If a route is requested, and the request is already called,
we may not received its reply and notification from the kernel, and
the corresponding Route object may not be remembered. Even in such
case, we need to remove the route, otherwise the route will come
later after the function called.
Frantisek Sumsal [Wed, 24 Jan 2024 18:19:29 +0000 (19:19 +0100)]
test: use the default nsec3-iterations value
In Knot 3.2 the nsec3-iterations default was changed to 0 and Knot now
issues a warning if the value is > 0. Let's just use the default value,
since it's not something that's important for our tests.
Mikko Ylinen [Thu, 18 Jan 2024 11:34:09 +0000 (13:34 +0200)]
efi: Add EFI CC measurement protocol to stub
In confidential computing, a virtual firmware may support measurement and
event log based upon the hardware Trusted Execution Environment (TEE)
capability.
The UEFI specification defines an interface between the virtual guest OS
and virtual firmware as EFI_CC_MEASUREMENT_PROTOCOL. The (vendor specific)
measurements are captured in the CC eventlog that follows the TCG2 format.
OVMF virtual firmware has the EFI_CC_MEASUREMENT_PROTOCOL support for
Intel Trust Domain Extensions (TDX). Intel TDX has 4 runtime measurement
registers (RTMR) defined as:
RTMR[0] for TDVF configuration
RTMR[1] for the TD OS loader and kernel
RTMR[2] for the OS application
RTMR[3] reserved for special usage only
The RTMR to PCR mappings are defined in the UEFI Spec 2.10 Section 38.4.1
as follows:
The CC measurement eventlog is currently exposed as a raw CCEL ACPI table
by the guest OS and the events can be replayed to check log matches with
the RTMR values.
Add EFI CC measurement protocol to stub to get the UKI components measured
and included in the remote attestation reports when vTPMs are not available.
Andrew Sayers [Tue, 9 Jan 2024 12:41:29 +0000 (12:41 +0000)]
Make RestartPreventExitStatus= documentation resemble SuccessExitStatus=
The documentation for `RestartPreventExitStatus=` differs from that for `SuccessExitStatus=` in ways that are sometimes confusing (e.g. using `numeric exit codes` instead of `numeric termination statuses`), and other times plain incorrect (e.g. not mentioning `termination status names`, which I've just confirmed to work in systemd 255).
This patch modifies the documentation to be as similar as possible, so as to reduce the reader's cognitive load.
Yu Watanabe [Sun, 14 Jan 2024 05:20:03 +0000 (14:20 +0900)]
network/route: manage all routes by Manager object
Previously, a Route object is owned by a Link object corresponding to the
outgoing interface of the route, and a Route object that does not have
outgoing interface is owned by the Manager object.
However, there were several issues:
- if a route has a nexthop ID, then the corresponding nexthop may be
changed to use another interface, hence the outgoing interface of the
route may be changed.
- if a route requested with MultiPathRoute=, then the link who requests
the route is different from the outgoing interface of the configured
route. So, we need to find routes on other interfaces on reconfiguring
or so.
By this change, the limit of the number of routes per-interface is
tentatively dropped. Let's re-introduce the limit later in a nicer way.
Takashi Sakamoto [Tue, 23 Jan 2024 06:20:29 +0000 (15:20 +0900)]
hwdb: ieee1394-unit-function: adjustment of entries with device attributes available in Linux v6.8
The series of changes[1] has been merged to Linux v6.8-rc1[2], which
alters the parser of the content of configuration ROM. As a result, some
device attributes for model information in the legacy layout of
configuration ROM are finally available for node and unit devices. The
change enables to distinguish the devices by model information, and what
is required in systemd PR 30205[3]. It can improve the hwdb for IEEE 1394
functions in the point addressed at issue 25029[4].
This commit fulfills some entries for the hwdb, which corresponds to some
devices with the legacy layout of configuration ROM. They provides both
vendor and model names to udev applications.
When I added the --background= switch I placed the empty line that was
supposed to separate the options from the next section before the switch
rather than after. Fix that.
To make issues like this harder to run into next time, let's move the \n
from the end of the preceeding line to the beginning of the section
title, since that's pretty much where they belong to.
