The access check call was broken (as it tried to read a service name
from the UpdateActivationEnvironment() method call which doesn't carry
any). Also, it's unnecessary to make any access checks here, as we just
forward the call to PID 1 which should do the access checks necessary.
Daniel Mack [Fri, 14 Nov 2014 14:18:56 +0000 (15:18 +0100)]
mount-setup: remove mount_setup_late()
Turns out we can just do kmod_setup() earlier, before we do mount_setup(),
so there's no need for mount_setup_late() anymore. Instead, put kdbusfs in
mount_table[].
Daniel Mack [Thu, 13 Nov 2014 19:33:03 +0000 (20:33 +0100)]
sd-bus: sync with kdbus upstream (ABI break)
kdbus has seen a larger update than expected lately, most notably with
kdbusfs, a file system to expose the kdbus control files:
* Each time a file system of this type is mounted, a new kdbus
domain is created.
* The layout inside each mount point is the same as before, except
that domains are not hierarchically nested anymore.
* Domains are therefore also unnamed now.
* Unmounting a kdbusfs will automatically also detroy the
associated domain.
* Hence, the action of creating a kdbus domain is now as
privileged as mounting a filesystem.
* This way, we can get around creating dev nodes for everything,
which is last but not least something that is not limited by
20-bit minor numbers.
The kdbus specific bits in nspawn have all been dropped now, as nspawn
can rely on the container OS to set up its own kdbus domain, simply by
mounting a new instance.
A new set of mounts has been added to mount things *after* the kernel
modules have been loaded. For now, only kdbus is in this set, which is
invoked with mount_setup_late().
Daniel Mack [Thu, 13 Nov 2014 10:59:29 +0000 (11:59 +0100)]
bus-proxyd: temporarily disable policy checks again
There are issues to investigate on with policies shipped by some
packages, which we'll address later. Move that topic out of the
way for now to bring sd-bus in sync with upstream kdbus.
Ronny Chevalier [Tue, 11 Nov 2014 19:05:40 +0000 (20:05 +0100)]
tests: add test-execute
add tests for the following directives:
- WorkingDirectory
- Personality
- IgnoreSIGPIPE
- PrivateTmp
- SystemCallFilter: It makes test/TEST-04-SECCOMP obsolete, so it has
been removed.
- SystemCallErrorNumber
- User
- Group
- Environment
Bastien Nocera [Wed, 12 Nov 2014 22:31:08 +0000 (23:31 +0100)]
keymap: Fix special keys on ThinkPad X60/X61 Tablet
KEY_DIRECTION is mapped to XF86RotateWindows, to rotate the display:
http://cgit.freedesktop.org/xkeyboard-config/commit/symbols/inet?id=ec875f6f9b7c4028e11d32b071989c682e6502bd
And F13 is mapped to XF86Tools, which is closest to the original toolbox
usage:
http://cgit.freedesktop.org/xkeyboard-config/tree/symbols/inet?id=7a2c4bed212ebbcc05f3c959aef659ce7dd31fd8#n221
Bastien Nocera [Wed, 12 Nov 2014 22:30:46 +0000 (23:30 +0100)]
keymap: Add support for IBM ThinkPad X41 Tablet
Scancode taken from:
http://www.thinkwiki.org/wiki/Tablet_Hardware_Buttons#Linux_Support
William Jon McCann provided the DMI match. IBM seems to have
swapped the version and model of the system:
Manufacturer: IBM
Product Name: 18666TU
Version: ThinkPad X41 Tablet
Daniel Mack [Tue, 11 Nov 2014 17:31:11 +0000 (18:31 +0100)]
sd-bus: pass attach flags to BUS_CREATOR_INFO
kdbus learned parsing the attach flags for the KDBUS_CMD_BUS_CREATOR_INFO
ioctl. Bits not set in this mask will not be exported. Set that field to
_KDBUS_ATTACH_ALL for now.
Daniel Mack [Thu, 23 Oct 2014 11:06:38 +0000 (13:06 +0200)]
bus-proxyd: explicitly address messages to unique and well-known name
In order to check for matching policy entries at message transfers, we
have to consider the following:
* check the currently owned names of both the sending and the receiving
peer. If the sending peer is connected via kdbus, the currently owned
names are already attached to the message. If it was originated by the
connection we're proxying for, we store the owned names in our own strv
so we can check against them.
