Daan De Meyer [Wed, 27 Mar 2024 10:07:52 +0000 (11:07 +0100)]
mkosi: Merge base and system images
The only reason to have these split up is to be able to build extension
images that use the base image as a base tree and install extra packages.
Until we have such a use case, let's merge the base and system images to
simplify things a bit.
We keep the mkosi.images/ directory to not cause too many conflicts with
the integration tests PR.
Ronan Pigott [Tue, 26 Mar 2024 07:33:19 +0000 (00:33 -0700)]
resolved: always return the validated answers when validating
We normally expect sd-resolved only to return the validated subset of a
validated response. In some cases we give up on validating, because we
have enough information already to conclude the answer is bogus.
Let's be sure to always reply with only the validated subset in these
cases too, so that we don't return bogus answers and confuse primitive
clients that won't see the SERVFAIL rcode.
shared/logs-show: restore infinite loop avoidance for corrupted journals
Fixes a bug introduced in e44f06065bf20e8d0e4adacff61350ebd36f299e: it was
supposed to be a refactoring, but unfortunately FOREACH_ARRAY is implemented
using a for loop, so when the 'goto finish' was replaced by 'break', it only
broke the inner loop, leading to a infinite loop.
Jakub Sitnicki [Thu, 15 Feb 2024 17:02:50 +0000 (18:02 +0100)]
socket: pass socket FDs to all ExecXYZ= commands but ExecStartPre=
Today listen file descriptors created by socket unit don't get passed to
commands in Exec{Start,Stop}{Pre,Post}= socket options.
This prevents ExecXYZ= commands from accessing the created socket FDs to do
any kind of system setup which involves the socket but is not covered by
existing socket unit options.
One concrete example is to insert a socket FD into a BPF map capable of
holding socket references, such as BPF sockmap/sockhash [1] or
reuseport_sockarray [2]. Or, similarly, send the file descriptor with
SCM_RIGHTS to another process, which has access to a BPF map for storing
sockets.
To unblock this use case, pass ListenXYZ= file descriptors to ExecXYZ=
commands as listen FDs [4]. As an exception, ExecStartPre= command does not
inherit any file descriptors because it gets invoked before the listen FDs
are created.
This new behavior can potentially break existing configurations. Commands
invoked from ExecXYZ= might not expect to inherit file descriptors through
sd_listen_fds protocol.
To prevent breakage, add a new socket unit parameter,
PassFileDescriptorsToExec=, to control whether ExecXYZ= programs inherit
listen FDs.
Luca Boccassi [Fri, 8 Mar 2024 23:02:19 +0000 (23:02 +0000)]
resolved: support reloading configuration at runtime
Drop connections and caches and reload config from files, to allow
for low-interruptions updates, and hook up to the usual SIGHUP and
ExecReload=. Mark servers and services configured directly via D-Bus
so that they can be kept around, and only the configuration file
settings are dropped and reloaded.
efi: Measure into both CC and TPM if available. (#31939)
* efi: Measure into both CC and TPM if available.
It's possible that both measurement protocols are made available, so
instead of assuming only one or the other are available, measure into
both to avoid a problem like CVE-2021-42299.
Vitaly Kuznetsov [Mon, 25 Mar 2024 10:18:25 +0000 (11:18 +0100)]
kernel-install/60-ukify: do not rebuild existing UKIs
In case kernel-install is called to install what's already a UKI, 60-ukify
must be skipped. E.g. when distro shipped and signed UKI is being installed,
it is counter-productive to try to rebuild it with ukify. Also, the existing
script is not ready to handle UKIs with embedded initramfs.
Note, it is already possible to disable 60-ukify by setting
KERNEL_INSTALL_UKI_GENERATOR to something but in case it is not set, 60-ukify
assumes it should run.
Richard Maw [Wed, 20 Mar 2024 14:33:17 +0000 (14:33 +0000)]
mkosi: Remove testuser from base/mkosi.postinst.chroot
The testuser user is only needed for integration tests,
which are used in the system user and this config
can be provided as drop-ins instead of inline in postinst scripts.
Hans de Goede [Sun, 24 Mar 2024 14:04:47 +0000 (15:04 +0100)]
hwdb: Add mapping for ACPI quickstart keys on Toshiba Z830
The Toshiba Z830 has 3 hotkeys which use the ACPI PNP0C32 quickstart spec:
https://archive.org/details/microsoft-acpi-dirapplaunch
These devices have an ACPI method called GHID() which suggests
it returns a value from the "HID Usage Tables" document, but these
methods simple returns a follow number for the button (1, 2 and 3).
The first 2 buttons are for what the manual calls "TOSHIBA eco button"
and "TOSHIBA Presentation button", since there is no good match for
these simply map them to KEY_PROG1 and KEY_PROG2.
The third button is intended to toggle the touchpad on/off, map
this to F21 which GNOME/KDE will interpret as touchpad toggle.
Krzesimir Nowak [Wed, 28 Feb 2024 13:23:22 +0000 (14:23 +0100)]
sysext: Implement ephemeral import mode
To enable it, use "ephemeral-import" either for mutable mode environment
variable or for value of "--mutable=" flag.
This is a combination of "ephemeral" and "import" modes. It results in a
mutable hierarchy that includes contents of the mutable extension data, but the
modifications are thrown away when the hierarchy is unmerged.
Krzesimir Nowak [Wed, 28 Feb 2024 08:17:27 +0000 (09:17 +0100)]
sysext: Implement ephemeral mode
To enable it, use "ephemeral" either for mutable mode environment variable or
for value of "--mutable=" flag.
Instead of using mutable dir in /var/lib/extensions.mutable/<hierarchy>, we
create a directory for overlayfs upperdir and workdir in the same tmpfs mount
that sysext worker process creates in /run/systemd/sysext. As the path for the
workdir will be gone when the worker quits, there is no need to do any
additional cleanup. As such, there is also no need to store a path to workdir
in the metadata directory.
Krzesimir Nowak [Tue, 19 Mar 2024 13:01:00 +0000 (14:01 +0100)]
sysext: Add support for mutable mode environment variables
The environment variable names are SYSTEMD_SYSEXT_MUTABLE_MODE for
systemd-sysext and SYSTEMD_CONFEXT_MUTABLE_MODE for systemd-confext. These
override the default mutable mode setting, but can be still overridden by a
command-line flag.
basic/virt: Fix virtualbox detection on proprietary system via board_vendor
Identify an virtualbox instance even if product_name, sys_vendor and bios_vendor reflect the
information of the real hardware, by checking if board_vendor == "Oracle Corporation"
This fixes #13429 again
The previous fix was removed in #21127
projects / thirdparty / systemd.git / log
