clang-16 has made the choice to turn on -Werror=implicit-function-declaration,implicit-int.
(See Gentoo's tracker bug https://bugs.gentoo.org/870412).
Added in commit 132c73b57ad1d363e97e1f4720f0e920826f34e1, systemd now does a
check to see if libatomic is needed with some compile/link tests with e.g.
__atomic_exchange_1, but the tests don't provide a prototype for
__atomic_exchange_1 so with clang-16 the test fails, breaking the build.
Let's simplify things by linking to libatomic unconditionally if it is found
and seems to work. If actually unneeded, it might be dropped via --as-needed.
This seems to work with gcc and clang.
declare_dependency() is used instead of cc.find_library(), because the latter
picks up a symlink in gcc private directory (e.g.
/usr/lib/gcc/x86_64-redhat-linux/12/libatomic.so), and we don't want that.
Frantisek Sumsal [Thu, 20 Oct 2022 15:06:26 +0000 (17:06 +0200)]
ci: run the Scorecards action in PRs only on config update
Also, unify the string quotation a bit and drop one unnecessary
expression syntax (as everything in `if` statements is automatically
evaluated as an expression).
Luca Boccassi [Wed, 19 Oct 2022 22:52:58 +0000 (23:52 +0100)]
service: do fine-grained validation of CPUSchedulingPriority= at execution time
The precise bounds of the scheduling priority depend on the scheduling policy,
so depending on the order in which the two settings are specified the
validation might pass or fail.
When checking the setting only validate the outer range (valid values in general are 0 to 99),
and let the execution fail later if the priority does not match the
specified policy (1 to 99 for RR/FIFO, 0 for the rest).
Luca Boccassi [Wed, 19 Oct 2022 23:37:08 +0000 (00:37 +0100)]
core: allow-list char-rtc with ProtectClock=yes only if needed
Allow-listing a device implicitly blocks everything else, so this
has the opposite of the intended effect when PrivateDevices= is
not used.
Allow-list char-rtc only if there is a device policy set.
The test would fail when addresses were being removed in parallel. In general,
the check is only valid when the machine configuration is static, which in
general isn't true.
CentOS CI (Arch Linux) fails in TEST-02-UNITTESTS test-local-addresses:
10:38:05 (gdb) #0 0x00007f86260a164c in ?? () from /usr/lib/libc.so.6
10:38:05 No symbol table info available.
10:38:05 #1 0x00007f8626051958 in raise () from /usr/lib/libc.so.6
10:38:05 No symbol table info available.
10:38:05 #2 0x00007f862603b53d in abort () from /usr/lib/libc.so.6
10:38:05 No symbol table info available.
10:38:05 #3 0x00007f862639a755 in log_assert_failed (
10:38:05 text=text@entry=0x56180e56c03b "n == n_ipv4 + n_ipv6",
10:38:05 file=file@entry=0x56180e56c0d1 "src/test/test-local-addresses.c",
10:38:05 line=line@entry=45,
10:38:05 func=func@entry=0x56180e56c360 <__PRETTY_FUNCTION__.6> "test_local_addresses") at ../build/src/basic/log.c:853
10:38:05 No locals.
10:38:05 #4 0x000056180e56b77e in test_local_addresses ()
10:38:05 at ../build/src/test/test-local-addresses.c:45
10:38:05 a = 0x0
10:38:05 n = 234
10:38:05 n_ipv4 = 236
10:38:05 n_ipv6 = 7
10:38:05 __PRETTY_FUNCTION__ = "test_local_addresses"
10:38:05 __func__ = "test_local_addresses"
10:38:05 #5 0x000056180e56ba67 in run_test_table () at ../build/src/shared/tests.h:106
10:38:05 r = 0
10:38:05 t = 0x56180e56e010 <__unique_prefix_static_test_table_entry10>
10:38:05 __PRETTY_FUNCTION__ = <optimized out>
10:38:05 __func__ = "run_test_table"
10:38:05 #6 0x000056180e56bb2f in main (argc=1, argv=0x7ffc3a814808)
10:38:05 at ../build/src/test/test-local-addresses.c:81
10:38:05 _intro = 0x0
10:38:05 _outro = 0x0
10:38:05 _r = 0
10:38:05 _q = 0
10:38:05 (gdb)
The logs show that there's a huge number of private addresses, probably from
some other test running in parallel.
shell-completion/zsh: silence error when machinectl is not installed
This fixes a few unrelated issues:
- when ENABLE_MACHINED is false, machinectl is not installed, but _sd_machines
is still used in a few places that want to complete -M and such.
