summaryrefslogtreecommitdiff
path: root/src/core
AgeCommit message (Collapse)Author
2016-11-16core: rename "clients" field of Job structure to "bus_track"Lennart Poettering
Let's make semantics of this field more similar to the same functionality in the Unit object, in particular as we add new functionality to it later on.
2016-11-16core: drop n_in_gc_queue field of Manager structureLennart Poettering
We count the units in the GC queue with this, but actually never make use of it, hence drop it.
2016-11-16core: a few small coding style/modernization updates for job.cLennart Poettering
2016-11-16shared: split out code for adding multiple names to sd_bus_track objectLennart Poettering
Let's introduce a new call bus_track_add_name_many() that adds a string list to a tracking object.
2016-11-15core:gperf: pass the exec_context struct directly to parse restrict namespacesDjalal Harouni
The RestrictNamespaces= takes yes, no or a list of namespaces types, therefor config_parse_restrict_namespaces() is a bit complex and it operates on the ExecContext, fix this by passing the offset of ExecContext directly otherwise restricting namespaces won't work.
2016-11-15core: property is RestrictNamespaces with sDjalal Harouni
2016-11-15core: improve the logic that implies no new privilegesDjalal Harouni
The no_new_privileged_set variable is not used any more since commit 9b232d3241fcfbf60af that fixed another thing. So remove it. Also no need to check if we are under user manager, remove that part too.
2016-11-10core:namespace: count and free failed paths inside chase_all_symlinks() (#4619)Djalal Harouni
This certainly fixes a bug that was introduced by PR https://github.com/systemd/systemd/pull/4594 that intended to fix https://github.com/systemd/systemd/issues/4567. The fix was not complete. This patch makes sure that we count and free all paths that fail inside chase_all_symlinks(). Fixes https://github.com/systemd/systemd/issues/4567
2016-11-08core: on DynamicUser= make sure that protecting sensitive paths is enforced ↵Djalal Harouni
(#4596) This adds a variable that is always set to false to make sure that protect paths inside sandbox are always enforced and not ignored. The only case when it is set to true is on DynamicUser=no and RootDirectory=/chroot is set. This allows users to use more our sandbox features inside RootDirectory= The only exception is ProtectSystem=full|strict and when DynamicUser=yes is implied. Currently RootDirectory= is not fully compatible with these due to two reasons: * /chroot/usr|etc has to be present on ProtectSystem=full * /chroot// has to be a mount point on ProtectSystem=strict.
2016-11-08Merge pull request #4536 from poettering/seccomp-namespacesZbigniew Jędrzejewski-Szmek
core: add new RestrictNamespaces= unit file setting Merging, not rebasing, because this touches many files and there were tree-wide cleanups in the mean time.
2016-11-08Merge pull request #4612 from keszybz/format-stringsZbigniew Jędrzejewski-Szmek
Format string tweaks (and a small fix on 32bit)
2016-11-08Merge pull request #4509 from keszybz/foreach-word-quotedMartin Pitt
Remove FOREACH_WORD_QUOTED
2016-11-07Rename formats-util.h to format-util.hZbigniew Jędrzejewski-Szmek
We don't have plural in the name of any other -util files and this inconsistency trips me up every time I try to type this file name from memory. "formats-util" is even hard to pronounce.
2016-11-07nspawn: slight simplificationZbigniew Jędrzejewski-Szmek
2016-11-07nspawn: avoid one strdup by using free_and_replaceZbigniew Jędrzejewski-Szmek
2016-11-07core: make RootDirectory= and ProtectKernelModules= workDjalal Harouni
Instead of having two fields inside BindMount struct where one is stack based and the other one is heap, use one field to store the full path and updated it when we chase symlinks. This way we avoid dealing with both at the same time. This makes RootDirectory= work with ProtectHome= and ProtectKernelModules=yes Fixes: https://github.com/systemd/systemd/issues/4567
2016-11-05core/device: port to extract_first_wordZbigniew Jędrzejewski-Szmek
2016-11-05core/load-fragment: modify existing environment instead of copying strv over ↵Zbigniew Jędrzejewski-Szmek
and over
2016-11-05core/load-fragment: port to extract_first_wordZbigniew Jędrzejewski-Szmek
2016-11-05tree-wide: drop unneded WHITESPACE param to extract_first_wordZbigniew Jędrzejewski-Szmek
It's the default, and NULL is shorter.
