SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
37,124 Commits 2 Branches 1 Tag
0672e2c6f84e0999ead8ea662360eb6bb8effe4c
Commit Graph
37124 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Lennart Poettering 0672e2c6f8 tree-wide: use FORK_RLIMIT_NOFILE_SAFE wherever possible 
Similar to the previous commit: in many cases no further fd processing
needs to be done in forked of children before execve() or any of its
flavours are called. In those case we can use FORK_RLIMIT_NOFILE_SAFE
instead.
 2018-12-01 12:50:45 +01:00
Lennart Poettering 595225af7a tree-wide: invoke rlimit_nofile_safe() before various exec{v,ve,l}() invocations 
Whenever we invoke external, foreign code from code that has
RLIMIT_NOFILE's soft limit bumped to high values, revert it to 1024
first. This is a safety precaution for compatibility with programs using
select() which cannot operate with fds > 1024.

This commit adds the call to rlimit_nofile_safe() to all invocations of
exec{v,ve,l}() and friends that either are in code that we know runs
with RLIMIT_NOFILE bumped up (which is PID 1 and all journal code for
starters) or that is part of shared code that might end up there.

The calls are placed as early as we can in processes invoking a flavour
of execve(), but after the last time we do fd manipulations, so that we
can still take benefit of the high fd limits for that.
 2018-12-01 12:50:45 +01:00
Lennart Poettering 909106ebdf process-util: add new FORK_RLIMIT_NOFILE_SAFE flag for safe_fork() 
The new flag simply means rlimit_nofile_safe() is called in the child
after all fds are rearranged.
 2018-12-01 12:50:45 +01:00
Lennart Poettering 3c069cdac4 move src/shared/rlimit-util.[ch] → src/basic/ 
This is really basic stuff and in a follow-up commit will use it all
across the codebase, including in process-util.[ch] which is in
src/basic/. Hence let's move it back to src/basic/ itself.
 2018-12-01 12:50:45 +01:00
Lennart Poettering 1300f91149 rlimit: add new rlimit_nofile_safe() helper 
This helper sets RLIMIT_NOFILE's soft limit to 1024 (FD_SETSIZE) for
compatibility with apps using select().

The idea is that we use this helper to reset the limit whenever we
invoke foreign code from our own processes which have bumped
RLIMIT_NOFILE high.
 2018-12-01 12:50:45 +01:00
Aleksei Timofeyev 09e5c07fbd resolved: add missed io-util.h header to resolved-dnstls-openssl.c 
Regression after commit 5cfa2c3dc0
 2018-12-01 12:49:01 +01:00
Evgeny Vereshchagin f5e75e08b0 travis: use latest instead of rawhide 2018-12-01 06:45:45 +03:00
Lennart Poettering 2c8f15aeca Merge pull request #11006 from poettering/conf-file-fix 
minor fixes for conf-files.c
 2018-12-01 00:47:22 +01:00
Lennart Poettering ac20048fc0 Merge pull request #11002 from keszybz/path_join-merging 
Path join merging
 2018-12-01 00:44:58 +01:00
Lennart Poettering f8ee4eaa48 Merge pull request #11004 from keszybz/remove-fixme-comment 
socket-util: drop obsolete FIXME comment and add test
 2018-12-01 00:01:11 +01:00
Zbigniew Jędrzejewski-Szmek 652ef29887 path-util: allow NULLs in arguments to path_join() 
This removes the need to remember to put strempty() in places, thus reducing
the likelihood of a stupid mistake.
 2018-11-30 22:21:17 +01:00
Lennart Poettering 59ea6e57a5 networkd: refuse IPv6 RADV prefixes that lack Prefix= setting 
Fixes: #9589
 2018-11-30 22:19:28 +01:00
Zbigniew Jędrzejewski-Szmek 15dca3711d basic/socket-util: use c-escaping to print unprintable socket paths 
We are pretty careful to reject abstract sockets that are too long to fit in
the address structure as a NUL-terminated string. And since we parse sockets as
strings, it is not possible to embed a NUL in the the address either.  But we
might receive an external socket (abstract or not), and we want to be able to
print its address in all cases. We would call socket_address_verify() and
refuse to print various sockets that the kernel considers legit.

