SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sysctl: introduce --save= and --revert= options (#43325)

Browse Source
This commit is contained in:
Yu Watanabe
2026-08-21 04:57:57 +09:00
committed by GitHub
parent 8c321be1fb 5e2d9c6ed1
commit 58b0764a20
3 changed files with 331 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd-sysctl.service.xml
+46 -1
View File
@@ -105,11 +105,36 @@
<varlistentry>
<term><option>--inline</option></term>
<listitem><para>Treat each positional argument as a separate configuration line instead of a file
name.</para>
name. When specified, at least one positional argument must be specified.</para>
<xi:include href="version-info.xml" xpointer="v259"/></listitem>
</varlistentry>
<varlistentry>
<term><option>--save=<replaceable>FILENAME</replaceable></option></term>
<listitem>
<para>Before applying the loaded sysctl settings, write them to <filename>/run/sysctl.d/</filename>
using the specified filename. If the filename does not end with <filename>.conf</filename>, the
suffix is appended. This option requires one or more positional arguments. May be combined with
<option>--inline</option>. This may be useful for creating runtime sysctl configuration files or
overriding existing sysctl configuration files.</para>
<xi:include href="version-info.xml" xpointer="v262"/>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--revert=<replaceable>FILENAME</replaceable></option></term>
<listitem>
<para>Before loading and applying the sysctl settings, removes the specified sysctl configuration
file under <filename>/run/sysctl.d/</filename>. If the filename does not end with
<filename>.conf</filename>, the suffix is appended. This may be useful for removing configuration
files created by <option>--save=</option>.</para>
<xi:include href="version-info.xml" xpointer="v262"/>
</listitem>
</varlistentry>
<xi:include href="standard-options.xml" xpointer="cat-config" />
<xi:include href="standard-options.xml" xpointer="tldr" />
<xi:include href="standard-options.xml" xpointer="no-pager" />
@@ -186,6 +211,26 @@ kernel.core_pattern = |/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t %P %I
of preference.</para>
</example>
<example>
<title>Disable IPv6 on an interface and save the specified setting</title>
<programlisting># /usr/lib/systemd/systemd-sysctl --save=99-disable-ipv6-foo - &lt;&lt;EOF
net.ipv6.conf.foo.disable_ipv6=1
EOF</programlisting>
<para>This disables IPv6 on the network interface <filename>foo</filename>, and creates
<filename>/run/sysctl.d/99-disable-ipv6-foo.conf</filename>.</para>
</example>
<example>
<title>Remove a runtime sysctl configuration file</title>
<programlisting># /usr/lib/systemd/systemd-sysctl --revert=99-disable-ipv6-foo --prefix=/net/ipv6/conf/foo</programlisting>
<para>This removes <filename>/run/sysctl.d/99-disable-ipv6-foo.conf</filename>, and applies the
remaining sysctl settings for the network interface <filename>foo</filename>.</para>
</example>
<para>See
<citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
for various ways to directly apply sysctl settings.</para>
src/sysctl/sysctl.c
+152 -6
View File
@@ -1,6 +1,7 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include <sys/stat.h>
#include <unistd.h>
#include "sd-json.h"
@@ -10,16 +11,20 @@
#include "constants.h"
#include "creds-util.h"
#include "errno-util.h"
#include "fs-util.h"
#include "glob-util.h"
#include "hashmap.h"
#include "log.h"
#include "main-func.h"
#include "mkdir.h"
#include "options.h"
#include "pager.h"
#include "path-util.h"
#include "pretty-print.h"
#include "string-util.h"
#include "strv.h"
#include "sysctl-util.h"
#include "tmpfile-util.h"
#include "verbs.h"
static char **arg_prefixes = NULL;
@@ -28,8 +33,12 @@ static bool arg_strict = false;
