Rebecca Cran [Fri, 5 Dec 2025 18:25:15 +0000 (11:25 -0700)]
hwdb: Add BMC USB-to-USB link devices to 82-net-auto-link-local.hwdb
Add BMC USB-to-USB Ethernet gadget devices found on ASRock Rack and
ADLINK boards containing Ampere Altra and AmpereOne CPUs to
82-net-auto-link-local.hwdb. Update 20-usb-vendor-model.hwdb with
devices which were missing.
Rebecca Cran [Fri, 5 Dec 2025 18:20:05 +0000 (11:20 -0700)]
hwdb,rules: add 82-net-auto-link-local.{hwdb,rules} to build
Update hwdb.d/meson.build and rules.d/meson.build to add the
82-net-auto-link-local.{hwdb,rules} files into the build. Commit ec541c569bd19bbb81791139371111a9a7f1a3d8 in 2023 added the files
but didn't add them to the build system.
David Tardon [Fri, 5 Dec 2025 14:17:13 +0000 (15:17 +0100)]
udev-rules: use the right variable
We carefully prepare a copy of a local buffer to save in device cache
and then save the buffer there instead... This leads to abort in free()
on exit (also, copied is leaked).
Luca Boccassi [Fri, 5 Dec 2025 11:58:34 +0000 (11:58 +0000)]
pid1: do not fail if dlopen of libmount fails because it is not compiled in
It is now possible to build and run without libmount. But if support
is compiled in, then we need to be able to load it. Hence gracefully
skip it when support is not compiled in, but fail otherwise.
Luca Boccassi [Fri, 5 Dec 2025 11:54:27 +0000 (11:54 +0000)]
Reapply "pid1: pull in libmount unconditionally"
It was actually intended to load libmount very early, as it is
needed by more than just mount units, such as umount_recursive(),
bind_remount_recursive(), get_sub_mounts(), etc.
Luca Boccassi [Fri, 5 Dec 2025 14:24:23 +0000 (14:24 +0000)]
Translations update from Fedora Weblate (#39998)
Translations update from [Fedora
Weblate](https://translate.fedoraproject.org) for
[systemd/main](https://translate.fedoraproject.org/projects/systemd/main/).
machined: add description to varlink server, unify error messages
manager_varlink_init_resolve_hook and manager_varlink_init_userdb are very
similar, but one didn't set a description and the other one had an error
message which didn't print the offending path.
Define constants for the paths, and also change other similar constants
to have slightly shorter names. (It's an "address" and "path", but we don't
need to have both parts in the name, esp. that it makes the name very long.)
Yu Watanabe [Sun, 30 Nov 2025 02:10:02 +0000 (11:10 +0900)]
musl: introduce wrappers for getopt() and getopt_long()
musl's getopt_long() behaves something different in handling optional arguments:
```
$ journalctl _PID=1 _COMM=systemd --since 19:19:01 -n all --follow
Failed to add match 'all': Invalid argument
```
This introduces getopt_long_fix() that reorders the passed arguments to make
getopt_long() provided by musl works as what we expect.
Also, musl's getopt() always behaves POSIXLY_CORRECT mode, and stops parsing
arguments when a non-option string found. Let's always use getopt_long().
Yu Watanabe [Tue, 2 Dec 2025 10:27:56 +0000 (19:27 +0900)]
sd-netlink: also read the reply for NFNL_MSG_BATCH_BEGIN message
When we send a batch of nfnl messages, but e.g. without sufficient
privilege, the kernel may only return an error message for
NFNL_MSG_BATCH_BEGIN and ignore all later messages.
So, we need to read the response for the NFNL_MSG_BATCH_BEGIN,
and if it is an error ignore the replies for the rest.
Yu Watanabe [Tue, 2 Dec 2025 14:02:50 +0000 (23:02 +0900)]
sd-netlink: introduce sd_netlink_ignore_serial()
When we send a message with NLM_F_ACK, but if later we are not
interested in the reply and do not want to call sd_netlink_read(),
the reply will be stored in the rqueue forever.
Let's introduce a way to ignore received message without waiting reply.
Luca Boccassi [Tue, 2 Dec 2025 14:16:27 +0000 (14:16 +0000)]
cryptsetup: downgrade dlopen not compiled message to debug
Every other log in this function is debug level, so downgrade this too.
Otherwise compiling without libcryptsetup means sd-executor logs at
error level when starting any service, regardless of whether it is
needed or not.
machined: in --user mode, restrict register access to our own UID, and that's it
This is a follow-up for 119d332d9c2cf1974b235c8d9e4e3ad821cf436a and
ensures the check only is applied to the system instance of machined. It
doesn't really apply to the per-user instance, because we never want to
permit differently privileged clients access anyway.
(The process_is_owned_by_uid() call might fail if invoked unpriv, hence
there's value in not calling it if machined runs in --user mode, it's
what makes machined actually work)
Previously, we looked for scripts in the tools/ directory ad hoc,
wherever they were needed. Let's do those checks in one place.
