7 weeks agoman: fix link markup
Lennart Poettering [Wed, 29 Jul 2020 15:37:33 +0000 (17:37 +0200)] 
man: fix link markup

7 weeks agoMerge pull request #16585 from yuwata/network-dhcp6-fixes
Lennart Poettering [Wed, 29 Jul 2020 13:59:11 +0000 (15:59 +0200)] 
Merge pull request #16585 from yuwata/network-dhcp6-fixes

network: fix several DHCP6 PD issues, and cleanup DHCP4 and NDISC

7 weeks agoMerge pull request #16590 from keszybz/test-fs-util-relax
Lennart Poettering [Wed, 29 Jul 2020 13:54:51 +0000 (15:54 +0200)] 
Merge pull request #16590 from keszybz/test-fs-util-relax

Small adjustements to let various tests pass in overloaded Fedora infra and related changes

7 weeks agoMerge pull request #16576 from keszybz/bump-tmp-size
Lennart Poettering [Wed, 29 Jul 2020 13:53:30 +0000 (15:53 +0200)] 
Merge pull request #16576 from keszybz/bump-tmp-size

Increase /tmp size to 50% of RAM

7 weeks agotest-cgroup-util: Handle result=NULL as empty string
Gaurav Singh [Tue, 28 Jul 2020 02:28:56 +0000 (22:28 -0400)] 
test-cgroup-util: Handle result=NULL as empty string

Signed-off-by: Gaurav Singh <>
7 weeks agofirstboot: Update help string with --root-shell options
Daan De Meyer [Wed, 29 Jul 2020 07:21:01 +0000 (08:21 +0100)] 
firstboot: Update help string with --root-shell options

7 weeks agotest-sleep: add more logging, show secure boot mode 16590/head
Zbigniew Jędrzejewski-Szmek [Mon, 27 Jul 2020 15:36:56 +0000 (17:36 +0200)] 
test-sleep: add more logging, show secure boot mode

In a user
reported that hibernation is not supported. This is probably caused
by secure boot, but our current logging does not make this

7 weeks agoNEWS: mention new tmpfs limits 16576/head
Zbigniew Jędrzejewski-Szmek [Fri, 24 Jul 2020 20:24:59 +0000 (22:24 +0200)] 
NEWS: mention new tmpfs limits

7 weeks agoBump /tmp size back to 50% of RAM
Zbigniew Jędrzejewski-Szmek [Fri, 24 Jul 2020 20:05:21 +0000 (22:05 +0200)] 
Bump /tmp size back to 50% of RAM

This should be enough to fix
But the limit should be significantly higher than 10% anyway. By setting a
limit on /tmp at 10% we'll break many reasonable use cases, even though the
machine would deal fine with a much larger fraction devoted to /tmp.
(In the first version of this patch I made it 25% with the comment that
"Even 25% might be too low.". The kernel default is 50%, and we have been using
that seemingly without trouble since
So let's just make it 50% again.)

See 7d85383edbab73274dc81cc888d884bb01070bc2.

(Another consideration is that we learned from from the whole initiative with
zram in Fedora that a reasonable size for zram is 0.5-1.5 of RAM, and that pretty
much all systems benefit from having zram or zswap enabled. Thus it is reasonable
to assume that it'll become widely used. Taking the usual compression effectiveness
of 0.2 into account, machines have effective memory available of between
1.0 - 0.2*0.5 + 0.5 = 1.4 (for zram sized to 0.5 of RAM) and
1.0 - 0.2*1.5 + 1.5 = 2.2 (for zram 1.5 sized to 1.5 of RAM) times RAM size.
This means that the 10% was really like 7-4% of effective memory.)

A comment is added to mount-util.h to clarify that tmp.mount is separate.

7 weeks agonetwork: rename settings about DHCPv6 Prefix Delegation 16585/head
Yu Watanabe [Tue, 28 Jul 2020 20:50:04 +0000 (05:50 +0900)] 
network: rename settings about DHCPv6 Prefix Delegation

Closes #16602.

7 weeks agonetwork: make RADVPrefixDelegation enum bitfield
Yu Watanabe [Tue, 28 Jul 2020 20:09:38 +0000 (05:09 +0900)] 
network: make RADVPrefixDelegation enum bitfield

This should not change any behavior.

7 weeks agonetwork: update address infomation even if link is in failed or linger state
Yu Watanabe [Thu, 23 Jul 2020 22:18:39 +0000 (07:18 +0900)] 
network: update address infomation even if link is in failed or linger state

As the link may be reconfigured later. If we do not update the address
information, then its setup state or operstate may not be updated

7 weeks agonetwork: do not assume static addresses are configured
Yu Watanabe [Thu, 23 Jul 2020 15:52:32 +0000 (00:52 +0900)] 
network: do not assume static addresses are configured

link_request_set_routes() is also called when a dynamic address is
configured. At that time, static addresses may not be configured yet.

Fixes #16546.

7 weeks agonetwork: check at least one dynamic address is assigned when DHCP is enabled
Yu Watanabe [Thu, 23 Jul 2020 12:18:24 +0000 (21:18 +0900)] 
network: check at least one dynamic address is assigned when DHCP is enabled

7 weeks agonetwork: dhcp6: drop addresses and delegated prefixes on client stop
Yu Watanabe [Wed, 22 Jul 2020 18:13:42 +0000 (03:13 +0900)] 
network: dhcp6: drop addresses and delegated prefixes on client stop

Previously, we did not drop addresses and delegated prefixes when
DHCP6 client is stopped.