static bool arg_verify = false;
static bool arg_inline = false;
static PagerFlags arg_pager_flags = 0;
static char *arg_save_file = NULL;
static char *arg_revert_file = NULL;
STATIC_DESTRUCTOR_REGISTER(arg_prefixes, strv_freep);
STATIC_DESTRUCTOR_REGISTER(arg_save_file, freep);
STATIC_DESTRUCTOR_REGISTER(arg_revert_file, freep);
COMMAND(
"systemd-sysctl\0",
@@ -226,6 +235,13 @@ static int apply_all(OrderedHashmap *sysctl_options) {
return r;
}
static void filter_sysctl_options(OrderedHashmap *sysctl_options) {
SysctlOption *option;
ORDERED_HASHMAP_FOREACH(option, sysctl_options)
if (!string_is_glob(option->key) && !test_prefix(option->key))
sysctl_option_free(ordered_hashmap_remove(sysctl_options, option->key));
}
static int parse_line(const char *fname, unsigned line, const char *buffer, bool *invalid_config, void *userdata) {
OrderedHashmap **sysctl_options = ASSERT_PTR(userdata);
_cleanup_free_ char *k = NULL, *v = NULL;
@@ -262,9 +278,19 @@ static int parse_line(const char *fname, unsigned line, const char *buffer, bool
const char *key = sysctl_normalize(strstrip(k)), *value = strstrip(v);
/* We can't filter out globs at this point, we'll need to do that later. */
if (!string_is_glob(key) && !test_prefix(key))
return 0;
if (arg_save_file) {
/* When saving the loaded rules, refuse unsafe characters, especially newlines, in keys
* and values. Otherwise, the saved file may not be parsed correctly. */
if (!string_is_safe(key, STRING_ALLOW_BACKSLASHES | STRING_ALLOW_QUOTES | STRING_ALLOW_GLOBS) ||
(value && !string_is_safe(value, STRING_ALLOW_EMPTY | STRING_ALLOW_BACKSLASHES | STRING_ALLOW_QUOTES | STRING_ALLOW_GLOBS)))
return log_syntax(NULL, LOG_WARNING, fname, line, SYNTHETIC_ERRNO(EINVAL),
"Ignoring unsafe key and/or value for '%s'.", key);
} else {
/* We can't filter out globs at this point, we'll need to do that later.
* Keep them when saving the loaded rules, and filter them after writing. */
if (!string_is_glob(key) && !test_prefix(key))
return 0;
}
SysctlOption *existing = ordered_hashmap_get(*sysctl_options, key);
if (existing) {
@@ -325,7 +351,82 @@ static int cat_config(char **files) {
return cat_files(NULL, files, arg_cat_flags);
}
static int save_sysctl_options(OrderedHashmap *sysctl_options, const char *filename) {
int r;
assert(filename);
if (ordered_hashmap_isempty(sysctl_options)) {
log_info("No sysctl settings loaded, not creating '%s'.", filename);
return 0;
}
r = mkdir_p("/run/sysctl.d/", 0755);
if (r < 0)
return log_error_errno(r, "Failed to create directory '/run/sysctl.d/': %m");
_cleanup_free_ char *path = path_join("/run/sysctl.d/", filename);
if (!path)
return log_oom();
_cleanup_fclose_ FILE *f = NULL;
_cleanup_(unlink_and_freep) char *temp_path = NULL;
r = fopen_temporary(path, &f, &temp_path);
if (r < 0)
return log_error_errno(r, "Failed to open a temporary file for '%s': %m", path);
if (fchmod(fileno(f), 0644) < 0)
return log_error_errno(errno, "Failed to chmod '%s': %m", temp_path);
fputs("# This is generated by systemd-sysctl.\n", f);
SysctlOption *option;
ORDERED_HASHMAP_FOREACH(option, sysctl_options)
fprintf(f, "%s%s%s%s\n",
option->ignore_failure || !option->value ? "-" : "",
option->key,
option->value ? " = " : "",
strempty(option->value));
r = fflush_and_check(f);
if (r < 0)
return log_error_errno(r, "Failed to flush '%s': %m", temp_path);
r = conservative_rename(temp_path, path);
if (r < 0)
return log_error_errno(r, "Failed to rename '%s' to '%s': %m", temp_path, path);
temp_path = mfree(temp_path);
return 0;
}
static int parse_conf_filename(const char *src, const char *option, char **dest) {
assert(option);
assert(dest);
if (isempty(src))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use an empty filename for %s.", option);
