SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
86,558 Commits 2 Branches 1 Tag
116394f7ceff8cf48b3f7578bbd5150edbeaafa5
Commit Graph
86558 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Lennart Poettering 116394f7ce tree-wide: move logging from varlink clients in nsresource.c/dissect-image.c into callers 
These calls are "library-like", hence better should only debug log on
their own, not more.
 2026-02-19 15:05:15 +01:00
Lennart Poettering 1bc237dd7a nspawn: add support for running mstack container images 2026-02-19 15:05:15 +01:00
Lennart Poettering 8cd29712cb discover-image: add support for discovering mstack images 2026-02-19 15:05:15 +01:00
Lennart Poettering 8187cd18d6 add mstack tool for accessing mstacks from the command line 2026-02-19 15:05:15 +01:00
Lennart Poettering 944161d0d4 vpick: add generic definition for mstack image pick filters 2026-02-19 15:05:15 +01:00
Lennart Poettering 8343032a86 mstack: introduce "mstack" concept 2026-02-19 15:05:15 +01:00
Lennart Poettering a9f6ba0496 pull: add OCI support 2026-02-19 15:05:15 +01:00
Lennart Poettering 087f2ec344 core: introduce exec_context_with_rootfs_strict() as a stricter version of exec_context_with_rootfs() 
We have two very similar checks in place: in some contexts we want to
know if *any* RootDirectory= is configured, in the other we want to
suppress if it is configured to our regular root. Let's add a helper for
both (even if we only need it once), to make the mirrored behaviour
clear.
 2026-02-19 15:05:15 +01:00
Lennart Poettering 6d327e9fdd core: use exec_context_with_rootfs() at one more place 2026-02-19 15:05:15 +01:00
Lennart Poettering 6527861039 tar-util: add support for extracting OCI compatible whiteouts, and turn them into overlayfs whiteouts 2026-02-19 15:05:15 +01:00
Lennart Poettering d66e3cc79a pull-job: make sure pull_job_restart() can be used to fetch the same resource again, just with new headers 
Let's flush out all response state from the job, but let's keep the
request data previously configured, in particular the headers set. This
is useful to re-request a resource, just with a slightly modified or
identical URL.
 2026-02-19 15:05:15 +01:00
Lennart Poettering 93915ec17a pull-job: add helpers to detect requests for authentication, and accept bearer tokens 2026-02-19 15:05:14 +01:00
Lennart Poettering 1f593d2b5e pull-job: add 'description' field to PullJob 
This is shown in the output in place of the URL if non-NULL. This is
useful for OCI's hash-based URLs, which alone are very opaque to read.
 2026-02-19 15:05:14 +01:00
Lennart Poettering 98b714e0cb pull-job: optionally free userdata when we destroy a PullJob 2026-02-19 15:05:14 +01:00
Lennart Poettering 4a886d9ab4 pull-job: add interface for controlling Accept: header sent to http server 2026-02-19 15:05:14 +01:00
Lennart Poettering 41b0c68760 pull-job: keep track of content type reported by server 2026-02-19 15:05:14 +01:00
Lennart Poettering dbf13060e1 uid-range: add uid_range_base() that returns the lowest entry 2026-02-19 15:05:14 +01:00
Lennart Poettering 4c701125df basic: define Architecture typedef in basic-forward.h 2026-02-19 15:05:14 +01:00
Kai Lüke bad16f324a openssl-util: pass the UI callback for interactive PIN prompts 
Observed with the tpm2 provider and the tpm2tss engine was that the
auth process failed because the provider/engine could not ask for the
PIN through the callback, resulting in:
  "Failed to load private key from ...: Input/output error"
Apparently the default UI method is not enough and the key setup
functions expect an explicit method.
Pass the existing UI method through as callback for the key setup.
 2026-02-19 10:21:01 +01:00
Dmytro Bagrii 8df975bb67 xorg/50-systemd-user: import XAUTHORITY only if set 
The warning will still be reported if XAUTHORITY is set but not exported.
However, such scenario is unlikely for xinitrc.d scripts environment.

Fixes #40745

Signed-off-by: Dmytro Bagrii <dimich.dmb@gmail.com>
 2026-02-19 08:15:33 +01:00
Oblivionsage b3a2444ba5 pe-binary: wrap remaining LE fields with byte-swap macros 
Follow-up to 02cab70acf. pe_hash(),
section_offset_cmp() and uki_hash() still had a bunch of raw accesses
to LE fields (e_lfanew, SizeOfHeaders, PointerToRawData, SizeOfRawData,
VirtualSize, certificate_table->Size) without le32toh(), so they'd
produce garbage on big-endian.

