summaryrefslogtreecommitdiff
path: root/src/core/load-fragment-gperf.gperf.m4
AgeCommit message (Collapse)Author
2015-04-21automount: add expire supportMichael Olbrich
2015-01-07conf-parse: don't accept invalid bus names as BusName= arguments in service ↵Lennart Poettering
units
2015-01-06core: add new logic for services to store file descriptors in PID 1Lennart Poettering
With this change it is possible to send file descriptors to PID 1, via sd_pid_notify_with_fds() which PID 1 will store individually for each service, and pass via the usual fd passing logic on next invocation. This is useful for enable daemon reload schemes where daemons serialize their state to /run, push their fds into PID 1 and terminate, restoring their state on next start from the data in /run and passed in from PID 1. The fds are kept by PID 1 as long as no POLLHUP or POLLERR is seen on them, and the service they belong to are either not dead or failed, or have a job queued.
2014-11-30core: warn and ignore SysVStartPriority=Zbigniew Jędrzejewski-Szmek
Option was being parsed but not used for anything.
2014-11-30When warning about unsupported options, be more detailedZbigniew Jędrzejewski-Szmek
2014-11-24smack: introduce new SmackProcessLabel optionWaLyong Cho
In service file, if the file has some of special SMACK label in ExecStart= and systemd has no permission for the special SMACK label then permission error will occurred. To resolve this, systemd should be able to set its SMACK label to something accessible of ExecStart=. So introduce new SmackProcessLabel. If label is specified with SmackProcessLabel= then the child systemd will set its label to that. To successfully execute the ExecStart=, accessible label should be specified with SmackProcessLabel=. Additionally, by SMACK policy, if the file in ExecStart= has no SMACK64EXEC then the executed process will have given label by SmackProcessLabel=. But if the file has SMACK64EXEC then the SMACK64EXEC label will be overridden. [zj: reword man page]
2014-11-06core: introduce the concept of AssertXYZ= similar to ConditionXYZ=, but ↵Lennart Poettering
fatal for a start job if not met
2014-11-05core: introduce new Delegate=yes/no property controlling creation of cgroup ↵Lennart Poettering
subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine.
2014-10-28swap: replace Discard= setting by a more generic Options= settingLennart Poettering
For now, it's systemd itself that parses the options string, but as soon as util-linux' swapon can take the option string directly with -o we should pass it on unmodified.
2014-10-28job: optionally, when a job timeout is hit, also execute a failure actionLennart Poettering
2014-09-29swap: introduce Discard propertyJan Synacek
Process possible "discard" values from /etc/fstab.
2014-09-19socket: introduce SELinuxContextFromNet optionMichal Sekletar
This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_mls_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
2014-09-08bus: parse BusPolicy directive in service filesDaniel Mack
Add a new directive called BusPolicy to define custom endpoint policies. If one such directive is given, an endpoint object in the service's ExecContext is created and the given policy is added to it.
2014-08-19socket: suffix newly added TCP sockopt time properties with "Sec"Lennart Poettering
This is what we have done so far for all other time values, and hence we should do this here. This indicates the default unit of time values specified here, if they don't contain a unit.
2014-08-19Revert "socket: introduce SELinuxLabelViaNet option"Lennart Poettering
This reverts commit cf8bd44339b00330fdbc91041d6731ba8aba9fec. Needs more discussion on the mailing list.
2014-08-19socket: introduce SELinuxLabelViaNet optionMichal Sekletar
This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
2014-08-14socket: Add support for TCP defer acceptSusant Sahani
TCP_DEFER_ACCEPT Allow a listener to be awakened only when data arrives on the socket. If TCP_DEFER_ACCEPT set on a server-side listening socket, the TCP/IP stack will not to wait for the final ACK packet and not to initiate the process until the first packet of real data has arrived. After sending the SYN/ACK, the server will then wait for a data packet from a client. Now, only three packets will be sent over the network, and the connection establishment delay will be significantly reduced.
2014-08-14socket: Add Support for TCP keep alive variablesSusant Sahani
The tcp keep alive variables now can be configured via conf parameter. Follwing variables are now supported by this patch. tcp_keepalive_intvl: The number of seconds between TCP keep-alive probes tcp_keepalive_probes: The maximum number of TCP keep-alive probes to send before giving up and killing the connection if no response is obtained from the other end. tcp_keepalive_time: The number of seconds a connection needs to be idle before TCP begins sending out keep-alive probes.
