After previous output from systemd-shutdown indicated a bug, my attention
was drawn to redundant output lines. Did they indicate an anomaly?
It turns out to be an expected, harmless result of the current code. But
we don't have much justification to run such redundant operations. Let's
remove the confusing redundant message.
We can stop trying to remount a directory read-only once its mount entry
has successfully been changed to "ro". We can simply let the kernel keep
track of this for us. I don't bother to try and avoid re-parsing the
mountinfo. I appreciate snappy shutdowns, but this code is already
intricate and buggy enough (see issue 7131).
(Disclaimer: At least for the moment, you can't _rely_ on always seeing
suspicious output from systemd-shutdown. By default, you can expect the
kernel to truncate the log output of systemd-shutdown. Ick ick ick!
Because /dev/kmsg is rate-limited by default. Normally it prints a message
"X lines supressed", but we tend to shut down before the timer expires
in this case).
I also tested with `systemctl reboot --force`, plus a loopback mount to
cause one of the umounts to fail initially. In this case another 2 lines
of output are removed (out of a larger number of lines).
Alan Jenkins [Thu, 19 Oct 2017 14:00:57 +0000 (15:00 +0100)]
core: systemd-shutdown: add missing check for umount_changed
The assumption was that nothing changes in the final attempt. This
would be confusing if a filesystem with a process in uninterruptible
sleep suddenly became un-stuck for the final attempt, but we still give
up and don't try to e.g. unmount any parent mounts.
I don't know how possible that is. But the code will be easier to read
without an assumption that it does not attempt to justify.
Lubomir Rintel [Wed, 18 Oct 2017 06:38:50 +0000 (08:38 +0200)]
core: fragments of masked units ought not be considered for NeedDaemonReload (#7060)
The units that are not loaded don't have dropin_paths set. This
currently results in units that have fragments to always have
NeedDaemonReload=true when masked:
$ find {/usr/lib,/run/user/8086}/systemd/user/meh.service* |xargs ls -ld
lrwxrwxrwx. 1 lkundrak lkundrak 9 Oct 11 11:19 /run/user/8086/systemd/user/meh.service -> /dev/null
-rw-rw-r--. 1 root root 49 Oct 11 10:16 /usr/lib/systemd/user/meh.service
drwxrwxr-x. 2 root root 4096 Oct 11 10:50 /usr/lib/systemd/user/meh.service.d
-rw-rw-r--. 1 root root 666 Oct 11 10:50 /usr/lib/systemd/user/meh.service.d/override.conf
$ systemctl --user daemon-reload
$ busctl --user get-property org.freedesktop.systemd1 \
/org/freedesktop/systemd1/unit/meh_2eservice \
org.freedesktop.systemd1.Unit NeedDaemonReload
b true
Susant Sahani [Wed, 18 Oct 2017 06:25:57 +0000 (11:55 +0530)]
networkd: Don't stop networkd if CONFIG_FIB_RULES=n in kernel (#7030)
If FIB Rules are not supported by the kernel then networkd fails to
start as it retuns error=-EOPNOTSUPP.
In this case just ignore and let start networkd.
```
Oct 08 10:22:24 naomi systemd[1]: Starting Network Service...
Oct 08 10:22:24 naomi systemd-networkd[983]: Could not enumerate rules: Operation not supported
Oct 08 10:22:24 naomi systemd[1]: systemd-networkd.service: Main process exited, code=exited, status=1/FAILURE
```
Yu Watanabe [Tue, 17 Oct 2017 23:57:54 +0000 (08:57 +0900)]
core: fix invalid error message
The error message corresponds to EILSEQ is "Invalid or incomplete
multibyte or wide character", and is not suitable in this case.
So, let's show a custom error message when the function
dynamic_creds_realize() returns -EILSEQ.
Michal Sekletar [Mon, 16 Oct 2017 14:15:05 +0000 (16:15 +0200)]
mount: make sure we unmount tmpfs mounts before we deactivate swaps (#7076)
In the past we introduced this property just for tmp.mount. However on
todays systems usually there are many more tmpfs mounts. Most notably
mounts backing XDG_RUNTIME_DIR for each user.
Let's generalize what we already have for tmp.mount and implement the
ordering After=swap.target for all tmpfs based mounts.