Also wrap VirtualSize in bootspec.c for consistency.
 2026-02-19 07:34:44 +09:00
Daan De Meyer 81cef494a6 vpick: Make suffix a single string again instead of a strv 
This was made a strv to handle either directories or raw images but
since we now handle that via multiple PickFilter instances, we don't
need suffixes to be a strv anymore.
 2026-02-18 23:14:11 +01:00
David Santamaría Rogado 17a3b387ae udev: rules: integration add spi bus for input dev 
This bus is used for internal input devices let's set the ID_BUS
property accordingly to tag devices over SPI as internal.

Follow-up for a4381cae8b.
 2026-02-19 06:45:13 +09:00
Luca Boccassi 9204838724 test: skip dnf signature checks in TEST-88-UPGRADE 
Fixes failure on Rawhide:

TEST-88-UPGRADE.sh[512]: Transaction failed: Rpm transaction failed.
TEST-88-UPGRADE.sh[512]: Warning: skipped OpenPGP checks for 15 packages from repository: @commandline
TEST-88-UPGRADE.sh[512]:   - package systemd-shared-260~devel-20260218150812.fc45.x86_64 does not verify: no signature
 2026-02-18 21:41:49 +00:00
Luca Boccassi db73f1b4c6 test: assorted fixes for integration tests (#40737) 2026-02-18 20:42:15 +00:00
Daan De Meyer db1689e69c machined: Skip root user namespace check for user managers 
You can register whatever process you want in the user machined instance
that is running in the same namespace as pid 1 as machined won't be allowed
to do anything privileged anyway that could be dangerous when running as a user
instance.

We have to skip the check as we user machined instances don't have
privileges to inspect pid1's user namespaces.
 2026-02-18 19:22:14 +01:00
Lennart Poettering 0b7d5a2844 pcrextend: fix memory leak 
Follow-up for: #40648
Addresses: https://github.com/systemd/systemd/pull/40648#issuecomment-3917469644
 2026-02-18 18:25:08 +01:00
Mario Limonciello (AMD) e30c044c23 Tag accel devices for uaccess-render 
accel devices are used for things like NPUs and should be tagged
for the logged in user just like GPUs are.
 2026-02-18 18:22:00 +01:00
Luca Boccassi af9a5121a1 test: cover both verity verification mechanisms in TEST-70-TPM2-nvpcr 
Follow-up for 521a523ce0
 2026-02-18 16:20:33 +00:00
Luca Boccassi b9813d6c95 test: move check for verity kernel keyring support to util.sh 2026-02-18 16:11:34 +00:00
Luca Boccassi 7112e4755e test: do not fail TEST-86-MULTI-PROFILE-UKI if full TPM2 support not available 
On a mkosi run on GHA:

[    9.547863] TEST-86-MULTI-PROFILE-UKI.sh[458]: + /usr/lib/systemd/systemd-measure --current
[    9.552790] TEST-86-MULTI-PROFILE-UKI.sh[463]: Measuring boot phases: enter-initrd, enter-initrd:leave-initrd, enter-initrd:leave-initrd:sysinit, enter-initrd:leave-initrd:sysinit:ready
[    9.553086] TEST-86-MULTI-PROFILE-UKI.sh[463]: Found container virtualization none.
[    9.553308] TEST-86-MULTI-PROFILE-UKI.sh[463]: Reading EFI variable /sys/firmware/efi/efivars/LoaderTpm2ActivePcrBanks-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f.
[    9.553486] TEST-86-MULTI-PROFILE-UKI.sh[463]: Loaded shared library 'libtss2-esys.so.0' via dlopen().
[    9.553676] TEST-86-MULTI-PROFILE-UKI.sh[463]: Loaded shared library 'libtss2-rc.so.0' via dlopen().
[    9.553867] TEST-86-MULTI-PROFILE-UKI.sh[463]: Loaded shared library 'libtss2-mu.so.0' via dlopen().
[    9.554050] TEST-86-MULTI-PROFILE-UKI.sh[463]: Sorry, system lacks full TPM2 support.
[FAILED] Failed to start TEST-86-MULTI-PROFILE-UKI.service - TEST-86-MULTI-PROFILE-UKI.
 2026-02-18 15:39:13 +00:00
Luca Boccassi 1cd2ff3cca stub: more hardening against malformed images 
Avoid issues with malformed images.