* Walk the list of names to check which name would allow the message to
pass, and explicitly use that name as destination of the message. If the
destination is on kdbus, store both the connection's unique name and the
chosen well-known-name in the message. That way, the kernel will make sure
the supplied name is owned by the supplied unique name, at the time of
sending, and return -EREMCHG otherwise.
* Make the policy checks optional by retrieving the bus owner creds, and
when the uid matches the current user's uid and is non-null, don't check
the bus policy.
Daniel Mack [Thu, 9 Oct 2014 11:26:53 +0000 (13:26 +0200)]
bus-proxyd: move name list iteration to policy users
We need to figure out which of the possible names satisfied the policy,
so we cannot do the iteration in check_policy_item() but have to leave it
to the users.
Daniel Mack [Wed, 22 Oct 2014 12:41:53 +0000 (14:41 +0200)]
sd-bus: add sd_bus_message.verify_destination_id and .destination_ptr
kdbus learned to accept both a numerical destination ID as well as a
well-known-name. In that case, kdbus makes sure that the numerical ID is in
fact the owner of the provided name and fails otherwise.
This allows for race-free assertion of a bus name owner while sending a
message, which is a requirement for bus-proxyd.
Add two new fields to sd_bus_message, and set the numerical ID to
verify_destination_id if bus_message_setup_kmsg() is called for a
message with a well-known name.
Also, set the destination's name in the kdbus item to .destination_ptr
if it is non-NULL.
Normal users should not touch these fields, and they're not publicy
accessible.
The --failed switch is not documented on purpose, since it is redundant
due to --state=failed, which it predates. Due to that it's not
documented in --help either.
We generally try to avoid redundant interfaces, but if we need to keep
them for compatibility we do so, however remove them from documentation
to ensure they are not used in future.
The man page is now changed to include a comment about the fact that
--failed is not documented on purpose. Also, explicitly mention
--state=failed as example for --state.
Ronny Chevalier [Wed, 5 Nov 2014 20:27:01 +0000 (21:27 +0100)]
tests: add test-path
It tests all available directives of Path units:
- PathChanged
- PathModified
- PathExists
- PathExisysGlob
- DirectoryNotEmpty
- MakeDirectory
- DirectoryMode
- Unit
Michael Chapman [Thu, 6 Nov 2014 08:47:02 +0000 (19:47 +1100)]
timer: reenable TIMER_ACTIVE timers when restarted
A timer configured with OnActiveSec will start its associated unit again
if the timer is stopped, then started. However, if the timer unit is
restarted -- with "systemctl restart", say -- this does not occur.
This commit ensures that TIMER_ACTIVE timers are re-enabled whenever the
timer is started, even if that's within a restart job.
Michal Schmidt [Thu, 6 Nov 2014 21:24:13 +0000 (22:24 +0100)]
shutdown: fix arguments to /run/initramfs/shutdown
Our initrd interface specifies that the verb is in argv[1].
This is where systemd passes it to systemd-shutdown, but getopt
permutes argv[]. This confuses dracut's shutdown script:
Shutdown called with argument '--log-level'. Rebooting!
getopt can be convinced to not permute argv[] by having '-' as the first
character of optstring. Let's use it. This requires changing the way
non-option arguments (in our case, the verb) are processed.
This fixes a bug where the system would reboot instead of powering off.
Michal Schmidt [Thu, 6 Nov 2014 15:48:11 +0000 (16:48 +0100)]
shared: create files even if the SELinux policy has no context for them
The SELinux policy defines no context for some files. E.g.:
$ matchpathcon /run/lock/subsys /dev/mqueue
/run/lock/subsys <<none>>
/dev/mqueue <<none>>
We still need to be able to create them.
In this case selabel_lookup_raw() returns ENOENT. We should then skip
setfscreatecon(), but still return success.
It was broken since c34255bdb2 ("label: unify code to make directories,
symlinks").
Harald Hoyer [Wed, 3 Sep 2014 11:31:25 +0000 (13:31 +0200)]
switch_root: do not fail, if base_filesystem_create() failed
Not all switch roots are like base_filesystem_create() wants them
to look like. They might even boot, if they are RO and don't have the FS
layout. Just ignore the error and switch_root nevertheless.
base_filesystem_create() should have logged, what went wrong.
We really don't want to get lost in adding fridge, car, plane, drone, or
whatever else, hence add a generic term "embedded" cover all the cases
where the computer is just part of something bigger, and not at the
focus of things.