| Age | Commit message (Collapse) | Author |
|---|
|
/etc/mtab should be labeled as "_", even though systemd has its own
smack label using '--with-smack-run-label' configuration. This is mainly
because all processes could read that file and the origin of this file
(i.e. /proc/mounts) is labeled as "_". This labels /etc/mtab as "_" when
'--with-smack-run-label' is enabled.
|
|
Do so only in /run. We shouldn't alter ACLs for existing files in /var,
but only for new files. If the admin made changes to the ACLs they
shouls stay in place.
We should still do recursive ACL changes for files in /run, since those
are not persistent, and will hence lack ACLs on every boot.
Also, /var/log/journal might be quit large, /run/log/journal is usually
not, hence we should avoid the recursive descending on /var, but not on
/run.
Fixes #534
|
|
Remove old temporary snapshots, but only at boot. Ideally we'd have
"self-destroying" btrfs snapshots that go away if the last last
reference to it does. To mimic a scheme like this at least remove the
old snapshots on fresh boots, where we know they cannot be referenced
anymore. Note that we actually remove all temporary files in
/var/lib/machines/ at boot, which should be safe since the directory has
defined semantics. In the root directory (where systemd-nspawn
--ephemeral places snapshots) we are more strict, to avoid removing
unrelated temporary files.
This also splits out nspawn/container related tmpfiles bits into a new
tmpfiles snippet to systemd-nspawn.conf
|
|
|
|
We will create the symlink on boot as a fallback to provide name
resolution. But if the symlink was removed afterwards, it most likely
should not be recreated. Creating it only on boot also solves the
issue where it would be created prematurely during installation,
before the system was actually booted.
https://bugzilla.redhat.com/show_bug.cgi?id=1197204
|
|
with them missing
This way the root subvolume can be left read-only easily, and variable
and user data writable with explicit quota set.
|
|
|
|
Add the +C file attribute (NOCOW) to the journal directories, so that
the flag is inherited automatically for new journal files created in
them. The journal write pattern is problematic on btrfs file systems as
it results in badly fragmented files when copy-on-write (COW) is used:
the performances decreases substantially over time.
To avoid this issue, this tmpfile.d snippet sets the NOCOW attribute to
the journal files directories, so newly created journal files inherit
the NCOOW attribute that disables copy-on-write.
Be aware that the NOCOW file attribute also disables btrfs checksumming
for these files, and thus prevents btrfs from rebuilding corrupted files
on a RAID filesystem.
In a single disk filesystems (or filesystems without redundancy) it is
safe to use the NOCOW flags without drawbacks, since the journal files
contain their own checksumming.
|
|
If HAVE_PAM isn't set then don't attempt to copy /etc/pam.d from the
factory, as it doesn't get installed.
|
|
"--disable-resolved"
This patch removes unnecessary blank line in
/usr/lib/tmpfiles.d/etc.conf when configured with "--disable-resolved".
(i.e. ENABLE_RESOLVED is not defined)
|
|
|
|
/var/lib/container to /var/lib/machines
Given that this is also the place to store raw disk images which are
very much bootable with qemu/kvm it sounds like a misnomer to call the
directory "container". Hence, let's change this sooner rather than
later, and use the generic name, in particular since we otherwise try to
use the generic "machine" preferably over the more specific "container"
or "vm".
|
|
In particular we upgrade /var/lib/container, /var/tmp and /tmp to
subvolumes.
|
|
Choose which system users defined in sysusers.d/systemd.conf and files
or directories in tmpfiles.d/systemd.conf, should be provided depending
on comile-time configuration.
|
|
The .service uses "/var/lib/container", not "containers".
|
|
Create /var/lib/containers so that it exists with an appropriate mode. We want
0700 by default so that users on the host aren't able to call suid root
binaries in the container. This becomes a security issue if a user can enter a
container as root, create a suid root binary, and call that from the host.
(This assumes that containers are caged by mandatory access control or are
started as user).
|
|
|
|
|
|
|
|
|
|
Now that logind will clean up all IPC resources of a user we should
really consider $XDG_RUNTIME_DIR as just another kind of IPC with the
same life-cycle logic as the other IPC resources. This should be safe
now to do since every user gets his own $XDG_RUNTIME_DIR tmpfs instance
with a fixed size limit, so that flooding of it will more effectively be
averted.
|
|
|
|
Management of /var/cache/man should move to the distribution package
owning the directory (for example, man-db). As man pages are a
non-essential part of the system and unnecessary for minimal setups,
there's no point in having systemd ship these lines.
