summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-07-22Merge pull request #3753 from poettering/tasks-max-scaleLennart Poettering
Add support for relative TasksMax= specifications, and bump default for services
2016-07-22coredump: truncate overly long coredump metadata fields (#3780)Lennart Poettering
Fixes: #3573 Replaces: #3588
2016-07-22systemctl: never check inhibitors if -H or -M are used (#3781)Lennart Poettering
Don't check inhibitors when operating remotely. The interactivity inhibitors imply can#t be provided anyway, and the current code checks for local sessions directly, via various sd_session_xyz() APIs, hence bypass it entirely if we operate on remote systems. Fixes: #3476
2016-07-22Merge pull request #3779 from kinvolk/alessandro/nspawn-inaccessible-devsLennart Poettering
cgroup: whitelist inaccessible devices for "auto" and "closed" DevicePolicy
2016-07-22cgroup: whitelist inaccessible devices for "auto" and "closed" DevicePolicy.Alessandro Puccetti
https://github.com/systemd/systemd/pull/3685 introduced /run/systemd/inaccessible/{chr,blk} to map inacessible devices, this patch allows systemd running inside a nspawn container to create /run/systemd/inaccessible/{chr,blk}.
2016-07-22nspawn: set DevicesPolicy closed and clean up duplicated devicesAlessandro Puccetti
2016-07-22namespace: ensure to return a valid inaccessible nodes (#3778)Alessandro Puccetti
Because /run/systemd/inaccessible/{chr,blk} are devices with major=0 and minor=0 it might be possible that these devices cannot be created so we use /run/systemd/inaccessible/sock instead to map them.
2016-07-22core: check for overflow when handling scaled MemoryLimit= settingsLennart Poettering
Just in case...
2016-07-22macros.systemd.in: add %systemd_ordering (#3776)Harald Hoyer
To remove the hard dependency on systemd, for packages, which function without a running systemd the %systemd_ordering macro can be used to ensure ordering in the rpm transaction. %systemd_ordering makes sure, the systemd rpm is installed prior to the package, so the %pre/%post scripts can execute the systemd parts. Installing systemd afterwards though, does not result in the same outcome.
2016-07-22core: change TasksMax= default for system services to 15%Lennart Poettering
As it turns out 512 is max number of tasks per service is hit by too many applications, hence let's bump it a bit, and make it relative to the system's maximum number of PIDs. With this change the new default is 15%. At the kernel's default pids_max value of 32768 this translates to 4915. At machined's default TasksMax= setting of 16384 this translates to 2457. Why 15%? Because it sounds like a round number and is close enough to 4096 which I was going for, i.e. an eight-fold increase over the old 512 Summary: | on the host | in a container old default | 512 | 512 new default | 4915 | 2457
2016-07-22logind: change TasksMax= value for user logins to 33%Lennart Poettering
Let's change from a fixed value of 12288 tasks per user to a relative value of 33%, which with the kernel's default of 32768 translates to 10813. This is a slight decrease of the limit, for no other reason than "33%" sounding like a nice round number that is close enough to 12288 (which would translate to 37.5%). (Well, it also has the nice effect of still leaving a bit of room in the PID space if there are 3 cooperating evil users that try to consume all PIDs... Also, I like my bikesheds blue). Since the new value is taken relative, and machined's TasksMax= setting defaults to 16384, 33% inside of containers is usually equivalent to 5406, which should still be ample space. To summarize: | on the host | in the container old default | 12288 | 12288 new default | 10813 | 5406
2016-07-22main: simplify things a bit by moving container check into fixup_environment()Lennart Poettering
2016-07-22core: rename MemoryLimitByPhysicalMemory transient property to MemoryLimitScaleLennart Poettering
That way, we can neatly keep this in line with the new TasksMaxScale= option. Note that we didn't release a version with MemoryLimitByPhysicalMemory= yet, hence this change should be unproblematic without breaking API.
