Daan De Meyer [Fri, 3 May 2024 08:57:22 +0000 (10:57 +0200)]
ci: Reduce the number of integration tests we run concurrently
Since there's a bunch of CPU hungry systemd-journal-remote processes
running on the host to received the forwarded logs, by running as many
test as the VM has cores we overload the available resources. Let's leave
use the number of cores - 1 to reduce resource contention.
Daan De Meyer [Sun, 5 May 2024 16:14:44 +0000 (18:14 +0200)]
test: Default to linux qemu firmware
Direct kernel boot results in much faster boot times so let's use
it by default.
We disable it for tests that need to reboot because +-50% of the
time, doing a reboot when using direct kernel boot causes qemu to
hang on reboot. Until we figure that out, let's use UEFI for the
tests that need to reboot.
Daan De Meyer [Mon, 6 May 2024 09:47:34 +0000 (11:47 +0200)]
TEST-46-HOMED: Skip barely fits test on ext4
For some reason this fails on ext4 with "No space left on device".
Until we figure out why, let's skip the test on ext4 (which is reported
as ext2/ext3 by stat).
Daan De Meyer [Sat, 4 May 2024 14:32:57 +0000 (16:32 +0200)]
TEST-04-JOURNAL: Make more robust
Avoid hitting https://github.com/systemd/systemd/issues/2913 by adding
some more sleeps. This is required to make the test pass when executed
with mkosi on my machine.
Daan De Meyer [Fri, 3 May 2024 13:56:52 +0000 (15:56 +0200)]
TEST-74-AUX-UTILS: Drop usage of loop module
This module is builtin on ubuntu causing the test to fail. Let's
use just dummy instead. I tried replacing it with scsi_debug but
that caused issues with modprobe complaining it could not remove
scsi_debug because it was in use.
Richard Maw [Thu, 22 Feb 2024 13:01:13 +0000 (13:01 +0000)]
TEST-74-AUX-UTILS: Support credential-provided root SSH public key
When root authorized keys are provided by mkosi they are not
newline-terminated so appending a public key to the file results
in a corrupt key, so just to be safe we add an empty line.
Daan De Meyer [Sat, 4 May 2024 10:20:24 +0000 (12:20 +0200)]
TEST-75-RESOLVED: Ignore resource record ifindex field
Depending on host configuration this may or may not be included (e.g.
on mkosi we get a result without an ifindex field). Let's strip it from
the resolved reply to avoid failing the test.
Daan De Meyer [Sun, 5 May 2024 09:38:09 +0000 (11:38 +0200)]
test: Always shutdown on test success in mkosi
When we want to get an interactive shell in a test that fails because
of a race condition, we might need to run the test a few times with
--repeat before it fails. However, currently, when -i is used, the VM
needs to be shut down manually each time before the next run can start.
Let's always shut down the VM if the test succeeds so that --repeat can
be used with -i to run the test until it fails and then get an interactive
shell in the VM.
Daan De Meyer [Fri, 3 May 2024 08:57:50 +0000 (10:57 +0200)]
test: Use MESON_TEST_ITERATION if available
This allows running the same test multiple times concurrently with
meson's --repeat option. Proposed upstream but not yet merged:
https://github.com/mesonbuild/meson/pull/13177.
Daan De Meyer [Thu, 2 May 2024 18:21:29 +0000 (20:21 +0200)]
test: Only set environment variable if integration tests are enabled.
If we set it to '0' if integration tests are not enabled then we can't
enable them from the command line since environment from meson takes
priority over environment variables from the command line.
We also rename the related variables to avoid conflicts with the
existing integration_tests variable.
Daan De Meyer [Sun, 5 May 2024 13:03:37 +0000 (15:03 +0200)]
mkosi: Make sure tmp.mount is not messed with on Debian/Ubuntu
We want /tmp to be a tmpfs so let's hack the debian packaging to
make sure that's the case until the debian packaging is fixed to
make /tmp a tmpfs for UPSTREAM=1 builds.
Daan De Meyer [Fri, 3 May 2024 10:56:50 +0000 (12:56 +0200)]
mkosi: Disable ext4's orphan_file feature for centos images
Not supported by e2fsck from centos. We also disable building repart
from source in CI as running it from the build directory means repart
will run mkfs.ext4 from the host which doesn't know about the orphan_file
feature causing it to fail.