Fixes #15455.
Fixes #13564.

7 weeks agonetwork: rename ipv4ll_address -> ipv4ll_address_configured
Yu Watanabe [Wed, 22 Jul 2020 16:21:40 +0000 (01:21 +0900)] 
network: rename ipv4ll_address -> ipv4ll_address_configured

7 weeks agonetwork: ndisc: also remove old DNSSL or RDNSS records after an SLAAC address is...
Yu Watanabe [Wed, 22 Jul 2020 12:44:44 +0000 (21:44 +0900)] 
network: ndisc: also remove old DNSSL or RDNSS records after an SLAAC address is ready

7 weeks agonetwork: ndisc: remove old addresses and routes after at least one SLAAC address...
Yu Watanabe [Wed, 22 Jul 2020 02:55:07 +0000 (11:55 +0900)] 
network: ndisc: remove old addresses and routes after at least one SLAAC address becomes ready

Otherwise, the old addresses will exist in deperecated state.

7 weeks agonetwork: dhcp4: release old lease after the new address become ready
Yu Watanabe [Tue, 21 Jul 2020 14:06:51 +0000 (23:06 +0900)] 
network: dhcp4: release old lease after the new address become ready

Previously, on DHCPv4 address renewal, the old address may be removed
while the new address is not ready yet.

This also simplifies the logic of removing address and routes.

7 weeks agonetwork: make address/route_configure optionally return created Address/Route object
Yu Watanabe [Wed, 22 Jul 2020 00:41:30 +0000 (09:41 +0900)] 
network: make address/route_configure optionally return created Address/Route object

7 weeks agonetwork: set key destructor in several hash_ops
Yu Watanabe [Tue, 21 Jul 2020 23:22:55 +0000 (08:22 +0900)] 
network: set key destructor in several hash_ops

7 weeks agonetwork: make link_check_ready() return earlier if the link is not in 'configuring...
Yu Watanabe [Tue, 21 Jul 2020 21:07:42 +0000 (06:07 +0900)] 
network: make link_check_ready() return earlier if the link is not in 'configuring' state

7 weeks agonetwork: ndisc: do not set configured flags when addresses or routes are not assigned yet
Yu Watanabe [Tue, 21 Jul 2020 21:03:10 +0000 (06:03 +0900)] 
network: ndisc: do not set configured flags when addresses or routes are not assigned yet

Just for safety.

7 weeks agonetwork: make link enter failed state if address_update() failed
Yu Watanabe [Thu, 23 Jul 2020 18:16:42 +0000 (03:16 +0900)] 
network: make link enter failed state if address_update() failed

7 weeks agonetwork: introduce callback called when an address becomes ready
Yu Watanabe [Tue, 21 Jul 2020 14:02:35 +0000 (23:02 +0900)] 
network: introduce callback called when an address becomes ready

7 weeks agotest-network: add tests for prefix routes
Yu Watanabe [Thu, 4 Jun 2020 04:21:02 +0000 (13:21 +0900)] 
test-network: add tests for prefix routes

7 weeks agonetwork: add debug log for configuring address
Yu Watanabe [Wed, 3 Jun 2020 01:11:08 +0000 (10:11 +0900)] 
network: add debug log for configuring address

7 weeks agotest-ndisc-rs: increase timeouts
Zbigniew Jędrzejewski-Szmek [Mon, 27 Jul 2020 14:09:22 +0000 (16:09 +0200)] 
test-ndisc-rs: increase timeouts

Timestamp: Mon 2020-07-27 13:50:50 UTC
Monotonic: 985702942708
Hop limit: 64
Flags: <|MANAGED>
Preference: medium
Lifetime: 180
No MTU set
>> Option 3
Valid Lifetime: 500
Preferred Lifetime: 440
Prefix Length: 64
Prefix: 2001:db8:dead:beef::
>> Option 25
DNS: 2001:db8:dead:beef::1
Lifetime: 60
>> Option 31
Domain: lab.intra
Lifetime: 60
>> Option 1
Address: 782bcbb36d53
NDISC: Started IPv6 Router Solicitation client
backoff timeout interval  1 3.600s <= 3.987s <= 4.400s
NDISC: Sent Router Solicitation, next solicitation in 3s
backoff timeout interval  2 7.576s <= 8.114s <= 8.374s
NDISC: Sent Router Solicitation, next solicitation in 8s
Assertion 'false' failed at src/libsystemd-network/test-ndisc-rs.c:172, function test_rs_hangcheck(). Aborting.

