When an administrator installed a custom keyring under /etc,
signature verification selected it instead of the vendor keyring
under /usr. That could make vendor-signed system updates stop
verifying after adding local keys.
Collect all readable default keyrings, including the current and
legacy /etc paths, and pass temporary copies to GnuPG with
separate --keyring options. Keep SYSTEMD_OPENPGP_KEYRING as an
explicit override, add regression coverage for keyring
coexistence, override behavior, and current-path signing, and
silence the expected shellcheck false positive in the test
cleanup helper.
Closes: #40702
The transactions-with-cycles subtest starts 20 mutually cyclic
services, reads the manager's TransactionsWithOrderingCycle ids over
varlink, and then requires a journal entry matching "cycle starting
with" for every id. On a fedora rawhide CI run the entry for
transaction id 42 was missing for the entire boot and journalctl
printed "-- No entries --", failing the unit, while the manager had
correctly recorded all 20 ids. In the exported journal of that boot,
transaction 42 kept only its debug-level enqueue line
transaction-cycle12.service: Trying to enqueue job
transaction-cycle12.service/start/replace
while the other 19 transactions each also kept the three messages
that follow it ("Found ordering cycle", "Unable to break cycle
starting with", "unfixable cyclic ordering dependency"), and PID1's
next message, accepted about 2 ms after the enqueue line, shows
journald itself kept ingesting.
The messages were lost, not late. The test VM boots with
systemd.log_level=debug, and the 20 cyclic starts made PID1 emit
about 12,400 debug messages within 30 seconds, 4,100 of them in the
final second, during which journald stalled for 94 ms between two
consecutive entries. PID1 gives its journal socket a 10 ms send
timeout (src/basic/log.c), and a message whose send times out is
either dropped outright, because log_struct() ignores the sendmsg
result and falls back only on formatting errors, or, for the plain
log calls that do fall back to kmsg, reappears as _TRANSPORT=kernel
text stripped of its structured fields, where a TRANSACTION_ID=
match cannot find it. The asserted messages are log_struct() calls,
so they are in the dropped class. Either way the journalctl
assertion comes up empty. This is also why the "journalctl --sync"
added in ed0727fecd does not help here: it only flushes what journald
already received.
Run the whole section, including the daemon-reload, at log level
info, and drain what the earlier subtests queued at debug level with
one "journalctl --sync" before the first start. The daemon-reload is
itself a heavy debug emitter that returns before journald has
drained its burst, so opening the quiet window after it would leave
that backlog competing with the first cycle messages. The two
messages the subtest greps for are emitted at LOG_ERR ("Unable to
break cycle starting with") and LOG_WARNING ("Job ... deleted to
break ordering cycle starting with") in src/core/transaction.c, and
the ids are recorded into transactions_with_cycle on the same code
path directly before them, so the assertion keeps its full strength
while the debug flood that displaced it is gone.
A single at_exit handler installed at the start of the test restores
the boot-time log level when any subtest aborts, and cleans up the
transient unit the aborting subtest had in flight, guarded on the
unit file existing as in TEST-26-SYSTEMCTL.sh. It replaces the
per-subtest restart_randomized_delay_cleanup() handler, so the two
subtests that change the log level share one restore path.
systemd-shutdown parsed a bunch of options, but had no way to print
them. Add the standard --help and --version options and the CLI
introspection.
parse_argv() is moved before the PID 1 check, so that the new options
also work when the binary is invoked manually. As PID 1 we can never
return from main() (the kernel would panic), so in that case parse
errors still freeze(), and the help output is followed by a freeze()
too. Ctrl-Alt-Delete and console reopening are re-enabled before
freezing, so that the freeze can be escaped through the kernel and the
error is visible, as before.
The --help/--version/introspect-cli option names are already listed in
the kernel command line exclusion list in proc-cmdline.c.
--introspect-cli follows the same deferred pattern as --help: parse_argv()
only records the action, and it is executed in the same place where
ACTION_HELP and ACTION_VERSION are handled.
The help is looked up by explicit name: in the multicall configuration
the systemd and systemd-executor commands share one binary, so the
"first COMMAND" default would depend on link order.
The "This program takes no positional arguments." line is dropped from
the help output — the default "[OPTION…]" synopsis already says so.
(And also, this is not quite true. It does take positional args when
called as init.)
This converts systemd-homed, -hostnamed, -importd, -localed, -logind,
-machined, -networkd, -portebled, -resolved, -sysupdated, -timedated,
and -timesyncd.