Daan De Meyer [Fri, 3 May 2024 12:15:55 +0000 (14:15 +0200)]
mkosi: Insist on KVM, VSOCK and TPM by default
By default mkosi will not run VMs with these features if they're not
available, but since various stuff in systemd makes use of these, let's
fail loudly if any of these are not available by default in systemd.
Users can still override these defaults locally if they wish.
Kai Lueke [Mon, 6 May 2024 04:06:51 +0000 (13:06 +0900)]
man: Remove OSConfig project mentioning for systemd-confext
The systemd-confext use case description was mentioning an OSConfig
project which won't say much to users. Also, it's good to call out that
systemd-confext provides a reliable way to manage configuration because
in contrast to other tools it will remove all old configuration files.
The Xiaomi Mipad2 tablet has 3 capacitive buttons at the bottom.
These 3 buttons are handled by the touchsceen (the touchscreen extends
downwards to cover the bottom bezel).
By default these send Windows specific shortcuts which do not work
with Linux desktop environments:
Menu: LeftMeta + S
Home: LeftCtrl + Esc
Back: Backspace
Map these to menu / leftmeta (Windows key / Win 8 tablet home button key) /
back.
Daan De Meyer [Sat, 4 May 2024 13:08:02 +0000 (15:08 +0200)]
meson: Test installation fixes
Let's use the new follow_symlinks flag instead on newer meson to.
We also switch back to copying symlinks instead of following them
and add an exclude for 25-default.link which becomes dangling when
installed and recreate it manually instead.
Daan De Meyer [Sat, 4 May 2024 14:54:41 +0000 (16:54 +0200)]
core: Record ExecMainStartTimestamp before forking
Otherwise there's a chance the handover timestamp is less than the
start timestamp depending on the whims of the scheduler.
For non-forking services, we also propagate the start timestamp into
Service->main_exec_status to make sure it starts earlier than the
handoff timestamp.
Richard Maw [Tue, 30 Apr 2024 16:23:02 +0000 (17:23 +0100)]
mkosi: Disable selinux labelling and install policy in initramfs
It is necessary to install the selinux policy in the initramfs
so that userland is entered with the correct label.
SELinuxRelabel defaults to auto, which will skip if the relabelling
command is not installed and will treat failure to relabel as non-fatal.
We can't force it on because root privileges are required if the labels
don't exist on the host system and we would like to be able to
cross-build from other distributions.
Since we are already committed to relabelling on first boot
there is no value in even trying to label.
anphir [Fri, 3 May 2024 08:34:05 +0000 (10:34 +0200)]
man: improve documentation about using resource-control options
According to the documentation in systemd.resource-control(5),
resource-control options may be used in mount, scope, service,
slice, socket and swap units.
While e.g. systemd.service(5) includes that information,
documentation for some other units does not.
The most problematic example is systemd.slice(5).
Its documentation states a slice unit may only contain [Install]
and [Unit] sections, while actually it may contain also a [Slice]
section with options from systemd.resource-control(5).
units/user/app.slice is an example of a slice unit having a [Slice]
section.
nspawn, vmspawn, run0: add env var for turning off background tinting
Some people are just sad, sad lost souls who don't like even the tiniest
ray of color in their life. Let's add an env var knob for allowing them
to turn the background tinting off, to drive the last bit of color from
their life so that they can stay in their grey grey life.
Yu Watanabe [Wed, 1 May 2024 21:18:52 +0000 (06:18 +0900)]
journal: explicitly sync namespaced journals before stopping socket units
Otherwise, if a service unit that requests LogNamespace= stopped before
systemd-journald@.service is started, logs generated by the service will be
lost, as systemd-journald@.socket is stopped and
systemd-journald@.service will never started.
To prevent the issue, let's introduce another implicit dependency to
a oneshot service that explicitly synchronizes a namespaced journal file
when the log namespace is not needed anymore.
libfido2-util: fix a regression in the pre-flight mechanism
The recently merged PR #32295 introduced support for the credProtect
extension, but in doing so, it broke the discoverability of credentials
by setting the policy to FIDO_CRED_PROT_UV_REQUIRED for UV-less,
PIN-protected credentials. This policy would require us to pass the PIN
to the token in the pre-flight request to be able to discover it,
which defeats the purpose of pre-flight requests as they're supposed
to be non-interactive.
This commit restricts the usage of credProtect to UV credentials only.
Looks like since [0] the Super-Linter repo was moved to
super-linter/super-linter and github/super-linter is just a fork, so
let's update the reference accordingly.