7 weeks agotest-path: increase timeout
Zbigniew Jędrzejewski-Szmek [Mon, 27 Jul 2020 13:08:35 +0000 (15:08 +0200)] 
test-path: increase timeout

The tests fail in Fedora's koji with a timeout. Let's just bump
the timeout:
--- stderr ---
Failed to connect to system bus: No such file or directory
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-exists.service: Failed to create cgroup /system.slice/kojid.service/path-exists.service: Permission denied
path-exists.service: Succeeded.
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-exists.service: Failed to create cgroup /system.slice/kojid.service/path-exists.service: Permission denied
path-exists.service: Succeeded.
path-exists.path: Succeeded.
Failed to connect to system bus: No such file or directory
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-existsglob.service: Failed to create cgroup /system.slice/kojid.service/path-existsglob.service: Permission denied
path-existsglob.service: Succeeded.
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-existsglob.service: Failed to create cgroup /system.slice/kojid.service/path-existsglob.service: Permission denied
path-existsglob.service: Succeeded.
path-existsglob.path: Succeeded.
Failed to connect to system bus: No such file or directory
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-changed.service: Failed to create cgroup /system.slice/kojid.service/path-changed.service: Permission denied
path-changed.service: Succeeded.
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-changed.service: Failed to create cgroup /system.slice/kojid.service/path-changed.service: Permission denied
path-changed.service: Succeeded.
path-changed.path: Succeeded.
Failed to connect to system bus: No such file or directory
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-modified.service: Failed to create cgroup /system.slice/kojid.service/path-modified.service: Permission denied
path-modified.service: Succeeded.
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-modified.service: Failed to create cgroup /system.slice/kojid.service/path-modified.service: Permission denied
path-modified.service: Succeeded.
path-modified.path: Succeeded.
Failed to connect to system bus: No such file or directory
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-mycustomunit.service: Failed to create cgroup /system.slice/kojid.service/path-mycustomunit.service: Permission denied
path-mycustomunit.service: Succeeded.
path-unit.path: Succeeded.
Failed to connect to system bus: No such file or directory
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-directorynotempty.service: Failed to create cgroup /system.slice/kojid.service/path-directorynotempty.service: Permission denied
path-directorynotempty.service: Succeeded.
-.slice: Failed to enable/disable controllers on cgroup /system.slice/kojid.service, ignoring: Permission denied
path-directorynotempty.service: Failed to create cgroup /system.slice/kojid.service/path-directorynotempty.service: Permission denied
path-directorynotempty.service: Failed to attach to cgroup /system.slice/kojid.service/path-directorynotempty.service: No such file or directory
path-directorynotempty.service: Failed at step CGROUP spawning /bin/true: No such file or directory
path-directorynotempty.service: Main process exited, code=exited, status=219/CGROUP
path-directorynotempty.service: Failed with result 'exit-code'.
Test timeout when testing path-directorynotempty.path

7 weeks agotest-fs-util: do not assume /dev is always real
Zbigniew Jędrzejewski-Szmek [Mon, 27 Jul 2020 11:49:12 +0000 (13:49 +0200)] 
test-fs-util: do not assume /dev is always real

When building in Fedora's koji, test-fs-util would fail:
--- command ---
10:18:29 SYSTEMD_LANGUAGE_FALLBACK_MAP='/builddir/build/BUILD/systemd-246-rc2/src/locale/language-fallback-map' PATH='/builddir/build/BUILD/systemd-246-rc2/x86_64-redhat-linux-gnu:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin' SYSTEMD_KBD_MODEL_MAP='/builddir/build/BUILD/systemd-246-rc2/src/locale/kbd-model-map' /builddir/build/BUILD/systemd-246-rc2/x86_64-redhat-linux-gnu/test-fs-util
--- stderr ---
/* test_chase_symlinks */
/* test_unlink_noerrno */
/* test_readlink_and_make_absolute */
/* test_var_tmp */
/* test_dot_or_dot_dot */
/* test_access_fd */
/* test_touch_file */
/* test_unlinkat_deallocate */
/* test_fsync_directory_of_file */
/* test_rename_noreplace */
/* test_path_is_encrypted */
/home encrypted: yes
/var encrypted: yes
/ encrypted: yes
/proc encrypted: no
/sys encrypted: no
/dev encrypted: yes
Assertion 'expect < 0 || ((r > 0) == (expect > 0))' failed at src/test/test-fs-util.c:863, function test_path_is_encrypted_one(). Aborting.

It seems / is encrypted, but /dev is just a normal directory.

7 weeks agofirstboot: Check if the given shell exists
Daan De Meyer [Sun, 26 Jul 2020 13:38:27 +0000 (14:38 +0100)] 
firstboot: Check if the given shell exists

8 weeks agonetwork: radv: Send RA on newly-added dynamic prefix
Michael Marley [Sun, 26 Jul 2020 03:23:48 +0000 (23:23 -0400)] 
network: radv: Send RA on newly-added dynamic prefix

When a prefix is delegated to an interface that is already sending
RAs, send an RA immediately to inform clients of the new prefix.
This allows them to start using it immediately instead of waiting
up to nearly 10 minutes (depending on when the last timed RA was
sent).  This type of situation might occur if, for example, an
outage of the WAN connection caused the addresses and prefixes to
be lost and later regained after service was restored.  The
condition for the number of RAs sent being above 0 simultaneously
ensures that RADV is already running and that this code doesn't
send any RAs before the timed RAs have started when the interface
first comes up.