The main meson.build file is shrunk somewhat, which is always nice.
meson: add source dir to include_directories automatically
Quite often we need to specify include_directories('.'). Normally, meson
does this automatically, but we specify implicit_include_directories : false,
see 30d20907bddfe064cc3437a888dd8f00d14929e4 for an explanation.
Passing the include_directories argument through the template layers was rather
cumbersome. Let's simplify things by always including the directory of the
first source file. This makes the definitions simpler, at the cost of having an
unnecessary include directory in the list in some cases.
(Tests are excluded from this change, because they happen to not need this, but
also because some tests have source[0] which is a custom target, and we'd need
newer meson to support that.)
Currently translated at 100.0% (264 of 264 strings)
Co-authored-by: Fco. Javier F. Serrador <fserrador@gmail.com>
Translate-URL: https://translate.fedoraproject.org/projects/systemd/main/es/
Translation: systemd/main
sd-notify: print a debug message when sd_notify() succeds
… and also when it fails, in the few cases where this wasn't done already.
When I was debugging https://github.com/systemd/systemd/issues/39048, it
was quite confusing that we print copious information about D-Bus messages
and all other steps we're undertaking, but nothing about the sd-notify
messages which are much more important. Add some debug messages for the
cases where we didn't print anything. (The case where $NOTIFY_SOCKET is
not set in left unchanged. The variable is often left unset and we don't
need to spam logs in that trivial case.)
journal: send READY=1 also when --lines=0 is given
If --lines=0 is given, we'd skip the setup and not invoke sd_notify,
potentially blocking the caller. Change the condition for the callback
to also include that case. Since then the callback would always be
set, the 'if' statement is not necessary anymore.
Yu Watanabe [Wed, 26 Nov 2025 18:10:29 +0000 (03:10 +0900)]
Pull in recent changes from Weblate (#39920)
One of the pending commits in Weblate causes conflicts due to an
unfortunate timing with 9e929e4aa78a38f822be7aa3da9c11994ad94c07, so
let's pull the changes into the main tree manually (and resolve the
conflicts).
ci: split out nvpcr test, so that it runs before rest of pcrextend (#39915)
in pcrextend we destroy pcr 11, and if we are booted in a kernel that
has pcr11 sigs, we cannot use that signature anymore. hence, let's do
the nvpcr test first, before doing the pcrextend stuff.
Daan De Meyer [Tue, 25 Nov 2025 12:33:25 +0000 (13:33 +0100)]
import: Make naming consistent
Always abbreviate import/pull/export structs with their first letter
instead of only doing it in some places and using the wrong letter in
other places.
Daan De Meyer [Tue, 25 Nov 2025 11:09:34 +0000 (12:09 +0100)]
fsprg: Drop const from gcry_mpi_t arguments
gcry_mpi_t is defined as "typedef struct gcry_mpi *gcry_mpi_t;".
When const is applied to this type, it resolves to
"struct gcry_mpi *const" instead of what we expect ("const struct gcry_mpi *").
So we end up with a const pointer to a mutable object instead of a mutable
pointer to a const object. Since the pointer passed to the function
is copied regardless, making it const has zero benefit.
You'd think we could instead stop using gcry_mpi_t and replace it with
"const struct gcry_mpi *", except that gcrypt leaked this mess into its
api, so it expects const pointers to mutable objects as well, which means
we can't take pointers to const objects as arguments, as we'd discard the qualifier
when calling a gcrypt function.
To avoid confusion, let's drop the const qualifiers from the gcry_mpi_t arguments.
This alignes with some other optional modules in shraed/,
and it allows dlopen_libmount() to be optimized out entirely.
Let's avoid emitting pointless symbols.
Since we now consider this a supported senario, let's hook up
libmount loading with the high-level unit_type_supported() machinery
and gracefully skip the whole unit accordingly.
Mike Yuan [Tue, 25 Nov 2025 17:42:11 +0000 (18:42 +0100)]
run: merge privileged_execution() into become_root()
This got split in 5cabeed80b30972babc7a082ca794c6b197e72ab
to accommodate --empower, and later --empower received
dedicated handling again (c36942916b7409109687d693c04b039def9c5b79).
I think the new naming makes more sense - --empower is privileged
after all, just with uid left unchanged. Hence merge
privileged_execution back into it.
Special casing --area= rather than --empower makes the code
self-explanatory, as --area= is about alternative home dir
after all. On top of that this ensures when --area= and
--empower are specified in combination we honor the home dir
switch, too.
Daan De Meyer [Mon, 24 Nov 2025 18:52:40 +0000 (19:52 +0100)]
run: Don't make executable absolute when --root-directory= is used
Also, unless --same-root-dir was specified, don't make the executable
absolute if we're running in a chroot. Situations like this are still iffy,
but we might as well handle them a little more gracefully.
tree-wide: Fix constness issues with newer glibc (#39896)
Latest glibc uses _Generic to have strstr() and other functions return
const char* or char* based on whether the input is a const char* or a
char*. This causes build failures as we previously always expected a
char*.