Also, bash completion calls machinectl in various places.
Make missing machinectl mean "no machines" in this case, so
that no error is generated in the callers.
- machinectl list --full would print multiple lines of output per machine,
breaking grep, issue introduced in e2268fa43742ece4a5cdc2e93f731b2bb2fcc883.
Using --max-addresses=1 would fix the issue, but let's use
--max-addresses=0 because we now can.
- the lists used in various places were slightly different for no good reason.
- don't use a subshell if not necessary.
The code for bash still uses the same combined list of images and running
machines for various commands. The zsh code uses images for start/clone, and
running machines for the rest. Maybe something to fix in the future.
The man page says nothing about "e". Glibc clearly accepts it without fuss, but
it is meaningless for a memory object (and probably doesn't work). This use is
not portable, so let's avoid it.
coredump: avoid deadlock when passing processed backtrace data
We would deadlock when passing the data back from the forked-off process that
was doing backtrace generation back to the coredump parent. This is because we
fork the child and wait for it to exit. The child tries to write too much data
to the output pipe, and and after the first 64k blocks on the parent because
the pipe is full. The bug surfaced in Fedora because of a combination of four
factors:
- 87707784c70dc9894ec613df0a6e75e732a362a3 was backported to v251.5, which
allowed coredump processing to be successful.
- 1a0281a3ebf4f8c16d40aa9e63103f16cd23bb2a was NOT backported, so the output
was very verbose.
- Fedora has the ELF package metadata available, so a lot of output can be
generated. Most other distros just don't have the information.
- gnome-calendar crashes and has a bazillion modules and 69596 bytes of output
are generated for it.
The code is changed to try to write data opportunistically. If we get partial
information, that is still logged. In is generally better to log partial
backtrace information than nothing at all.
Yu Watanabe [Tue, 18 Oct 2022 12:23:26 +0000 (21:23 +0900)]
test: skip one test for iszero_safe() on i386 without SSE2
We do not provide any numerical libraries, and iszero_safe() is only
used in parsing or formatting JSON. Hence, it is not necessary for us to
request that the function provides the same result on different systems.
manager: use target process context to set socket context
Use target process context to set socket context when using SELinuxContextFromNet
not systemd's context. Currently when using the SELinuxContextFromNet option for
a socket activated services, systemd calls getcon_raw which returns init_t and
uses the resulting context to compute the context to be passed to the
setsockcreatecon call. A socket of type init_t is created and listened on and
this means that SELinux policy cannot be written to control which processes
(SELinux types) can connect to the socket since the ref policy allows all
'types' to connect to sockets of the type init_t. When security accessors see
that any process can connect to a socket this raises serious concerns. I have
spoken with SELinux contributors in person and on the mailing list and the
consensus is that the best solution is to use the target executables context
when computing the sockets context in all cases.
Before this patch, the flow was:
'''
mac_selinux_get_child_mls_label:
peercon = getpeercon_raw(socket_fd);
if (!exec_label)
exec_label = getfilecon_raw(exe);
socket_open_fds:
if (params->selinux_context_net) #
label = mac_selinux_get_our_label(); # this part is removed
else #
label = mac_selinux_get_create_label_from_exe(path);
socket_address_listen_in_cgroup(s, &p->address, label);
analyze: use DumpUnitsMatchingPatternsByFileDescriptor
Similarly to DumpByFileDescriptor vs Dump,
DumpUnitsMatchingPatternsByFileDescriptor is used in preference. Dissimilarly,
a fallback to DumpUnitsMatchingPatterns is not done on error, because there is
no need for backwards compatibility.
The code is still more verbose than I'd like, but there are four different code
paths with slightly different rules in each case, so it's hard to make this all
very brief. Since we have a separate file dedicated to making those calls, the
verbose-but-easy-to-follow implementation should be OK.