Reported on various yeswehack.com reports

YWH-PGM9780-73
YWH-PGM9780-68
YWH-PGM9780-67
YWH-PGM9780-87
 2026-02-18 15:05:44 +00:00
Daan De Meyer cec9eb5e7e vmspawn: Don't keep tpmstate around in auto mode if ephemeral 2026-02-18 15:18:58 +01:00
Zbigniew Jędrzejewski-Szmek ba67af7efb Bump minimum version of python to 3.9 (#40711) 2026-02-18 13:33:29 +01:00
Luca Boccassi a23d89065a bash completion: various machinectl/portablectl fixes (#40719) 2026-02-18 11:08:29 +00:00
dependabot[bot] 20b2224a7c build(deps): bump super-linter/super-linter in the actions group 
Bumps the actions group with 1 update: [super-linter/super-linter](https://github.com/super-linter/super-linter).


Updates `super-linter/super-linter` from 8.4.0 to 8.5.0
- [Release notes](https://github.com/super-linter/super-linter/releases)
- [Changelog](https://github.com/super-linter/super-linter/blob/main/CHANGELOG.md)
- [Commits](https://github.com/super-linter/super-linter/compare/12562e48d7059cf666c43a4ecb0d3b5a2b31bd9e...61abc07d755095a68f4987d1c2c3d1d64408f1f9)

---
updated-dependencies:
- dependency-name: super-linter/super-linter
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-18 19:54:44 +09:00
Luca Boccassi 5137d58c22 bash completion: add --user/--system to portablectl 2026-02-18 10:40:12 +00:00
Luca Boccassi 28846f4e62 bash completion: add missing machinectl parameters 2026-02-18 10:40:12 +00:00
Luca Boccassi 3f618b8851 bash completion: fix machinectl completion when mixing machines and files 2026-02-18 10:39:38 +00:00
Luca Boccassi 5b6516f81e bash completion: add --system/--user to machinectl 2026-02-18 10:39:38 +00:00
Luca Boccassi 6fdc22f933 ci: set dependabot cooldown period, disable persisting credentials for actions/checkout (#40728) 
github/dependabot: set cooldown period
github/workflows: disable persisting credentials for actions/checkout
 2026-02-18 10:39:11 +00:00
Yu Watanabe d0e1f58200 metrics: add networkd related metrics (#40619) 
This adds support for networkd related metrics. The output looks like this:
```
{
	"name" : "io.systemd.Network.addressState",
	"object" : "lo",
	"value" : "off"
}
{
	"name" : "io.systemd.Network.adminState",
	"object" : "lo",
	"value" : "unmanaged"
}
{
	"name" : "io.systemd.Network.carrierState",
	"object" : "lo",
	"value" : "carrier"
}
{
	"name" : "io.systemd.Network.ipv4AddressState",
	"object" : "lo",
	"value" : "off"
}
{
	"name" : "io.systemd.Network.ipv6AddressState",
	"object" : "lo",
	"value" : "off"
}
{
	"name" : "io.systemd.Network.managedInterfaces",
	"value" : 0
}
{
	"name" : "io.systemd.Network.operationalState",
	"object" : "lo",
	"value" : "carrier"
}
```
 2026-02-18 19:26:55 +09:00
Yu Watanabe ef6c8c79dc Revert "check-os-release.py compatible with Python < 3.8" 
This reverts commit ce0a056abc.
 2026-02-18 18:47:15 +09:00
Yu Watanabe 08719d0e78 Revert "tools: make update-dbus-docs compatible with Python 3.7" 
This reverts commit 668b3a42fe.

Now we require Python 3.9 or newer.
 2026-02-18 18:47:15 +09:00
Yu Watanabe 7ff27c8012 Revert "generate-bpf-delegate-configs: fix compatibility with Python 3.7" 
This reverts commit dee77ac201.

Now we require Python 3.9 or newer.
 2026-02-18 18:47:15 +09:00
Yu Watanabe 3aaa9d9882 Revert "meson: fix compatibility with Python 3.7" 
This reverts commit 2793d6acf0.

Now we require Python 3.9 or newer.
 2026-02-18 18:47:15 +09:00
Jörg Behrmann 761f1ef2f3 Bump minimum version of python to 3.9 
This was announced in fd8c620751 and every
still-supported distributo release provides at least 3.9, as tracked by #38608.
 2026-02-18 18:47:15 +09:00
Yu Watanabe 582d499e32 meson: ukify unconditionally requires pefile module 
Follow-up for 3fc5eed470.
 2026-02-18 18:47:15 +09:00
Yaping Li 23c639be6d metrics: add networkd related metrics 2026-02-18 17:58:33 +09:00
Yu Watanabe 69f75cd896 network: use higher log level when we cannot bind resolve hook varlink socket 2026-02-18 17:57:32 +09:00