Yu Watanabe [Thu, 22 Feb 2024 05:28:52 +0000 (14:28 +0900)]
icmp6-util: make icmp6_receive() refuse packets without IPv6 sender address
Previously, the function supports packets without IPv6 sender address
for unit tests. However, now unit tests use their own version of
icmp6_receive(). Hence, let's make the check more strict.
This allows us to pin the process locally when GetUnitByPIDFD
is not available, just like what we have been doing for
'systemctl whoami'. Also, fix looking up remote pid.
We can't use pidfd for those.
Luca Boccassi [Fri, 23 Feb 2024 21:09:11 +0000 (21:09 +0000)]
Fallback from pidfd_open on permission errors too
Skip using pidfds if we get a permission denied error.
This can happen with an old policy and a new kernel that uses the
new pidfs filesystem to back pidfds, instead of anonymous inodes,
as the existing policy denies access.
This is already the case for most uses of pidfd_open, like pidref,
but not on these two. Fix them.
ptyfwd: optionally prefix window title with colored dot
in uid0/systemd-run/nspawn we already set a window title with a colorful
unicode dot indicating the changed privileges/execution context. This typically
gets overriden by the shell inside the environment however.
Let's tweak this a bit: when we see the window title OSC ANSI sequence
passing through, let's patch in the unicode dot as a prefix to the
title.
This is super pretty, since it makes sure root sessions via 0ad are
really easily recognizable as such, because the window title carries an
🔴 red dot as prefix then.
By default swtpm runs with four banks: SHA1, SHA256, SHA384, SHA512.
This means all data that is part of the boot will be hashed four times,
which slows everything down.
Let's restrict things to SHA256 only, which is the one that really
matters. SHA1 is no up to today's standards anyway, and noone really
consumes the other two, hence no point in enabling this.
To disable the banks we need to call swtpm_setup with --pcr-banks. Do
so.
TPM 1.2 is obsolete, and doesn't really provide much security guarantees
given it's build around SHA1 which is not up to today's standards.
The rest of systemd's TPM codebase never supported TPM 1.2 hence let's
drop this partial support in sd-stub too. It has created problems after
all (sd-stub reported the measuements and userspace assumed these were
for TPM2), without bringing any benefits (given that the measurements we
make are not consumed by us anyway, unlike those for TPM 2.0)
This broke all the URLs, we can't have that. (And actually, we probably don't
_want_ to make the change either. It's nicer to have all the pages in one
directory, so one doesn't have to figure out to which collection the page
belongs.)
Max Staudt [Thu, 22 Feb 2024 08:47:36 +0000 (17:47 +0900)]
udev: Add /dev/media/by-path symlinks for media controllers
Add persistent symlinks for media controller ("mediaX") devices, based
on their ID_PATH udev properties.
For example, if the uvcvideo driver creates /dev/media0, a persistent
name may be:
/dev/media/by-path/pci-0000:04:00.3-usb-0:1:1.0-media-controller
Persistent links are a handy tool to make scripts self-documenting
during development or in tests, as well as less error prone in case of
devices changing enumeration order. For media controllers, one can
alternatively scan through all of them and look for a matching bus_info
in their struct media_device_info, but the links are much handier when
drafting something by hand.
A similar pattern already exists for Video4Linux /dev/videoX devices,
see 60-persistent-v4l.rules for those.
Yu Watanabe [Tue, 20 Feb 2024 21:20:45 +0000 (06:20 +0900)]
network: introduce per-interface IP forwarding settings
This deprecates IPForward= setting, which unconditionally controled
the global setting, even though it is a setting in .network file.
Instead, this introduces new IPv4Forwarding= and IPv6Forwarding=
settings both in .network and networkd.conf.
If these settings are specified in a .network file, then the
per-interface forwarding setting will be configured.
If specified in networkd.conf, then the global IP forwarding setting will
be configured.
While the subsequent change made this change no longer trigger warnings if fq_codel wasn't present, it is still recommended to have this enabled. Add the necessary kernel configuration to the documentation.
test-ukify: skip signing in tests when slow tests are disabled
I have a large initrd (built with mkosi-initrd) and the test-ukify takes 30 s.
Let's use the usual approach of skipping the slowests tests.
(pytest has marks, and it would be nicer to mark tests with pytest.mark.slow,
and then use "-m 'not slow'" in the meson test invocation. But markers must be
pre-registered, otherwise pytest emits a warning. There are a few ways to
register markers, but they all require "project configuration", but because of
how we invoke pytest, this is hard to do. So let's just use an environment
variable.)
Susant Sahani [Tue, 20 Feb 2024 13:12:20 +0000 (18:42 +0530)]
netdev/macvlan: allow to set the broadcast queueing threshold
Allow to set the broadcast queueing threshold
on macvlan devices. This controls which multicast packets will be
processed in a workqueue instead of inline.
medusalix [Wed, 21 Feb 2024 20:02:37 +0000 (21:02 +0100)]
hwdb: Add headset form-factor override for Xbox Wireless Dongle
The Xbox Wireless Headset does not get assigned a sound form factor
when connected via the dongle using the `xone` driver.
Add USB IDs for the old & new dongle and built-in variants.
tree-wide: be more careful when passing literal integers to "t" bus message fields
Since we use varargs for sd_message_append() we need to make sure the
parameters we pass are actually 64bit wide, if "t" is used. Hence cast
appropriately if necessary.
I went through the whole tree, and in most cases we got it right, but
there are some cases we missed so far.
vmspawn: rename "qemu" specific switches to not carry the "qemu" prefix
This renames a few of the switches vmspawn takes, such as --qemu-mem=
and --qemu-smp= to names without the "qemu" moniker and uses less
cryptic names (i.e. --ram= and --cpus=).
I think it's a bit unsystematic that so far we use the "qemu" prefix for
some options but not for others. At least I could not figure out a
system when we use it and when we don't. Hence let's clean it up and
just use simpler names without suffix.
After all we might want to plug other hypervisors behind vmspawn one
day, hence I think there's value in sticking to generic names for these
switches that allow us to switch out backends easily. In particular for
--ram= and --cpus= which are probably the most fundamental of VM settings
there are.
The old switches are support for compat, but not advertised in man page
or --help text anymore.
I left "--qemu-gui" under its current name, since it fundamentally is a
a qemu concept, exposing a qemu specific graphical UI.
The 1-based VT indexes are what people usually expect, since the primary
name of VTs uses them (i.e. /dev/tty1, /dev/tty2, …). Hence, let's
always use 1-based VT indexes, and early on convert 0-based VT indexes
to minimize confusion.
bsod: add new option --tty= to specify TTY to output on
If specified we'll not try to find a free V, but instead just output
directly to the specified TTY. This is particularly useful for
debugging, as it means "systemd-bsod --tty=/dev/tty" just works.
pcrlock: handle measurement logs where hash algs in header are announced in different order than in records
Apparently on HyperV the measurement logs announce the hash algs in a
different order in the header than the records have them. Let's handle
this gracefully
projects / thirdparty / systemd.git / log
