David Herrmann [Sun, 18 Jan 2015 22:56:19 +0000 (23:56 +0100)]
bus: drop systemd.kdbus_attach_flags_mask= cmdline
There is no reason to provide our own attach_flags_mask. We can simply
rely on kdbus.attach_flags_mask= which is read by the kernel *and* kmod.
If it's set, we assume the user wants to override our setting, so we
simply skip setting it.
David Herrmann [Sun, 18 Jan 2015 22:54:42 +0000 (23:54 +0100)]
core: write kdbus.attach_flags_mask only on real boot
The kernel module system is not namespaced, so no container should ever
modify global options. Make sure we set the kdbus attach_flags_mask only
on a real boot as PID1.
Topi Miettinen [Sun, 18 Jan 2015 14:01:25 +0000 (16:01 +0200)]
timesyncd: consider too long packets as invalid
If the received NTP message from server didn't fit to our buffer, either
it is doing something nasty or we don't know the protocol. Consider the
packet as invalid.
David Herrmann [Sun, 18 Jan 2015 20:34:33 +0000 (21:34 +0100)]
bus-proxy: don't pretend everyone is root
While it's a lovely scenario, it's probably not really useful. Fix our
GetConnectionUnixUser() to return the actual 'euid' which we asked for,
not the possible uninitialized 'uid'.
David Herrmann [Sun, 18 Jan 2015 19:07:51 +0000 (20:07 +0100)]
Revert "test-exec: do not skip all the tests"
This reverts commit 68e68ca8106e7cd874682ae425843b48579c6539. We *need*
root access to create cgroups. The only exception is if it is run from
within a cgroup with "Delegate=yes". However, this is not always true and
we really shouldn't rely on this.
If your terminal runs from within a systemd --user instance, you're fine.
Everyone else is not (like running from ssh, VTs, and so on..).
David Herrmann [Sun, 18 Jan 2015 18:37:34 +0000 (19:37 +0100)]
bus: fix SD_BUS_CREDS_AUGMENT on kdbus queries
If we set SD_BUS_CREDS_AUGMENT, we *need* the PID from the kernel so we
can lookup further information from /proc. However, we *must* set
SD_BUS_CREDS_PIDS in "mask", otherwise, our creds-collector will never
actually copy the pid into "sd_bus_creds". Fix this, so
SD_BUS_CREDS_AUGMENT works even if SD_BUS_CREDS_PID is not specified by
the caller.
David Herrmann [Sun, 18 Jan 2015 12:55:55 +0000 (13:55 +0100)]
bus: use EUID over UID and fix unix-creds
Whenever a process performs an action on an object, the kernel uses the
EUID of the process to do permission checks and to apply on any newly
created objects. The UID of a process is only used if someone *ELSE* acts
on the process. That is, the UID of a process defines who owns the
process, the EUID defines what privileges are used by this process when
performing an action.
Process limits, on the other hand, are always applied to the real UID, not
the effective UID. This is, because a process has a user object linked,
which always corresponds to its UID. A process never has a user object
linked for its EUID. Thus, accounting (and limits) is always done on the
real UID.
This commit fixes all sd-bus users to use the EUID when performing
privilege checks and alike. Furthermore, it fixes unix-creds to be parsed
as EUID, not UID (as the kernel always takes the EUID on UDS). Anyone
using UID (eg., to do user-accounting) has to fall back to the EUID as UDS
does not transmit the UID.
David Herrmann [Sun, 18 Jan 2015 12:54:46 +0000 (13:54 +0100)]
bus-proxy: fake all UIDs/GIDs, not just the real UID/GID
Make sure we tell the kernel to fake all UIDs/GIDs. Otherwise, the remote
side has no chance of querying our effective UID (which is usually what
they're interested in).
David Herrmann [Sun, 18 Jan 2015 12:07:21 +0000 (13:07 +0100)]
bus-proxy: fix bus-uid tracking
We need to implicitly allow HELLO from users with the same uid as the bus.
Fix the bus-uid tracking to use the original uid, not the uid after
privilege-dropping.
David Herrmann [Sun, 18 Jan 2015 11:59:39 +0000 (12:59 +0100)]
logind: hide 'self' links if not available
If the caller does not run in a session/seat or has no tracked user, hide
the /org/freedesktop/login1/.../self links in introspection data.
Otherwise, "busctl tree org.freedesktop.login1" tries to query those nodes
even though it cant.
David Herrmann [Sat, 17 Jan 2015 20:18:52 +0000 (21:18 +0100)]
bus-proxy: don't print error-messages if we check multiple dests
If we test the policy against multiple destination names, we really should
not print warnings if one of the names results in DENY. Instead, pass the
whole array of names to the policy and let it deal with it.
David Herrmann [Sat, 17 Jan 2015 17:23:33 +0000 (18:23 +0100)]
bus-proxy: drop privileges if run as root
We cannot use "User=" in unit-files if we want to retain privileges. So
make bus-proxy.c explicitly drop privileges. However, only do that if
we're root, as there is no need to drop it on the user-bus.
Some time ago 95-keymap.rules was replaced by
60-keyboard.hwdb. Original comments for MSI laptops (that were in
95-keymap.rules) were removed, but I think they are important for
understanding what's going on.
David Herrmann [Sat, 17 Jan 2015 13:32:58 +0000 (14:32 +0100)]
bus-proxy: set custom thread names
Set thread-names to "p$PIDu$UID" and suffix with '*' if truncated. This
helps debugging bus-proxy issues if we want to figure out which
connections are currently open.