if (startswith(src, "."))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Dot-prefixed filenames are not allowed for %s.", option);
_cleanup_free_ char *name = NULL;
if (!endswith(src, ".conf"))
name = strjoin(src, ".conf");
else
name = strdup(src);
if (!name)
return log_oom();
if (!filename_is_valid(name))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid file name '%s' specified for %s.", name, option);
return free_and_replace(*dest, name);
}
static int parse_argv(int argc, char *argv[], char ***remaining_args) {
int r;
assert(argc >= 0);
assert(argv);
assert(remaining_args);
@@ -391,6 +492,20 @@ static int parse_argv(int argc, char *argv[], char ***remaining_args) {
arg_inline = true;
break;
OPTION_LONG("save", "FILENAME",
"Write loaded settings to the specified file"):
r = parse_conf_filename(opts.arg, "--save=", &arg_save_file);
if (r < 0)
return r;
break;
OPTION_LONG("revert", "FILENAME",
"Remove the specified file from /run/sysctl.d/"):
r = parse_conf_filename(opts.arg, "--revert=", &arg_revert_file);
if (r < 0)
return r;
break;
OPTION_COMMON_INTROSPECT_CLI:
return introspect_cli(SD_JSON_FORMAT_OFF);
}
@@ -401,6 +516,14 @@ static int parse_argv(int argc, char *argv[], char ***remaining_args) {
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Positional arguments are not allowed with --cat-config/--tldr.");
if (arg_inline && strv_isempty(*remaining_args))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"--inline requires positional arguments.");
if (arg_save_file && strv_isempty(*remaining_args))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"--save= requires positional arguments.");
return 1;
}
@@ -416,17 +539,40 @@ static int run(int argc, char *argv[]) {
umask(0022);
if (arg_revert_file) {
_cleanup_free_ char *path = path_join("/run/sysctl.d/", arg_revert_file);
if (!path)
return log_oom();
if (unlink(path) < 0 && errno != ENOENT)
return log_error_errno(errno, "Failed to remove '%s': %m", path);
}
_cleanup_ordered_hashmap_free_ OrderedHashmap *sysctl_options = NULL;
if (!strv_isempty(args)) {
unsigned pos = 0;
STRV_FOREACH(arg, args) {
if (arg_inline)
if (arg_inline) {
pos++;
const char *s = skip_leading_chars(*arg, /* bad= */ NULL);
if (IN_SET(*s, '\0', '#'))
continue;
/* Use (argument):n, where n==1 for the first positional arg */
RET_GATHER(r, parse_line("(argument)", ++pos, *arg, /* invalid_config= */ NULL, &sysctl_options));
else
RET_GATHER(r, parse_line("(argument)", pos, s, /* invalid_config= */ NULL, &sysctl_options));
} else
RET_GATHER(r, parse_file(&sysctl_options, *arg, false));
}
if (arg_save_file) {
r = save_sysctl_options(sysctl_options, arg_save_file);
if (r < 0)
return r;
filter_sysctl_options(sysctl_options);
}
} else {
_cleanup_strv_free_ char **files = NULL;
test/units/TEST-87-AUX-UTILS-VM.sysctl.sh
+133 -1
View File
@@ -16,7 +16,8 @@ echo "-foo.foo=42" >/tmp/foo.conf
assert_rc 0 /usr/lib/systemd/systemd-sysctl /tmp/foo.conf
assert_rc 0 /usr/lib/systemd/systemd-sysctl --strict /tmp/foo.conf
assert_rc 0 /usr/lib/systemd/systemd-sysctl --inline "foo.bar=42"
assert_rc 1 /usr/lib/systemd/systemd-sysctl --inline
assert_rc 0 /usr/lib/systemd/systemd-sysctl --inline " foo.bar=42" "#comment" " "
assert_rc 1 /usr/lib/systemd/systemd-sysctl --inline --strict "foo.bar=42"
assert_rc 0 /usr/lib/systemd/systemd-sysctl --inline -- "-foo.bar=42"
assert_rc 0 /usr/lib/systemd/systemd-sysctl --inline --strict -- "-foo.bar=42"
@@ -91,3 +92,134 @@ EOF
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "1"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"
##########################
# --save= and --revert=
##########################
(! /usr/lib/systemd/systemd-sysctl --save=)
(! /usr/lib/systemd/systemd-sysctl --save=.)
