Almost all programs are simple and have only a single command. When
printing options, let's just use the first COMMAND block found by default.
This means we can drop the explicit program-name argument and reduce
copy&paste boilerplate.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The "Commands" option group is moved before the
other options and an explicit "Options" group is added, so that the sections
are printed in the same order as before. --help now goes through the pager,
like other commands with --no-pager. The mount.mstack helper interface is
described by a second COMMAND(), so that it is exposed by --introspect-cli
too.
Previously, when a library was dynamically loaded via a helper function
inside libsystemd-shared.so, the resulting dlopen ELF note was not
propagated to the invoking executable's ELF metadata.
This commit explicitly annotates each executable with the relevant
dlopen ELF notes for any optional dependencies it might potentially
load. This ensures that package managers and build systems can properly
discover runtime dependencies that are triggered indirectly.
Both the main parser and the util-linux mount-helper-mode parser
(invoked as mount.mstack) are converted with "systmed-mstack" and
"mount.mstack" as namespaces. The latter has no help.
For systemd-mstack, Commands are listed first, and then Options.
And --no-pager, --no-legend, --json= are moved to the end.
Co-developed-by: Claude Opus 4.7 <noreply@anthropic.com>
So far we opened a new Varlink connection for every mountfsd/nsresourced
method call. Given each tool only does a very small number of calls
(usually 1…5) on them and the connections are cheap this is not too
wasteful. Nonetheless, let's do something about it, and allow reusing
the connection for multiple calls.
This not only makes things a bit more efficient, but has one more
important benefit: Varlink connections pin the security context of the
client when connecting. This means that varlink method calls done with a
connection established while some code was privileged will still operate
as privieged once privs are dropped, until the connection is closed.
This pinning effect is really nice, as it gives us behaviour in a
"capability system" like scheme. Later code is going to use that to
continue doing certain priv userns ops even after unsharing userns and
becoming fully unpriv.
felix h
Zbigniew Jędrzejewski-Szmek
Yu Watanabe
Antonio Alvarez Feijoo
Lennart Poettering