summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-02-09man: update pam_systemd and systemd-logind man pages a bitLennart Poettering
This builds on @utezduyar's #4640, but extends on it. Fixes: #4550 Replaces: #4640
2017-02-09man: improve documentation on seccomp regarding alternative ABIsLennart Poettering
Let's clarify that RestrictAddressFamilies= and MemoryDenyWriteExecute= are only fully effective if non-native system call architectures are disabled, since they otherwise may be used to circumvent the filters, as the filters aren't equally effective on all ABIs. Fixes: #5277
2017-02-09Merge pull request #5287 from poettering/exit-codesZbigniew Jędrzejewski-Szmek
rework WorkingDirectory= and RootDirectory= management for services
2017-02-09Merge pull request #5255 from poettering/percent-escapeZbigniew Jędrzejewski-Szmek
fstab-generator: Options= applies specifier expansion
2017-02-09execute: set the right exit status for CHDIR vs. CHROOTLennart Poettering
Fixes: #5125
2017-02-09execute: use prefix_roota() where appropriateLennart Poettering
2017-02-09execute: set working directory to /root if User= is not set, but ↵Lennart Poettering
WorkingDirectory=~ is Or actually, try to to do the right thing depending on what is available: - If we know $HOME from User=, then use that. - If the UID for the service is 0, hardcode that WorkingDirectory=~ means WorkingDirectory=/root - In any other case (which will be the unprivileged --user case), use get_home_dir() to find the $HOME of the user we are running as. - Otherwise fail. Fixes: #5246 #5124
2017-02-09Revert "core/execute: set HOME, USER also for root users"Lennart Poettering
This reverts commit 8b89628a10af3863bfc97872912e9da4076a5929. This broke #5246
2017-02-09networkd: add multicast membership to lldp socket (#5282)27o
2017-02-09dhcp-server: always save the ACKed lease address (#5281)27o
2017-02-09Merge pull request #5279 from keszybz/man-revertsMartin Pitt
A revert and some other tweaks for the man pages
2017-02-08Merge pull request #4962 from poettering/root-directory-2Zbigniew Jędrzejewski-Szmek
Add new MountAPIVFS= boolean unit file setting + RootImage=
2017-02-08man: add more commas for clarify and reword a few sentencesZbigniew Jędrzejewski-Szmek
2017-02-08man: revert documentation about RequiresMountsFor= honoring noautoZbigniew Jędrzejewski-Szmek
This effectively reverts commit 5d2abc04fc95f5c5f6d0eaf2f: Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> Date: Wed Apr 16 22:15:42 2014 -0400 man: document relationship between RequiresMountsFor and noauto https://bugzilla.redhat.com/show_bug.cgi?id=1088057 Fixes #5249.
2017-02-08man: break long lines and update Fedora versionsZbigniew Jędrzejewski-Szmek
We should try to keep the unbreakable lines below 80 columns. It's not always possible of course. Also, use the dl.fp.o alias instead of a specific mirror.
2017-02-09Merge pull request #5270 from poettering/seccomp-namespace-fixEvgeny Vereshchagin
swap seccomp filter params on s390
2017-02-09man: fix docs for swap's DefaultDependencies= (#5278)David Glasser
There was a missing dependency and one with the wrong type. Additionally, refer to DefaultDependencies= once instead of twice, without a vague reference in the first one that doesn't mention that the value matters. Fixes #5226.
2017-02-08update TODOLennart Poettering
2017-02-08seccomp: on s390 the clone() parameters are reversedLennart Poettering
Add a bit of code that tries to get the right parameter order in place for some of the better known architectures, and skips restrict_namespaces for other archs. This also bypasses the test on archs where we don't know the right order. In this case I didn't bother with testing the case where no filter is applied, since that is hopefully just an issue for now, as there's nothing stopping us from supporting more archs, we just need to know which order is right. Fixes: #5241
2017-02-08systemctl: make sure that --now is carried out (#5209)Jan Synacek
When services are already enabled/disabled/masked, make sure that --now still enforces start/stop.