David Herrmann [Sat, 17 Jan 2015 12:57:46 +0000 (13:57 +0100)]
bus-proxy: turn into multi-threaded daemon
Instead of using Accept=true and running one proxy for each connection, we
now run one proxy-daemon with a thread per connection. This will enable us
to share resources like policies in the future.
Colin Guthrie [Mon, 12 Jan 2015 20:40:14 +0000 (20:40 +0000)]
random-seed: avoid errors when we cannot write random-seed file
When we call 'systemd-random-seed load' with a read-only /var/lib/systemd,
the cleanup code (which rewrites the random-seed file) will fail and exit.
Arguably, if the filesystem is read-only and the random-seed file exists
then this will be possibly be quite bad for entroy on subsequent reboots
but it should still not make the unit fail.
Peter Hutterer [Thu, 8 Jan 2015 23:51:40 +0000 (09:51 +1000)]
hwdb: add MOUSE_WHEEL_CLICK_ANGLE as property
Most mice have a wheel click angle of 15 degrees, i.e. 24 clicks per full
wheel rotation. Some mice, like the Logitech M325 have a larger angle. To
allow userspace to make use of that knowledge, add a property to the hwdb.
This allows for better predictive scrolling. e.g. a mouse that has a smaller
click angle will scroll faster, with this value you can accommodate this
where needed. Likewise, using "half turn of the wheel" or "full turn of the
wheel" as a UI element becomes possible.
This addition is mainly driven by libinput 0.8, having the angle enables
libinput to provide an API that distinguishes between a physical distance
(like touchpad scrolling does) and discrete steps (wheel clicks).
Callers can choose what they prefer based on the device.
nspawn,machined: change default container image location from /var/lib/container to /var/lib/machines
Given that this is also the place to store raw disk images which are
very much bootable with qemu/kvm it sounds like a misnomer to call the
directory "container". Hence, let's change this sooner rather than
later, and use the generic name, in particular since we otherwise try to
use the generic "machine" preferably over the more specific "container"
or "vm".
After all, nspawn can now dissect MBR partition levels, too, hence
".gpt" appears a misnomer. Moreover, the the .raw suffix for these files
is already pretty popular (the Fedora disk images use it for example),
hence sounds like an OK scheme to adopt.
Sometimes udev or some other background daemon might keep the loopback
devices busy while we already want to detach them. Downgrade the warning
about it.
Given that we use autodetach downgrading these messages should be with
little risk.
nspawn: add support for limited dissecting of MBR disk images with nspawn
With this change nspawn's -i switch now can now make sense of MBR disk
images too - however only if there's only a single, bootable partition
of type 0x83 on the image. For all other cases we cannot really make
sense from the partition table alone.
The big benefit of this change is that upstream Fedora Cloud Images can
now be booted unmodified with systemd-nspawn:
nspawn: pass the container's init PID out via sd_notify()
This is useful for nspawn managers that want to learn when nspawn is
finished with initialiuzation, as well what the PID of the init system
in the container is.
nspawn: add file system locks for controlling access to container images
This adds three kinds of file system locks for container images:
a) a file system lock next to the actual image, in a .lck file in the
same directory the image is located. This lock has the benefit of
usually being located on the same NFS share as the image itself, and
thus allows locking container images across NFS shares.
b) a file system lock in /run, named after st_dev and st_ino of the
root of the image. This lock has the advantage that it is unique even
if the same image is bind mounted to two different places at the same
time, as the ino/dev stays constant for them.
c) a file system lock that is only taken when a new disk image is about
to be created, that ensures that checking whether the name is already
used across the search path, and actually placing the image is not
interrupted by other code taking the name.
a + b are read-write locks. When a container is booted in read-only mode
a read lock is taken, otherwise a write lock.
Lock b is always taken after a, to avoid ABBA problems.
Lock c is mostly relevant when renaming or cloning images.
networkd: propagate IPFoward= per-interface setting also to /proc/sys/net/ipv4/ip_forward
We need to turn on /proc/sys/net/ipv4/ip_forward before the
per-interface forwarding setting is useful, hence let's propagate the
per-interface setting once to the system-wide setting.
Due to the unclear ownership rules of that flag, and the fact that
turning it on also has effects on other sysctl flags we try to minimize
changes to the flag, and only turn it on once. There's no logic to
turning it off again, but this should be fairly unproblematic as the
per-interface setting defaults to off anyway.
networkd: introduce an AddressFamilyBoolean enum type
This introduces am AddressFamilyBoolean type that works more or less
like a booleaan, but can optionally turn on/off things for ipv4 and ipv6
independently. THis also ports the DHCP field over to it.
This undoes a small part of 13790add4bf648fed816361794d8277a75253410
which was erroneously added, given that zero length datagrams are OK,
and hence zero length reads on a SOCK_DGRAM be no means mean EOF.
Now that networkd's IP masquerading support means that running
containers with "--network-veth" will provide network access out of the
box for the container, let's add a shortcut "-n" for it, to make it
easily accessible.
networkd: add minimal IP forwarding and masquerading support to .network files
This adds two new settings to networkd's .network files:
IPForwarding=yes and IPMasquerade=yes. The former controls the
"forwarding" sysctl setting of the interface, thus controlling whether
IP forwarding shall be enabled on the specific interface. The latter
controls whether a firewall rule shall be installed that exposes traffic
coming from the interface as coming from the local host to all other
interfaces.
This also enables both options by default for container network
interfaces, thus making "systemd-nspawn --network-veth" have network
connectivity out of the box.