Let's do the strict verification only in case of socket addresses we parse and
open ourselves, and do less strict verification when printing addresses of
existing sockets, and use c-escaping to print embedded NULs and such.

More tests are added.

This should make LGTM happier because on FIXME comment is removed.
 2018-11-30 21:58:47 +01:00
Zbigniew Jędrzejewski-Szmek 3a48499153 shared/socket-util: do not print empty CID 
That's just ugly.
 2018-11-30 21:40:04 +01:00
Zbigniew Jędrzejewski-Szmek 39e73acb9b test-socket-util: add test for socket_address_print 2018-11-30 21:40:02 +01:00
Zbigniew Jędrzejewski-Szmek 041103a688 test-socket-util: the usual modernization 2018-11-30 21:37:44 +01:00
Lennart Poettering b806f0b0aa Merge pull request #10701 from poettering/analyze-security 
systemd-analyze: add a new "security" verb for analyzing unit sandboxing options
 2018-11-30 19:41:59 +01:00
Lennart Poettering 380b82d678 conf-files: remove unused function 2018-11-30 16:56:35 +01:00
Lennart Poettering a7181c671a conf-files: remove misplaced log_oom() 
The caller should log in this case (and all callers in fact already do),
hence let's remove the duplicate logging here.
 2018-11-30 16:55:57 +01:00
Lennart Poettering 243dd6ae1d conf-files: improve algorithm O(n²) → O(n) 2018-11-30 16:55:33 +01:00
Lennart Poettering d96c081aa5 update TODO 2018-11-30 16:48:09 +01:00
Lennart Poettering ee93c1e664 man: document systemd-analyze security 2018-11-30 16:48:09 +01:00
Lennart Poettering ec16f3b6dd analyze: add new security verb 2018-11-30 16:48:09 +01:00
Lennart Poettering 88db94fa57 format-table: make sure we never call memcmp() with NULL parameters 2018-11-30 16:46:10 +01:00
Lennart Poettering 62d99b3970 format-table: add calls to query the data in a specific cell 2018-11-30 16:46:10 +01:00
Lennart Poettering 30d98de00c format-table: always underline header line 2018-11-30 16:46:10 +01:00
Lennart Poettering 9314ead785 format-table: add an API for getting the cell at a specific row/column 2018-11-30 16:46:10 +01:00
Lennart Poettering 27e730e6d0 format-table: add table_update() to update existing entries 2018-11-30 16:46:10 +01:00
Lennart Poettering a2c73e2d38 format-table: optionally allow reversing the sort order for a column 2018-11-30 16:46:10 +01:00
Lennart Poettering a4661181fa format-table: add option to store/format percent and uint64_t values in cells 2018-11-30 16:46:10 +01:00
Lennart Poettering a22318e554 format-table: before outputting a color, check if colors are available 
This is in many cases redundant, as a similar check is done by various
callers already, but in other cases (where we read the color from a
static table for example), it's nice to let the color check be done by
the table code itself, and since it doesn't hurt in the other cases just
do it again.
 2018-11-30 16:46:10 +01:00
Lennart Poettering 165ca5663e format-table: optionally make specific cells clickable links 2018-11-30 16:46:10 +01:00
Lennart Poettering 13b0d4d7bd format-table: when duplicating a cell, also copy the color 2018-11-30 16:46:10 +01:00
Lennart Poettering 62d6a1cc9f terminal-util: split out file:// generation from terminal_urlify_path() 
This way we can use it at other places, for example when preparing URLs
for format_table_set_url()
 2018-11-30 16:46:10 +01:00
Lennart Poettering 8a453c9dfc macro: update DIV_ROUND_UP() so that it can be called nested 2018-11-30 16:46:10 +01:00
Lennart Poettering b06f0cc625 parse-util: allow parse_boolean() to take a NULL argument 
It's pretty useful to allow parse_boolean() to take a NULL argument and
return an error in that case, rather than abort. i.e. making this a
runtime rather than programming error allows us to shorten code
elsewhere.
 2018-11-30 16:46:09 +01:00
Lennart Poettering 2987225ce6 analyze: use strv_skip() where appropriate 2018-11-30 16:46:09 +01:00
Lennart Poettering 0ed3da7c8c analyze: remove unnecessary negation of bus_error_message() error number parameter 2018-11-30 16:46:09 +01:00
Lennart Poettering 90bea7448d analyze: fix include order 2018-11-30 16:46:09 +01:00
Lennart Poettering ad5ffe3716 seccomp-util: drop process_vm_readv from @debug group 
it's already part of @ipc, no need to have it in both. Given that @ipc
is much more popular (as it is part of @system-service for example),
let's not define it a second time.
 2018-11-30 16:46:09 +01:00
Lennart Poettering 5f1b0cc6d0 locale-util: add logic to output smiley emojis at various happiness levels 2018-11-30 16:19:29 +01:00
Zbigniew Jędrzejewski-Szmek 62a85ee0a9 tree-wide: rename path_join_many() to path_join() 
$ git grep -e path_join_many -l|xargs sed -r -i 's/path_join_many/path_join/g'