Ivan Shapovalov [Sun, 7 Jan 2024 02:01:28 +0000 (03:01 +0100)]
hostname-setup: read hostname from system.hostname credential
`system.hostname` credential is treated similarly to the pre-existing
`system.machine_id` credential. It is considered after /etc/hostname,
but prior to the kernel defaults or os-release defaults.
Fixes #30667.
Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
repart: don't try to determine sector size from a disk image we should consider empty
If we are told to start from scratch we shouldn't look into the old
image to determine sector size. Looking there is confusing at best, but
plain wrong in many other cases.
Nick Rosbrook [Thu, 18 Jan 2024 20:49:42 +0000 (15:49 -0500)]
test-execute: skip tests that are broken without unprivileged userns
With newer versions of AppArmor, unprivileged user namespace creation
may be restricted by default, in which case user manager instances will
not be able to apply PrivateUsers=yes (or the settings which require it).
Additionally, if a kernel has the kernel.unprivileged_userns_clone
sysctl patch, and that sysctl is 0, then unprivileged userns creation
will always fail.
If a test unit is going to be run in a user manager, and that unit
requires PrivateUsers=yes (explicitly or implicitly), then skip it if
we do not have user namespace privileges.
Rafaël Kooi [Mon, 22 Jan 2024 16:04:07 +0000 (17:04 +0100)]
id128-util: Attempt to read UUID from /sys/hypervisor/uuid
When using the Xen hypervisor the virtual machine UUID is exposed here.
This is useful when one needs stable IPv4 address assignment, e.g. for a
set of RAM nodes that are built from a template.
color-util: make return values of rgb_to_hsv() optional
When we want to tint the bg color we don't care about the hue, we want
to set it ourself after all, hence make the arguments optional, so that
we don't even have to ask for it.
Frantisek Sumsal [Tue, 23 Jan 2024 12:06:55 +0000 (13:06 +0100)]
man: suffix signals with ()
Since signals can take arguments, let's suffix them with () as we
already do with functions. To make sure we remain consistent, make the
`update-dbus-docs.py` script check & fix any occurrences where this is
not the case.
Ivan Shapovalov [Tue, 23 Jan 2024 00:10:49 +0000 (01:10 +0100)]
shell-completion/zsh: complete hidden images when word starts with "."
Show hidden images in the completion results, but only if the current
word starts with ".", such that
- `machinectl clone <Tab>` will only offer non-hidden images, but
- `machinectl clone .<Tab>` will offer both hidden and non-hidden images
If there are name collisions in the leds subsystem, the 2nd device node with the
colliding name gets automatically renamed by appending _1, the third by
appending _2 and so on.
This wildcard change makes sure that systemd-backlight also catches these
renamed nodes for kbd_backlight entries.
Frantisek Sumsal [Mon, 22 Jan 2024 13:15:31 +0000 (14:15 +0100)]
core: raise the log priority if sd-executor is missing
Log about missing executor at the emergency level, so the message always
makes it to the console - otherwise it won't get anywhere, since we
can't even start systemd-journald in that case.
Before:
Welcome to Arch Linux!
[ 5.202479] systemd[1]: Failed to allocate manager object: No such file or directory
[!!!!!!] Failed to allocate manager object.
[ 5.207741] systemd[1]: Freezing execution.
After:
Welcome to Arch Linux!
[ 5.279408] systemd[1]: Failed to open executor binary '/usr/lib/systemd/systemd-executor': No such file or directory
[ 5.290756] systemd[1]: Failed to allocate manager object: No such file or directory
[!!!!!!] Failed to allocate manager object.
[ 5.295919] systemd[1]: Freezing execution.
Matt Muggeridge [Mon, 22 Jan 2024 09:55:41 +0000 (19:55 +1000)]
IPv6 RA: Support the Retrans Timer field (IPv6 Conformance Test: v6LC.2.1.5)
The RA's Retransmission Timer field was being ignored. This resolves the IPv6
Core Conformance test, v6LC.2.1.5 [1].
Retransmission Timer is a 32-bit unsigned integer. The time, in milliseconds,
between retransmitted Neighbor Solicitation messages. Used by the Address
Resolution and Neighbor Unreachability Detection (NUD) algorithm.