8 weeks agoFix clang-11 issues
Christian Göttsche [Sat, 25 Jul 2020 16:23:11 +0000 (18:23 +0200)] 
Fix clang-11 issues

Tested with clang 11.0.0-++20200715043845+0e377e253c1-1~exp1 on Debian sid

../src/network/test-networkd-conf.c:104:56: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int]
        test_config_parse_duid_rawdata_one(BYTES_0_128 + 2, 0, &(DUID){0, 128, BYTES_1_128});
../src/network/test-networkd-conf.c:104:56: note: use array indexing to silence this warning
        test_config_parse_duid_rawdata_one(BYTES_0_128 + 2, 0, &(DUID){0, 128, BYTES_1_128});
                                           &           [  ]
1 warning generated.

../src/test/test-clock.c:52:17: warning: ignoring return value of function declared with 'warn_unused_result' attribute [-Wunused-result]
                ftruncate(fileno(f), 0);
                ^~~~~~~~~ ~~~~~~~~~~~~
1 warning generated.

(gdb) run
Starting program: systemd/build/test-alloc-util
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/".
x1: 0x7fffffffd2d0
x2: 0x7fffffffdac0
y: 0x7fffffffd2cc
z: 0x7fffffffd2c0
*** buffer overflow detected ***: terminated

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt full
        set = {__val = {0, 18446744073709551615, 0, 0, 0, 0, 140737348658240140737348659520, 0, 0, 0, 0, 0, 0, 0, 0}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x22ff0, sa_sigaction = 0x22ff0}, sa_mask = {__val = {14073734988860342171274217127421712742171274217383, 0, 0, 0, 0, 143329, 143344, 140737351162752, 8959, 184467440737095513284289072}},
          sa_flags = -138460788, sa_restorer = 0xffffffffffffffff}
        sigs = {__val = {32, 0 <repeats 15 times>}}
        ap = {{gp_offset = 24, fp_offset = 0, overflow_arg_area = 0x7fffffffd280, reg_save_area = 0x7fffffffd210}}
        fd = <optimized out>
        list = <optimized out>
        nlist = <optimized out>
        cp = <optimized out>
No locals.
No locals.
No locals.
No locals.
No locals.
        l = 0
No locals.
        p1 = 0x405500 "\223Nd\n\351\301mA\214\262A\247\306b\276\317\327\353\346k\035\024\273{\276&!kλ\233\217\t\207\276\327\347\351\355\307R\276\063{\235w=\237E\357\277KL\245\374\245\066M\201+\333\064\272\332g>1<@"
        p2 = <optimized out>
        i = <optimized out>
No locals.

8 weeks agocatalog: update Polish translation
Piotr Drąg [Fri, 24 Jul 2020 14:06:48 +0000 (16:06 +0200)] 
catalog: update Polish translation

8 weeks agoresolvectl: fix older resolved or networkd support to set DNS servers
Yu Watanabe [Fri, 24 Jul 2020 12:03:25 +0000 (21:03 +0900)] 
resolvectl: fix older resolved or networkd support to set DNS servers

Fixes #16573.

8 weeks agoMerge pull request #16566 from poettering/nspawn-osrelease-fixes v246-rc2
Yu Watanabe [Fri, 24 Jul 2020 04:37:31 +0000 (13:37 +0900)] 
Merge pull request #16566 from poettering/nspawn-osrelease-fixes

nspawn: os-release reorganization, second try

8 weeks agoMerge pull request #16567 from keszybz/more-news
Yu Watanabe [Fri, 24 Jul 2020 04:35:09 +0000 (13:35 +0900)] 
Merge pull request #16567 from keszybz/more-news

NEWS and hwdb update for v246-rc2

8 weeks agoselinux: handle getcon_raw producing a NULL pointer, despite returning 0
Axel Rasmussen [Thu, 23 Jul 2020 17:54:23 +0000 (10:54 -0700)] 
selinux: handle getcon_raw producing a NULL pointer, despite returning 0

Previously, we assumed that success meant we definitely got a valid
pointer. There is at least one edge case where this is not true (i.e.,
we can get both a 0 return value, and *also* a NULL pointer):

When this case occurrs, if we don't check the pointer we SIGSEGV in
early initialization.

8 weeks agosemaphoreci: update Debian release to bullseye
Dan Streetman [Wed, 22 Jul 2020 22:51:41 +0000 (18:51 -0400)] 
semaphoreci: update Debian release to bullseye

The Debian upstream-ci branch is updating to require debhelper 13,
which is only currently available from bullseye, or buster-backports.

8 weeks agoupdate TODO 16566/head
Lennart Poettering [Thu, 23 Jul 2020 14:58:56 +0000 (16:58 +0200)] 
update TODO

8 weeks agonspawn: rework how /run/host/ is set up
Lennart Poettering [Thu, 23 Jul 2020 14:49:13 +0000 (16:49 +0200)] 
nspawn: rework how /run/host/ is set up

Let's find the right os-release file on the host side, and only mount
the one that matters, i.e. /etc/os-release if it exists and
/usr/lib/os-release otherwise. Use the fixed path /run/host/os-release
for that.

Let's also mount /run/host as a bind mount on itself before we set up
/run/host, and let's mount it MS_RDONLY after we are done, so that it
remains immutable as a whole.