The service name and description move from service_parse_argv() arguments
into a COMMAND() description that each daemon now defines. The
service_parse_argv() macro captures the calling binary's verb section,
where that COMMAND is found, while the options are still defined and
parsed in libshared, in the new "service" option namespace that each
COMMAND references. (The named namespace makes sure that options defined
by other translation units in libshared can never leak into the
services' parsers.)
The supported features are declared via option group filtering: each
COMMAND lists "Options" plus "Bus introspection" and/or "Runtime scope".
Unsupported options are now rejected by the parser as unknown options
(and are not shown in --help), replacing the runtime "This service does
not support …" errors.
The help output changes slightly: the "Bus introspection" and "Runtime
scope" option groups now get their own headings, and some descriptions
were reworded to the imperative form used elsewhere.
Standard parse_argv() func is added. --version is now accepted
(previously only the help forms were recognized, via argv_looks_like_help()).
The synopsis changes from "systemd-integritysetup COMMAND ..." to the
standard "systemd-integritysetup [OPTION…] COMMAND …", and the help output
gains an Options section. "help" as the first argument keeps working via
the hidden common help verb.
Previously, we'd just print help and exit with success if no arguments
were given. This seems unexpected and wrong. The program now prints the
usual error message:
Command verb required (one of attach, detach, help).
A newly created network namespace may disallow ICMP echo sockets for
unprivileged users even when their GIDs are mapped into the container.
When creating both user and network namespaces, initialize
net.ipv4.ping_group_range using the mapped GID range capped at INT32_MAX.
This follows the system-wide default from sysctl.d/50-default.conf while
respecting the user namespace mapping and the kernel's accepted limit.
Leave externally supplied network namespaces untouched and treat write
failures as non-fatal warnings.
Add regression coverage for the default 64K mapped range using the tools
already available in the minimal container image.
Fixes#41603
Otherwise, if the library is not loaded yet, these functions will fail.
Note, currently, all callers of tar_x/tar_c() load libarchive before
calling them. So, this should not change any behavior. Just for safety
and following our usual coding style.
Previously, if open_inode_finalize() for an object was failed, the number
count was not decremented, hence open_inode_done() is called twice for
the object: once in the failed open_inode_finalize(), and once in the
open_inode_free_array() invoked by the cleanup attribute.
Note, with the previous commit, open_inode_done() is idempotent. Hence,
calling open_inode_done() twice (or more) for the same object is
harmless. Just for safety.
The embedded controller on the HP ENVY x360 Convertible 13 emits atkbd
scancode e057 on every lid open. The generic HP block maps e057 to
KEY_WLAN, which desktop environments bind to the airplane-mode action, so
opening the lid switches off every radio. There is no physical key on this
machine that emits e057, it only ever arrives from the lid.
This is the same firmware behavior already quirked for the HP Spectre
x360 Convertible ("Prevents random airplane mode activation") and the HP
Pavilion Gaming 15-dk1 ("lid keys").
Add the property to the existing ENVY x360 13 record rather than to the
Spectre d7 block. The match line for this model already appears further
down the file, so duplicating it there is rejected by parse-hwdb.
e058 is emitted on lid close but carries no keycode in the generic HP
block, so it is already inert and is left alone here.
Replaces #43495.
Closes#43494.
Co-authored-by: Robin Richard Rajan <robinrichardrajan@gmail.com>
The Hangsheng R75 QMK keyboard (USB 342d:e483) exposes a System
Control interface with ABS capabilities. input_id consequently
classifies the interface as a joystick and sets ID_INPUT_JOYSTICK=1.
This makes desktop environments such as KDE Plasma expose the
keyboard as a game controller.
Setting ID_INPUT_JOYSTICK=0 for this device fixes the classification
while preserving its keyboard, consumer control and system control
functionality.
Affected modalias:
input:b0003v342DpE483e0111-e0,1,3,4,k74,8A,8B,8E,8F,94,AE,E3,F8,161,164,198,1B6,24E,24F,ra10,11,28,m4,lsfw
zsh only ever offered unit names after `systemctl show`, since
_systemctl_show() was sharing the same completion function as
is-active/status/preset/etc., none of which recognize `-`-prefixed
words at all. This meant `systemctl show --<TAB>` and
`systemctl show --property <TAB>` produced no completions, even
though the same options complete fine before the subcommand word
(bash has always completed both cases correctly).
