#include <sys/prctl.h>
#include <sys/utsname.h>
#include <unistd.h>
-#if HAVE_SECCOMP
-#include <seccomp.h>
-#endif
#if HAVE_VALGRIND_VALGRIND_H
# include <valgrind/valgrind.h>
#endif
#include "chase.h"
#include "clock-util.h"
#include "conf-parser.h"
+#include "confidential-virt.h"
+#include "copy.h"
#include "cpu-set-util.h"
#include "crash-handler.h"
#include "dbus-manager.h"
#include "psi-util.h"
#include "random-util.h"
#include "rlimit-util.h"
-#if HAVE_SECCOMP
#include "seccomp-util.h"
-#endif
#include "selinux-setup.h"
#include "selinux-util.h"
#include "signal-util.h"
#include "time-util.h"
#include "umask-util.h"
#include "user-util.h"
+#include "version.h"
#include "virt.h"
#include "watchdog.h"
#include <sanitizer/lsan_interface.h>
#endif
-#define DEFAULT_TASKS_MAX ((TasksMax) { 15U, 100U }) /* 15% */
-
static enum {
ACTION_RUN,
ACTION_HELP,
static bool arg_switched_root;
static PagerFlags arg_pager_flags;
static bool arg_service_watchdogs;
-static ExecOutput arg_default_std_output;
-static ExecOutput arg_default_std_error;
-static usec_t arg_default_restart_usec;
-static usec_t arg_default_timeout_start_usec;
-static usec_t arg_default_timeout_stop_usec;
-static usec_t arg_default_timeout_abort_usec;
-static usec_t arg_default_device_timeout_usec;
-static bool arg_default_timeout_abort_set;
-static usec_t arg_default_start_limit_interval;
-static unsigned arg_default_start_limit_burst;
+static UnitDefaults arg_defaults;
static usec_t arg_runtime_watchdog;
static usec_t arg_reboot_watchdog;
static usec_t arg_kexec_watchdog;
static char *arg_watchdog_device;
static char **arg_default_environment;
static char **arg_manager_environment;
-static struct rlimit *arg_default_rlimit[_RLIMIT_MAX];
static uint64_t arg_capability_bounding_set;
static bool arg_no_new_privs;
static nsec_t arg_timer_slack_nsec;
-static usec_t arg_default_timer_accuracy_usec;
static Set* arg_syscall_archs;
static FILE* arg_serialization;
-static int arg_default_cpu_accounting;
-static bool arg_default_io_accounting;
-static bool arg_default_ip_accounting;
-static bool arg_default_blockio_accounting;
-static bool arg_default_memory_accounting;
-static bool arg_default_tasks_accounting;
-static TasksMax arg_default_tasks_max;
-static usec_t arg_default_memory_pressure_threshold_usec;
-static CGroupPressureWatch arg_default_memory_pressure_watch;
static sd_id128_t arg_machine_id;
static EmergencyAction arg_cad_burst_action;
-static OOMPolicy arg_default_oom_policy;
static CPUSet arg_cpu_affinity;
static NUMAPolicy arg_numa_policy;
static usec_t arg_clock_usec;
static void *arg_random_seed;
static size_t arg_random_seed_size;
-static int arg_default_oom_score_adjust;
-static bool arg_default_oom_score_adjust_set;
-static char *arg_default_smack_process_label;
static usec_t arg_reload_limit_interval_sec;
static unsigned arg_reload_limit_burst;
static int console_setup(void) {
_cleanup_close_ int tty_fd = -EBADF;
+ unsigned rows, cols;
int r;
tty_fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
if (r < 0)
return log_error_errno(r, "Failed to reset /dev/console: %m");
- return 0;
-}
-
-static int set_machine_id(const char *m) {
- sd_id128_t t;
- assert(m);
-
- if (sd_id128_from_string(m, &t) < 0)
- return -EINVAL;
-
- if (sd_id128_is_null(t))
- return -EINVAL;
+ r = proc_cmdline_tty_size("/dev/console", &rows, &cols);
+ if (r < 0)
+ log_warning_errno(r, "Failed to get terminal size, ignoring: %m");
+ else {
+ r = terminal_set_size_fd(tty_fd, NULL, rows, cols);
+ if (r < 0)
+ log_warning_errno(r, "Failed to set terminal size, ignoring: %m");
+ }
- arg_machine_id = t;
return 0;
}
if (r < 0)
log_warning_errno(r, "Failed to parse default standard output switch %s, ignoring: %m", value);
else
- arg_default_std_output = r;
+ arg_defaults.std_output = r;
} else if (proc_cmdline_key_streq(key, "systemd.default_standard_error")) {
if (r < 0)
log_warning_errno(r, "Failed to parse default standard error switch %s, ignoring: %m", value);
else
- arg_default_std_error = r;
+ arg_defaults.std_error = r;
} else if (streq(key, "systemd.setenv")) {
if (proc_cmdline_value_missing(key, value))
return 0;
- r = set_machine_id(value);
+ r = id128_from_string_nonzero(value, &arg_machine_id);
if (r < 0)
