SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
70,015 Commits 2 Branches 1 Tag
032fd10de88fedcaec68d1049596c25e9a4ea355
Commit Graph
70015 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Yu Watanabe 032fd10de8 test-network: use read_networkd_log() at one more place 2024-01-06 12:46:00 +09:00
Yu Watanabe bd581438a1 test-network: sync journal before read 
Otherwise, test cases that check journal entries, e.g. test_unit_file()
may fail.
 2024-01-06 12:45:59 +09:00
Lennart Poettering 6db53d20f5 nspawn: lock down access to notify socket a bit 
On Linux only the "w" access bit is necessary to connect to an AF_UNIX
socket, hence let's only set that and nothing else, to limit exposure.

Just paranoia.
 2024-01-06 11:21:00 +09:00
Frantisek Sumsal d7942fe5fc core: escape spaces in paths during serialization 
Otherwise we split them incorrectly when deserializing them.

Resolves: #30747
 2024-01-06 11:19:59 +09:00
Yu Watanabe b82b4d258e Merge pull request #30794 from poettering/parse-vsock-better 
socket-util: add more careful parsers for AF_VSOCK cid/port
 2024-01-06 11:16:19 +09:00
Yu Watanabe 7ba3e44651 udevadm: allow to override the default log level by environment variable 
Previously, there was no way to override the log level for test and
test-builtin commands. Let's re-parse environment after setting the log
level to debug. Then, we can control the log level through environment
variable.
 2024-01-06 08:30:58 +09:00
Yu Watanabe 976309db6a Merge pull request #30796 from mrc0mmand/journalctl-namespaces 
journalctl: provide shell completion for --namespace=
 2024-01-06 08:30:31 +09:00
Lennart Poettering a6a7983dbf dev-setup: rework make_inaccessible_nodes() around openat() and friends 
Let's operate on fds rather than paths. Make some tweaks to the logic on
top:

1. Mark the resulting dir as read-only after we are done.
2. Use the new inode_type_to_string() calls to determine the inode
   names.
3. If an inode already exists, try to adjust the access mode, just in
   case.
4. Use FOREACH_ARRAY()
 2024-01-06 08:27:51 +09:00
Yu Watanabe 0d1706b5fa Merge pull request #30775 from yuwata/network-nexthop-is-ready 
network: introduce nexthop_is_ready() helper function and use it
 2024-01-06 08:27:35 +09:00
networkException dcfac3a3f9 parse-helpers: allow port 0 for socket bind items 
This patch adds a new parameter to parse_ip_port_range, giving callers
the option to allow ranges to have their min be 0 instead of 1.

This is then used by parse_ip_ports_token, intern used by
parse_socket_bind_item to allow port 0 when restricting bind system
calls with SocketBindDeny / SocketBindAllow.

With this, users running server software written using the golang
standard library will be able to effectively sandbox their software,
albeit with a small loss in security protections by allowing the
process to bind on a random port in the
/proc/sys/net/ipv4/ip_local_port_range.
 2024-01-06 08:27:14 +09:00
Lennart Poettering 9807ee19b0 Merge pull request #30791 from poettering/nspawn-restrict-run-host 
nspawn: make some files we expose in /run/host/ in nspawn read-only via access mode
 2024-01-05 22:37:29 +01:00
Lennart Poettering 32fa24582c nspawn: add new common make_run_host() helper 
This new helper creates the /run/host/ top-level dir inside the
container.
 2024-01-05 22:34:47 +01:00
Lennart Poettering 8e471c6a9f socket-util: add more careful parsers for AF_VSOCK cid/port 
Let's handle the magic CIDs, and filter out invalid ports.
 2024-01-05 22:29:55 +01:00
Lennart Poettering 41dd51f8f5 missing: add a bunch of vsock related defines 2024-01-05 22:29:55 +01:00
Yu Watanabe 92a39246ad Merge pull request #30790 from poettering/null-creds-allow-with-tpm 
creds: allow using NULL encryption if explicitly requested even if TPM is available, and add a comprehensive credential encryption/decrpytion test
 2024-01-06 04:26:38 +09:00
Frantisek Sumsal 178c8c24ec shell-completion: provide completion for journalctl --namespace= 
Resolves: #30381
 2024-01-05 19:21:51 +01:00
Frantisek Sumsal 2fe03e25fb shell-completion: fix mixed indent 2024-01-05 19:21:51 +01:00
Frantisek Sumsal 68f66a1713 journalctl: implement --list-namespaces 
Apart from being useful on its own, this will be used in the following
commit for shell completions.
 2024-01-05 19:21:51 +01:00
Lennart Poettering 05794f5c48 nspawn: set read-only access mode on two /run/host/ files 
The diectory is mounted read-only anyway, hence this doesn't do much,
but let's lock this down on every level we can.
 2024-01-05 17:31:08 +01:00
Lennart Poettering 2148c669d2 fileio: add new flag WRITE_STRING_FILE_MODE_0444 
With this write_string_file() will create the file with 0444 access mode
(i.e. read-only).
 2024-01-05 17:30:41 +01:00
Lennart Poettering 3a3315c705 test: add credential encryption/decryption test 2024-01-05 17:20:05 +01:00
Lennart Poettering 9c3d8db990 creds-util: optionally, allow NULL credentials even with TPM 2024-01-05 17:20:05 +01:00
Lennart Poettering 3289aba5a0 Merge pull request #30754 from poettering/iovecification 
tpm2-util: convert various things over to struct iovec rather that data ptr + size
 2024-01-05 14:45:15 +01:00
Lennart Poettering 53cea64542 Merge pull request #30784 from poettering/json-dispatch-enum 
json: add macro for automatically defining a dispatcher for an enum
 2024-01-05 14:44:59 +01:00
Lennart Poettering fe10493ca8 Merge pull request #30785 from poettering/json-allow-extensions 
json: add flag for allowing extension of json objects when dispatching, without otherwise being permissive
 2024-01-05 14:44:50 +01:00
Yu Watanabe ff4240fc22 test: wait for verbose-success.service finished 
Otherwise, the command 'echo' may not be invoked yet.