8 weeks agoportabled: update host's os-release path
Luca Boccassi [Thu, 23 Jul 2020 13:44:10 +0000 (14:44 +0100)] 
portabled: update host's os-release path

8 weeks agodoc: update os-release spec with new path for container host's file
Luca Boccassi [Thu, 23 Jul 2020 12:46:13 +0000 (13:46 +0100)] 
doc: update os-release spec with new path for container host's file

8 weeks agoNEWS: fix typo in path
Luca Boccassi [Thu, 23 Jul 2020 12:45:45 +0000 (13:45 +0100)] 
NEWS: fix typo in path

8 weeks agonspawn: add missing spdx header
Lennart Poettering [Wed, 22 Jul 2020 15:50:45 +0000 (17:50 +0200)] 
nspawn: add missing spdx header

8 weeks agoMerge pull request #16561 from yuwata/test-ordered-set
Lennart Poettering [Thu, 23 Jul 2020 16:31:03 +0000 (18:31 +0200)] 
Merge pull request #16561 from yuwata/test-ordered-set

test: clarify that ordered_set_put() returns -EEXIST if entry is duplicated

8 weeks agocore: clean more env vars from env block pid1 receives
Lennart Poettering [Thu, 23 Jul 2020 06:48:56 +0000 (08:48 +0200)] 
core: clean more env vars from env block pid1 receives

We generally clean all env vars we use ourselves to communicate with out
childrens. We forgot some more recent additions however. Let's correct

8 weeks agoNEWS: reorder entries a bit and add a few items 16567/head
Zbigniew Jędrzejewski-Szmek [Thu, 23 Jul 2020 15:53:39 +0000 (17:53 +0200)] 
NEWS: reorder entries a bit and add a few items

8 weeks agoNEWS: update contributors list for v246-pre
Zbigniew Jędrzejewski-Szmek [Thu, 23 Jul 2020 15:30:54 +0000 (17:30 +0200)] 
NEWS: update contributors list for v246-pre

8 weeks agohwdb: update again for v246
Zbigniew Jędrzejewski-Szmek [Thu, 23 Jul 2020 15:25:40 +0000 (17:25 +0200)] 
hwdb: update again for v246

Just a few minor changes.

8 weeks agofirstboot: don't create /etc/passwd with mode 000
Lennart Poettering [Thu, 23 Jul 2020 12:24:38 +0000 (14:24 +0200)] 
firstboot: don't create /etc/passwd with mode 000

It needs to be world readable (unlike /etc/shadow) when created anew.

This fixes systems that boot with "systemd-nspawn --volatile=yes", i.e.
come up with an entirely empty /etc/ and thus no existing /etc/passwd
file when firstboot runs.

8 weeks agonspawn: fix MS_SHARED mount propagation for userns containers
Lennart Poettering [Thu, 23 Jul 2020 09:13:44 +0000 (11:13 +0200)] 
nspawn: fix MS_SHARED mount propagation for userns containers

We want our OS trees to be MS_SHARED by default, so that our service
namespacing logic can work correctly. Thus in nspawn we mount everything
MS_SHARED when organizing our tree. We do this early on, before changing
the user namespace (if that's requested). However CLONE_NEWUSER actually
resets MS_SHARED to MS_SLAVE for all mounts (so that less privileged
environments can't affect the more privileged ones). Hence, when
invoking it we have to reset things to MS_SHARED afterwards again. This
won't reestablish propagation, but it will make sure we get a new set of
mount peer groups everywhere that then are honoured for the mount
namespaces/propagated mounts set up inside the container further down.

8 weeks agoUpdate mkosi.ubuntu to 'focal'
szb512 [Tue, 14 Jul 2020 13:33:29 +0000 (09:33 -0400)] 
Update mkosi.ubuntu to 'focal'

[zjs: Looking at, iptables-dev
was a transitional package that was pulling in libxtables-dev, libip4tc-dev,
and libip6tc-dev (as listed by @GiedriusS). iptables-dev is gone in focal, so
replace it by the expanded list.]

8 weeks agonetwork: compare with peer address if it is specified
Yu Watanabe [Tue, 21 Jul 2020 16:03:16 +0000 (01:03 +0900)] 
network: compare with peer address if it is specified

Follow-ups for dfef713f3e390ced671ce0ee87782cc373c937d0.

8 weeks agoMerge pull request #16532 from yuwata/network-sync-state-file
Zbigniew Jędrzejewski-Szmek [Thu, 23 Jul 2020 14:34:38 +0000 (16:34 +0200)] 
Merge pull request #16532 from yuwata/network-sync-state-file

network: sync link state file on dbus call, and ndisc cleanups

8 weeks agotest-ordered-set: add a case where we get 0 for duplicate entries 16561/head
Zbigniew Jędrzejewski-Szmek [Thu, 23 Jul 2020 13:47:21 +0000 (15:47 +0200)] 
test-ordered-set: add a case where we get 0 for duplicate entries

This API is a complete mess. We forgot to do a hashed comparison for duplicate
entries and we use a direct pointer comparison. For trivial_hash_ops the result
is the same. For all other case, it's not. Fixing this properly will require
auditing all the uses of set_put() and ordered_set_put(). For now, let's just
acknowledge the breakage.