log_warning_errno(r, "MachineID '%s' is not valid, ignoring: %m", value);
if (proc_cmdline_value_missing(key, value))
return 0;
- r = parse_sec(value, &arg_default_timeout_start_usec);
+ r = parse_sec(value, &arg_defaults.timeout_start_usec);
if (r < 0)
log_warning_errno(r, "Failed to parse default start timeout '%s', ignoring: %m", value);
- if (arg_default_timeout_start_usec <= 0)
- arg_default_timeout_start_usec = USEC_INFINITY;
+ if (arg_defaults.timeout_start_usec <= 0)
+ arg_defaults.timeout_start_usec = USEC_INFINITY;
} else if (proc_cmdline_key_streq(key, "systemd.default_device_timeout_sec")) {
if (proc_cmdline_value_missing(key, value))
return 0;
- r = parse_sec(value, &arg_default_device_timeout_usec);
+ r = parse_sec(value, &arg_defaults.device_timeout_usec);
if (r < 0)
log_warning_errno(r, "Failed to parse default device timeout '%s', ignoring: %m", value);
- if (arg_default_device_timeout_usec <= 0)
- arg_default_device_timeout_usec = USEC_INFINITY;
+ if (arg_defaults.device_timeout_usec <= 0)
+ arg_defaults.device_timeout_usec = USEC_INFINITY;
} else if (proc_cmdline_key_streq(key, "systemd.cpu_affinity")) {
void *userdata) {
int r;
- r = config_parse_timeout_abort(unit, filename, line, section, section_line, lvalue, ltype, rvalue,
- &arg_default_timeout_abort_usec, userdata);
+ r = config_parse_timeout_abort(
+ unit,
+ filename,
+ line,
+ section,
+ section_line,
+ lvalue,
+ ltype,
+ rvalue,
+ &arg_defaults.timeout_abort_usec,
+ userdata);
if (r >= 0)
- arg_default_timeout_abort_set = r;
+ arg_defaults.timeout_abort_set = r;
return 0;
}
int oa, r;
if (isempty(rvalue)) {
- arg_default_oom_score_adjust_set = false;
+ arg_defaults.oom_score_adjust_set = false;
return 0;
}
return 0;
}
- arg_default_oom_score_adjust = oa;
- arg_default_oom_score_adjust_set = true;
+ arg_defaults.oom_score_adjust = oa;
+ arg_defaults.oom_score_adjust_set = true;
return 0;
}
#endif
{ "Manager", "TimerSlackNSec", config_parse_nsec, 0, &arg_timer_slack_nsec },
- { "Manager", "DefaultTimerAccuracySec", config_parse_sec, 0, &arg_default_timer_accuracy_usec },
- { "Manager", "DefaultStandardOutput", config_parse_output_restricted, 0, &arg_default_std_output },
- { "Manager", "DefaultStandardError", config_parse_output_restricted, 0, &arg_default_std_error },
- { "Manager", "DefaultTimeoutStartSec", config_parse_sec, 0, &arg_default_timeout_start_usec },
- { "Manager", "DefaultTimeoutStopSec", config_parse_sec, 0, &arg_default_timeout_stop_usec },
+ { "Manager", "DefaultTimerAccuracySec", config_parse_sec, 0, &arg_defaults.timer_accuracy_usec },
+ { "Manager", "DefaultStandardOutput", config_parse_output_restricted, 0, &arg_defaults.std_output },
+ { "Manager", "DefaultStandardError", config_parse_output_restricted, 0, &arg_defaults.std_error },
+ { "Manager", "DefaultTimeoutStartSec", config_parse_sec, 0, &arg_defaults.timeout_start_usec },
+ { "Manager", "DefaultTimeoutStopSec", config_parse_sec, 0, &arg_defaults.timeout_stop_usec },
{ "Manager", "DefaultTimeoutAbortSec", config_parse_default_timeout_abort, 0, NULL },
- { "Manager", "DefaultDeviceTimeoutSec", config_parse_sec, 0, &arg_default_device_timeout_usec },
- { "Manager", "DefaultRestartSec", config_parse_sec, 0, &arg_default_restart_usec },
- { "Manager", "DefaultStartLimitInterval", config_parse_sec, 0, &arg_default_start_limit_interval }, /* obsolete alias */
- { "Manager", "DefaultStartLimitIntervalSec", config_parse_sec, 0, &arg_default_start_limit_interval },
- { "Manager", "DefaultStartLimitBurst", config_parse_unsigned, 0, &arg_default_start_limit_burst },
+ { "Manager", "DefaultDeviceTimeoutSec", config_parse_sec, 0, &arg_defaults.device_timeout_usec },
+ { "Manager", "DefaultRestartSec", config_parse_sec, 0, &arg_defaults.restart_usec },
+ { "Manager", "DefaultStartLimitInterval", config_parse_sec, 0, &arg_defaults.start_limit_interval}, /* obsolete alias */
+ { "Manager", "DefaultStartLimitIntervalSec", config_parse_sec, 0, &arg_defaults.start_limit_interval},
+ { "Manager", "DefaultStartLimitBurst", config_parse_unsigned, 0, &arg_defaults.start_limit_burst },
{ "Manager", "DefaultEnvironment", config_parse_environ, arg_runtime_scope, &arg_default_environment },
{ "Manager", "ManagerEnvironment", config_parse_environ, arg_runtime_scope, &arg_manager_environment },