2017-02-08sd-event: "when exiting no signal event are pending" is a wrong assertion ↵Franck Bui
(#5271) The code make the following assertion: when freeing a event loop object (usually it's done after exiting from the main event loop), no signal events are still queued and are pending. This assertion can be found in event_unmask_signal_data() with "assert(!d->current);" assertion. It appears that this assertion can be wrong at least in a specific case described below. Consider the following example which is inspired from udev: a process defines 3 source events: 2 are created by sd_event_add_signal() and 1 is created by sd_event_add_post(). 1. the process receives the 2 signals consecutively so that signal 'A' source event is queued and pending. Consequently the post source event is also queued and pending. This is done by sd_event_wait(). 2. The callback for signal 'A' is called by sd_event_dispatch(). 3. The next call to sd_event_wait() will queue signal 'B' source event. 4. The callback for the post source event is called and calls sd_event_exit(). 5. the event loop is exited. 6. freeing the event loop object will lead to the assertion failure in event_unmask_signal_data(). This patch simply removes this assertion as it doesn't seem to be a bug if the signal data still reference a signal source at this point.
2017-02-08sysctl.d: replace URL of SysRq key documentation (#5274)Peter Körner
The kernel documentation page is not distribution specific and also more likely to be up to date than the Fedora wiki page referenced previously.
2017-02-08fstab-generator: also convert % → %% for What=Lennart Poettering
Same reasons as the previous patch.
2017-02-08fstab-generator: Options= applies specifier expansionLennart Poettering
Let's document that this is the case, and properly escape % when we generate Options= in the generator. Fixes: #5086
2017-02-08nspawn: Add support for sysroot pivoting (#5258)Philip Withnall
Add a new --pivot-root argument to systemd-nspawn, which specifies a directory to pivot to / inside the container; while the original / is pivoted to another specified directory (if provided). This adds support for booting container images which may contain several bootable sysroots, as is common with OSTree disk images. When these disk images are booted on real hardware, ostree-prepare-root is run in conjunction with sysroot.mount in the initramfs to achieve the same results.
2017-02-08test: Fix a maybe-uninitialised compiler warning (#5269)Philip Withnall
The compiler warning is a false positive, since n_addresses is always initialised on the success path from parse_argv(), but the compiler obviously can’t work that out. Fixes: src/test/test-nss.c:426:9: warning: 'n_addresses' may be used uninitialized in this function [-Wmaybe-uninitialized]
2017-02-08seccomp: MemoryDenyWriteExecute= should affect both mmap() and mmap2() (#5254)Lennart Poettering
On i386 we block the old mmap() call entirely, since we cannot properly filter it. Thankfully it hasn't been used by glibc since quite some time. Fixes: #5240
2017-02-08Merge pull request #5231 from keszybz/mask-wantsLennart Poettering
Mask individual .wants/.requires symlinks
2017-02-07dissect: don't honour NOAUTO flags when looking for ESP (#5224)Lennart Poettering
The flag is originally defined for "basic data partitions", but not for the ESP. We reuse it for the various partitions defined by the Discoverable Partitions Spec, but it isn't defined for the ESP, hence don't check for it. Instead, do check for GPT_FLAG_NO_BLOCK_IO_PROTOCOL, as that flag actually is defined for all partition types, and recommended to use by the UEFI spec. Fixes: #5218
2017-02-07tests: add dropin dependency testsFranck Bui
[zj: tests assertions adjusted to the different logic in which masking of a dependency through one name, does not forbid the dependency being added through another name.]