2016-11-04core: add new RestrictNamespaces= unit file settingLennart Poettering
This new setting permits restricting whether namespaces may be created and managed by processes started by a unit. It installs a seccomp filter blocking certain invocations of unshare(), clone() and setns(). RestrictNamespaces=no is the default, and does not restrict namespaces in any way. RestrictNamespaces=yes takes away the ability to create or manage any kind of namspace. "RestrictNamespaces=mnt ipc" restricts the creation of namespaces so that only mount and IPC namespaces may be created/managed, but no other kind of namespaces. This setting should be improve security quite a bit as in particular user namespacing was a major source of CVEs in the kernel in the past, and is accessible to unprivileged processes. With this setting the entire attack surface may be removed for system services that do not make use of namespaces.
2016-11-03Merge pull request #4510 from keszybz/tree-wide-cleanupsLennart Poettering
Tree wide cleanups
2016-11-03core: intialize user aux groups and SupplementaryGroups= when DynamicUser= ↵Djalal Harouni
is set Make sure that when DynamicUser= is set that we intialize the user supplementary groups and that we also support SupplementaryGroups= Fixes: https://github.com/systemd/systemd/issues/4539 Thanks Evgeny Vereshchagin (@evverx)
2016-11-02Revert some uses of xsprintfZbigniew Jędrzejewski-Szmek
This reverts some changes introduced in d054f0a4d4. xsprintf should be used in cases where we calculated the right buffer size by hand (using DECIMAL_STRING_MAX and such), and never in cases where we are printing externally specified strings of arbitrary length. Fixes #4534.
2016-11-02Merge pull request #4481 from poettering/perpetualZbigniew Jędrzejewski-Szmek
Add "perpetual" unit concept, sysctl fixes, networkd fixes, systemctl color fixes, nspawn discard.
2016-11-02core: make a constant table actually constantLennart Poettering
2016-11-02core: don't hit an assert when printing status messages about units with ↵Lennart Poettering
overly long description strings This essentially reverts one part of d054f0a4d451120c26494263fc4dc175bfd405b1. (We might also choose to use proper ellipsation here, but I wasn't sure the memory allocation this requires wouöld be a good idea here...) Fixes: #4534
2016-11-02Merge pull request #4456 from keszybz/stored-fdsLennart Poettering
Preserve stored fds over service restart
2016-11-02Merge pull request #4483 from poettering/exec-orderLennart Poettering
more seccomp fixes, and change of order of selinux/aa/smack and seccomp application on exec
2016-11-02pid1: fix fd memleak when we hit FileDescriptorStoreMax limitZbigniew Jędrzejewski-Szmek
Since service_add_fd_store() already does the check, remove the redundant check from service_add_fd_store_set(). Also, print a warning when repopulating FDStore after daemon-reexec and we hit the limit. This is a user visible issue, so we should not discard fds silently. (Note that service_deserialize_item is impacted by the return value from service_add_fd_store(), but we rely on the general error message, so the caller does not need to be modified, and does not show up in the diff.)
2016-11-02core: change mount_synthesize_root() return to intLennart Poettering
Let's propagate the error here, instead of eating it up early. In a later change we should probably also change mount_enumerate() to propagate errors up, but that would mean we'd have to change the unit vtable, and thus change all unit types, hence is quite an invasive change.
2016-11-02unit: unify some code with new unit_new_for_name() callLennart Poettering
2016-11-02core: make the root mount perpetual tooLennart Poettering
Now that have a proper concept of "perpetual" units, let's make the root mount one too, since it also cannot go away.