2014-08-14Revert "socket: add support for TCP fast Open"Lennart Poettering
This reverts commit 9528592ff8d7ff361da430285deba8196e8984d5. Apparently TFO is actually the default at least for the server side now. Also the setsockopt doesn't actually take a bool, but a qlen integer.
2014-08-14socket: add support for TCP fast OpenSusant Sahani
TCP Fast Open (TFO) speeds up the opening of successiveTCP) connections between two endpoints.It works by using a TFO cookie in the initial SYN packet to authenticate a previously connected client. It starts sending data to the client before the receipt of the final ACK packet of the three way handshake is received, skipping a round trip and lowering the latency in the start of transmission of data.
2014-08-14socket: add support for tcp nagleSusant Sahani
This patch adds support for TCP TCP_NODELAY socket option. This can be configured via NoDelay conf parameter. TCP Nagle's algorithm works by combining a number of small outgoing messages, and sending them all at once. This controls the TCP_NODELAY socket option.
2014-07-08load-fragment: ConditionFirstBoot wants a bool string, not a pathMichal Schmidt
2014-07-07firstboot: get rid of firstboot generator again, introduce ↵Lennart Poettering
ConditionFirstBoot= instead As Zbigniew pointed out a new ConditionFirstBoot= appears like the nicer way to hook in systemd-firstboot.service on first boots (those with /etc unpopulated), so let's do this, and get rid of the generator again.
2014-07-03core: introduce new RestartForceExitStatus= service settingLennart Poettering
This does the inverse of RestartPreventExitStatus=: it forces a restart of a service when a certain exit status is returned by a service process.
2014-06-17install: introduce new DefaultInstance= field for [Install] sectionsLennart Poettering
The DefaultInstance= name is used when enabling template units when only specifying the template name, but no instance. Add DefaultInstance=tty1 to getty@.service, so that when the template itself is enabled an instance for tty1 is created. This is useful so that we "systemctl preset-all" can work properly, because we can operate on getty@.service after finding it, and the right instance is created.
2014-06-16mount: add new SloppyOptions= setting for mount units, mapping to mount(8)'s ↵Lennart Poettering
"-s" switch
2014-06-13core: add new ConditionNeedsUpdate= unit conditionLennart Poettering
This new condition allows checking whether /etc or /var are out-of-date relative to /usr. This is the counterpart for the update flag managed by systemd-update-done.service. Services that want to be started once after /usr got updated should use: [Unit] ConditionNeedsUpdate=/etc Before=systemd-update-done.service This makes sure that they are only run if /etc is out-of-date relative to /usr. And that it will be executed after systemd-update-done.service which is responsible for marking /etc up-to-date relative to the current /usr. ConditionNeedsUpdate= will also checks whether /etc is actually writable, and not trigger if it isn't, since no update is possible then.
2014-06-05kdbus: when uploading bus name policy, resolve users/groups out-of-processLennart Poettering
It's not safe invoking NSS from PID 1, hence fork off worker processes that upload the policy into the kernel for busnames.
2014-06-05socket: add SocketUser= and SocketGroup= for chown()ing sockets in the file ↵Lennart Poettering
system This is relatively complex, as we cannot invoke NSS from PID 1, and thus need to fork a helper process temporarily.
2014-06-04core: make sure we properly parse ProtectHome= and ProtectSystem=Lennart Poettering
2014-06-04core: rename ReadOnlySystem= to ProtectSystem= and add a third value for ↵Lennart Poettering
also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.
2014-06-04socket: add new Symlinks= option for socket unitsLennart Poettering
With Symlinks= we can manage one or more symlinks to AF_UNIX or FIFO nodes in the file system, with the same lifecycle as the socket itself. This has two benefits: first, this allows us to remove /dev/log and /dev/initctl from /dev, thus leaving only symlinks, device nodes and directories in the /dev tree. More importantly however, this allows us to move /dev/log out of /dev, while still making it accessible there, so that PrivateDevices= can provide /dev/log too.