Follow-up for 25aa35d465.
 2024-01-05 13:08:10 +01:00
Lennart Poettering f0e4244b2f tree-wide: use JSON_ALLOW_EXTENSIONS when disptching at various places 
If we want to allow method replies to be extended without this breaking
compat, then we should set this flag. Do so at various method call
replies hence.

Also do it when parsing user/group records, which are expressly
documented to be extensible, as well as the hibernate JSON record.
 2024-01-05 12:43:06 +01:00
Lennart Poettering a617fd9047 json: add new dispatch flag JSON_ALLOW_EXTENSIONS 
This is a subset of JSON_PERMISSIVE focussed on allowing parsing of
varlink replies that get extended, i.e. gain new fields, without
allowing more than that (i.e. without allowing missing fields, or bad
field types or such).
 2024-01-05 12:43:06 +01:00
Lennart Poettering 8ef31e1f13 Merge pull request #29692 from H5117/fix_pkcs11_uri 
cryptenroll: change class in provided PKCS#11 URI if necessary
 2024-01-05 12:14:26 +01:00
Lennart Poettering 00096a3549 oomd: make use of new JSON_DISPATCH_ENUM_DEFINE() macro 2024-01-05 12:08:37 +01:00
Lennart Poettering 19f3282929 user-record: port over to JSON_DISPATCH_ENUM_DEFINE() 2024-01-05 12:08:37 +01:00
Lennart Poettering 8618ff1368 test: add unit test for JSON_DISPATCH_ENUM_DEFINE() 2024-01-05 12:08:37 +01:00
Lennart Poettering dda6629622 json: add macro for automatically defining a dispatcher for an enum 2024-01-05 12:08:37 +01:00
Lennart Poettering 8d042bc40a tpm2-util: more iovec'ification 
Let's move more code to using struct iovec for passing around binary
chunks of data.

No real changes in behaviour, just refactoring.
 2024-01-05 11:34:46 +01:00
Lennart Poettering 9d1c3e9413 test: add unit tests for the new iovec helpers 2024-01-05 11:34:46 +01:00
Lennart Poettering dddc12f9eb iovec-util: add CONST_IOVEC_MAKE_STRING() 2024-01-05 11:10:22 +01:00
Lennart Poettering 4cc467b67c iovec-util: add new iovec_memdup() helper 2024-01-05 11:10:22 +01:00
Lennart Poettering bf38e4c0c1 iovec-util: add new iovec_memcmp() helper 2024-01-05 11:10:22 +01:00
Lennart Poettering 39f586873d iovec-util: add iovec_is_valid() helper 2024-01-05 11:10:22 +01:00
Lennart Poettering 33d1febbd7 iovec-util: rework IOVEC_MAKE_STRING() to work with compound initialized input 
This avoids the ({}) that IOVEC_MAKE_STRING() so far used and might
cause a memory corruption if the parameter passed in is itself allocated
via a compount initialized array or so.

Also, this makes sure both IOVEC_MAKE_STRING() and IOVEC_MAKE() accept
'const' parameters without this causing a compiler warning.
 2024-01-05 11:10:22 +01:00
Lennart Poettering b22f0a502d json: add more iovec helpers for serializing/deserializing binary data 2024-01-05 11:10:22 +01:00
Lennart Poettering 995389aac6 update TODO 2024-01-05 11:09:23 +01:00
Frantisek Sumsal 355222c404 Merge pull request #30772 from yuwata/test-network-improvements 
test-network: add more test cases and several cleanups
 2024-01-05 11:09:14 +01:00
Yu Watanabe 115a09004e test: fix typo 
Follow-up for 995bf013a1.
 2024-01-05 19:08:12 +09:00
Yu Watanabe c270e41f5e man: fix typo 
Follow-up for 7d93e4af80.
 2024-01-05 19:08:12 +09:00
Yu Watanabe 20a0aeb039 vpick: fix typo 
Follow-up for 76511c1bd3.
 2024-01-05 19:08:12 +09:00
Yu Watanabe d61df11fcd login: noone -> no one 
Follow-up for 59afe07c21.
 2024-01-05 19:08:12 +09:00
Yu Watanabe e75c24c450 core/dbus-manager: fix typo 
Follow-up for 84c01612de.
 2024-01-05 19:08:12 +09:00
Yu Watanabe 9e44842a9a string-util: fix typo 
Follow-up for 63566c6b6f.
 2024-01-05 19:08:12 +09:00
Yu Watanabe 56a89426f6 TODO: fix typo 
Follow-up for 97c493f214.
 2024-01-05 19:08:12 +09:00