2017-02-07core/load-dropin: add more sanity checks on .wants/.requires symlinksZbigniew Jędrzejewski-Szmek
Feb 04 22:35:42 systemd[1462]: foo.service: Wants dependency dropin /home/zbyszek/.config/systemd/user/foo.service.wants/diffname.service target ../barbar.service has different name Feb 04 22:35:42 systemd[1462]: foo.service: Wants dependency dropin /home/zbyszek/.config/systemd/user/foo.service.wants/wrongname is not a valid unit name, ignoring
2017-02-07core: drop code that is now unusedZbigniew Jędrzejewski-Szmek
2017-02-07core: implement masking of .wants/.requires symlinksZbigniew Jędrzejewski-Szmek
Fixes #1169. Fixes #4830. Example log errors: Feb 04 22:13:28 systemd[1462]: foo.service: Wants dependency on empty_file.service is masked by /home/zbyszek/.config/systemd/user/foo.service.wants/empty_file.service, ignoring Feb 04 22:13:28 systemd[1462]: foo.service: Wants dependency on masked.service is masked by /home/zbyszek/.config/systemd/user/foo.service.wants/masked.service, ignoring
2017-02-07core: when loading .wants and .requires, follow the same logic as .d conf ↵Zbigniew Jędrzejewski-Szmek
dropins Essentially, instead of sequentially adding deps based on all symlinks encountered in .wants and .requires dirs for each name and each unit file load path, iteratate over the load paths and unit names gathering symlinks, then order them based on priority, and then iterate over the final list, adding dependencies. This patch doesn't change the logic too much, except that the order in which dependencies are applied might be different. It wasn't defined before, so that not really a change. Adding filtering on the symlinks is left for later patches.
2017-02-07basic/dirent-util: allow suffix to be omitted for dirent_is_file_with_suffixZbigniew Jędrzejewski-Szmek
2017-02-07man: s/--unmount/--umount/g (#5243)Lennart Poettering
The --help text currently uses the "--umount" spelling, hence to the same in the man page too. And let's settle on "umount" instead of "unmount" here, since most folks probably expect that when typing in a command, as util-linux' tool is called "umount" after all, and so is the symlink "systemd-umount" we install.
2017-02-07Merge pull request #5263 from poettering/install-aliasZbigniew Jędrzejewski-Szmek
2017-02-07Revert "fix handling of templates instantiated in /usr/lib (#5263)"Zbigniew Jędrzejewski-Szmek
This reverts commit 0698b674920aa8a56dbd6a625729a35e5ae9c5df. It was supposed to be merged, not squashed.
2017-02-07fix handling of templates instantiated in /usr/lib (#5263)Lennart Poettering
Fix handling of templates instantiated in /usr/lib. All work to fix #5136.
2017-02-07man: document *.d/ drop-in file order (#5262)Lucas Werkmeister
2017-02-07tmpfiles.d: set primary group rights to r-w (#5265)lewo
If the /var/log/journal directory is created with rigths 700, the application of an ACL rules without any primary group right sets it to 0. A chmod 755 on this file will then only set the ACL mask and let the ACL primary group right to 0. The directory is then unreadable for the primary group. This patch explicitly sets the primary group to avoid this problem. Fixes #5264.
2017-02-07Merge pull request #5219 from poettering/run-size-checkZbigniew Jędrzejewski-Szmek
before reloading, check that /run/systemd has enough space
2017-02-07Merge pull request #5259 from lucaswerkmeister/manLennart Poettering
Manpage improvements
2017-02-07Merge pull request #5261 from AsciiWolf/masterLennart Poettering
l10n: various fixes
2017-02-07install: remove some unused parameters from various functions in install.cLennart Poettering
No need to pass what we don't use.
2017-02-07install: when a template unit is instantiated via a /usr symlink, consider ↵Lennart Poettering
it enabled If a unit foobar@.service stored below /usr is instantiated via a symlink foobar@quux.service also below /usr, then we should consider the instance statically enabled, while the template itself should continue to be considered enabled/disabled/static depending on its [Install] section. In order to implement this we'll now look for enablement symlinks in all unit search paths, not just in the config and runtime dirs. Fixes: #5136
2017-02-07l10n: fix file permissions of Indonesian translationAsciiWolf
2017-02-07l10n: fix strings formatting in Czech translationAsciiWolf
2017-02-07man: document that systemd-run --on-* cannot be used with --ptyLucas Werkmeister
2017-02-07install: don't enter loop when traversing a template symlinksLennart Poettering
Before this patch, if we'd encounter an instance or template symlink while traversing a chain of symlinks we'd fill in the instance name and retry the iteration. This makes no sense if the resulting name is actually the same as we are coming from, as we'd just spin a couple of times in the loop, until the UNIT_FILE_FOLLOW_SYMLINK_MAX iteration limit is hit. Fix this, by accepted the symlink as it is, if it identical to what we filled in.