Commit Graph
7535 Commits
Author SHA1 Message Date
Yu Watanabe 59159aee20 Merge pull request #24018 from keszybz/generator-cleanups
Make generators easier to test, fix various corner issues
2022-07-16 05:11:49 +09:00
Lennart Poettering 3acb6edef3 sysusers: allow defining additional sysusers lines via credentials 2022-07-16 00:47:22 +09:00
lastkrick 69a7d10832 man: fix typo in systemd.network documentation in IPv6RoutePrefix section (#24030) 2022-07-16 00:45:56 +09:00
Zbigniew Jędrzejewski-Szmek 99e3d47679 fstab-generator: allow overriding path to /sysroot/etc/fstab too
This adds $SYSTEMD_SYSROOT_FSTAB analoguous to $SYSTEMD_FSTAB.
2022-07-15 15:48:05 +02:00
Lennart Poettering 9fbb7df7bc Merge pull request #24011 from poettering/condition-cred
pid1: add new condition type "ConditionCredential=" for checking for credentials passed into the system
2022-07-15 15:03:49 +02:00
Zbigniew Jędrzejewski-Szmek 17021368fc generators: accept one or three args, do not write to /tmp
Since the general generator logic was established in the rewrite in
07719a21b6, generators would always write to /tmp
by default. I think this not a good default at all, because generators write a
bunch of files and would create a mess in /tmp. And for debugging, one
generally needs to remove all the files in the output directory, because
generators will complain in the output paths are already present. Thus the
approach of disabling console logging and writing many files to /tmp when
invoked with no arguments is not nice, so let's disallow operation with no
args.

But when debugging, one generally does not care about the separate output dirs
(most generators use only one). Thus the general pattern I use is something
like:
  rm -rf /tmp/x && mkdir /tmp/x && build/some-generator /tmp/{x,x,x}
This commit allows only one directory to be specified and simplifies this to:
  rm -rf /tmp/x && mkdir /tmp/x && build/some-generator /tmp/x
2022-07-15 13:10:39 +02:00
Lennart Poettering 708daf42d8 tmpfiles: optionally, decode string to write to files with base64
This is useful to use "f" or "w" to write arbitrary binary files to
disk, or files with newlines and similar (for example to provision SSH
host keys and similar).
2022-07-15 11:55:03 +02:00
Lennart Poettering 462511c8c6 man: fix copy/paste typo 2022-07-15 10:53:45 +02:00
Lennart Poettering 4f80cfca5e pid1: add mechanism for conditionalizing units/network/netdev/link based on credentials passed in
This is useful when provisioning systems via nspawn/qemu and running
specific services only if specific data is passed into the system.
2022-07-15 10:53:45 +02:00
Lennart Poettering 8de7de462b pid1: import creds from SMBIOS too, not just qemu's fw_cfg
This imports credentials also via SMBIOS' "OEM vendor string" section,
similar to the existing import logic from fw_cfg.

Functionality-wise this is very similar to the existing fw_cfg logic,
both of which are easily settable on the qemu command line.

Pros and cons of each:

SMBIOS OEM vendor strings:
   - pro: fast, because memory mapped
   - pro: somewhat VMM independent, at least in theory
   - pro: qemu upstream sees this as the future
   - pro: no additional kernel module needed
   - con: strings only, thus binary data is base64 encoded