- { "Manager", "DefaultLimitCPU", config_parse_rlimit, RLIMIT_CPU, arg_default_rlimit },
- { "Manager", "DefaultLimitFSIZE", config_parse_rlimit, RLIMIT_FSIZE, arg_default_rlimit },
- { "Manager", "DefaultLimitDATA", config_parse_rlimit, RLIMIT_DATA, arg_default_rlimit },
- { "Manager", "DefaultLimitSTACK", config_parse_rlimit, RLIMIT_STACK, arg_default_rlimit },
- { "Manager", "DefaultLimitCORE", config_parse_rlimit, RLIMIT_CORE, arg_default_rlimit },
- { "Manager", "DefaultLimitRSS", config_parse_rlimit, RLIMIT_RSS, arg_default_rlimit },
- { "Manager", "DefaultLimitNOFILE", config_parse_rlimit, RLIMIT_NOFILE, arg_default_rlimit },
- { "Manager", "DefaultLimitAS", config_parse_rlimit, RLIMIT_AS, arg_default_rlimit },
- { "Manager", "DefaultLimitNPROC", config_parse_rlimit, RLIMIT_NPROC, arg_default_rlimit },
- { "Manager", "DefaultLimitMEMLOCK", config_parse_rlimit, RLIMIT_MEMLOCK, arg_default_rlimit },
- { "Manager", "DefaultLimitLOCKS", config_parse_rlimit, RLIMIT_LOCKS, arg_default_rlimit },
- { "Manager", "DefaultLimitSIGPENDING", config_parse_rlimit, RLIMIT_SIGPENDING, arg_default_rlimit },
- { "Manager", "DefaultLimitMSGQUEUE", config_parse_rlimit, RLIMIT_MSGQUEUE, arg_default_rlimit },
- { "Manager", "DefaultLimitNICE", config_parse_rlimit, RLIMIT_NICE, arg_default_rlimit },
- { "Manager", "DefaultLimitRTPRIO", config_parse_rlimit, RLIMIT_RTPRIO, arg_default_rlimit },
- { "Manager", "DefaultLimitRTTIME", config_parse_rlimit, RLIMIT_RTTIME, arg_default_rlimit },
- { "Manager", "DefaultCPUAccounting", config_parse_tristate, 0, &arg_default_cpu_accounting },
- { "Manager", "DefaultIOAccounting", config_parse_bool, 0, &arg_default_io_accounting },
- { "Manager", "DefaultIPAccounting", config_parse_bool, 0, &arg_default_ip_accounting },
- { "Manager", "DefaultBlockIOAccounting", config_parse_bool, 0, &arg_default_blockio_accounting },
- { "Manager", "DefaultMemoryAccounting", config_parse_bool, 0, &arg_default_memory_accounting },
- { "Manager", "DefaultTasksAccounting", config_parse_bool, 0, &arg_default_tasks_accounting },
- { "Manager", "DefaultTasksMax", config_parse_tasks_max, 0, &arg_default_tasks_max },
- { "Manager", "DefaultMemoryPressureThresholdSec", config_parse_sec, 0, &arg_default_memory_pressure_threshold_usec },
- { "Manager", "DefaultMemoryPressureWatch", config_parse_memory_pressure_watch, 0, &arg_default_memory_pressure_watch },
+ { "Manager", "DefaultLimitCPU", config_parse_rlimit, RLIMIT_CPU, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitFSIZE", config_parse_rlimit, RLIMIT_FSIZE, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitDATA", config_parse_rlimit, RLIMIT_DATA, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitSTACK", config_parse_rlimit, RLIMIT_STACK, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitCORE", config_parse_rlimit, RLIMIT_CORE, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitRSS", config_parse_rlimit, RLIMIT_RSS, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitNOFILE", config_parse_rlimit, RLIMIT_NOFILE, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitAS", config_parse_rlimit, RLIMIT_AS, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitNPROC", config_parse_rlimit, RLIMIT_NPROC, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitMEMLOCK", config_parse_rlimit, RLIMIT_MEMLOCK, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitLOCKS", config_parse_rlimit, RLIMIT_LOCKS, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitSIGPENDING", config_parse_rlimit, RLIMIT_SIGPENDING, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitMSGQUEUE", config_parse_rlimit, RLIMIT_MSGQUEUE, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitNICE", config_parse_rlimit, RLIMIT_NICE, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitRTPRIO", config_parse_rlimit, RLIMIT_RTPRIO, arg_defaults.rlimit },
+ { "Manager", "DefaultLimitRTTIME", config_parse_rlimit, RLIMIT_RTTIME, arg_defaults.rlimit },
+ { "Manager", "DefaultCPUAccounting", config_parse_bool, 0, &arg_defaults.cpu_accounting },
+ { "Manager", "DefaultIOAccounting", config_parse_bool, 0, &arg_defaults.io_accounting },
+ { "Manager", "DefaultIPAccounting", config_parse_bool, 0, &arg_defaults.ip_accounting },
