We cannot compare a boolean with a bit mask. This worked only by
accident, since MANAGER_IS_INHIBITED_CHECK_DELAY happened to be 1. But
we need to do this properly.
It's not sufficient to append a DNS key to a packet, we must also update
the qdcount too. We got this right in most tests but didn#t here.
Moreover, we must extract the packet then to actually have a DnsQuestion
properly filled in.
Fix that. Without this the tests didn't test anything reasonable.
Now that we have recognizable errors, let's print clear error messages
when we try to unlock a TPM slot. And in case of the token plugin
propagate this as ENOANO so that libcryptsetup recognizes this as bad
PIN. (ENOANO is documented as the error to return in that case)
tpm2-util: recognize DA lockout mode and PIN failures properly
When we create the policy session the previously passed PIN will be
checked. This means we'll see PIN errors here, in case the PIN is wrong
or if DA lockout mode has been triggered.
Recognize these two errors, and bubble up recognizable errors.
Lukas Nykryn [Wed, 18 Jun 2025 11:33:25 +0000 (13:33 +0200)]
man: encourage the creation of empty machine-id instead of deleting it
Current text hints that machine-id in template image should be empty
if the system is read-only. But most of the bare metal systems and
regular VMs have /etc read-only at this phase of boot.
The function getdents64() was introduced in glibc-2.30, and our baseline
on glibc is 2.31. Hence, we can assume the function always exists.
The posix_getdents() wrapper was introduced for compatibility with musl.
However, even the latest release of musl does not provide posix_getdents()
yet. Also, even with musl, by defining _LARGEFILE64_SOURCE, we can get
getdents64() and struct dirent64. Hence, the wrapper is anyway not
necessary.
Yu Watanabe [Mon, 9 Jun 2025 15:39:38 +0000 (00:39 +0900)]
mallinfo-util: assume mallinfo() exists
The check existed for musl. Let's remove it, as we explicitly request glibc.
While removing the check, this also drops generic_mallinfo, introduces
a tiny converter from struct mallinfo to struct mallinfo2 if mallinfo2()
does not exist, and renames mallinfo-util.h to malloc.h.
With this change, we can drop many ifdefs and casts in .c files.
When we remove an existing inode in order to create a symlink we need to
create the symlink via a pinned directory again, instead of using an
absolute path, otherwise this will not work in the --root= case.
Let's fix this, and switch this over to symlinkat_atomic_full().
env-file: port write_env_file() to label_ops_pre()
Let's make more use of label_ops_pre()/label_ops_post(), and replace
write_env_file_label() by a flag to write_env_file().
This simplifies and normalizes the code.
This also makes one relevant change: it sets the new
WRITE_ENV_FILE_LABEL flag in firstboot.c when we write locale.conf,
where we previously did not (but should have). This should address one
detail of #37857.
Yu Watanabe [Tue, 17 Jun 2025 19:58:04 +0000 (04:58 +0900)]
sd-lldp: several improvements (#37845)
This makes
- sd-lldp-tx not send machine ID as chassis ID, but use application
specific machine ID,
- sd-lldp-tx emit vlan ID if it is running on a vlan interface,
- Describe() DBus method also reply LLDP configurations,
- io.systemd.Network.GetLLDPNeighbors varlink method provides vlan ID,
if received.
We now consider link-local addresses routable when we have configured
unicast link-local dns servers. This allows creating the DNS scope, even
when the interface doesn't get a routable address.
cgroup-util: Always open cgroupv2 attribute files in O_NONBLOCK mode
As explained in https://lore.kernel.org/all/20250419183545.1982187-1-shakeel.butt@linux.dev/,
writing to memory.max or memory.high triggers synchronous memory reclaim
if the limit is lowered. This can end up taking nonnegligible amounts
of time, completely blocking pid1 from doing any other work while the
reclaim is ongoing.
To address this problem, the kernel going to add O_NONBLOCK semantics
to memory.max and memory.high. If the file is opened with O_NONBLOCK,
the synchronous memory reclaim is skipped and only triggered later
without blocking the process writing the file. Let's make sure we make
use of this by opening cgroupv2 attribute files with O_NONBLOCK.
We opt to do this for all cgroupv2 attribute files, to make sure that
if the same problem happens elsewhere in the future and is fixed in the
same way, we immediately take advantage of that fix without having to
make changes in systemd as well. We probably never want to block when
writing cgroupv2 attributes and any cases where we do want to block should
indicate so explicitly instead of blocking by default.
Since shim 16, it is not possible anymore to override the security arch
protocol to avoid signature check and measurements.
Also on Dell servers, EFI_SECURITY2_ARCH_PROTOCOL is not implemented, so
unexpected measurements on PCR 4 were still happening.
This just loads and run the kernel pe. We verify that there is no
relocation needed. Also for simplification, we assume and verify that
the base address is expected to be 0.
Mike Yuan [Fri, 6 Jun 2025 19:47:39 +0000 (21:47 +0200)]
sd-varlink: hook up fd passing control with SO_PASSRIGHTS
This is a tricky one, because we effectively turn fd passing input
toggle into a tristate: unset, disabled, and enabled; whereas unset
and disabled were identical previously. *Unset* state silently
ignores SCM_RIGHTS passed by invoking recv() instead of recvmsg(),
and for disabled we now disable SO_PASSRIGHTS completely.
The plot thickens when it comes to the server, since we want to
turn off the SO_PASSRIGHTS already on the listening socket so that
there's no race between accept() and recvmsg() wrt SO_PASSRIGHTS state.