fw_cfg:
   - pro: has been supported for longer in qemu
   - pro: supports binary data
   - con: slow, because IO port based
   - con: only qemu
   - con: requires qemu_fw_cfg.ko kernel module
   - con: qemu upstream sees this as legacy
2022-07-15 08:31:34 +09:00
Yu Watanabe 08894b568f Merge pull request #24021 from poettering/man-rlimit-comments
man: elaborate on the usefulness (and not-so-usefulness) of various process resource limits
2022-07-15 08:28:53 +09:00
Yu Watanabe 3f5ef8aeac Merge pull request #24019 from yuwata/network-ipv4ll
network: refuse 169.254.0.0/24 and 169.254.255.0/24
2022-07-15 07:59:13 +09:00
Lennart Poettering 8c88895772 man: explain why various resource limits don't make sense and should not be used. 2022-07-14 23:53:51 +02:00
Yu Watanabe dfeb5a076a Merge pull request #24016 from poettering/sysctl-cred-extra
sysctl: also process sysctl requests via the "sysctl.extra" credential
2022-07-15 04:20:35 +09:00
Yu Watanabe d3efcd2def network: refuse 169.254.0.0/24 and 169.254.255.0/24 for IPv4LLStartAddress=
Follow-up for #23927.
2022-07-15 03:37:09 +09:00
Yu Watanabe c1dd250f18 Merge pull request #23927 from AndreKalb/feature/ipv4-link-local-start-address
network: Feature IPv4 link-local start address
2022-07-15 03:21:26 +09:00
Zbigniew Jędrzejewski-Szmek 9cfc294fe0 man: fix formatting of "BARRIER=1"
Whitespace inside of the <varname> field was propagated to the displayed form,
causing strange indentation.
2022-07-14 19:25:15 +02:00
Lennart Poettering 3840b14781 man: drop misplaced ',' 2022-07-14 18:04:01 +02:00
Lennart Poettering 39f0d1d2e7 sysctl: also process sysctl requests via the "sysctl.extra" credential 2022-07-14 18:02:58 +02:00
Andre Kalb 1df6201882 man/network: ServerAddress= drop "literal" from IP address ranges 2022-07-14 14:35:42 +02:00
Andre Kalb 34b63c9e45 network: Add support to select an IPv4 link-local start address 2022-07-13 23:57:18 +02:00
Zbigniew Jędrzejewski-Szmek 9e6df03412 man: lift pam_systemd_homed description to Summary
Also change the title to describe the module more comprehensively.
Follow-up for 90bc309aa2. Suggested
in https://bugzilla.redhat.com/show_bug.cgi?id=2085485#c5.
2022-07-13 14:00:54 +01:00
Yu Watanabe 0925c79c9e Merge pull request #23881 from keszybz/kernel-install-strikes-yet-again
kernel-install: fix invocation as installkernel, add tests, tweak documentation
2022-07-13 02:44:50 +02:00
Łukasz Stelmach aa5ae9711e smack: Add DefaultSmackProcessLabel to user.conf and system.conf
DefaultSmackProcessLabel tells systemd what label to assign to its child
process in case SmackProcessLabel is not set in the service file. By
default, when DefaultSmackProcessLabel is not set child processes inherit
label from systemd.

If DefaultSmackProcessLabel is set to "/" (which is an invalid character
for a SMACK label) the DEFAULT_SMACK_PROCESS_LABEL set during compilation
is ignored and systemd act as if the option was unset.
2022-07-12 22:47:32 +01:00
Luca Boccassi 768456e8e6 Merge pull request #23979 from DaanDeMeyer/nspawn-relative-paths
nspawn: Support relative paths for --bind and --overlay
2022-07-12 22:41:10 +01:00
Daan De Meyer 448f737730 nspawn: Support relative source paths for --bind and --overlay 2022-07-12 13:14:11 +02:00
Zbigniew Jędrzejewski-Szmek 6755285ccb kernel-install: allow overriding the plugin list too
The use of IFS=<newline> is dropped. Let's just iterate over the list, using
any whitespace as separator.
2022-07-12 09:22:09 +02:00
Lennart Poettering 90bc309aa2 man: explain why pam_systemd_home wants to be in all four stacks
Suggested here:

https://bugzilla.redhat.com/show_bug.cgi?id=2085485#c5
2022-07-11 21:03:58 +01:00
Daan De Meyer f075e32ca1 nspawn: Rewrap --overlay docs 2022-07-11 21:43:41 +02:00
Zbigniew Jędrzejewski-Szmek 4bd035153b manager: add taint flag "support-ended"
In the welcome line, use NAME= as the fallback for PRETTY_NAME=.
PRETTY_NAME= doesn't have to be set, but NAME= should.

Example output:
---
Welcome to Fedora Linux 37 (Rawhide Prerelease)!

[  !!  ] This OS version (Fedora Linux 37 (Rawhide Prerelease)) is past its end-of-support date (1999-01-01)
Queued start job for default target graphical.target.
[  OK  ] Created slice system-getty.slice.
---
2022-07-10 14:33:52 +02:00
Zbigniew Jędrzejewski-Szmek 8bf9eb7e6b man: update the description of taint flags
We had a description in README, and an outdated list in the man page.
I think we should keep a reference-style list in the man page. The description
in README is more free-form.
2022-07-09 19:18:14 +02:00
Zbigniew Jędrzejewski-Szmek caa779abb6 man: redefine SUPPORT_END= to mean one day earlier
I thought it would be nice to specify the last day of support, because I
thought it'd seem more natural. But in practice this doesn't work well, because
such a truncated timestamp is usually taken to mean midnight that starts the
given date. I.e. 2011-12-13 is a shorthand for 2011-12-13 00:00:00 and not
2011-12-13 23:59:59.999999999999. Let's instead specify that the given date is
the first unsupported day, which is meaningful for humans, and let the computer
treat it as midnight, which gives consistent interpratation.
2022-07-09 18:02:34 +02:00
Luca Boccassi 89f119b654 Merge pull request #23731 from bluca/bootctl_image
bootctl: add --root and --image
2022-07-08 21:59:16 +01:00
Luca Boccassi 02d06ba180 bootctl: add --install-source=auto|image|host
When using --root=/--image= the binaries to install/update will be
picked from the directory/image. Add an option to let the caller
choose.
By default (auto) the image is tried first, and if nothing is found
then the host. The other options allow to strictly try the image
or host and ignore the other.
2022-07-08 16:58:51 +01:00
Luca Boccassi 80a2381d5c bootctl: add --root and --image
Operate on image/directory, and also take files to install from it
2022-07-08 16:58:15 +01:00
Frank Dana 1f7eed4c35 resolvectl man page: Word correction 2022-07-07 13:02:06 +02:00
Zbigniew Jędrzejewski-Szmek 2615c1f17a os-release: define SUPPORT_END=
Fixes #21764.