Give `show` its own completion function that first tries the
existing global option specs (now pulled out into a `_sys_arguments`
array so they can be reused) via _arguments, falling back to unit
name completion for everything else. The unit-name fallback is
factored into a shared _systemctl_non_template_units() helper so it
isn't duplicated between _systemctl_show() and the existing
NONTEMPLATE_UNITS loop.
While doing so, fix pre-existing bugs in that option list which this
change makes newly reachable (and, for the filters below, newly
relevant) after `show`:
- `-P` was documented as a bare `--privileged[Acquire privileges
before execution]` flag, which systemctl does not have. `-P NAME`
is actually short-only and equivalent to `--value --property=NAME`
(src/systemctl/systemctl.c); it now completes property names the
same way `-p`/`--property` do, and is grouped next to them instead
of sitting in `--privileged`'s old, unrelated slot.
- `-p`/`--property`, `-t`/`--type`, and `--state` all lacked the `*`
repeatability prefix, so completion stopped offering each after its
first use even though systemctl accumulates all three
(parse_property_argument()/parse_types_argument()/
parse_states_argument(), all via strv_consume()). `_loginctl`
already uses the correct `'*'{-p+,--property=}...` form for -p.
-t/--type and --state are both documented as filters that apply to
`show` specifically (man/systemctl.xml), same as -p/--property.
- `--value`, documented specifically for `show` ("When showing
properties, only print the value"), was missing from the zsh
completion entirely, though bash already completes it.
- `-M`/`--machine=` (OPTION_COMMON_MACHINE) was likewise missing,
despite directly affecting `show`'s bus transport the same way the
already-present `-H`/`--host` does; `_loginctl`/`_busctl` already
have the matching `_sd_machines`-backed spec.
Also switch both `_arguments` call sites to splice `_sys_arguments`
as `"$_sys_arguments[@]"` rather than bare, matching the prevailing
quoted-array idiom used by five other completions in this directory
(_systemd-hwdb, _userdbctl, _systemd-id128, _updatectl,
_systemd-sysupdate) and avoiding the unquoted form's behavior of
silently eliding any element that becomes empty.
Fixes#37463
This time, various commands with non-trivial requirements are handled.
So the series is shorter, but has a pattern of feature additions and
then those new features being used. The way that --help output is
formatted is changed a bit in various places. Those changes are
described in individual commits.
22 'static int help()' functions left after this.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added.
Options are now in two groups: "Common options" and Mount options". In
--help, for systemd-mount, both groups are shown. For systemd-umount, only
the first. This changes the behaviour a bit: previously, both groups were
shown together as one list. I think the new behaviour is actually a bit
better, because it makes it easier for the user to figure out that the
commands share common options and one of the commands has its private
second group. But if people think that the previous behaviour should
be restored, we could add a display options to squish the groups back
together.
--help now goes through the pager, like other commands with --no-pager.
So far, option groups were only used for display: when parsing options,
the group markers were ignored and all options within a namespace were
considered as potential matches. The group was reported in introspection
data and used as section seperator in help display. To allow a single
option namespace to be used for two commands, pipe through a nulstr with
option group names to look at when parsing options. The field is set in
the Command description and used in various option-handling contexts:
- when parsing and looking for an option, do not consider the entries
that are in the group that is not listed in the nulstr,
- when listing options in help or introspection, skip over unlisted
groups.
The verbs_find_verb and verbs_find_command helpers are adjusted to have
a consistent interface.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. --help now goes through the pager, like other
commands with --no-pager.
Also, previously, -h/--help/--version were listed in the "Commands"
section. This was cute, but recreating this in the new scheme would
be complicated. Also, it seems unnecessary. --help/--version and some
other commands terminate the program in all binaries, so they could
be considered "commands" in all cases. But we printed them together
with verbs only in a few cases. So I think it's fine to move them
back to the "Options" section. This makes the description of options
much more consistent between different programs.
This allows commands like systemd-sysext + systemd-confext to be handled
without duplicating entries in the verbs table. The basic idea is to have
the following layout in the SYSTEMD_VERBS section:
VERB_COMMAND_MARKER → "systemd-sysext", .flags = COMMAND_VERBS_SHARED
VERB_COMMAND_MARKER → "systemd-confext", .flags = COMMAND_VERBS_SHARED
VERB("status"),
VERB("merge"),
...
