| Age | Commit message (Collapse) | Author |
|---|
|
This patch adds to new options:
-Z PROCESS_LABEL
This specifies the process label to run on processes run within the container.
-L FILE_LABEL
The file label to assign to memory file systems created within the container.
For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following
chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
|
|
This is now part of libsystemd.
|
|
|
|
|
|
|
|
|
|
|
|
Ensure to start getty programs on all essential system consoles on Linux on
System z. Add these essential devices to the list of virtualization_consoles
to always generate getty configurations.
For the sake of completion, the list of essential consoles is:
/dev/sclp_line0 - Operating system messages applet (LPAR)
/dev/ttysclp0 - Integrated ASCII console applet (z/VM and LPAR)
/dev/ttyS0 - Already handled by systemd (3215 console on z/VM)
/dev/hvc0 - Already handled by systemd (IUCV HVC terminal on z/VM)
Depending on the environment, z/VM or LPAR, only a subset of these terminals
are available.
See also RH BZ 860158[1] "Cannot login via Operating System Console into RHEL7
instance installed on a LPAR". This bugzilla actually blocks the installation
of Linux on System z instances in LPAR mode.
[1] https://bugzilla.redhat.com/show_bug.cgi?id=860158
|
|
|
|
|
|
By specifiy a Controller property when creating the scope a client can
specify a bus name that will be notified with a RequestStop bus signal
when the scope has been asked to shut down, instead of sending SIGTERM
to the scope processes themselves.
https://bugzilla.redhat.com/show_bug.cgi?id=1032695
|
|
|
|
|
|
The kernel will not be changed to support this, so drop the code. Listening
for all RTM_NEWLINK messages and filtering on name is reliable, so it is not
a problem.
|
|
Compute the 'secs' field as seconds since start of lease acquisition
procedure. Start off with a value of zero and increase it only for
each resent DHCP discover message. See the discussion before and
after http://www.ietf.org/mail-archive/web/dhcwg/current/msg05836.html
and Section 3.1 of RFC 2131.
|
|
Go back to Init state independent of the current state the client
is in.
|
|
A checksum field with value zero means no UDP checksum has been
computed for the packet.
|
|
|
|
|
|
In trying to track down a stupid linker bug, I noticed a bunch of
memset() calls that should be using memzero() to make it more "obvious"
that the options are correct (i.e. 0 is not the length, but the data to
set). So fix up all current calls to memset(foo, 0, length) to
memzero(foo, length).
|
|
It would crash and the legend in the bottom followed the time 0.0.
|
|
Missed in 5c795114.
|
|
|
|
|
|
When creating a new link, the kernel will not inform us about the new ifindex
in its ack. We have to listen for newly created devices and deduce the new
ifindex by matching on the ifname.
We used to do this by waiting for a new device from libudev, but that is asking
for trouble, as udev will happily rename the device before handing it to us.
Listen on rtnl instead, the chance of the name being changed before reaching us
is much smaller (if not nil).
Kernel patch in the works to make this unneccessary.
|
|
|
|
This was originally included in the dhcp-client at my request, but it is not
really dhcp-specific and useful outside of it, so let's pull it out.
|
|
|
|
Error out if the address family is already set to something incompatible with the
address being parsed.
|
|
These connections are never torn down, even when the DHCP specifications say that
they should be. This is useful/necessary when the rootfs (or another critical fs)
is mounted over this network connection, and dataloss would result if the connection
is lost.
This option defaults to off, but our initrd generator (TBD) will enable it when
applicable.
|
|
(Also, only send the audit msg once, too)
|
|
|
|
well-known name into the sender
|
|
GetNameOwner() bus call is the bus driver name itself, for compatibility
with dbus1
|
|
|
|
never come
|
|
|
|
Given that we now have KillMode=mixed where SIGTERM might kill a smaller
set than SIGKILL we need to make sure to always go explicitly throught
the SIGKILL state to get the right end result.
|
|
|
|
process, but SIGKILL to all daemon processes
This should fix some race with terminating systemd --user, where the
system systemd instance might race against the user systemd instance
when sending SIGTERM.
|
|
(The kernel module got fixed, so let's reenable this again)
|
|
|
|
We'd reqeue the next status update very soon after. Change it so that we wait
for full 5s without any job status changes until we print anything.
|
|
This reverts commit 28c758de94bc8ba97b89d9dab3f517cf466978d0
but makes job_coldplug smarter.
In (v1) I changed the job start timestamp to be always set, so the
start time can be reported in the cylon eye message. The bug was that
when deserializing jobs, they would be ignored if their start
timestamp was unset which was synonymous with no timeout. But after
the change, jobs would have a start timestamp set despite having no
timeout. After deserialization they would be considered immediately
expired. Fix this by checking if the timeout is not zero when
considering jobs for expiration.
|
|
It is nice to wrap umask handling and return convention,
but glibc's mkostemp is async-signal-safe already.
|
|
Current glibc implementation is safe. Kernel does this atomically,
and write is actually implemented through writev. So if write is
async-signal-safe, than writev pretty much must be too.
|
|
Let's unify our code here, and also always specifiy O_CLOEXEC.
|
|
|
|
On other archs we'll not define it so that open_tmpfile() falls back to
unguessable name + unlink.
|
|
|
