Daniel Mack [Tue, 21 Oct 2014 17:19:44 +0000 (19:19 +0200)]
sd-bus: sync kdbus.h (ABI break)
In kdbus.h, the following details changed:
* All commands gained a 'kernel_flags' field to report the flags supported
by the driver. Before, this was done in the 'flags' field in a
bidirectional way, which turned out to be a problem for the code in
sd-bus, as many parts of it reuse the same ioctl struct more than once
and consider them to be owned by userspace.
* Name listings are now returned by a new struct instead of reusing struct
kdbus_cmd_name for that matter. This way, we don't add more unneeded
fields to it and make the API cleaner.
* 'conn_flags' was renamed to 'flags' in struct kdbus_cmd_hello to make
the API a bit more unified.
Michal Schmidt [Thu, 16 Oct 2014 11:49:04 +0000 (13:49 +0200)]
sysctl.d: default to fq_codel, fight bufferbloat
Quoting from Jon Corbet's report of Stephen Hemminger's talk at Linux
Plumbers Conference 2014 (https://lwn.net/Articles/616241/):
[...] So Stephen encouraged everybody to run a command like:
sysctl -w net.core.default_qdisc=fq_codel
That will cause fq_codel to be used for all future connections
[Qdiscs apply to interfaces, not connections. Pointed out by TomH
in the article comments. -- mschmidt] (up to the next reboot).
Unfortunately, the default queuing discipline cannot be changed,
since it will certainly disturb some user's workload somewhere.
Let's have the recommended default in systemd.
Thanks to Dave Täht for advice and the summary at
https://lists.bufferbloat.net/pipermail/cerowrt-devel/2014-October/003701.html
Daniel Mack [Mon, 20 Oct 2014 13:26:00 +0000 (15:26 +0200)]
sd-bus: sync kdbus.h (ABI break)
kdbus.h now has KDBUS_ATTACH_COMM split into KDBUS_ATTACH_TID_COMM and
KDBUS_ATTACH_PID_COMM. The items were split already, so the change in
systemd is easy.
Daniel Mack [Sat, 18 Oct 2014 18:57:53 +0000 (20:57 +0200)]
sd-bus: sync kdbus.h (ABI break)
In kdbus.h, the 'features' field has been dropped again. Instead of
negotiating features that way, we decided to make the kernel return the
set of supported flags in each ioctl struct's .flags field, in both the
success and error cases.
Without the socket open we are going to crash and burn. If for
whatever reason we fail during deserialization we will fail when
trying to open the socket. In this case it is better to unlink the old
socket and maybe lose some messages, than to continue without the
notification socket.
Of course this situation should not happen, but we should handle
it as gracefully as possible anyway.
Daniel Mack [Fri, 17 Oct 2014 14:04:49 +0000 (16:04 +0200)]
nspawn: fix DeviceAllow list
Commit 864e17068 ("nspawn: actually allow access to /dev/net/tun in the
container") added "/dev/net/tun" to the list of allowed devices but forgot
to tweak the array length, which caused "/dev/kdbus/*" to be missed.
Michal Sekletar [Fri, 17 Oct 2014 09:51:46 +0000 (11:51 +0200)]
execute: don't fail child when we don't have privileges to setup namespaces
If we don't have privileges to setup the namespaces then we are most likely
running inside some sort of unprivileged container, hence not being able to
create namespace is not a problem because spawned service can't access host
system anyway.
shell-completion: propose templates for disable/[re]enable/[re]start
Templates can be [re]enabled, on their own if the have DefaultInstance set,
and with an instance suffix in all cases. Propose just the template name
ending in @, to underline the instance suffix may have to be appended.
Likewise for start/restart.
This means that sometimes superflous units that one will not really
want to operate on will be proposed, but this seems better than
proposing a very incomplete set of names.
shell-completion: fix completion of inactive units
Units which not loaded were not proposed properly. OTOH, we should
filter units from get-unit-files by their state if they are currently
loaded. Bring zsh completions in line with bash completion, the same
logic should be used in both implementations.
Lukasz Skalski [Mon, 13 Oct 2014 13:29:57 +0000 (15:29 +0200)]
bus-proxyd: improve compatibility with dbus-1
'GetConnectionUnixProcessID', 'GetConnectionUnixUser' and
'GetConnectionSELinuxSecurityContext' methods should return
'NameHasNoOwner' error (if chosen name is not available on bus)
with more detailed description - like dbus-1:
Could not get PID of name 'org.freedesktop.test': no such name.
Could not get UID of name 'org.freedesktop.test': no such name.
Could not get security context of name 'org.freedesktop.test': no such name.
Otherwise we have only laconic message without proper dbus error:
Error System.Error.ENXIO: No such device or address
resolved: apply label to /run/systemd/resolve/resolv.conf
Under an SELinux system, we want the file that is created to
have a proper context, different from the default for files in /run.
This is so that the policy can give access to almost everyone to
this file.
systemctl: when mangle unit names for the "isolate", suffix with ".target" rather than ".service" by default
After all, we set AllowIsolate exclusively for target units so far, and
this is more or less the only thing tht makes sense, hence also use
".target" as completion suffix by default.
