lvalue);
@@ -721,18 +722,19 @@ int config_parse_strv(const char *unit,
* we actually fill in a real empty array here rather
* than NULL, since some code wants to know if
* something was set at all... */
- empty = strv_new(NULL, NULL);
+ empty = new0(char*, 1);
if (!empty)
return log_oom();
strv_free(*sv);
*sv = empty;
+
return 0;
}
for (;;) {
char *word = NULL;
- int r;
+
r = extract_first_word(&rvalue, &word, WHITESPACE, EXTRACT_QUOTES|EXTRACT_RETAIN_ESCAPE);
if (r == 0)
break;
diff --git a/test/test-efi-create-disk.sh b/test/test-efi-create-disk.sh
index 56dd09abd7..cd4699dc18 100755
--- a/test/test-efi-create-disk.sh
+++ b/test/test-efi-create-disk.sh
@@ -11,8 +11,8 @@ mkfs.vfat -F32 ${LOOP}p1
mkdir -p mnt
mount ${LOOP}p1 mnt
-mkdir -p mnt/EFI/{Boot,systemd}
-cp systemd-bootx64.efi mnt/EFI/Boot/bootx64.efi
+mkdir -p mnt/EFI/{BOOT,systemd}
+cp systemd-bootx64.efi mnt/EFI/BOOT/BOOTX64.efi
[ -e /boot/shellx64.efi ] && cp /boot/shellx64.efi mnt/
diff --git a/units/systemd-nspawn@.service.in b/units/systemd-nspawn@.service.in
index ea28941507..8f9cf9acfe 100644
--- a/units/systemd-nspawn@.service.in
+++ b/units/systemd-nspawn@.service.in
@@ -20,7 +20,7 @@ RestartForceExitStatus=133
SuccessExitStatus=133
Slice=machine.slice
Delegate=yes
-TasksMax=8192
+TasksMax=16384
# Enforce a strict device policy, similar to the one nspawn configures
# when it allocates its own scope unit. Make sure to keep these
@@ -35,6 +35,8 @@ DeviceAllow=/dev/tty rwm
DeviceAllow=/dev/net/tun rwm
DeviceAllow=/dev/pts/ptmx rw
DeviceAllow=char-pts rw
+DeviceAllow=/run/systemd/inaccessible/chr rwm
+DeviceAllow=/run/systemd/inaccessible/blk rwm
# nspawn itself needs access to /dev/loop-control and /dev/loop, to
# implement the --image= option. Add these here, too.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-25 01:03:25 +0000