+ { "Manager", "DefaultBlockIOAccounting", config_parse_bool, 0, &arg_defaults.blockio_accounting },
+ { "Manager", "DefaultMemoryAccounting", config_parse_bool, 0, &arg_defaults.memory_accounting },
+ { "Manager", "DefaultTasksAccounting", config_parse_bool, 0, &arg_defaults.tasks_accounting },
+ { "Manager", "DefaultTasksMax", config_parse_tasks_max, 0, &arg_defaults.tasks_max },
+ { "Manager", "DefaultMemoryPressureThresholdSec", config_parse_sec, 0, &arg_defaults.memory_pressure_threshold_usec },
+ { "Manager", "DefaultMemoryPressureWatch", config_parse_memory_pressure_watch, 0, &arg_defaults.memory_pressure_watch },
{ "Manager", "CtrlAltDelBurstAction", config_parse_emergency_action, arg_runtime_scope, &arg_cad_burst_action },
- { "Manager", "DefaultOOMPolicy", config_parse_oom_policy, 0, &arg_default_oom_policy },
+ { "Manager", "DefaultOOMPolicy", config_parse_oom_policy, 0, &arg_defaults.oom_policy },
{ "Manager", "DefaultOOMScoreAdjust", config_parse_oom_score_adjust, 0, NULL },
{ "Manager", "ReloadLimitIntervalSec", config_parse_sec, 0, &arg_reload_limit_interval_sec },
{ "Manager", "ReloadLimitBurst", config_parse_unsigned, 0, &arg_reload_limit_burst },
#if ENABLE_SMACK
- { "Manager", "DefaultSmackProcessLabel", config_parse_string, 0, &arg_default_smack_process_label },
+ { "Manager", "DefaultSmackProcessLabel", config_parse_string, 0, &arg_defaults.smack_process_label },
#else
{ "Manager", "DefaultSmackProcessLabel", config_parse_warn_compat, DISABLED_CONFIGURATION, NULL },
#endif
/* Traditionally "0" was used to turn off the default unit timeouts. Fix this up so that we use
* USEC_INFINITY like everywhere else. */
- if (arg_default_timeout_start_usec <= 0)
- arg_default_timeout_start_usec = USEC_INFINITY;
- if (arg_default_timeout_stop_usec <= 0)
- arg_default_timeout_stop_usec = USEC_INFINITY;
+ if (arg_defaults.timeout_start_usec <= 0)
+ arg_defaults.timeout_start_usec = USEC_INFINITY;
+ if (arg_defaults.timeout_stop_usec <= 0)
+ arg_defaults.timeout_stop_usec = USEC_INFINITY;
return 0;
}
static void set_manager_defaults(Manager *m) {
+ int r;
assert(m);
- /* Propagates the various default unit property settings into the manager object, i.e. properties that do not
- * affect the manager itself, but are just what newly allocated units will have set if they haven't set
- * anything else. (Also see set_manager_settings() for the settings that affect the manager's own behaviour) */
-
- m->default_timer_accuracy_usec = arg_default_timer_accuracy_usec;
- m->default_std_output = arg_default_std_output;
- m->default_std_error = arg_default_std_error;
- m->default_timeout_start_usec = arg_default_timeout_start_usec;
- m->default_timeout_stop_usec = arg_default_timeout_stop_usec;
- m->default_timeout_abort_usec = arg_default_timeout_abort_usec;
- m->default_timeout_abort_set = arg_default_timeout_abort_set;
- m->default_device_timeout_usec = arg_default_device_timeout_usec;
- m->default_restart_usec = arg_default_restart_usec;
- m->default_start_limit_interval = arg_default_start_limit_interval;
- m->default_start_limit_burst = arg_default_start_limit_burst;
-
- /* On 4.15+ with unified hierarchy, CPU accounting is essentially free as it doesn't require the CPU
- * controller to be enabled, so the default is to enable it unless we got told otherwise. */
- if (arg_default_cpu_accounting >= 0)
- m->default_cpu_accounting = arg_default_cpu_accounting;
- else
- m->default_cpu_accounting = cpu_accounting_is_cheap();
-
- m->default_io_accounting = arg_default_io_accounting;
- m->default_ip_accounting = arg_default_ip_accounting;
- m->default_blockio_accounting = arg_default_blockio_accounting;
- m->default_memory_accounting = arg_default_memory_accounting;
- m->default_tasks_accounting = arg_default_tasks_accounting;
- m->default_tasks_max = arg_default_tasks_max;
- m->default_memory_pressure_watch = arg_default_memory_pressure_watch;
- m->default_memory_pressure_threshold_usec = arg_default_memory_pressure_threshold_usec;
- m->default_oom_policy = arg_default_oom_policy;
- m->default_oom_score_adjust_set = arg_default_oom_score_adjust_set;
- m->default_oom_score_adjust = arg_default_oom_score_adjust;
-
- (void) manager_set_default_smack_process_label(m, arg_default_smack_process_label);