8 weeks agoman: do not say that isolate is like switching runlevels
Zbigniew Jędrzejewski-Szmek [Thu, 23 Jul 2020 07:03:58 +0000 (09:03 +0200)] 
man: do not say that isolate is like switching runlevels

We need to do better here, but for now let's at least not trick
users into nuking their graphical environment. Inspired by #16548.

8 weeks agoMerge pull request #16557 from keszybz/two-ci-fixes
Zbigniew Jędrzejewski-Szmek [Thu, 23 Jul 2020 13:24:46 +0000 (15:24 +0200)] 
Merge pull request #16557 from keszybz/two-ci-fixes

Two ci fixes

8 weeks agotest: clarify that ordered_set_put() returns -EEXIST if entry is duplicated
Yu Watanabe [Thu, 23 Jul 2020 12:28:53 +0000 (21:28 +0900)] 
test: clarify that ordered_set_put() returns -EEXIST if entry is duplicated

2 months agomeson: do not choke on time epoch when there are no git tags 16557/head
Zbigniew Jędrzejewski-Szmek [Thu, 23 Jul 2020 10:23:58 +0000 (12:23 +0200)] 
meson: do not choke on time epoch when there are no git tags

github ci was failing with: ERROR: String '' cannot be converted to int

2 months agosemaphore: pull in tree explicitly
Zbigniew Jędrzejewski-Szmek [Thu, 23 Jul 2020 10:17:15 +0000 (12:17 +0200)] 
semaphore: pull in tree explicitly

semaphoreci was failing with:
Can't exec "tree": No such file or directory at /tmp/autopkgtest-lxc.v9oand4g/downtmp/build.TIm/src/test/ line 1752.

2 months agoupdate NEWS
Lennart Poettering [Thu, 23 Jul 2020 08:01:40 +0000 (10:01 +0200)] 
update NEWS

2 months agoMerge pull request #16496 from DaanDeMeyer/firstboot-shell
Lennart Poettering [Thu, 23 Jul 2020 06:39:45 +0000 (08:39 +0200)] 
Merge pull request #16496 from DaanDeMeyer/firstboot-shell

firstboot: Add --root-shell option and tighten up passwd/shadow handling

2 months agoGet SOURCE_EPOCH from the latest git tag instead of NEWS
Daan De Meyer [Mon, 20 Jul 2020 19:41:48 +0000 (20:41 +0100)] 
Get SOURCE_EPOCH from the latest git tag instead of NEWS

Currently, each change to NEWS triggers a meson reconfigure that
changes SOURCE_EPOCH which causes a full rebuild. Since NEWS changes
relatively often, we have a full rebuild each time we pull from
master even if we pull semi-regularly. This is further compounded
when using branches since NEWS has a relatively high chance to
differ between branches which causes git to update the modification
time, leading to a full rebuild when switching between branches.

We fix this by using the creation time of the latest git tag instead.

2 months agoMerge pull request #16542 from keszybz/make-targets-fail-again
Lennart Poettering [Thu, 23 Jul 2020 06:37:47 +0000 (08:37 +0200)] 
Merge pull request #16542 from keszybz/make-targets-fail-again

Make targets fail again

2 months agoexecute: take ownership of more fields in ExecParameters
Lennart Poettering [Wed, 22 Jul 2020 13:18:43 +0000 (15:18 +0200)] 
execute: take ownership of more fields in ExecParameters

Let's simplify things a bit, and take ownership of more fields in
ExecParameters, so that they are automatically freed when the structure
is released.

2 months agofirstboot: Add --root-shell option 16496/head
Daan De Meyer [Tue, 21 Jul 2020 21:35:21 +0000 (22:35 +0100)] 
firstboot: Add --root-shell option

2 months agofirstboot: Tighten up passwd/shadow handling
Daan De Meyer [Tue, 21 Jul 2020 21:30:16 +0000 (22:30 +0100)] 
firstboot: Tighten up passwd/shadow handling

There are a lot of edge cases that the current implementation
doesn't handle, especially in cases where one of passwd/shadow
exists and the other doesn't exist. For example, if
--root-password is specified, we will write /etc/shadow but
won't add a root entry to /etc/passwd if there is none.

To fix some of these issues, we constrain systemd-firstboot to
only modify /etc/passwd and /etc/shadow if both do not exist
already (or --force) is specified. On top of that, we calculate
all necessary information for both passwd and shadow upfront so
we can take it all into account when writing the actual files.

If no root password options are given --force is specified or both
files do not exist, we lock the root account for security purposes.

2 months agopid1: target units can fail through dependencies 16542/head
Zbigniew Jędrzejewski-Szmek [Wed, 22 Jul 2020 13:49:29 +0000 (15:49 +0200)] 
pid1: target units can fail through dependencies

Fixes #16401.

c80a9a33d04fb4381327a69ce929c94a9f1d0e6c introduced the .can_fail field,
but didn't set it on .targets. Targets can fail through dependencies.
This leaves .slice and .device units as the types that cannot fail.

$ systemctl cat bad.service bad-fallback.service


ExecStart=echo Fixing everythign!

$ sudo systemctl start
systemd[1]: Starting bad.service...
systemd[1]: bad.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: bad.service: Failed with result 'exit-code'.
systemd[1]: Failed to start bad.service.
systemd[1]: Dependency failed for
systemd[1]: Job failed with result 'dependency'.
systemd[1]: Triggering OnFailure= dependencies.
systemd[1]: Starting bad-fallback.service...
echo[46901]: Fixing everythign!
systemd[1]: bad-fallback.service: Succeeded.
systemd[1]: Finished bad-fallback.service.