FAIL: test-engine
=================
Cannot find cgroup mount point: No such file or directory
Assertion 'r >= 0' failed at ../src/test/test-engine.c:46, function main(). Aborting.
FAIL: test-sched-prio
=====================
Cannot find cgroup mount point: No such file or directory
Assertion 'r >= 0' failed at ../src/test/test-sched-prio.c:42, function main(). Aborting.
FAIL: test-bus-cleanup
======================
Assertion 'sd_bus_open_system(&bus) >= 0' failed at ../src/libsystemd/sd-bus/test-bus-cleanup.c:40, function test_bus_open(). Aborting.
after new: refcount 1
David Herrmann [Sat, 11 Oct 2014 16:53:26 +0000 (18:53 +0200)]
NEWS: don't mention noinst_* debug programs
systemd-evcat and systemd-modeset are not installed systemd wide and
should really just be used by developers to test the libsystemd-terminal
features. No reason to mention it in NEWS.. despite the undulating
rainbows..
David Herrmann [Sat, 11 Oct 2014 16:49:20 +0000 (18:49 +0200)]
terminal/grdrm: force deep modeset on enter
Usually, when our session is activated (or re-configurated) we should be
able to try a page-flip to our buffer. The kernel driver should reject it
if it is incompatible. As it turns out, drivers don't do this. Therefore,
we now force a deep modeset if we're not sure what mode is set.
This has the side-effect that we might get glitches on session-switches
(depending on driver behavior). However, there's no way around this and it
is what everyone does so far. Most drivers still detect if we keep the
mode and so don't touch the clocks. Therefore, we just get a regular async
flip.
Dan Williams [Wed, 8 Oct 2014 19:15:45 +0000 (14:15 -0500)]
sd-dhcp-client: support non-Ethernet hardware addresses
Like Infiniband. See RFC 4390 section 2.1 for details on DHCP
and Infiniband; chaddr is zeroed, hlen is set to 0, and htype
is set to ARPHRD_INFINIBAND because IB hardware addresses
are 20 bytes in length.
Michael Scherer [Sat, 11 Oct 2014 08:13:43 +0000 (04:13 -0400)]
Report aa_change_onexec error code
Since aa_change_onexec return the error code in errno, and return
-1, the current code do not give any useful information when
something fail. This make apparmor easier to debug, as seen on
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=760526
mount-setup: skip relabelling when SELinux and SMACK not supported
This is also the only place where FTW_ACTIONRETVAL is used, so
this makes systemd compile without SELinux or SMACK support
when the standard library doesn't support this extension.
Lukasz Skalski [Fri, 10 Oct 2014 10:29:04 +0000 (12:29 +0200)]
kdbus: fix buffer overflow in bus_get_owner_kdbus() function
Commit 710fc9779b7c (kdbus repo) introduced attaching items[]
instead of name[] in kdbus_cmd_conn_info struct. Commit 581fe6c81
(systemd repo) caught up with this change, but item size was not
properly calculated.
They were left from an early review iteration, when hibernate-resume
functionality was intended to work also outside of initramfs.
Now this is not the case, and these dependencies became redundant
as systemd-fsck-root.service can never be part of initramfs, and
systemd-remount-fs.service makes little sense in it.
sd_journal_enumerate_unique will lock its mmap window to prevent it
from being released by calling mmap_cache_get with keep_always=true.
This call may return windows that are wider, but compatible with the
parameters provided to it.
This can result in a mismatch where the window to be released cannot
properly be selected, because we have more than one window matching the
parameters of mmap_cache_release. Therefore, introduce a release_cookie
to be used when releasing the window.
sd-journal: do not reset sd_j_enumerate_unique position on error
systemctl would call sd_j_enumerate_unique() interleaved with
sd_j_next(). But the latter can remove a file if it detects an
error in it. In those circumstances sd_j_enumerate_unique would
restart with the first file in hashmap. With many corrupted files
sd_j_enumerate_unique might iterate over the list multiple times.
Avoid this by jumping to the next file in unique list if possible,
or setting a flag that tells sd_j_enumerate_unique that it is done
otherwise.
Michal Schmidt [Thu, 9 Oct 2014 15:27:57 +0000 (17:27 +0200)]
service: enter SERVICE_STOP_SIGTERM state after getting "STOPPING=1"
SERVICE_STOP would mean we're running the ExecStop command. That's not
the case with "STOPPING=1".
Instead we should enter the same state as if we just told the service
to stop, i.e. SERVICE_STOP_SIGTERM.
This fixes a bug where voluntarily exiting services would hang around in
deactivating state until timeout.
Patrik Flykt [Wed, 8 Oct 2014 08:00:07 +0000 (11:00 +0300)]
sd-dhcp6-lease: Name the structure containing IAADDR data
With this change the DHCP6_OPTION_IAADDR_LEN define can be removed in
favor of using sizeof(). Using the name of the struct and sizeof()
makes it clearer how much and what data is being copied from the
DHCPv6 message.
Daniel Mack [Thu, 9 Oct 2014 11:26:53 +0000 (13:26 +0200)]
bus-policy: move name list iteration to policy users
We need to figure out which of the possible names satisfied the policy,
so we cannot do the iteration in check_policy_item() but have to leave it
to the users.