However, if we do this unconditionally, the existing use case of
creating a custom connection callback and enabling fd passing there
would be broken.
Hence, let's introduce a new flag,
SD_VARLINK_SERVER_FD_PASSING_INPUT_STRICT, which when set
ties the enablement of fd passing to SO_PASSRIGHTS in server,
and set it for all our varlink servers.
Refer to the previous commit for the rationale behind return value
change in sd_varlink_set_allow_fd_passing_input().
Mike Yuan [Mon, 9 Jun 2025 22:01:53 +0000 (00:01 +0200)]
sd-varlink: unify AF_UNIX check in sd_varlink_set_allow_fd_passing_output()
Currently, the socket type is only checked if the fd passing is
being enabled. The special handling seems unnecessary though,
as in the disable case, either fd passing is already false and
would be caught by the (... == !!b) shortcut at the beginning,
or the AF_UNIX check wouldn't have succeeded in the first place,
for the initial toggle to true. Hence, just uniformly check
AF_UNIX.
While at it, sd_varlink_set_allow_fd_passing_*() oddly return 1
iff changed and !b, which doesn't fit into our coding style and
I can't come up with any use case for such behavior. Let's
return 1 on changed and 0 otherwise.
sd_varlink_set_allow_fd_passing_input() will be fixed in the later
commits with other enhancements.
Mike Yuan [Fri, 6 Jun 2025 19:01:33 +0000 (21:01 +0200)]
core/socket: introduce AcceptFileDescriptors=
This controls the new SO_PASSRIGHTS socket option in kernel v6.16.
Note that I intentionally choose a different naming scheme than
Pass*=, since all other Pass*= options controls whether some extra
bits are attached to the message, while this one's about denying
file descriptor transfer and it feels more explicit this way.
And diverging from underlying socket option name is precedented
by Timestamping=. But happy to change it to just say PassRights=
if people disagree.
Arkadiusz Bokowy [Thu, 12 Jun 2025 14:20:29 +0000 (16:20 +0200)]
sd-bus: Preserve interfaces addition order
When adding a new interface to the object add it at the end of the list.
This way, when iterating over the list, e.g., during handling introspect
call, the order of returned interfaces will mach the order in which they
were added.
Luca Boccassi [Mon, 16 Jun 2025 22:28:57 +0000 (23:28 +0100)]
fstab-generator: set mode=0755 with root=tmpfs
If mode= is not set in rootflags= add mode=0755 when a tmpfs
is used on the rootfs, otherwise it will be group/world writable
as that's the default mode for tmpfs filesystems.
* 7de88c66bd Do not mark symlinks as %ghost
* 92c16c1dab Let systemd-{sysusers,shared} conflict with older systemd
* ed6b885327 Version 257.6
* 5a53eac13c Package pcrlock files together with systemd-pcrlock
* 2192e86112 Move mount.ddi symlinks to -container subpackage
* 451184cbea Revert "Disable freezing of user sessions"
* f6af46db12 Backport adb/fastboot udev rules (BZ#2356537)
* f6b814cc0f Backport CI fix
* d304477023 Version 257.5
* 2dc224ae5d Update systemd to version 257.6 / rev 448 via SR 1281804
* 15818e66dd Update systemd to version 257.5 / rev 447 via SR 1278063
* 2480ac89f0 Update 000product to rev 4383
* c381cdada8 update 2025-04-11 16:42
* bb036b2b8e Update systemd to version 257.4 / rev 444 via SR 1252776
* 55ae12d80b Update systemd to version 257.3 / rev 443 via SR 1249841
* a7fcf45b77 Update systemd to version 257.3 / rev 442 via SR 1247443
* 15cb472aeb upgpkg: 257.6-1: new upstream release
* 1c11767e01 upgpkg: 257.5-3: backlight: Drop support for actual_brightness
* 489e88099e upgpkg: 257.5-2: fast-forward to current v257-stable
Yu Watanabe [Mon, 16 Jun 2025 08:55:11 +0000 (17:55 +0900)]
manager: also restart stub listner on reload
Previously, the extra stub listners were stopped but new ones were not
started. Also, the main stub listners were not restarted, hence the
new settings were not applied. This fixes the above two issues.
Note, to fix the issue, we need to keep CAP_NET_BIND_SERVICE capability
to make it allow to bind stub listner later.
Yu Watanabe [Mon, 16 Jun 2025 08:51:49 +0000 (17:51 +0900)]
resolve: several cleanups for manager_dispatch_reload_signal()
- set defaults after all existing configs and setups cleared,
- mention failures are ignored in log messages,
- drop one redundant log message,
- do not return negative errno but exit event loop on critical failure.
Yu Watanabe [Mon, 16 Jun 2025 07:42:38 +0000 (16:42 +0900)]
network/tunnel: rename Ip6TnlMode to TunnelMode
This also makes ip6tnl can be created without specifying Mode= setting,
as the kernel accepts new-link netlink message without the
IFLA_IPTUN_PROTO attribute.
No effective functional change, just refactoring and preparation for
later change.
nsresourced: make sure "tun" driver is properly loaded and accessible
We need access to /dev/net/tun, hence make sure we can actually see
/dev/. Also make sure the module is properly loaded before we operate,
given that we run with limit caps. But then again give the CAP_NET_ADMIN
cap, since we need to configure the network tap/tun devices.
projects / thirdparty / systemd.git / log