2016-07-22core: support percentage specifications on TasksMax=Lennart Poettering
This adds support for a TasksMax=40% syntax for specifying values relative to the system's configured maximum number of processes. This is useful in order to neatly subdivide the available room for tasks within containers.
2016-07-22Merge pull request #3762 from poettering/sigkill-logMartin Pitt
log about all processes we forcibly kill
2016-07-22Merge pull request #3764 from poettering/assorted-stuff-2Martin Pitt
Assorted fixes
2016-07-21nspawn: enable major=0/minor=0 devices inside the container (#3773)Alessandro Puccetti
https://github.com/systemd/systemd/pull/3685 introduced /run/systemd/inaccessible/{chr,blk} to map inacessible devices, this patch allows systemd running inside a nspawn container to create /run/systemd/inaccessible/{chr,blk}.
2016-07-21missing_syscall: add __NR_copy_file_range for powerpc architecture (#3772)Alessio Igor Bogani
2016-07-21update TODOLennart Poettering
2016-07-21hwdb: axis resolution override for the Lenovo Y700 (#3769)Peter Hutterer
https://bugs.freedesktop.org/show_bug.cgi?id=97011
2016-07-21Merge pull request #3770 from AlexanderKurtz/masterLennart Poettering
bootctl: Always use upper case for "/EFI/BOOT" and "/EFI/BOOT/BOOT*.EFI".
2016-07-21core: remove duplicate includes (#3771)Thomas H. P. Andersen
2016-07-20Merge pull request #3760 from poettering/rfkill-fixZbigniew Jędrzejewski-Szmek
rfkill dead-lock fix
2016-07-20documentation: add a short document describing how to test your systemd ↵Lennart Poettering
build tree (#3763)
2016-07-21bootctl: Always use upper case for "/EFI/BOOT" and "/EFI/BOOT/BOOT*.EFI".Alexander Kurtz
If the ESP is not mounted with "iocharset=ascii", but with "iocharset=utf8" (which is for example the default in Debian), the file system becomes case sensitive. This means that a file created as "FooBarBaz" cannot be accessed as "foobarbaz" since those are then considered different files. Moreover, a file created as "FooBar" can then also not be accessed as "foobar", and it also prevents such a file from being created, as both would use the same 8.3 short name "FOOBAR". Even though the UEFI specification [0] does give the canonical spelling for the files mentioned above, not all implementations completely conform to that, so it's possible that those files would already exist, but with a different spelling, causing subtle bugs when scanning or modifying the ESP. While the proper fix would of course be that everybody conformed to the standard, we can work around this problem by just referencing the files by their 8.3 short names, i.e. using upper case. Fixes: #3740 [0] <http://www.uefi.org/specifications>, version 2.6, section 3.5.1.1
2016-07-21bootctl: Use lower case string constants in case-insensitive comparisons.Alexander Kurtz
2016-07-20namespace: fix wrong return value from mount(2) (#3758)Topi Miettinen
Fix bug introduced by #3263: mount(2) return value is 0 or -1, not errno. Thanks to Evgeny Vereshchagin (@evverx) for reporting.
2016-07-20basic: fix macro definition in nss-util.hLennart Poettering
Fix a copy/paste mistake.
2016-07-20execute: make sure JoinsNamespaceOf= doesn't leak ns fds to executed processesLennart Poettering
2016-07-20namespace: add a (void) castLennart Poettering
2016-07-20nspawn: when netns is on, mount /proc/sys/net writableLennart Poettering
Normally we make all of /proc/sys read-only in a container, but if we do have netns enabled we can make /proc/sys/net writable, as things are virtualized then.
2016-07-20nspawn: document why the uid shift range is the way it isLennart Poettering
2016-07-20conf-parser: minor coding style improvementsLennart Poettering
2016-07-20units: fix TasksMax=16384 for systemd-nspawn@.serviceLennart Poettering
When a container scope is allocated via machined it gets 16K set already since cf7d1a30e44bf380027a2e73f9bf13f423a33cc1. Make sure when a container is run as system service it gets the same values.
