summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-10-06core: leave PAM stub process around with GIDs updatedLennart Poettering
In the process execution code of PID 1, before 096424d1230e0a0339735c51b43949809e972430 the GID settings where changed before invoking PAM, and the UID settings after. After the change both changes are made after the PAM session hooks are run. When invoking PAM we fork once, and leave a stub process around which will invoke the PAM session end hooks when the session goes away. This code previously was dropping the remaining privs (which were precisely the UID). Fix this code to do this correctly again, by really dropping them else (i.e. the GID as well). While we are at it, also fix error logging of this code. Fixes: #4238
2016-10-06sd-bus: add DNS errors to the errno translation tableLennart Poettering
We generate these, hence we should also add errno translations for them.
2016-10-06resolved: properly handle BADCOOKIE DNS errorLennart Poettering
Add this new error code (documented in RFC7873) to our list of known errors.
2016-10-06sd-bus: add a few missing entries to the error translation tablesLennart Poettering
These were forgotten, let's add some useful mappings for all errors we define.
2016-10-06sd-device/networkd: unify code to get a socket for issuing netdev ioctls onLennart Poettering
As suggested here: https://github.com/systemd/systemd/pull/4296#issuecomment-251911349 Let's try AF_INET first as socket, but let's fall back to AF_NETLINK, so that we can use a protocol-independent socket here if possible. This has the benefit that our code will still work even if AF_INET/AF_INET6 is made unavailable (for exmple via seccomp), at least on current kernels.
2016-10-06update TODOLennart Poettering
2016-10-06Merge pull request #4280 from giuseppe/unprivileged-userLennart Poettering
[RFC] run systemd in an unprivileged container
2016-10-06units: systemd-udevd: add AF_INET and AF_INET6 to RestrictAddressFamilies= ↵Yu Watanabe
(#4296) The udev builtin command `net_setup_link` requires AF_INET and AF_INET6. Fixes #4293.
2016-10-06Merge pull request #4199 from dvdhrm/hwdb-orderLennart Poettering
hwdb: return conflicts in a well-defined order
2016-10-06core: do not fail in a container if we can't use setgroupsGiuseppe Scrivano
It might be blocked through /proc/PID/setgroups
2016-10-06audit: disable if cannot create NETLINK_AUDIT socketGiuseppe Scrivano
2016-10-06networkd: fix coding style (#4294)Susant Sahani
2016-10-06journald, ratelimit: fix inaccurate message suppression in ↵Yuki Inoguchi
journal_rate_limit_test() (#4291) Currently, the ratelimit does not handle the number of suppressed messages accurately. Even though the number of messages reaches the limit, it still allows to add one extra messages to journal. This patch fixes the problem.
2016-10-05catalog,po: update Polish translation (#4290)Piotr Drąg
2016-10-05Fix typoGiuseppe Scrivano
2016-10-05networkd: use BridgeFDB as well on bridge ports (#4253)Tobias Jungel
[BridgeFDB] did not apply to bridge ports so far. This patch adds the proper handling. In case of a bridge interface the correct flag NTF_MASTER is now set in the netlink call. FDB MAC addresses are now applied in link_enter_set_addresses to make sure the link is setup.
2016-10-05Added ArchLinux config for mkosi (#4274)Zeal Jagannatha
2016-10-05seccomp: add support for the s390 architecture (#4287)hbrueckner
Add seccomp support for the s390 architecture (31-bit and 64-bit) to systemd. This requires libseccomp >= 2.3.1.
2016-10-05nspawn: add log message to let users know that nspawn needs an empty /dev ↵Djalal Harouni
directory (#4226) Fixes https://github.com/systemd/systemd/issues/3695 At the same time it adds a protection against userns chown of inodes of a shared mount point.
2016-10-04NEWS: typo fixes (#4285)Thomas H. P. Andersen
2016-10-04tree-wide: remove consecutive duplicate words in commentsStefan Schweter
2016-10-04list: LIST_INSERT_BEFORE: update head if necessary (#4261)Michael Olbrich
If the new item is inserted before the first item in the list, then the head must be updated as well. Add a test to the list unit test to check for this.
2016-10-04automount: make sure the expire event is restarted after a daemon-reload (#4265)Michael Olbrich
If the corresponding mount unit is deserialized after the automount unit then the expire event is set up in automount_trigger_notify(). However, if the mount unit is deserialized first then the automount unit is still in state AUTOMOUNT_DEAD and automount_trigger_notify() aborts without setting up the expire event. Explicitly call automount_start_expire() during coldplug to make sure that the expire event is set up as necessary. Fixes #4249.
2016-10-04Typo (`mathes` → `matches`) (#4283)Lucas Werkmeister
2016-10-04po: updated Swedish translation (#4241)andhe
* po: updated Swedish translation * po: swedish: fix login vs write logs to confusion Since previous commit (updated messages) there's now a mix of different translation meanings for the same thing. While both translations are technically correct I think the meaning of the original messages are probably "to login" rather than "to write log messages to". This commit switches all translations to the "login" meaning.
2016-10-04Merge pull request #4273 from keszybz/docsMartin Pitt
Routing-domains-manpage tweak and NEWS update
2016-10-04Typo (`virtiualization` → `virtualization`) (#4281)Elias Probst
2016-10-03man: remove consecutive duplicate words (#4268)Stefan Schweter
This PR removes consecutive duplicate words from the man pages of: * `resolved.conf.xml` * `systemd.exec.xml` * `systemd.socket.xml`
2016-10-03nspawn: set shared propagation mode for the containerAlban Crequy
2016-10-03build-sys: use non-breaking spaces in contributor listZbigniew Jędrzejewski-Szmek
I think it's easier to read peoples' names with this change.