2014-06-04socket: optionally remove sockets/FIFOs in the file system after useLennart Poettering
2014-06-03core: add new ReadOnlySystem= and ProtectedHome= settings for service unitsLennart Poettering
ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for a service. ProtectedHome= uses fs namespaces to mount /home and /run/user inaccessible or read-only for a service. This patch also enables these settings for all our long-running services. Together they should be good building block for a minimal service sandbox, removing the ability for services to modify the operating system or access the user's private data.
2014-05-22cgroups: simplify CPUQuota= logicLennart Poettering
Only accept cpu quota values in percentages, get rid of period definition. It's not clear whether the CFS period controllable per-cgroup even has a future in the kernel, hence let's simplify all this, hardcode the period to 100ms and only accept percentage based quota values.
2014-05-22cgroup: rework startup logicLennart Poettering
Introduce a (unsigned long) -1 as "unset" state for cpu shares/block io weights, and keep the startup unit set around all the time.
2014-05-22core: add startup resource control optionWaLyong Cho
Similar to CPUShares= and BlockIOWeight= respectively. However only assign the specified weight during startup. Each control group attribute is re-assigned as weight by CPUShares=weight and BlockIOWeight=weight after startup. If not CPUShares= or BlockIOWeight= be specified, then the attribute is re-assigned to each default attribute value. (default cpu.shares=1024, blkio.weight=1000) If only CPUShares=weight or BlockIOWeight=weight be specified, then that implies StartupCPUShares=weight and StartupBlockIOWeight=weight.
2014-05-19fix spelling of privilegeNis Martensen
2014-04-25core: expose CFS CPU time quota as high-level unit propertiesLennart Poettering
2014-04-24service: rename StartLimitAction enum to FailureActionMichael Olbrich
It's used for the FailureAction property as well.
2014-04-24service: add FailureAction= optionMichael Olbrich
It has the same possible values as StartLimitAction= and is executed immediately if a service fails.
2014-04-21service: add support for reboot argument when triggered by StartLimitAction=Michael Olbrich
When rebooting with systemctl, an optional argument can be passed to the reboot system call. This makes it possible the specify the argument in a service file and use it when the service triggers a restart. This is useful to distinguish between manual reboots and reboots caused by failing services.
2014-03-24core: remove tcpwrap supportLennart Poettering
tcpwrap is legacy code, that is barely maintained upstream. It's APIs are awful, and the feature set it exposes (such as DNS and IDENT access control) questionnable. We should not support this natively in systemd. Hence, let's remove the code. If people want to continue making use of this, they can do so by plugging in "tcpd" for the processes they start. With that scheme things are as well or badly supported as they were from traditional inetd, hence no functionality is really lost.
2014-03-24timer: support timers that can resume the system from suspendLennart Poettering
2014-03-21timer: add timer persistance (aka anacron-like behaviour)Lennart Poettering
2014-03-19busname: introduce Activating directiveDaniel Mack
Add a new config 'Activating' directive which denotes whether a busname is actually registered on the bus. It defaults to 'yes'. If set to 'no', the .busname unit only uploads policy, which will remain active as long as the unit is running.
2014-03-18core: add new AcceptFD= setting to .busname unitsLennart Poettering
AcceptFD= defaults to true, thus making sure that by default fd passing is enabled for all activatable names. Since for normal bus connections fd passing is enabled too by default this makes sure fd passing works correctly regardless whether a service is already activated or not. Making this configurable on both busname units and in bus connections is messy, but unavoidable since busnames are established and may queue messages before the connection feature negotiation is done by the service eventually activated. Conversely, feature negotiation on bus connections takes place before the connection acquires its names. Of course, this means developers really should make sure to keep the settings in .busname units in sync with what they later intend to negotiate.
2014-03-07busname: add parser for bus name policiesDaniel Mack
There are three directives to specify bus name polices in .busname files: * AllowUser [username] [access] * AllowGroup [groupname] [access] * AllowWorld [access] Where [access] is one of * 'see': The user/group/world is allowed to see a name on the bus * 'talk': The user/group/world is allowed to talk to a name * 'own': The user/group/world is allowed to own a name There is no user added yet in this commit.
2014-03-05core: don't override NoNewPriviliges= from SystemCallFilter= if it is ↵Lennart Poettering
already explicitly set
2014-03-03conf-parser: config_parse_path_strv() is not generic, so let's move it into ↵Lennart Poettering
load-fragment.c The parse code actually checked for specific lvalue names, which is really wrong for supposedly generic parsers...