Distribution packages should make sure the appropriate package for their
distribution adopts this line. Ideally, the line is adopted by the
upstream package.
For Fedora I have filed this bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1110274
|
|
destination before creating a symlink
Also, make use of this for mtab as long as mount insists on creating it
even if we invoke it with "-n".
|
|
doesn't exist
If /etc/resolv.conf doesn't exist it's better than nothing to make it
point to networkd's version.
|
|
|
|
from /etc
|
|
systemd-journal
Also, don't apply access mode recursively to /var/log/journal/*/, since
that might be quite large, and should be correct anyway.
|
|
directories they are contained in
|
|
|
|
Let's allow booting up with /var empty. Only create the most basic
directories to get to a working directory structure and symlink set in
/var.
|
|
"m" so far has been a non-globbing version of "z". Since this makes it
quite redundant, let's get rid of it. Remove "m" from the man pages,
beef up "z" docs instead, and make "m" nothing more than a compatibility
alias for "z".
|
|
Configuration will be in
root:root /run/systemd/network
and state will be in
systemd-network:systemd-network /run/systemd/netif
This matches what we do for logind's seat/session state.
|
|
|
|
|
|
This ways the networkd client library should work even if networkd is
not running.
http://lists.freedesktop.org/archives/systemd-devel/2014-May/019242.html
|
|
When starting up journald on a new system, set the proper permissions on
the system.journal files, not only on the journal directory.
|
|
Various operations done by systemd-tmpfiles may only be safely done at
boot (e.g. removal of X lockfiles in /tmp, creation of /run/nologin).
Other operations may be done at any point in time (e.g. setting the
ownership on /{run,var}/log/journal). This distinction is largely
orthogonal to the type of operation.
A new switch --unsafe is added, and operations which should only be
executed during bootup are marked with an exclamation mark in the
configuration files. systemd-tmpfiles.service is modified to use this
switch, and guards are added so it is hard to re-start it by mistake.
If we install a new version of systemd, we actually want to enforce
some changes to tmpfiles configuration immediately. This should now be
possible to do safely, so distribution packages can be modified to
execute the "safe" subset at package installation time.
/run/nologin creation is split out into a separate service, to make it
easy to override.
https://bugzilla.redhat.com/show_bug.cgi?id=1043212
https://bugzilla.redhat.com/show_bug.cgi?id=1045849
|
|
This way it is easy to only exclude directories from the current boot
from automatic clean up in /var/tmp.
Also, pick a longer name for the directories so that are globs in
tmp.conf can be simpler yet equally accurate.
|
|
In d8c9d3a (systemd: use unit name in PrivateTmp directories)
I forgot to update the tmpfiles config.
|
|
4608af4333d0f7f5 set permissions for journal storage on persistent disk
but not the volatile storage.
ref: https://bugs.archlinux.org/task/37170
|
|
Seeing http://www.happyassassin.net/2013/09/27/further-sysadmin-adventures-wheres-my-freeipa-badge/
it seems that the default message is a bit confusing for people
who never encountered it before, so adding a link to the manpage could
help them.
|
|
In order to avoid a deadlock between journald looking up the
"systemd-journal" group name, and nscd (or anyother NSS backing daemon)
logging something back to the journal avoid all NSS in journald the same
way as we avoid it from PID 1.
With this change we rely on the kernel file system logic to adjust the
group of created journal files via the SETGID bit on the journal
directory. To ensure that it is always set, even after the user created
it with a simply "mkdir" on the shell we fix it up via tmpfiles on boot.
|
|
Embedded folks don't need the machine registration stuff, hence it's
nice to make this optional. Also, I'd expect that machinectl will grow
additional commands quickly, for example to join existing containers and
suchlike, hence it's better keeping that separate from loginctl.
|
|
Currently, PrivateTmp=yes means that the service cannot see the /tmp
shared by rest of the system and is isolated from other services using
PrivateTmp, but users can access and modify /tmp as seen by the
service.
Move the private /tmp and /var/tmp directories into a 0077-mode
directory. This way unpriviledged users on the system cannot see (or
modify) /tmp as seen by the service.
|
|
|
|
See http://thread.gmane.org/gmane.comp.sysutils.systemd.devel/6874/focus=6891
Should fix https://bugzilla.redhat.com/show_bug.cgi?id=866693
|
|
|
|
|
|
systemd-user-sessoins.service will later on remove the flag file, thus
permitting user logins when the time has come.
|