2 months agoRevert "units: drop OnFailure= from .target units"
Zbigniew Jędrzejewski-Szmek [Wed, 22 Jul 2020 10:51:15 +0000 (12:51 +0200)] 
Revert "units: drop OnFailure= from .target units"

This reverts commit c7220ca8025e8dbded36131b23a502d975c45754.

The removal was done as a reaction to the messages from systemd: Requested dependency ignored (target units cannot fail). Requested dependency ignored (target units cannot fail). Requested dependency ignored (target units cannot fail). Requested dependency ignored (target units cannot fail). Requested dependency ignored (target units cannot fail).
But it seems that the messages themselves are wrong, and the units were OK.

2 months agocore/job: adjust whitespace and comment
Zbigniew Jędrzejewski-Szmek [Wed, 22 Jul 2020 15:57:23 +0000 (17:57 +0200)] 
core/job: adjust whitespace and comment

2 months agotest-network: add test for duplicated IPv6Token= 16532/head
Yu Watanabe [Tue, 21 Jul 2020 00:45:11 +0000 (09:45 +0900)] 
test-network: add test for duplicated IPv6Token=

2 months agonetwork: ndisc: ignore duplicated IPv6Token=
Yu Watanabe [Tue, 21 Jul 2020 00:42:30 +0000 (09:42 +0900)] 
network: ndisc: ignore duplicated IPv6Token=

2 months agonetwork: ndisc: do not store duplicated data in Set
Yu Watanabe [Tue, 21 Jul 2020 00:09:08 +0000 (09:09 +0900)] 
network: ndisc: do not store duplicated data in Set

The Address objects in the set generated by ndisc_router_generate_addresses()
have the equivalent prefixlen, flags, prefered lifetime.
This commit makes ndisc_router_generate_addresses() return Set of

2 months agoMerge pull request #16536 from poettering/time-clock-map-fixes
Zbigniew Jędrzejewski-Szmek [Wed, 22 Jul 2020 11:05:13 +0000 (13:05 +0200)] 
Merge pull request #16536 from poettering/time-clock-map-fixes

time-util: clock mapping improvements

2 months agoutil: use IN6_ARE_ADDR_EQUAL() macro
Yu Watanabe [Tue, 21 Jul 2020 00:08:48 +0000 (09:08 +0900)] 
util: use IN6_ARE_ADDR_EQUAL() macro

2 months agotest-network: drop unnecessary sleep() in NetworkdStateFileTests.test_state_file
Yu Watanabe [Mon, 20 Jul 2020 20:50:15 +0000 (05:50 +0900)] 
test-network: drop unnecessary sleep() in NetworkdStateFileTests.test_state_file

2 months agonetwork: make bus methods sync link state file
Yu Watanabe [Mon, 20 Jul 2020 20:26:06 +0000 (05:26 +0900)] 
network: make bus methods sync link state file

2 months agonetwork: introduce link_save_and_clean()
Yu Watanabe [Mon, 20 Jul 2020 20:21:28 +0000 (05:21 +0900)] 
network: introduce link_save_and_clean()

2 months agotree-wide: use siphash24_compress_string() where it is applicable
Yu Watanabe [Mon, 20 Jul 2020 19:54:37 +0000 (04:54 +0900)] 
tree-wide: use siphash24_compress_string() where it is applicable

2 months agoutil: introduce siphash24_compress_string()
Yu Watanabe [Mon, 20 Jul 2020 19:42:11 +0000 (04:42 +0900)] 
util: introduce siphash24_compress_string()

2 months agoutil: make siphash24_compress_boolean() inline
Yu Watanabe [Mon, 20 Jul 2020 19:35:56 +0000 (04:35 +0900)] 
util: make siphash24_compress_boolean() inline

This also changes the stored type from int to uint8_t in order to make
hash value endianness independent.

2 months agotest-path: decrease variable scope
Zbigniew Jędrzejewski-Szmek [Wed, 22 Jul 2020 10:12:54 +0000 (12:12 +0200)] 
test-path: decrease variable scope

2 months agotest: increase timeout for test-path
Zbigniew Jędrzejewski-Szmek [Wed, 22 Jul 2020 10:12:36 +0000 (12:12 +0200)] 
test: increase timeout for test-path

The CI occasionally fail in test-path with a timeout. test-path loads
units from the filesystem, and this conceivably might take more than
the default limit of 3 s. Increase the timeout substantially to see if
this helps.