-
- (void) manager_set_default_rlimits(m, arg_default_rlimit);
-
- (void) manager_default_environment(m);
- (void) manager_transient_environment_add(m, arg_default_environment);
+ /* Propagates the various default unit property settings into the manager object, i.e. properties
+ * that do not affect the manager itself, but are just what newly allocated units will have set if
+ * they haven't set anything else. (Also see set_manager_settings() for the settings that affect the
+ * manager's own behaviour) */
+
+ r = manager_set_unit_defaults(m, &arg_defaults);
+ if (r < 0)
+ log_warning_errno(r, "Failed to set manager defaults, ignoring: %m");
+
+ r = manager_default_environment(m);
+ if (r < 0)
+ log_warning_errno(r, "Failed to set manager default environment, ignoring: %m");
+
+ r = manager_transient_environment_add(m, arg_default_environment);
+ if (r < 0)
+ log_warning_errno(r, "Failed to add to transient environment, ignoring: %m");
}
static void set_manager_settings(Manager *m) {
if (r < 0)
log_warning_errno(r, "Failed to set watchdog pretimeout governor to '%s', ignoring: %m", arg_watchdog_pretimeout_governor);
- manager_set_show_status(m, arg_show_status, "commandline");
+ manager_set_show_status(m, arg_show_status, "command line");
m->status_unit_format = arg_status_unit_format;
}
if (r < 0)
return log_error_errno(r, "Failed to parse default standard output setting \"%s\": %m",
optarg);
- arg_default_std_output = r;
+ arg_defaults.std_output = r;
break;
case ARG_DEFAULT_STD_ERROR:
if (r < 0)
return log_error_errno(r, "Failed to parse default standard error output setting \"%s\": %m",
optarg);
- arg_default_std_error = r;
+ arg_defaults.std_error = r;
break;
case ARG_UNIT:
break;
case ARG_MACHINE_ID:
- r = set_machine_id(optarg);
+ r = id128_from_string_nonzero(optarg, &arg_machine_id);
if (r < 0)
return log_error_errno(r, "MachineID '%s' is not valid: %m", optarg);
break;
if (r < 0)
return r;
- if (fseeko(f, 0, SEEK_SET) == (off_t) -1)
+ if (fseeko(f, 0, SEEK_SET) < 0)
return log_error_errno(errno, "Failed to rewind serialization fd: %m");
r = fd_cloexec(fileno(f), false);
return 0;
}
+static int setup_os_release(RuntimeScope scope) {
+ _cleanup_free_ char *os_release_dst = NULL;
+ const char *os_release_src = "/etc/os-release";
+ int r;
+
+ if (access("/etc/os-release", F_OK) < 0) {
+ if (errno != ENOENT)
+ log_debug_errno(errno, "Failed to check if /etc/os-release exists, ignoring: %m");
+
+ os_release_src = "/usr/lib/os-release";
+ }
+
+ if (scope == RUNTIME_SCOPE_SYSTEM) {
+ os_release_dst = strdup("/run/systemd/propagate/.os-release-stage/os-release");
+ if (!os_release_dst)
+ return log_oom_debug();
+ } else {
+ if (asprintf(&os_release_dst, "/run/user/" UID_FMT "/systemd/propagate/.os-release-stage/os-release", geteuid()) < 0)
+ return log_oom_debug();
+ }
+
+ r = mkdir_parents_label(os_release_dst, 0755);
+ if (r < 0)
+ return log_debug_errno(r, "Failed to create parent directory of %s, ignoring: %m", os_release_dst);
+
+ r = copy_file_atomic(os_release_src, os_release_dst, 0644, COPY_MAC_CREATE|COPY_REPLACE);
+ if (r < 0)
+ return log_debug_errno(r, "Failed to create %s, ignoring: %m", os_release_dst);
+
+ return 0;
+}
+
static int write_container_id(void) {
const char *c;
int r = 0; /* avoid false maybe-uninitialized warning */
assert(table[objective]);
xsprintf(log_level, "--log-level=%d", log_get_max_level());
- xsprintf(timeout, "--timeout=%" PRI_USEC "us", arg_default_timeout_stop_usec);
+ xsprintf(timeout, "--timeout=%" PRI_USEC "us", arg_defaults.timeout_stop_usec);
const char* command_line[10] = {
SYSTEMD_SHUTDOWN_BINARY_PATH,
}
}
+static void finish_remaining_processes(ManagerObjective objective) {
+ assert(objective >= 0 && objective < _MANAGER_OBJECTIVE_MAX);
+
+ /* Kill all remaining processes from the initrd, but don't wait for them, so that we can handle the
+ * SIGCHLD for them after deserializing. */
+ if (IN_SET(objective, MANAGER_SWITCH_ROOT, MANAGER_SOFT_REBOOT))
+ broadcast_signal(SIGTERM, /* wait_for_exit= */ false, /* send_sighup= */ true, arg_defaults.timeout_stop_usec);
+
+ /* On soft reboot really make sure nothing is left. Note that this will skip cgroups
+ * of units that were configured with SurviveFinalKillSignal=yes. */