And then in places where we want to work on the verbs, we skip over the
verb entries with VERB_COMMAND_MARKER and COMMAND_VERBS_SHARED flag set.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The note about invocation as 'installkernel' is
kept as the footer. Verb and option column widths are kept separate, since
the verb table is very wide. --help now goes through the pager, like other
commands with --no-pager.
A separate COMMAND block is included for installkernel, but it is only
used for introspection data.
The custom halt_help() and shutdown_help() are replaced by COMMAND()
descriptions (one per command name, halt/poweroff/reboot sharing the
"halt" option namespace), and --introspect-cli is added to both parsers.
halt/poweroff/reboot now each reference their own man page name.
journal_file_open_reliably() recovers from nine distinct errors, but the
warning it emits names none of them:
systemd-journald[47980]: File /var/log/journal/95790226b8d0779f4b4797314ca986d4/user-7736.journal corrupted or uncleanly shut down, renaming and replacing.
So an administrator cannot tell an unclean journald shutdown (-EBUSY)
from real corruption (-EBADMSG), an incompatible feature flag
(-EPROTONOSUPPORT) or a failing disk (-EIO) — all of which reach this
line. The reason is known at this point, but only reachable through the
log_debug_errno() calls in journal_file_verify_header(), which are off by
default and gone by the time the warning is noticed.
Append %m so the error is part of the message. It now reads
File /run/log/journal/…/user-7736.journal corrupted or uncleanly shut down, renaming and replacing: Device or resource busy
for a file left online by an unclean journald exit, and
… renaming and replacing: No data available
for a truncated one.
Image builds create a key separate from the SecureBoot one for verity
signing. Its certificate ships inside the image as the sysext trust
anchor.
`genkey` certs had a hardcoded "SecureBoot signing key on host <fqdn of
the build machine>" CN, which describes neither that verity role nor a
meaningful hostname.
Make that name configurable with `SecureBootCertificateCommonName=`,
like mkosi's `--genkey-common-name`. That allows image build tools to
re-use `ukify genkey` for non-SB keys.
Unlike the implicit truncation for the default name, a specified one
which is too long is an error. Add a citation where that limit comes
frm.
This adds FONT_SCALE= setting in vconsole.conf,
vconsole.font_scale= kernel command line option and credential support.
When 2 or 200% is specified, the console font size will be doubled.
Closes#43273.
Create the file with open_tmpfile_linkable_at().
Write the recovery key and trailing newline to the temporary fd.
Set the final mode to 0600 before publishing it.
Link it into place with link_tmpfile_at(..., LINK_TMPFILE_SYNC).
In review it was raised that the file is often synthesized and that this
synthetization might not include all the fields, let's allow the more
recently added fields to be missing to avoid a regression in
compatibility.
As discussed in the PR, those fields can go down, so they cannot be advertised
as type COUNTER. But the type is shared for the whole family, so we need to
create a new family to keep the other ones as COUNTER and add the new ones
as GAUGE.
kernel/sched/cputime.c says above get_cpu_idle_time_us() and get_cpu_iowait_time_us():
> Note that this is partially broken due to the counter of iowait tasks that
> can be remotely updated without any synchronization. Therefore it is possible
> to observe backward values within two consecutive reads.
steal is apparently also unreliable because it is reported by the hyperviser.
So let's be cautious and report it as gauge too.
Extend the io.systemd.Basic metric families with host-level runtime
metrics: cumulative per-state CPU seconds, memory in use (MemTotal minus
MemAvailable), swap in use, the kernel's 10s pressure stall averages
(cpu/memory/io x some/full). Partitions and stacked devices are excluded
from the disk counters, since their traffic is already accounted for in
the parent device.
Also extend the TEST-74 report subtest with checks for the new metrics.
Network metrics are not added, because the service runs with
PrivateNetwork=yes, and it doesn't make sense to report stats for 'lo'.
After some back-and-forth, I settled on "CPUUsage". We use this scheme of
capitalization in other metric family names: "IPv4Public", "IPv6Public",
IPv4AddressState", "IPv6AddressState", "OSRelease" "SMBIOS" "BootID",
"CPUsOnline", "MachineID", "MachineInfo", "OSRelease",
"SMBIOS.SystemManufacturer", "TPM2.Manufacturer", "TPM2.VendorString",
"IOReadBytes", "IOReadOperations", "CGroup". The exception is
"io.systemd.cgroup.CpuUsage". I think we should treat that one as a
mistake and consider changing it to conform.