2016-07-20core: normalize header inclusion in execute.h a bitLennart Poettering
We don't actually need any functionality from cgroup.h in execute.h, hence don't include that. However, we do need the Unit structure from unit.h, hence include that, and move it as late as possible, since it needs the definitions from execute.h.
2016-07-20execute: normalize connect_logger_as() parameters slightlyLennart Poettering
All other functions in execute.c that need the unit id take a Unit* parameter as first argument. Let's change connect_logger_as() to follow a similar logic.
2016-07-20logind: always abandon session scopes before killing themLennart Poettering
This way systemd is informed that we consider everything inside the scope as "left-over", and systemd can log about killing it. With this change systemd will log about all processes killed due to the session clean-up on KillUserProcesses=yes.
2016-07-20core: when a scope was abandoned, always log about processes we killLennart Poettering
After all, if a unit is abandoned, all processes inside of it may be considered "left over" and are something we should better log about.
2016-07-20core: make sure RequestStop signal is send directedLennart Poettering
This was accidentally left commented out for debugging purposes, let's fix that and make the signal directed again.
2016-07-20cgroup: suppress sending follow-up SIGCONT after sending SIGCONT/SIGKILL anywayLennart Poettering
2016-07-20core: when forcibly killing/aborting left-over unit processes log about itLennart Poettering
Let's lot at LOG_NOTICE about any processes that we are going to SIGKILL/SIGABRT because clean termination of them didn't work. This turns the various boolean flag parameters to cg_kill(), cg_migrate() and related calls into a single binary flags parameter, simply because the function now gained even more parameters and the parameter listed shouldn't get too long. Logging for killing processes is done either when the kill signal is SIGABRT or SIGKILL, or on explicit request if KILL_TERMINATE_AND_LOG instead of LOG_TERMINATE is passed. This isn't used yet in this patch, but is made use of in a later patch.
2016-07-20PO: italian updates (#3761)Daniele Medri
2016-07-20util: don't send SIGCONT following a SIGCONT or SIGKILL in kill_and_sigcont()Lennart Poettering
2016-07-20logind: minor coding style improvementsLennart Poettering
2016-07-20Merge pull request #3759 from poettering/namespace-fixupLennart Poettering
minor follow-up fixes for #3685
2016-07-20rules: make sure always set at least one property on rfkill devicesLennart Poettering
The rfkill service waits for rfkill device initialization as reported by udev_device_is_initialized(), and if that is never reported it might dead-lock. However, udev never reports completed initialization for devices that have no properties or tags set. For some rfkill devices this might be the case, in particular those which are connected to exotic busses, where path_id returns nothing. This patch simply sets the SYSTEM_RFKILL property on all rfkill devices, to ensure that udev_device_is_initialized() always reports something useful and we don't dead-lock. Fixes: #2745
2016-07-20man: document a tiny bit better what udev_device_get_is_initialized() ↵Lennart Poettering
actually returns
2016-07-20namespace: minor improvementsLennart Poettering
We generally try to avoid strerror(), due to its threads-unsafety, let's do this here, too. Also, let's be tiny bit more explanatory with the log messages, and let's shorten a few things.
2016-07-20core: hide legacy bus propertiesLennart Poettering
We usually hide legacy bus properties from introspection. Let's do that for the InaccessibleDirectories= properties too. The properties stay accessible if requested, but they won't be listed anymore if people introspect the unit.
2016-07-19man: revise entry about specifying a file path (#3739)mulkieran
* Specifying a device node has an effect much larger than a simple shortcut for a field/value match, so the original sentence is no longer a good way to start the paragraph. * Specifying a device node causes matches to be generated for all ancestor devices of the device specified, not just its parents. * Indicates that the path must be absolute, but that it may be a link. * Eliminates a few typos.