Closes #24989.
I only did a quick test that all both variants works locally and over ssh.
Frantisek Sumsal [Mon, 17 Oct 2022 16:11:21 +0000 (18:11 +0200)]
test: call sync() before checking the test logs
Otherwise we might hit a race where we read the test log just before
it's fully written to the disk:
```
======================================================================
FAIL: test_interleaved (__main__.ExecutionResumeTest.test_interleaved)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/root/systemd/test/test-exec-deserialization.py", line 170, in test_interleaved
self.check_output(expected_output)
File "/root/systemd/test/test-exec-deserialization.py", line 111, in check_output
self.assertEqual(output, expected_output)
AssertionError: 'foo\n' != 'foo\nbar\n'
foo
+ bar
```
With some debug:
```
test_interleaved (__main__.ExecutionResumeTest.test_interleaved) ...
Assertion failed; file contents just after the assertion:
b'foo\n'
Frantisek Sumsal [Mon, 17 Oct 2022 13:00:12 +0000 (15:00 +0200)]
test: use SIGKILL to kill the container if necessary
TEST-69 uses a Python wrapper around the systemd-nspawn call, which on
error calls the `spawn.terminate()` method. However, with no arguments
it will only use SIGHUP and SIGINT signals - this might leave a stuck
container around, causing fails if the test is run again. With `force=True`
SIGKILL is used as well (if necessary).
Jan Janssen [Fri, 14 Oct 2022 09:09:12 +0000 (11:09 +0200)]
boot: Rework shim image verification
This moves the shim security arch override to the new
ReinstallProtocolInterface based interface. This also has the benefit to
reduce the time window in which we have this override active and also
actually removes it, which was not previously done.
The shim hooks themselves are also modernized too. The upcalls should
really not be neccessary if shim is happy with the provided binary.
Jan Janssen [Wed, 21 Sep 2022 10:23:36 +0000 (12:23 +0200)]
boot: Remove unused parameters from pe_kernel_info
Only the compat entry address is used now. This also now only returns
the compat entry address. If the image is native we do not need to try
calling into the entry address again as we would already have done so
from StartImage (and failed).
Jan Janssen [Wed, 21 Sep 2022 09:07:53 +0000 (11:07 +0200)]
stub: Use LoadImage/StartImage to start the kernel
This is the proper way to start any EFI binary. The fact this even ever
worked was because the kernel does not have any PE relocations.
The only downside is that the embedded kernel image has to be signed and
trusted by the firmware under secure boot. A future commit will try to
deal with that.
Jan Janssen [Wed, 21 Sep 2022 08:42:40 +0000 (10:42 +0200)]
stub: Rename image parameter
This is really the parent image for the kernel that is to be run.
Renaming it as such prevents confusion with any image handles that are
about to be created.
Frantisek Sumsal [Mon, 17 Oct 2022 12:31:25 +0000 (14:31 +0200)]
test: ignore gcov errors in TEST-34
TEST-34 complains in `test_check_writable` when running with gcov, as
the build directory tree is not writable with DynamicUser=true. As I had
no luck with $GCOV_PREFIX and other runtime gcov configuration, let's
just ignore the gcov errors for this test.
core: simplify the return convention in manager_load_unit()
This function was returning 0 or 1 on success. It has many callers, and it
wasn't clear if any of them care about the distinction. It turns out they don't
and the return values were done for convenience because manager_load_unit_prepare()
returns 0 or 1. Let's invert the code in the static function to follow the usual
pattern where 0 means "no work was done" and 1 means "work was done", and make
the non-static function always return 0 to make the code easier to read, and
also add comments that explain what is happening.
This adds two more phases to the PCR boot phase logic: "sysinit" +
"final".
The "sysinit" one is placed between sysinit.target and basic.target.
It's good to have a milestone in this place, since this is after all
file systems/LUKS volumes are in place (which sooner or later should
result in measurements of their own) and before services are started
(where we should be able to rely on them to be complete).
This is particularly useful to make certain secrets available for
mounting secondary file systems, but making them unavailable later.
This breaks API in a way (as measurements during runtime will change),
but given that the pcrphase stuff wasn't realeased yet should be OK.
projects / thirdparty / systemd.git / log