Support setting a default value for the neighbour retransmission timer value with:
[Network]
IPv6RetransmissionTimeSec=<int>
By default, upon receiving a Router Advertisement with the Retransmission Timer
field set to a non-zero value, it will update the kernel's retransmit timer value.
To disable this behaviour, configure the UseIPv6RetransmissionTime= under the
[IPv6AcceptRA] section.
[IPv6AcceptRA]
UseIPv6RetransmissionTime=<bool>
RFC4861: Neighbor Discovery in IPv6
* Section 4.2 RA Message Format.
* Section 6.3.4 Processing Received Router Advertisements
A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time,
and Retrans Timer) may contain a value denoting that it is
unspecified. In such cases, the parameter should be ignored and the
host should continue using whatever value it is already using. In
particular, a host MUST NOT interpret the unspecified value as
meaning change back to the default value that was in use before the
first Router Advertisement was received.
The RetransTimer variable SHOULD be copied from the Retrans Timer
field, if the received value is non-zero.
These are wrappers around getpwuid_r() and friends, and will allocate the
right-sized buffer for this call.
We so far had multiple implementations of a buffer allocation loop
around getpwuid_r() and friends, and they all suck in some way. Let's
clean this up and add a common implementation, and use it everywhere.
Also, be more careful with error numbers, in particular systematically
turn ENOENT into ENOSRCH (the former is what is returned if /etc/passwd
is absent, which we want to consider identical to user not existing,
which is ENOSRCH). We so far did this at some invocations, but not all.
There are some invocations of getpwuid() left in the codebase. We really
should fix those too, and have a single unified implementation of the
logic, but those are not as trivial to convert, so left for another
time.
nspawn,vmspawn: let's add some terminal magic to the welcome text
Let's grey the text out, and prefix it with a vertical grey bar, to make
clear this is output from the host, not the payload, and make it clearly
distinguishable from what follows.
Let's also make the image name clickable (with new enough
shared-mime-info this should allow you to look into the image with
gnome-disk-utility or a similar tool.
vmspawn: make "-m" value formatting independent of locale
We cannot format the memory string via printf() %f format strings, since
that's locale dependent and qemu doesn't like that. hence format this as
an integer. We'll lose sub-MiB accuracy, but systems with less than 1
MiB memory don't really make much sense anyway.
We already support -j as shortcut for JSON mode in various tools. Let's
add one more. We probably should add this systematically (at least where
it doesn't conflict with an existing -j switch with other purpose). But
I am too lazy to add that now.
vmspawn: close host vsock fd once we passed it to the child
Without this I qemu simply froze in a weird state for me if I kill it:
it was supposedly a zombie, but we'd get the pidfd POLLIN event for it
only once the fd is closed. Hence let's close it right-away.
(Smells like a kernel issue actually, but too lazy to bother with this).
Daan De Meyer [Mon, 22 Jan 2024 11:04:45 +0000 (12:04 +0100)]
mkosi: Use authselect local profile if it exists
authselect 1.5.0 removed the "minimal" profile and added the "local"
profile instead. Let's modify our post-installation script to take
these changes into account.
Adrian Vovk [Sat, 30 Dec 2023 19:06:39 +0000 (14:06 -0500)]
core: path: Re-enter waiting if target is deactivating
Previously, path units would remain in the running state while their
target unit is deactivating. This left a window of time where the target
unit is no longer operational (i.e. it is busy deactivating/cleaning
up/etc) but the path unit would continue to ignore inotify events. In
short: any inotify event that occurs while the target unit deactivates
would be completely lost.
With this commit, the path will go back into a waiting state when the
target unit starts deactivating. This means that any inotify event that
occurs while the target unit deactivates will queue a start job.
ptyfwd: when leaving a session with tinted background, clear to end of screen
So if we tint the background of a ptyfwd session with a color and the
session ends, then so far we reset the bg color and clear till the end
of line.
Let's instead clear till the end of the screen. This is nicer since it
means that any follow-up output will not be affected by the changed
background color anymore.
projects / thirdparty / systemd.git / log