2016-10-03NEWS: add another batch of entriesZbigniew Jędrzejewski-Szmek
2016-10-03man: rework the explanation of Domains=Zbigniew Jędrzejewski-Szmek
Put more emphasis on the routing part. This is the more interesting thing, and also more complicated and novel. Explain "search domains" as the special case. Also explain the effect of ~. in more detail.
2016-10-03man: fix indentation in tableZbigniew Jędrzejewski-Szmek
<entry>-ies must be a single line of text. Otherwise docbook does strange things to the indentation.
2016-10-01core: do not try to create /run/systemd/transient in test modeZbigniew Jędrzejewski-Szmek
This prevented systemd-analyze from unprivileged operation on older systemd installations, which should be possible. Also, we shouldn't touch the file system in test mode even if we can.
2016-10-01analyze-verify: honour $SYSTEMD_UNIT_PATH, allow system paths to be ignoredZbigniew Jędrzejewski-Szmek
SYSTEMD_UNIT_PATH=foobar: systemd-analyze verify barbar/unit.service will load units from barbar/, foobar/, /etc/systemd/system/, etc. SYSTEMD_UNIT_PATH= systemd-analyze verify barbar/unit.service will load units only from barbar/, which is useful e.g. when testing systemd's own units on a system with an older version of systemd installed.
2016-10-01core: complain if Before= dep on .device is declaredZbigniew Jędrzejewski-Szmek
[Unit] Before=foobar.device [Service] ExecStart=/bin/true Type=oneshot $ systemd-analyze verify before-device.service before-device.service: Dependency Before=foobar.device ignored (.device units cannot be delayed)
2016-10-01systemctl: Add --wait option to wait until started units terminate againMartin Pitt
Fixes #3830
2016-10-01man: update mx record example (#4257)Stefan Schweter
2016-10-01Merge pull request #4164 from martinpitt/nss-resolveZbigniew Jędrzejewski-Szmek
nss-resolve: return NOTFOUND instead of UNAVAIL for DNSSEC validation failures
2016-10-01nss-resolve: return NOTFOUND instead of UNAVAIL on resolution errorsMartin Pitt
It needs to be possible to tell apart "the nss-resolve module does not exist" (which can happen when running foreign-architecture programs) from "the queried DNS name failed DNSSEC validation" or other errors. So return NOTFOUND for these cases too, and only keep UNAVAIL for the cases where we cannot handle the given address family. This makes it possible to configure a fallback to "dns" without breaking DNSSEC, with "resolve [!UNAVAIL=return] dns". Add this to the manpage. This does not change behaviour if resolved is not running, as that already falls back to the "dns" glibc module. Fixes #4157
2016-10-01man: drop myhostname from recommended nsswitch host configurationMartin Pitt
resolve includes myhostname functionality, so there is no need to add it again.
2016-10-01nss-resolve: simplify error handlingMartin Pitt
Handle general errors from the resolved call in _nss_resolve_gethostbyaddr2_r() the same say as in the other variants: Just "goto fail" as that does exactly the same.
2016-10-01core: update warning messageZbigniew Jędrzejewski-Szmek
"closing all" might suggest that _all_ fds received with the notification message will be closed. Reword the message to clarify that only the "unused" ones will be closed.
2016-10-01core: get rid of unneeded state variableZbigniew Jędrzejewski-Szmek
No functional change.
2016-09-30networkd: fix "parametres" typo (#4244)Elias Probst
2016-09-30Merge pull request #4225 from keszybz/coredumpMartin Pitt
coredump: remove Storage=both support, various fixes for sd-coredump and coredumpctl
2016-09-30resolved: don't query domain-limited DNS servers for other domains (#3621)Martin Pitt
DNS servers which have route-only domains should only be used for the specified domains. Routing queries about other domains there is a privacy violation, prone to fail (as that DNS server was not meant to be used for other domains), and puts unnecessary load onto that server. Introduce a new helper function dns_server_limited_domains() that checks if the DNS server should only be used for some selected domains, i. e. has some route-only domains without "~.". Use that when determining whether to query it in the scope, and when writing resolv.conf. Extend the test_route_only_dns() case to ensure that the DNS server limited to ~company does not appear in resolv.conf. Add test_route_only_dns_all_domains() to ensure that a server that also has ~. does appear in resolv.conf as global name server. These reproduce #3420. Add a new test_resolved_domain_restricted_dns() test case that verifies that domain-limited DNS servers are only being used for those domains. This reproduces #3421. Clarify what a "routing domain" is in the manpage. Fixes #3420 Fixes #3421
2016-09-29pid1: more informative error message for ignored notificationsZbigniew Jędrzejewski-Szmek
It's probably easier to diagnose a bad notification message if the contents are printed. But still, do anything only if debugging is on.
2016-09-29pid1: process zero-length notification messages againZbigniew Jędrzejewski-Szmek
This undoes 531ac2b234. I acked that patch without looking at the code carefully enough. There are two problems: - we want to process the fds anyway - in principle empty notification messages are valid, and we should process them as usual, including logging using log_unit_debug().
2016-09-29pid1: don't return any error in manager_dispatch_notify_fd() (#4240)Franck Bui
If manager_dispatch_notify_fd() fails and returns an error then the handling of service notifications will be disabled entirely leading to a compromised system. For example pid1 won't be able to receive the WATCHDOG messages anymore and will kill all services supposed to send such messages.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-12-25 05:53:54 +0000