Christian Hesse [Fri, 13 Oct 2017 07:10:26 +0000 (09:10 +0200)]
man: update changes about gateway -> _gateway (#7085)
Commit 5248e7e1f11aba6859de0b28f0dd3778b22842f2
(resolved,nss-myhostname: use _gateway for the gateway) changed how the
gateway is resolved. Reflect the change in documentation.
Vito Caputo [Thu, 12 Oct 2017 06:14:07 +0000 (23:14 -0700)]
shared: add vectorized parse_field() (#7056)
By vectorizing parse_field() the chain of parse_field() calls in
output_short() can be replaced with a single call receiving a description
of the desired fields and their targets.
While at it, eliminate the repeated strlen() calls performed on constant
field names by making parse_field() receive the field length, and storing
it in the ParseFieldVec at compile time.
Also sort the output_short() fields so the short ones are tried first, for
a minor efficiency gain.
In addition to making the code less repetitive, gcc in my tests now inlines
the parse_fieldv() call in output_short().
It always bothered me a bit that unit-name.[ch] contains so many
definitions that aren't really have much to do with unit nameing, for
example all the unit state definitions.
With this patch unit-name.[ch] is split into two: the file now contains
only the unit naming related operations, and everything else is split
out into a new set of files unit-def.[ch]. That's mostly unit state
stuff as well as dbus path and interface name operations.
No functional changes. This just moves code around.
(Note as both .c files include each other's headers this doesn't make
the build simpler or anything. All it does is make the C files a bit
shorter, and medicate my pretend OCD)
Lubomir Rintel [Wed, 11 Oct 2017 07:29:30 +0000 (09:29 +0200)]
basic/env-util: drop the validation when deserializing environment
The environment variables we've serialized can quite possibly contain
characters outside the set allowed by env_assignment_is_valid(). In
fact, my environment seems to contain a couple of these:
* TERMCAP set by screen contains a '\x7f' character
* BASH_FUNC_module%% variable has a '%' character in name
Strict check of environment variables name and value certainly makes sense for
unit files, but not so much for deserialization of values we already had
in our environment.
Yu Watanabe [Wed, 11 Oct 2017 05:41:13 +0000 (14:41 +0900)]
dynamic-user: permit the case static uid and gid are different
This makes systemd supports the case that DynamicUser=yes and
static user and group exist such that uid and gid of them are different.
We only refuse the operation when user does not exist but the group
with the same name exists.
gwendalcr [Tue, 10 Oct 2017 08:03:38 +0000 (01:03 -0700)]
rules: Add MODEL_ID for NVMe device (#7037)
To mimic MODEL_ID variable built for ATA and SCSI devices, add rules
to add MODEL_ID variable for NVMe devices.
TEST: Check on a system with NVMe device that MODEL_ID variable is
present:
udevadm info --query=all -n /dev/nvme0n1p1 | grep ID_MODEL
and
udevadm info --query=all -n /dev/nvme0n1p1 | grep ID_MODEL
return:
E: ID_MODEL=SAMSUNG...
We generally use the casing "Namespace" for the word, and that's visible
in a number of user-facing interfaces, including "RestrictNamespace=" or
"JoinsNamespaceOf=". Let's make sure to use the same casing internally
too.
man: symlinks are made onto "unit files", not "units"
We should be careful when talking about "units" and "unit files". The
latter should be the concept on disk, and the former, the loaded version
of it. However, as a single unit file can result in multiple loaded
units (think templates), and a units can also exist with no unit file at
all (think .device units), we should be precise.
As symlinks are created on unit files rather than units (as symlinks are
an fs object, and unit files are too, but units are not), let's say so
here.
Some kernel modules may be loaded if the hardware does not exist
(usually when the hardware is hot-pluggable), while others fail with
ENODEV. Let's make those two cases more similar, and simply log
modules which cannot be loaded because of missing hardware without
failing systemd-modules-load.service.