+ if (objective == MANAGER_SOFT_REBOOT)
+ broadcast_signal(SIGKILL, /* wait_for_exit= */ false, /* send_sighup= */ false, arg_defaults.timeout_stop_usec);
+}
+
static int do_reexecute(
ManagerObjective objective,
int argc,
if (saved_rlimit_memlock->rlim_cur != RLIM_INFINITY)
(void) setrlimit(RLIMIT_MEMLOCK, saved_rlimit_memlock);
- /* Kill all remaining processes from the initrd, but don't wait for them, so that we can handle the
- * SIGCHLD for them after deserializing. */
- if (IN_SET(objective, MANAGER_SWITCH_ROOT, MANAGER_SOFT_REBOOT))
- broadcast_signal(SIGTERM, /* wait_for_exit= */ false, /* send_sighup= */ true, arg_default_timeout_stop_usec);
+ finish_remaining_processes(objective);
if (!switch_root_dir && objective == MANAGER_SOFT_REBOOT) {
/* If no switch root dir is specified, then check if /run/nextroot/ qualifies and use that */
if (switch_root_dir) {
r = switch_root(/* new_root= */ switch_root_dir,
/* old_root_after= */ NULL,
- /* flags= */ objective == MANAGER_SWITCH_ROOT ? SWITCH_ROOT_DESTROY_OLD_ROOT : 0);
+ /* flags= */ (objective == MANAGER_SWITCH_ROOT ? SWITCH_ROOT_DESTROY_OLD_ROOT : 0) |
+ (objective == MANAGER_SOFT_REBOOT ? 0 : SWITCH_ROOT_RECURSIVE_RUN));
if (r < 0)
log_error_errno(r, "Failed to switch root, trying to continue: %m");
}
int objective = manager_loop(m);
if (objective < 0) {
*ret_error_message = "Failed to run main loop";
- return log_emergency_errno(objective, "Failed to run main loop: %m");
+ return log_struct_errno(LOG_EMERG, objective,
+ LOG_MESSAGE("Failed to run main loop: %m"),
+ "MESSAGE_ID=" SD_MESSAGE_CORE_MAINLOOP_FAILED_STR);
}
switch (objective) {
if (v > 0)
log_info("Detected virtualization %s.", virtualization_to_string(v));
+ v = detect_confidential_virtualization();
+ if (v > 0)
+ log_info("Detected confidential virtualization %s.", confidential_virtualization_to_string(v));
+
log_info("Detected architecture %s.", architecture_to_string(uname_architecture()));
if (in_initrd())
_cleanup_free_ char *id_text = NULL;
/* Let's check whether we are in first boot. First, check if an override was
- * specified on the kernel commandline. If yes, we honour that. */
+ * specified on the kernel command line. If yes, we honour that. */
- r = proc_cmdline_get_bool("systemd.condition-first-boot", &first_boot);
+ r = proc_cmdline_get_bool("systemd.condition-first-boot", /* flags = */ 0, &first_boot);
if (r < 0)
- log_debug_errno(r, "Failed to parse systemd.condition-first-boot= kernel commandline argument, ignoring: %m");
+ log_debug_errno(r, "Failed to parse systemd.condition-first-boot= kernel command line argument, ignoring: %m");
if (r > 0)
log_full(first_boot ? LOG_INFO : LOG_DEBUG,
- "Kernel commandline argument says we are %s first boot.",
+ "Kernel command line argument says we are %s first boot.",
first_boot ? "in" : "not in");
else {
/* Second, perform autodetection. We use /etc/machine-id as flag file for
r = read_one_line_file("/etc/machine-id", &id_text);
if (r < 0 || streq(id_text, "uninitialized")) {
if (r < 0 && r != -ENOENT)
- log_warning_errno(r, "Unexpected error while reading /etc/machine-id, ignoring: %m");
+ log_warning_errno(r, "Unexpected error while reading /etc/machine-id, assuming first boot: %m");
first_boot = true;
log_info("Detected first boot.");
return r;
}
+ /* Pull credentials from various sources into a common credential directory (we do
+ * this here, before setting up the machine ID, so that we can use credential info
+ * for setting up the machine ID) */
+ (void) import_credentials();
+
(void) os_release_status();
(void) hostname_setup(true);
/* Force transient machine-id on first boot. */
- machine_id_setup(NULL, /* force_transient= */ first_boot, arg_machine_id, NULL);
+ machine_id_setup(/* root= */ NULL, /* force_transient= */ first_boot, arg_machine_id, /* ret_machine_id */ NULL);
(void) loopback_setup();
bump_unix_max_dgram_qlen();
bump_file_max_and_nr_open();
test_usr();
write_container_id();
+
+ /* Copy os-release to the propagate directory, so that we update it for services running
+ * under RootDirectory=/RootImage= when we do a soft reboot. */
+ r = setup_os_release(RUNTIME_SCOPE_SYSTEM);
+ if (r < 0)
+ log_warning_errno(r, "Failed to copy os-release for propagation, ignoring: %m");
}
