diff --git a/man/sd_bus_request_name.xml b/man/sd_bus_request_name.xml index 0f6a4ec313..7229ef517a 100644 --- a/man/sd_bus_request_name.xml +++ b/man/sd_bus_request_name.xml @@ -65,9 +65,9 @@ Description - sd_bus_request_name() requests a well-known service name on a bus. It takes a bus - connection, a valid bus name and a flags parameter. The flags parameter is a combination of the following - flags: + sd_bus_request_name() requests a well-known service name on a bus. It takes a + bus connection, a valid bus name, and a flags parameter. The flags parameter is a combination of zero or + more of the following flags: @@ -82,8 +82,9 @@ SD_BUS_NAME_REPLACE_EXISTING - Take over the name if it is already acquired by another peer, and that other peer has permitted - takeover by setting SD_BUS_NAME_ALLOW_REPLACEMENT while acquiring it. + Take over the name if it was already acquired by another peer, and that other peer + has permitted takeover by setting SD_BUS_NAME_ALLOW_REPLACEMENT while acquiring + it. diff --git a/man/systemd-tmpfiles.xml b/man/systemd-tmpfiles.xml index f05e5ea2e5..7720ef53fa 100644 --- a/man/systemd-tmpfiles.xml +++ b/man/systemd-tmpfiles.xml @@ -65,6 +65,22 @@ tmpfiles.d5 are searched for a matching file and the file found that has the highest priority is executed. + + System services (systemd-tmpfiles-setup.service, + systemd-tmpfiles-setup-dev.service, + systemd-tmpfiles-clean.service) invoke systemd-tmpfiles to create + system files and to perform system wide cleanup. Those services read administrator-controlled + configuration files in tmpfiles.d/ directories. User services + (systemd-tmpfiles-setup.service, + systemd-tmpfiles-clean.service) also invoke systemd-tmpfiles, but + it reads a separate set of files, which includes user-controlled files under + ~/.config/user-tmpfiles.d/ and ~/.local/share/user-tmpfiles.d/, + and administrator-controller files under /usr/share/user-tmpfiles.d/. Users may use + this to create and clean up files under their control, but the system instance performs global cleanup + and is not influenced by user configuration. Note that this means a time-based cleanup configured in the + system instance, such as the one typically configured for /tmp, will thus also + affect files created by the user instance if they are placed in /tmp, even if the + user instance's time-based cleanup is turned off. @@ -174,7 +190,7 @@ It is possible to combine , , and - in one invocation (in which case removal and clean-up are executed before creation of new files). For example, + in one invocation (in which case removal and cleanup are executed before creation of new files). For example, during boot the following command line is executed to ensure that all temporary and volatile directories are removed and created according to the configuration file: diff --git a/man/systemd.socket.xml b/man/systemd.socket.xml index e29602b068..84faf89c2e 100644 --- a/man/systemd.socket.xml +++ b/man/systemd.socket.xml @@ -51,11 +51,11 @@ which configure resource control settings for the processes of the socket. - For each socket file, a matching service file must exist, + For each socket unit, a matching service unit must exist, describing the service to start on incoming traffic on the socket (see systemd.service5 - for more information about .service files). The name of the + for more information about .service units). The name of the .service unit is by default the same as the name of the .socket unit, but can be altered with the option described below. Depending on the setting of the @@ -66,7 +66,7 @@ socket file foo.socket needs a matching service foo.service if is set. If - is set, a service template file + is set, a service template foo@.service must exist from which services are instantiated for each incoming connection. diff --git a/man/systemd.unit.xml b/man/systemd.unit.xml index 3079db1a6b..d13212ebcc 100644 --- a/man/systemd.unit.xml +++ b/man/systemd.unit.xml @@ -1607,7 +1607,9 @@ %h User home directory - This is the home directory of the user running the service manager instance. In case of the system manager this resolves to /root. + This is the home directory of the user running the service manager instance. In case of the system manager this resolves to /root. + +Note that this setting is not influenced by the User= setting configurable in the [Service] section of the service unit. %H @@ -1697,12 +1699,16 @@ %u User name - This is the name of the user running the service manager instance. In case of the system manager this resolves to root. + This is the name of the user running the service manager instance. In case of the system manager this resolves to root. + +Note that this setting is not influenced by the User= setting configurable in the [Service] section of the service unit. %U User UID - This is the numeric UID of the user running the service manager instance. In case of the system manager this resolves to 0. + This is the numeric UID of the user running the service manager instance. In case of the system manager this resolves to 0. + +Note that this setting is not influenced by the User= setting configurable in the [Service] section of the service unit. %v diff --git a/src/core/execute.c b/src/core/execute.c index a8b6c92873..9975de1ff5 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -2406,7 +2406,8 @@ static int apply_mount_namespace( const ExecCommand *command, const ExecContext *context, const ExecParameters *params, - const ExecRuntime *runtime) { + const ExecRuntime *runtime, + char **error_path) { _cleanup_strv_free_ char **empty_directories = NULL; char *tmp = NULL, *var = NULL; @@ -2482,7 +2483,8 @@ static int apply_mount_namespace( needs_sandboxing ? context->protect_home : PROTECT_HOME_NO, needs_sandboxing ? context->protect_system : PROTECT_SYSTEM_NO, context->mount_flags, - DISSECT_IMAGE_DISCARD_ON_LOOP); + DISSECT_IMAGE_DISCARD_ON_LOOP, + error_path); bind_mount_free_many(bind_mounts, n_bind_mounts); @@ -3319,10 +3321,13 @@ static int exec_child( needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime); if (needs_mount_namespace) { - r = apply_mount_namespace(unit, command, context, params, runtime); + _cleanup_free_ char *error_path = NULL; + + r = apply_mount_namespace(unit, command, context, params, runtime, &error_path); if (r < 0) { *exit_status = EXIT_NAMESPACE; - return log_unit_error_errno(unit, r, "Failed to set up mount namespacing: %m"); + return log_unit_error_errno(unit, r, "Failed to set up mount namespacing%s%s: %m", + error_path ? ": " : "", strempty(error_path)); } } diff --git a/src/core/main.c b/src/core/main.c index e34da11984..d65455c6c0 100644 --- a/src/core/main.c +++ b/src/core/main.c @@ -1546,6 +1546,11 @@ static int fixup_environment(void) { if (setenv("TERM", t, 1) < 0) return -errno; + /* The kernels sets HOME=/ for init. Let's undo this. */ + if (path_equal_ptr(getenv("HOME"), "/") && + unsetenv("HOME") < 0) + log_warning_errno(errno, "Failed to unset $HOME: %m"); + return 0; } diff --git a/src/core/namespace.c b/src/core/namespace.c index 8475145f06..ec7af3ab1c 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -1187,7 +1187,8 @@ int setup_namespace( ProtectHome protect_home, ProtectSystem protect_system, unsigned long mount_flags, - DissectImageFlags dissect_image_flags) { + DissectImageFlags dissect_image_flags, + char **error_path) { _cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL; _cleanup_(decrypted_image_unrefp) DecryptedImage *decrypted_image = NULL; @@ -1440,6 +1441,8 @@ int setup_namespace( proc_self_mountinfo = fopen("/proc/self/mountinfo", "re"); if (!proc_self_mountinfo) { r = log_debug_errno(errno, "Failed to open /proc/self/mountinfo: %m"); + if (error_path) + *error_path = strdup("/proc/self/mountinfo"); goto finish; } @@ -1453,8 +1456,11 @@ int setup_namespace( continue; r = follow_symlink(root, m); - if (r < 0) + if (r < 0) { + if (error_path && mount_entry_path(m)) + *error_path = strdup(mount_entry_path(m)); goto finish; + } if (r == 0) { /* We hit a symlinked mount point. The entry got rewritten and might point to a * very different place now. Let's normalize the changed list, and start from @@ -1465,8 +1471,11 @@ int setup_namespace( } r = apply_mount(root, m); - if (r < 0) + if (r < 0) { + if (error_path && mount_entry_path(m)) + *error_path = strdup(mount_entry_path(m)); goto finish; + } m->applied = true; } @@ -1490,8 +1499,11 @@ int setup_namespace( /* Second round, flip the ro bits if necessary. */ for (m = mounts; m < mounts + n_mounts; ++m) { r = make_read_only(m, blacklist, proc_self_mountinfo); - if (r < 0) + if (r < 0) { + if (error_path && mount_entry_path(m)) + *error_path = strdup(mount_entry_path(m)); goto finish; + } } } diff --git a/src/core/namespace.h b/src/core/namespace.h index 022bdb6142..73fcb3fc82 100644 --- a/src/core/namespace.h +++ b/src/core/namespace.h @@ -86,7 +86,8 @@ int setup_namespace( ProtectHome protect_home, ProtectSystem protect_system, unsigned long mount_flags, - DissectImageFlags dissected_image_flags); + DissectImageFlags dissected_image_flags, + char **error_path); int setup_tmp_dirs( const char *id, diff --git a/src/libsystemd/sd-bus/bus-objects.c b/src/libsystemd/sd-bus/bus-objects.c index fe3b9feea6..d18c578177 100644 --- a/src/libsystemd/sd-bus/bus-objects.c +++ b/src/libsystemd/sd-bus/bus-objects.c @@ -638,8 +638,14 @@ static int property_get_set_callbacks_run( if (r < 0) return r; - if (type != 'v' || !streq(strempty(signature), strempty(c->vtable->x.property.signature))) - return sd_bus_reply_method_errorf(m, SD_BUS_ERROR_INVALID_ARGS, "Incorrect parameters for property '%s', expected '%s', got '%s'.", c->member, strempty(c->vtable->x.property.signature), strempty(signature)); + if (type != 'v') + return sd_bus_reply_method_errorf(m, SD_BUS_ERROR_INVALID_SIGNATURE, + "Incorrect signature when setting property '%s', expected 'v', got '%c'.", + c->member, type); + if (!streq(strempty(signature), strempty(c->vtable->x.property.signature))) + return sd_bus_reply_method_errorf(m, SD_BUS_ERROR_INVALID_ARGS, + "Incorrect parameters for property '%s', expected '%s', got '%s'.", + c->member, strempty(c->vtable->x.property.signature), strempty(signature)); r = sd_bus_message_enter_container(m, 'v', c->vtable->x.property.signature); if (r < 0) diff --git a/src/test/test-ns.c b/src/test/test-ns.c index d3dbb54ca1..e9233a1643 100644 --- a/src/test/test-ns.c +++ b/src/test/test-ns.c @@ -75,7 +75,8 @@ int main(int argc, char *argv[]) { PROTECT_HOME_NO, PROTECT_SYSTEM_NO, 0, - 0); + 0, + NULL); if (r < 0) { log_error_errno(r, "Failed to setup namespace: %m");