The two test functions are merged into one.
 2018-11-30 10:59:47 +01:00
Zbigniew Jędrzejewski-Szmek 30016f21b3 tree-wide: replace path_join with path_join_many 2018-11-30 10:40:38 +01:00
Zbigniew Jędrzejewski-Szmek b2ac2b01c8 Merge pull request #10996 from poettering/oci-prep 
Preparation for the nspawn-OCI work
 2018-11-30 10:09:00 +01:00
Filipe Brandenburger 00195abcbe docs: turn LGTM URL into a markdown link 2018-11-30 12:02:13 +03:00
Claudius Ellsel d03a00e2de hwdb: Put Lenovo mouse under the correct category in 70-mouse.hwdb (#10995) 
[zj: the entry for a Thinkpad mouse is moved to the end of Lenovo section, and a
      Lenovo mouse is moved from Logitech section to Lenovo section.]
 2018-11-30 09:14:30 +01:00
Fabrice Fontaine 38c1c96db1 meson.build: fix detection of -Werror=shadow 
Pass -Werror=shadow in args of cc.compiles otherwise test will always
succeed
This fix a build failure with gcc 4.7.3

Fixes:
 - http://autobuild.buildroot.org/results/ffd71c473d3b29618c18cd2e04705370266696f2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
 2018-11-30 08:45:22 +01:00
Zbigniew Jędrzejewski-Szmek 9ed6a1d2c6 Merge pull request #10990 from keszybz/link-libmount-less 
Link libmount less
 2018-11-29 21:38:37 +01:00
Zbigniew Jędrzejewski-Szmek 77c772f227 Move mount-util.c to shared/ 
libmount dep is moved from libbasic to libshared, potentially removing
libmount from some build products.
 2018-11-29 21:03:44 +01:00
Zbigniew Jędrzejewski-Szmek 049af8ad0c Split out part of mount-util.c into mountpoint-util.c 
The idea is that anything which is related to actually manipulating mounts is
in mount-util.c, but functions for mountpoint introspection are moved to the
new file. Anything which requires libmount must be in mount-util.c.

This was supposed to be a preparation for further changes, with no functional
difference, but it results in a significant change in linkage:

$ ldd build/libnss_*.so.2
(before)
build/libnss_myhostname.so.2:
	linux-vdso.so.1 (0x00007fff77bf5000)
	librt.so.1 => /lib64/librt.so.1 (0x00007f4bbb7b2000)
	libmount.so.1 => /lib64/libmount.so.1 (0x00007f4bbb755000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f4bbb734000)
	libc.so.6 => /lib64/libc.so.6 (0x00007f4bbb56e000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f4bbb8c1000)
	libblkid.so.1 => /lib64/libblkid.so.1 (0x00007f4bbb51b000)
	libuuid.so.1 => /lib64/libuuid.so.1 (0x00007f4bbb512000)
	libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f4bbb4e3000)
	libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 (0x00007f4bbb45e000)
	libdl.so.2 => /lib64/libdl.so.2 (0x00007f4bbb458000)
build/libnss_mymachines.so.2:
	linux-vdso.so.1 (0x00007ffc19cc0000)
	librt.so.1 => /lib64/librt.so.1 (0x00007fdecb74b000)
	libcap.so.2 => /lib64/libcap.so.2 (0x00007fdecb744000)
	libmount.so.1 => /lib64/libmount.so.1 (0x00007fdecb6e7000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fdecb6c6000)
	libc.so.6 => /lib64/libc.so.6 (0x00007fdecb500000)
	/lib64/ld-linux-x86-64.so.2 (0x00007fdecb8a9000)
	libblkid.so.1 => /lib64/libblkid.so.1 (0x00007fdecb4ad000)
	libuuid.so.1 => /lib64/libuuid.so.1 (0x00007fdecb4a2000)
	libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fdecb475000)
	libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 (0x00007fdecb3f0000)
	libdl.so.2 => /lib64/libdl.so.2 (0x00007fdecb3ea000)
build/libnss_resolve.so.2:
	linux-vdso.so.1 (0x00007ffe8ef8e000)
	librt.so.1 => /lib64/librt.so.1 (0x00007fcf314bd000)
	libcap.so.2 => /lib64/libcap.so.2 (0x00007fcf314b6000)
	libmount.so.1 => /lib64/libmount.so.1 (0x00007fcf31459000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fcf31438000)
	libc.so.6 => /lib64/libc.so.6 (0x00007fcf31272000)
	/lib64/ld-linux-x86-64.so.2 (0x00007fcf31615000)
	libblkid.so.1 => /lib64/libblkid.so.1 (0x00007fcf3121f000)
	libuuid.so.1 => /lib64/libuuid.so.1 (0x00007fcf31214000)
	libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fcf311e7000)
	libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 (0x00007fcf31162000)
	libdl.so.2 => /lib64/libdl.so.2 (0x00007fcf3115c000)
build/libnss_systemd.so.2:
	linux-vdso.so.1 (0x00007ffda6d17000)
	librt.so.1 => /lib64/librt.so.1 (0x00007f610b83c000)
	libcap.so.2 => /lib64/libcap.so.2 (0x00007f610b835000)
	libmount.so.1 => /lib64/libmount.so.1 (0x00007f610b7d8000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f610b7b7000)
	libc.so.6 => /lib64/libc.so.6 (0x00007f610b5f1000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f610b995000)
	libblkid.so.1 => /lib64/libblkid.so.1 (0x00007f610b59e000)
	libuuid.so.1 => /lib64/libuuid.so.1 (0x00007f610b593000)
	libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f610b566000)
	libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 (0x00007f610b4e1000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007f610b4db000)

(after)
build/libnss_myhostname.so.2:
	linux-vdso.so.1 (0x00007fff0b5e2000)
	librt.so.1 => /lib64/librt.so.1 (0x00007fde0c328000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fde0c307000)
	libc.so.6 => /lib64/libc.so.6 (0x00007fde0c141000)
	/lib64/ld-linux-x86-64.so.2 (0x00007fde0c435000)
build/libnss_mymachines.so.2:
	linux-vdso.so.1 (0x00007ffdc30a7000)
	librt.so.1 => /lib64/librt.so.1 (0x00007f06ecabb000)
	libcap.so.2 => /lib64/libcap.so.2 (0x00007f06ecab4000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f06eca93000)
	libc.so.6 => /lib64/libc.so.6 (0x00007f06ec8cd000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f06ecc15000)
build/libnss_resolve.so.2:
	linux-vdso.so.1 (0x00007ffe95747000)
	librt.so.1 => /lib64/librt.so.1 (0x00007fa56a80f000)
	libcap.so.2 => /lib64/libcap.so.2 (0x00007fa56a808000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fa56a7e7000)
	libc.so.6 => /lib64/libc.so.6 (0x00007fa56a621000)
	/lib64/ld-linux-x86-64.so.2 (0x00007fa56a964000)
build/libnss_systemd.so.2:
	linux-vdso.so.1 (0x00007ffe67b51000)
	librt.so.1 => /lib64/librt.so.1 (0x00007ffb32113000)
	libcap.so.2 => /lib64/libcap.so.2 (0x00007ffb3210c000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007ffb320eb000)
	libc.so.6 => /lib64/libc.so.6 (0x00007ffb31f25000)
	/lib64/ld-linux-x86-64.so.2 (0x00007ffb3226a000)

I don't quite understand what is going on here, but let's not be too picky.
 2018-11-29 21:03:44 +01:00