r = watchdog_set_device(arg_watchdog_device);
r = xdg_user_runtime_dir(&p, "/systemd");
if (r < 0) {
*ret_error_message = "$XDG_RUNTIME_DIR is not set";
- return log_emergency_errno(r, "Failed to determine $XDG_RUNTIME_DIR path: %m");
+ return log_struct_errno(LOG_EMERG, r,
+ LOG_MESSAGE("Failed to determine $XDG_RUNTIME_DIR path: %m"),
+ "MESSAGE_ID=" SD_MESSAGE_CORE_NO_XDGDIR_PATH_STR);
}
(void) mkdir_p_label(p, 0755);
(void) make_inaccessible_nodes(p, UID_INVALID, GID_INVALID);
+ r = setup_os_release(RUNTIME_SCOPE_USER);
+ if (r < 0)
+ log_warning_errno(r, "Failed to copy os-release for propagation, ignoring: %m");
break;
}
r = capability_bounding_set_drop_usermode(arg_capability_bounding_set);
if (r < 0) {
*ret_error_message = "Failed to drop capability bounding set of usermode helpers";
- return log_emergency_errno(r, "Failed to drop capability bounding set of usermode helpers: %m");
+ return log_struct_errno(LOG_EMERG, r,
+ LOG_MESSAGE("Failed to drop capability bounding set of usermode helpers: %m"),
+ "MESSAGE_ID=" SD_MESSAGE_CORE_CAPABILITY_BOUNDING_USER_STR);
}
r = capability_bounding_set_drop(arg_capability_bounding_set, true);
if (r < 0) {
*ret_error_message = "Failed to drop capability bounding set";
- return log_emergency_errno(r, "Failed to drop capability bounding set: %m");
+ return log_struct_errno(LOG_EMERG, r,
+ LOG_MESSAGE("Failed to drop capability bounding set: %m"),
+ "MESSAGE_ID=" SD_MESSAGE_CORE_CAPABILITY_BOUNDING_STR);
}
}
if (arg_no_new_privs) {
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
*ret_error_message = "Failed to disable new privileges";
- return log_emergency_errno(errno, "Failed to disable new privileges: %m");
+ return log_struct_errno(LOG_EMERG, errno,
+ LOG_MESSAGE("Failed to disable new privileges: %m"),
+ "MESSAGE_ID=" SD_MESSAGE_CORE_DISABLE_PRIVILEGES_STR);
}
}
}
(void) bump_rlimit_nofile(saved_rlimit_nofile);
(void) bump_rlimit_memlock(saved_rlimit_memlock);
- /* Pull credentials from various sources into a common credential directory */
- if (arg_runtime_scope == RUNTIME_SCOPE_SYSTEM && !skip_setup)
- (void) import_credentials();
-
return 0;
}
r = manager_add_job(m, JOB_START, target, JOB_REPLACE, NULL, &error, &job);
if (r < 0) {
*ret_error_message = "Failed to start default target";
- return log_emergency_errno(r, "Failed to start default target: %s", bus_error_message(&error, r));
+ return log_struct_errno(LOG_EMERG, r,
+ LOG_MESSAGE("Failed to start default target: %s", bus_error_message(&error, r)),
+ "MESSAGE_ID=" SD_MESSAGE_CORE_START_TARGET_FAILED_STR);
}
} else if (r < 0) {
*ret_error_message = "Failed to isolate default target";
- return log_emergency_errno(r, "Failed to isolate default target: %s", bus_error_message(&error, r));
+ return log_struct_errno(LOG_EMERG, r,
+ LOG_MESSAGE("Failed to isolate default target: %s", bus_error_message(&error, r)),
+ "MESSAGE_ID=" SD_MESSAGE_CORE_ISOLATE_TARGET_FAILED_STR);
} else
log_info("Queued %s job for default target %s.",
job_type_to_string(job->type),
static void fallback_rlimit_nofile(const struct rlimit *saved_rlimit_nofile) {
struct rlimit *rl;
- if (arg_default_rlimit[RLIMIT_NOFILE])
+ if (arg_defaults.rlimit[RLIMIT_NOFILE])
return;
/* Make sure forked processes get limits based on the original kernel setting */
* instance), then lower what we pass on to not confuse our children */
rl->rlim_cur = MIN(rl->rlim_cur, (rlim_t) FD_SETSIZE);
- arg_default_rlimit[RLIMIT_NOFILE] = rl;
+ arg_defaults.rlimit[RLIMIT_NOFILE] = rl;
}
static void fallback_rlimit_memlock(const struct rlimit *saved_rlimit_memlock) {
/* Pass the original value down to invoked processes */
- if (arg_default_rlimit[RLIMIT_MEMLOCK])
+ if (arg_defaults.rlimit[RLIMIT_MEMLOCK])
return;
rl = newdup(struct rlimit, saved_rlimit_memlock, 1);
rl->rlim_cur = MAX(rl->rlim_cur, (rlim_t) DEFAULT_RLIMIT_MEMLOCK);
}
- arg_default_rlimit[RLIMIT_MEMLOCK] = rl;
+ arg_defaults.rlimit[RLIMIT_MEMLOCK] = rl;
}
static void setenv_manager_environment(void) {
arg_switched_root = false;
arg_pager_flags = 0;
arg_service_watchdogs = true;
- arg_default_std_output = EXEC_OUTPUT_JOURNAL;
- arg_default_std_error = EXEC_OUTPUT_INHERIT;
- arg_default_restart_usec = DEFAULT_RESTART_USEC;
- arg_default_timeout_start_usec = manager_default_timeout(arg_runtime_scope);