Let's fix the compilation failures and add our own macros similar to
glibc's to have string functions that return a mutable or const pointer
depending on the input.
Daan De Meyer [Tue, 25 Nov 2025 15:46:04 +0000 (16:46 +0100)]
tree-wide: Fix constness issues with newer glibc
Latest glibc uses _Generic to have strstr() and other functions return
const char* or char* based on whether the input is a const char* or a
char*. This causes build failures as we previously always expected a char*.
Let's fix the compilation failures and add our own macros similar to glibc's
to have string functions that return a mutable or const pointer depending on
the input.
Daan De Meyer [Mon, 24 Nov 2025 18:48:49 +0000 (19:48 +0100)]
run0: Give --empower its own color, title and emoji
When in --empower mode, all created files will be owned by the current
user, which could be problematic when creating files outside of the
current user's home directory, as other processes running as the same
user would be able to edit those files.
While this is a bit of an edge case since users already have to go through
the effort of writing --empower to indicate they want a privileged session
as the current user, it's not unphatomable to think they could start an
empowered session which they later return to and continue using. Currently,
it's not easy to differentiate a regular run0 session and an empowered session
at a glance, so users might think they're using a regular run0 session when
they're actually using an empowered session.
To address this problem, let's give empowered session their own identify, by
making the background orange, using the pumpkin emoji as the shell prompt
prefix and giving them an orange circle as the PTY title.
mkosi: Rework how the pkgenv environment variables are set
Instead of including distribution specific files in the subimages,
let's have one common mkosi.pkgenv/ directory that handles all the
matching which is then included in the subimages.
This gives us more control on exactly how we do the matching.
* 10544812b3 Don't fix up vmlinuz locations if not required
* 9baf551923 Reduce amount of packages in default image
* 9e1a2f18b8 Add support for assert sections
* c7c6e2c0b1 ubuntu: Switch to devel as the default release
* 0822deb69c Improve logging when we can not extract kernel version from filename
* 1fd7ef3db7 Do not build default initrd if Initrds= is specified
* 611c8b46c8 Don't unconditionally sync when PackageCacheDirectory=/var
* ab37f24d38 README: add link to OBS docs for mkosi builds
* 02bf256ebb completion: add reuse ignore comments
* 10ccb0b04f Make sure not all subimages depend on default-initrd subimage
* 442e1ce0f1 mkosi-tools: systemd-boot-tools is now available for all arches
* 307fc1dba3 action: make it work when used as a submodule
* c37a55f91b config: serialize dataclass instances in our JSONEncoder
* f26cb34155 log: set terminal window title in complete_step while mkosi runs
* 280c78e681 Make sure inherited settings are applied for the default initrd
* ae4f2fd718 Fix typo
* 5644f3e83e build(deps): bump github/codeql-action from 3.29.7 to 3.30.5
* 7d7b26b8c9 build(deps): bump actions/checkout from 4.2.2 to 5.0.0
* e805253447 postmarketos: implement is_kernel_package
* dd51d2e019 postmarketos: provide missing i386-vars.fd
* e23e6de66b Do not relabel files when building extension image
* ab05ead5eb Bump various systemd version checks to 258
* 382cc8b450 preset: drop systemd-networkd-wait-online.service
* 477b6b2ed5 mkosi-initrd: install systemd-container in network profile
* 1d167c0b53 mkosi-initrd: add 89-ethernet.network for network profile
* b1e81dec3a mkosi-initrd: Install libseccomp explicitly
* 3c431a141c opensuse: repository non-oss-debug is invalid
* 62ab363149 ci: add an s390x build job for additional coverage
* 62765f2d07 mailmap: deduplicate Daan
* 47f963f40b Revert "ci: Disable PPC jobs temporarily"
* 6a48f83dda dnf: Always specify --best again
* 3702368616 sandbox: Make all relative paths absolute during argparsing
* a587af0bf7 dnf: Fix /var package cache directory check in package_subdirs()
* 56cdbc25b5 Always use repository metadata from /var package cache directory
* 669d4418a3 Add note on Encrypt=yes to Passphrase= docs
* caa129edae Drop BuildSourcesEphemeral=yes from default image config
* 7edca63478 Add devicetree-auto support for UKI
* 6cb1649074 Don't add ncdu for ppc64-le on Fedora
* e019d2d2a6 ci: Disable PPC jobs temporarily
Some of the functions were ignoring failure in cleanup, others weren't. If we
got a reply, it's better to use it, so ignore failures in cleanup everywhere.
basic/terminal-util: operate on one fd in get_default_background_color()
This moves the open call earlier, so that we do any state-changing operations
if we actually managed to open the nonblocking fd. The code is easier to follow
this way and might be more robust.
Suprisingly, this fixes https://github.com/systemd/systemd/issues/39055: it
seems that run0 chowns /dev/stdin (in my case /dev/pts/0) to root:root, and the
second run0 can read and write stdin/stdout throught the already-open fds,
but fd_reopen fails.
projects / thirdparty / systemd.git / log