2 months agoMerge pull request #16530 from yuwata/udev-fix-race-in-renaming-network-interface
Zbigniew Jędrzejewski-Szmek [Wed, 22 Jul 2020 09:50:09 +0000 (11:50 +0200)] 
Merge pull request #16530 from yuwata/udev-fix-race-in-renaming-network-interface

udev: fix race in renaming network interface

2 months agoMerge pull request #16407 from bluca/verity_reuse
Lennart Poettering [Wed, 22 Jul 2020 09:36:49 +0000 (11:36 +0200)] 
Merge pull request #16407 from bluca/verity_reuse

verity: re-use already open devices if the hashes match

2 months agoRevert "man: add note about systemd-vconsole-setup.service and tty as input/output"
Zbigniew Jędrzejewski-Szmek [Mon, 20 Jul 2020 06:22:45 +0000 (08:22 +0200)] 
Revert "man: add note about systemd-vconsole-setup.service and tty as input/output"

This reverts commit 0b578036301d7c3f2dab8df1f31f0121552a4e10.

systemd-vconsole-setup (the binary) is supposed to run asynchronously by udev
therefore ordering early interactive services after systemd-vconsole-setup.service
has basically no effect.

Let's remove this paragraph. It's better to say nothing than to give pointless

2 months agotest: adapt test-functions for SUSE
Elisei Roca [Tue, 21 Jul 2020 20:14:53 +0000 (22:14 +0200)] 
test: adapt test-functions for SUSE

2 months agoMerge pull request #16514 from keszybz/zstd-decompress-fix
Zbigniew Jędrzejewski-Szmek [Wed, 22 Jul 2020 08:40:19 +0000 (10:40 +0200)] 
Merge pull request #16514 from keszybz/zstd-decompress-fix

Fix coredumpctl operation with zstd-compressed journals

2 months agoMerge pull request #16540 from poettering/acl-fix
Zbigniew Jędrzejewski-Szmek [Wed, 22 Jul 2020 08:34:12 +0000 (10:34 +0200)] 
Merge pull request #16540 from poettering/acl-fix

two ACL handling fixes

2 months agoverity: re-use already open devices if the hashes match 16407/head
Luca Boccassi [Wed, 8 Jul 2020 18:57:31 +0000 (19:57 +0100)] 
verity: re-use already open devices if the hashes match

Opening a verity device is an expensive operation. The kernelspace operations
are mostly sequential with a global lock held regardless of which device
is being opened. In userspace jumps in and out of multiple libraries are
required. When signatures are used, there's the additional cryptographic

We know when two devices are identical: they have the same root hash.
If libcrypsetup returns EEXIST, double check that the hashes are really
the same, and that either both or none have a signature, and if everything
matches simply remount the already open device. The kernel will do
reference counting for us.

In order to quickly and reliably discover if a device is already open,
change the node naming scheme from '/dev/mapper/major:minor-verity' to

Unfortunately libdevmapper is not 100% reliable, so in some case it
will say that the device already exists and it is active, but in
reality it is not usable. Fallback to an individually-activated
unique device name in those cases for robustness.

2 months agodm-util: use CRYPT_DEACTIVATE_DEFERRED instead of ioctl
Luca Boccassi [Tue, 14 Jul 2020 14:07:21 +0000 (15:07 +0100)] 
dm-util: use CRYPT_DEACTIVATE_DEFERRED instead of ioctl

2 months agocoredump: port to use common add_acls_for_user() 16540/head
Lennart Poettering [Tue, 21 Jul 2020 20:21:28 +0000 (22:21 +0200)] 
coredump: port to use common add_acls_for_user()

It's line-by-line the same logic, hence use the common implementation.

2 months agoacl-util: fix error handling in add_acls_for_user()
Lennart Poettering [Tue, 21 Jul 2020 20:19:17 +0000 (22:19 +0200)] 
acl-util: fix error handling in add_acls_for_user()

2 months agooffline-passwd: use chase_symlinks()
Lennart Poettering [Tue, 21 Jul 2020 14:25:45 +0000 (16:25 +0200)] 
offline-passwd: use chase_symlinks()

In case the passwd/group file is symlinked, follow things correctly.

Follow-up for: #16512

2 months agoupdate TODO
Lennart Poettering [Tue, 21 Jul 2020 15:46:14 +0000 (17:46 +0200)] 
update TODO

2 months agoman: update docs with the new functions and other enhancements 16514/head
Zbigniew Jędrzejewski-Szmek [Tue, 21 Jul 2020 15:16:52 +0000 (17:16 +0200)] 
man: update docs with the new functions and other enhancements

2 months agohomectl: fix warning about unused function
Zbigniew Jędrzejewski-Szmek [Sun, 19 Jul 2020 09:05:44 +0000 (11:05 +0200)] 
homectl: fix warning about unused function

../src/home/homectl-pkcs11.c:19:13: warning: ‘pkcs11_callback_data_release’ defined but not used [-Wunused-function]
   19 | static void pkcs11_callback_data_release(struct pkcs11_callback_data *data) {
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 months agoTODO: add entry for XZ
Zbigniew Jędrzejewski-Szmek [Sun, 19 Jul 2020 08:22:21 +0000 (10:22 +0200)] 
TODO: add entry for XZ

The docs for XZ don't seem to answer this at first blush, or maybe
I'm looking in the wrong place... This might make XZ less terribly slow,
but on the other hand, almost nobody uses it, so it doesn't matter that

2 months agojournal/compress: remove loop in decompress_startswith_zstd()
Zbigniew Jędrzejewski-Szmek [Sun, 19 Jul 2020 08:18:46 +0000 (10:18 +0200)] 
journal/compress: remove loop in decompress_startswith_zstd()

This should be more efficient with no downsides. Same considerations as in the
previous commit hold.