- arg_default_timeout_stop_usec = manager_default_timeout(arg_runtime_scope);
- arg_default_timeout_abort_usec = manager_default_timeout(arg_runtime_scope);
- arg_default_timeout_abort_set = false;
- arg_default_device_timeout_usec = manager_default_timeout(arg_runtime_scope);
- arg_default_start_limit_interval = DEFAULT_START_LIMIT_INTERVAL;
- arg_default_start_limit_burst = DEFAULT_START_LIMIT_BURST;
+
+ unit_defaults_done(&arg_defaults);
+ unit_defaults_init(&arg_defaults, arg_runtime_scope);
+
arg_runtime_watchdog = 0;
arg_reboot_watchdog = 10 * USEC_PER_MINUTE;
arg_kexec_watchdog = 0;
arg_default_environment = strv_free(arg_default_environment);
arg_manager_environment = strv_free(arg_manager_environment);
- rlimit_free_all(arg_default_rlimit);
arg_capability_bounding_set = CAP_MASK_UNSET;
arg_no_new_privs = false;
arg_timer_slack_nsec = NSEC_INFINITY;
- arg_default_timer_accuracy_usec = 1 * USEC_PER_MINUTE;
arg_syscall_archs = set_free(arg_syscall_archs);
/* arg_serialization — ignore */
- arg_default_cpu_accounting = -1;
- arg_default_io_accounting = false;
- arg_default_ip_accounting = false;
- arg_default_blockio_accounting = false;
- arg_default_memory_accounting = MEMORY_ACCOUNTING_DEFAULT;
- arg_default_tasks_accounting = true;
- arg_default_tasks_max = DEFAULT_TASKS_MAX;
- arg_default_memory_pressure_threshold_usec = MEMORY_PRESSURE_DEFAULT_THRESHOLD_USEC;
- arg_default_memory_pressure_watch = CGROUP_PRESSURE_WATCH_AUTO;
arg_machine_id = (sd_id128_t) {};
arg_cad_burst_action = EMERGENCY_ACTION_REBOOT_FORCE;
- arg_default_oom_policy = OOM_STOP;
cpu_set_reset(&arg_cpu_affinity);
numa_policy_reset(&arg_numa_policy);
arg_random_seed_size = 0;
arg_clock_usec = 0;
- arg_default_oom_score_adjust_set = false;
- arg_default_smack_process_label = mfree(arg_default_smack_process_label);
-
arg_reload_limit_interval_sec = 0;
arg_reload_limit_burst = 0;
}
* do this only if we don't run as root (i.e. only if we are run in user mode, for an unprivileged
* user). */
- if (arg_default_oom_score_adjust_set)
+ if (arg_defaults.oom_score_adjust_set)
return;
if (getuid() == 0)
if (a == b)
return;
- arg_default_oom_score_adjust = b;
- arg_default_oom_score_adjust_set = true;
+ arg_defaults.oom_score_adjust = b;
+ arg_defaults.oom_score_adjust_set = true;
}
static int parse_configuration(const struct rlimit *saved_rlimit_nofile,
r = fdset_new_fill(/* filter_cloexec= */ 0, ret_fds);
if (r < 0) {
*ret_error_message = "Failed to allocate fd set";
- return log_emergency_errno(r, "Failed to allocate fd set: %m");
+ return log_struct_errno(LOG_EMERG, r,
+ LOG_MESSAGE("Failed to allocate fd set: %m"),
+ "MESSAGE_ID=" SD_MESSAGE_CORE_FD_SET_FAILED_STR);
}
(void) fdset_cloexec(*ret_fds, true);
r = fixup_environment();
if (r < 0) {
- log_emergency_errno(r, "Failed to fix up PID 1 environment: %m");
+ log_struct_errno(LOG_EMERG, r,
+ LOG_MESSAGE("Failed to fix up PID 1 environment: %m"),
+ "MESSAGE_ID=" SD_MESSAGE_CORE_PID1_ENVIRONMENT_STR);
error_message = "Failed to fix up PID1 environment";
goto finish;
}
r = parse_argv(argc, argv);
if (r < 0) {
- error_message = "Failed to parse commandline arguments";
+ error_message = "Failed to parse command line arguments";
goto finish;
}
arg_action == ACTION_TEST ? MANAGER_TEST_FULL : 0,
&m);
if (r < 0) {
- log_emergency_errno(r, "Failed to allocate manager object: %m");
+ log_struct_errno(LOG_EMERG, r,
+ LOG_MESSAGE("Failed to allocate manager object: %m"),
+ "MESSAGE_ID=" SD_MESSAGE_CORE_MANAGER_ALLOCATE_STR);
error_message = "Failed to allocate manager object";
goto finish;
}
#endif
#if HAS_FEATURE_ADDRESS_SANITIZER
- __lsan_do_leak_check();
+ /* At this stage we most likely don't have stdio/stderr open, so the following
+ * LSan check would not print any actionable information and would just crash
+ * PID 1. To make this a bit more helpful, let's try to open /dev/console,
+ * and if we succeed redirect LSan's report there. */
+ if (getpid_cached() == 1) {
+ _cleanup_close_ int tty_fd = -EBADF;
+
+ tty_fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
+ if (tty_fd >= 0)
+ __sanitizer_set_report_fd((void*) (intptr_t) tty_fd);
+
+ __lsan_do_leak_check();
+ }
#endif
if (r < 0)
projects / thirdparty / systemd.git / blobdiff