I think is very simple, but flexible. The date may be set early, for distros
that have a fixed schedule, but it doesn't have to. So for example Debian could
push out an update that sets a few months before the release goes EOL. And
various tools, in particular graphical desktops, can start nagging people to
upgrade a few weeks before the date.

As discussed in the bug, we don't need granularity higher than a day. And this
means that we can use a simple human- and machine-readable format.
I was considering other names, e.g. something with "EOL", but I think that
"SUPPORT_END" is better because it doesn't imply that the machine will somehow
stop working. This is supposed to be an advisory, nothing more.
2022-07-07 07:35:17 +09:00
Zbigniew Jędrzejewski-Szmek 132b63bd31 Merge pull request #15205 from jlebon/pr/preset-all-firstboot
manager: optionally, do a full preset on first boot
2022-07-06 19:11:01 +02:00
Zbigniew Jędrzejewski-Szmek 91199185b1 kernel-install: allow overriding the path to config files
It's pretty hard to write tests without this. I started out by adding separate
variables for each of the files we read, but there's a bunch, and in practice
it's good enough to just override the directory.
2022-07-06 16:33:11 +02:00
Zbigniew Jędrzejewski-Szmek f5f5047ff1 man: rework documentation of kernel-install config
Variables read by kernel-install and those exported by it were described
without any clear separation. So in particular it was pretty hard to answer
a question like "what variables can be set in install.conf". The in- and
out-variables are now split into two separate subsections.
2022-07-06 16:33:09 +02:00
Lennart Poettering 0c772b1cc1 man: "enabled commands are started at boot" is rubbish
it's enabled units, and they might be started by various forms of
activation, not just "at boot".

Fix that.
2022-07-06 15:56:53 +02:00
Yu Watanabe 917c6bb4b3 Merge pull request #23916 from keszybz/assorted-patches
Assorted patches
2022-07-06 14:15:50 +09:00
Lennart Poettering e07ed99dd7 docs: normalize uppercasing of titles of network doc 2022-07-05 22:12:08 +02:00
Zbigniew Jędrzejewski-Szmek 6f52e1c63b man: fix link to glob(3) 2022-07-05 21:49:12 +02:00
nl6720 0e68582323 tree-wide: link to docs.kernel.org for kernel documentation
https://www.kernel.org/ links to https://docs.kernel.org/ for the documentation.
See https://git.kernel.org/pub/scm/docs/kernel/website.git/commit/?id=ebc1c372850f249dd143c6d942e66c88ec610520

These URLs are shorter and nicer looking.
2022-07-04 19:56:53 +02:00
Zbigniew Jędrzejewski-Szmek f217f9a8b3 man/network: fix wording and syntax
Follow-up for 0bcc6557fb. Docbook doesn't
know <variable>.
2022-07-02 13:40:49 +02:00
Zbigniew Jędrzejewski-Szmek 2f8211c64a tree-wide: use html links for kernel docs
Instead of using "*.txt" as reference name, use the actual destination title.
2022-07-02 12:13:00 +02:00
Zbigniew Jędrzejewski-Szmek 628f7b1e70 sd-bus: use assert_return() in public function sd_bus_message_dump
Also, document that NULL is allowed.
2022-06-30 10:55:39 +02:00
Zbigniew Jędrzejewski-Szmek 7e922b0584 sd-event: let sd_event_source_set_enabled accept NULL
Same story as before: disabling a non-existent event source shouldn't
need to be guarded by an if. I retained the wrapper so that that we don't
have to say SD_EVENT_OFF in the many places where this is called.
2022-06-30 10:35:27 +02:00
Zbigniew Jędrzejewski-Szmek 71193c0b62 sd-event: allow sd_event_source_is_enabled() to return false for NULL
This is a natural use case, and instead of defining a wrapper to do this
for us, let's just make this part of the API. Calling with NULL was not
allowed, so this is not a breaking change to the interface.

(After sd_event_source_is_enabled was originally added, we introduced
sd_event_source_disable_unref() and other similar functions which accept
NULL. So not accepting NULL here is likely to confuse people. Let's just
make the API usable with minimal fuss.)
2022-06-30 10:35:27 +02:00