For modules which don't exist, let's warn, but not fail the whole
service. I think a warning is appropriate because it's likely that
a typo was made.
kmod_module_probe_insert_module returns 0 on success, != 0 on failure
More specifically, it should return > 0 only for conditions specified in
probe_flags. We only set KMOD_PROBE_APPLY_BLACKLIST in probe_flags, so the
code was correct, but add an assert to clarify this.
g0tar [Thu, 5 Oct 2017 20:17:51 +0000 (22:17 +0200)]
pass currently completed word to systemctl list-unit-files/list-units (#6927)
This change noticeably increases completion performance at the expense
of preventing possible _correct, _approximate or any matcher-list rules.
Still, responsiveness increase so huge seems to make it worth the price.
resolved: add support for explicitly forgetting everything we learnt about DNS server feature levels
This adds "systemd-resolve --reset-server-features" for explicitly
forgetting what we learnt. This might be useful for debugging
purposes, and to force systemd-resolved to restart its learning logic
for all DNS servers.
resolved: automatically forget all learnt DNS server information when the network configuration changes
When the network configuration changes we should relearn everything
there is to know about the configured DNS servers, because we might talk
to the same addresses, but there might be different servers behind them.
units: restore User=systemd-journal-gateway in systemd-journal-gatewayd.service (#7005)
After the discussions around #7003 I think we should restore the
User=systemd-journal-gateway line for systemd-journal-gatewayd.service,
too, so that we continue to use the state user if it exists, and create
it as dynamic user only when it does not.
Note that undoes part of a change made after 234, i.e. a never released
change.
Djalal Harouni [Thu, 5 Oct 2017 12:46:41 +0000 (14:46 +0200)]
seccomp: remove 'gettid' syscall from '@process' syscall set (#6989)
The gettid syscall is one of the most basic syscalls, it never fails and
it operates on current thread. Most applications are not suposed to use
it, however even if it is used there is no much justification on blocking
it. This patch removes it from '@process' set so if users blacklist this
set to block setns or clone syscalls, the gettid syscall will still be
available. Of course they can always block gettid explicitly.
Note that the gettid is already in the '@default' set.
unit: when JobTimeoutSec= is turned off, implicitly turn off JobRunningTimeoutSec= too
We added JobRunningTimeoutSec= late, and Dracut configured only
JobTimeoutSec= to turn of root device timeouts before. With this change
we'll propagate a reset of JobTimeoutSec= into JobRunningTimeoutSec=,
but only if the latter wasn't set explicitly.
This should restore compatibility with older systemd versions.
resolved: rework how we handle truncation in the stub resolver
When we a reply message gets longer than the client supports we need to
truncate the response and set the TC bit, and we already do that.
However, we are not supposed to send incomplete RRs in that case, but
instead truncate right at a record boundary. Do that.
This fixes the "Message parser reports malformed message packet."
warning the venerable "host" tool outputs when a very large response is
requested.
seccomp: ignore (and debug log) errors by all invocations of seccomp_rule_add_exact()
System calls might exist on some archs but not on others, or might be
multiplexed but not on others. Ignore such errors when putting together
a filter at this location like we already do it on all others.
seccomp: always handle seccomp_load() failing the same way
Unfortunately libseccomp doesn't return (nor document) clean error
codes, hence until then only check for specific error codes that we
propagate, but ignore (but debug log) all others. Do this at one more
place, we are already doing that at all others.
seccomp: include prlimit64 and ugetrlimit in @default
Also, move prlimit64() out of @resources.
prlimit64() may be used both for getting and setting resource limits, and
is implicitly called by glibc at various places, on some archs, the same
was as getrlimit(). SImilar, igetrlimit() is an arch-specific
replacement for getrlimit(), and hence should be whitelisted at the same
place as getrlimit() and prlimit64().
Also see: https://lists.freedesktop.org/archives/systemd-devel/2017-September/039543.html
dynamic-user: don't use a UID that currently owns IPC objects (#6962)
This fixes a mostly theoretical potential security hole: if for some
reason we failed to remove IPC objects created for a dynamic user (maybe
because a MAC/SElinux erronously prohibited), then we should not hand
out the same UID again until they are successfully removed.
With this commit we'll enumerate the IPC objects currently existing, and
step away from using a UID for the dynamic UID logic if there are any
matching it.
man: document which special "systemctl" commands are synchronous and which asynchronous.
This documents the status quo, clarifying when we are synchronous and
when asynchronous by default and when --no-block is support to force
asynchronous operation.
projects / thirdparty / systemd.git / log