2016-11-02core: rework the "no_gc" unit flag to become a more generic "perpetual" flagLennart Poettering
So far "no_gc" was set on -.slice and init.scope, to units that are always running, cannot be stopped and never exist in an "inactive" state. Since these units are the only users of this flag, let's remodel it and rename it "perpetual" and let's derive more funcitonality off it. Specifically, refuse enqueing stop jobs for these units, and report that they are "unstoppable" in the CanStop bus property.
2016-11-02core: initialize groups list before checking SupplementaryGroups= of a unit ↵Djalal Harouni
(#4533) Always initialize the supplementary groups of caller before checking the unit SupplementaryGroups= option. Fixes https://github.com/systemd/systemd/issues/4531
2016-11-02execute: apply seccomp filters after changing selinux/aa/smack contextsLennart Poettering
Seccomp is generally an unprivileged operation, changing security contexts is most likely associated with some form of policy. Moreover, while seccomp may influence our own flow of code quite a bit (much more than the security context change) make sure to apply the seccomp filters immediately before executing the binary to invoke. This also moves enforcement of NNP after the security context change, so that NNP cannot affect it anymore. (However, the security policy now has to permit the NNP change). This change has a good chance of breaking current SELinux/AA/SMACK setups, because the policy might not expect this change of behaviour. However, it's technically the better choice I think and should hence be applied. Fixes: #3993
2016-11-01core: when restarting services, don't close fdsZbigniew Jędrzejewski-Szmek
We would close all the stored fds in service_release_resources(), which of course broke the whole concept of storing fds over service restart. Fixes #4408.
2016-10-28pid1: nicely log when doing operation on stored fdsZbigniew Jędrzejewski-Szmek
Should help with debugging #4408.
2016-10-28pid1: only log about added fd if it was really addedZbigniew Jędrzejewski-Szmek
If it was a duplicate, log nothing.
2016-10-28Merge pull request #4495 from topimiettinen/block-shmat-execDjalal Harouni
seccomp: also block shmat(..., SHM_EXEC) for MemoryDenyWriteExecute
2016-10-28Merge pull request #4458 from keszybz/man-nonewprivilegesMartin Pitt
Document NoNewPrivileges default value
2016-10-27core: make unit argument const for apply seccomp functionsDjalal Harouni
2016-10-27core: lets apply working directory just after mount namespacesDjalal Harouni
This makes applying groups after applying the working directory, this may allow some flexibility but at same it is not a big deal since we don't execute or do anything between applying working directory and droping groups.
2016-10-27core: get the working directory value inside apply_working_directory()Djalal Harouni
Improve apply_working_directory() and lets get the current working directory inside of it.
2016-10-27core: move apply working directory code into its own apply_working_directory()Djalal Harouni
2016-10-27core: move the code that setups namespaces on its own functionDjalal Harouni
2016-10-26seccomp: also block shmat(..., SHM_EXEC) for MemoryDenyWriteExecuteTopi Miettinen
shmat(..., SHM_EXEC) can be used to create writable and executable memory, so let's block it when MemoryDenyWriteExecute is set.
2016-10-24Merge pull request #4450 from poettering/seccompfixesZbigniew Jędrzejewski-Szmek
Various seccomp fixes and NEWS update.
2016-10-24core: move initialization of -.slice and init.scope into the unit_load() ↵Lennart Poettering
callbacks Previously, we'd synthesize the root slice unit and the init scope unit in the enumerator callbacks for the unit type. This is problematic if either of them is already referenced from a unit that is loaded as result of another unit type's enumerator logic. Let's clean this up and simply create the two objects from the enumerator callbacks, if they are not around yet. Do the actual filling in of the settings from the unit_load() callbacks, to match how other units are loaded. Fixes: #4322
2016-10-24seccomp: add new helper call seccomp_load_filter_set()Lennart Poettering
This allows us to unify most of the code in apply_protect_kernel_modules() and apply_private_devices().
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-28 15:23:24 +0000