(! /usr/lib/systemd/systemd-sysctl --save=.conf)
(! /usr/lib/systemd/systemd-sysctl --save=aaa/hoge.conf)
(! /usr/lib/systemd/systemd-sysctl --save=../hoge.conf)
(! /usr/lib/systemd/systemd-sysctl --revert=)
(! /usr/lib/systemd/systemd-sysctl --revert=.)
(! /usr/lib/systemd/systemd-sysctl --revert=.conf)
(! /usr/lib/systemd/systemd-sysctl --revert=aaa/hoge.conf)
(! /usr/lib/systemd/systemd-sysctl --revert=../hoge.conf)
# --save= requires positional arguments
(! /usr/lib/systemd/systemd-sysctl --save=foo)
# Do not create an empty conf file.
/usr/lib/systemd/systemd-sysctl \
--prefix=/net/ipv4/conf/hoge --save=foo --inline "# comment only"
[[ ! -e /run/sysctl.d/foo.conf ]]
echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
/usr/lib/systemd/systemd-sysctl \
--prefix=/net/ipv4/conf/hoge --save=foo --inline -- \
'# This argument should be ignored' \
'net.ipv4.conf.*.drop_gratuitous_arp=1' \
'net.ipv4.*.*.bootp_relay=1' \
'-net.ipv4.conf.all.bootp_relay' \
'-net.ipv4.aaa.*.disable_policy=1' \
'# Arguments with unsafe characters should be ignored' \
$'foo\nbar.hoge=1' \
$'foo.bar=4\n2'
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "1"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"
diff /run/sysctl.d/foo.conf - <<EOF
# This is generated by systemd-sysctl.
net/ipv4/conf/*/drop_gratuitous_arp = 1
net/ipv4/*/*/bootp_relay = 1
-net/ipv4/conf/all/bootp_relay
-net/ipv4/aaa/*/disable_policy = 1
EOF
echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
/usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/hoge --save=foo - <<EOF
# This line should be ignored
net.ipv4.conf.*.drop_gratuitous_arp=1
net.ipv4.*.*.bootp_relay=1
-net.ipv4.conf.all.bootp_relay
-net.ipv4.aaa.*.disable_policy=1
foo.bar=42
EOF
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "1"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"
diff /run/sysctl.d/foo.conf - <<EOF
# This is generated by systemd-sysctl.
net/ipv4/conf/*/drop_gratuitous_arp = 1
net/ipv4/*/*/bootp_relay = 1
-net/ipv4/conf/all/bootp_relay
-net/ipv4/aaa/*/disable_policy = 1
foo/bar = 42
EOF
echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
# Verify that the saved .conf file is loaded.
/usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/hoge
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "1"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"
echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
# Check that the saved .conf file can be overridden.
/usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/hoge --save=foo /run/sysctl.d/foo.conf - <<EOF
net.ipv4.conf.*.drop_gratuitous_arp=0
net.ipv4.conf.hoge.disable_policy=1
EOF
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "0"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "1"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "1"
diff /run/sysctl.d/foo.conf - <<EOF
# This is generated by systemd-sysctl.
net/ipv4/*/*/bootp_relay = 1
-net/ipv4/conf/all/bootp_relay
-net/ipv4/aaa/*/disable_policy = 1
foo/bar = 42
net/ipv4/conf/*/drop_gratuitous_arp = 0
net/ipv4/conf/hoge/disable_policy = 1
EOF
echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
/usr/lib/systemd/systemd-sysctl --revert=foo --prefix=/net/ipv4/conf/hoge
[[ ! -e /run/sysctl.d/foo.conf ]]
# Assume that no saved sysctl .conf files modify these variables.
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "0"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "0"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"
echo 0 >/proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp
echo 0 >/proc/sys/net/ipv4/conf/hoge/bootp_relay
echo 0 >/proc/sys/net/ipv4/conf/hoge/disable_policy
# Try again to test when foo.conf does not exist
/usr/lib/systemd/systemd-sysctl --revert=foo --prefix=/net/ipv4/conf/hoge
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/drop_gratuitous_arp)" "0"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/bootp_relay)" "0"
assert_eq "$(cat /proc/sys/net/ipv4/conf/hoge/disable_policy)" "0"