Let's clarify that these settings only apply to stdout/stderr logging.
Always mention the journal before syslog (as the latter is in most ways
just a legacy alias these days). Always mention the +console cases too.
This addition is kept brief on purpose, since in order to write a good
generator users don't really need to grok templating/instantiation.
Fixes: #7257
This was probably a typo, since depending proxy-to-nginx.service on
itself makes no sense, but depending on the socket does.
Signed-off-by: Roland Hieber <r.hieber@pengutronix.de>
SetLinger is authorized by the PolicyKit action "set-self-linger", if it is
not passed an explicit UID.
According to comments we were determining the default UID from the client's
session. However, user processes e.g. which are run from a terminal
emulator do not necessarily belong to a session scope unit. They may
equally be started from the systemd user manager [1][2]. Actually the
comment was wrong, and it would also have worked for processes
started from the systemd user manager.
Nevertheless it seems to involve fetching "augmented credentials" i.e.
it's using a racy method, so we shouldn't have been authenticating based
on it.
We could change the default UID, but that raises issues especially for
consistency between the methods. Instead we can just use the clients
effective UID for authorization.
This commit also fixes `loginctl enable-linger $USER` to match the docs
that say it was equivalent to `loginctl enable-linger` (given that $USER
matches the callers user and owner_uid). Previously, the former would not
have suceeded for unpriviliged users in the default configuration.
[1] It seems the main meaning of per-session scopes is tracking the PAM
login process. Killing that provokes logind to revoke device access. Less
circularly, killing it provokes getty to hangup the TTY.
[2] User units may be started with an environment which includes
XDG_SESSION_ID (presuambly GNOME does this?). Or not.
It's not systemd that invokes the service internally as needed, it's
systemd-localed. Correct that.
Also, stop using the word "helper". To me a "helper" constitutes
something internal, not official API. I doubt systemd-vconsole-setup
really matches that description though, hence let's better avoid the
term.
Also, clean up some other wording, and be less imbiguous, by suggesting
a single command to apply vconsole.conf instead of two.
Follow-up for 597c25d2a7
MemoryDenyWriteExecution policy could be be bypassed by using pkey_mprotect
instead of mprotect to create an executable writable mapping.
The impact is mitigated by the fact that the man page says "Note that this
feature is fully available on x86-64, and partially on x86", so hopefully
people do not rely on it as a sole security measure.
Found by Karin Hossen and Thomas Imbert from Sogeti ESEC R&D.
https://bugs.launchpad.net/bugs/1725348
This makes each system call in SystemCallFilter= blacklist optionally
takes errno name or number after a colon. The errno takes precedence
over the one given by SystemCallErrorNumber=.
C.f. #7173.
Closes#7169.
https://www.freedesktop.org/wiki/Software/systemd/SystemUpdates/
> This document has been replaced by systemd.offline-updates(7) man page.
It's weird to visit the first "see also", and find that it is what the manpage replaces (and looks very similar). Surely we should remove this link.
This option allows restricting the shown fields in the output modes that
would normally show all fields. It allows clients that are only
interested in a subset of the fields to access those more efficiently.
Also, it makes the resulting size of the output more predictable.
It has no effect on the various `short` output modes, because those
already only show a subset of the fields.
This augments %t which already resolves to the runtime directory root, and
should be useful for units that want to pass any of these paths in
command line arguments.
Example:
ExecStart=/usr/bin/mydaemon --datadir=%S/mydaemon
Why not expose a specifier resolving directly to the configured
state/runtime/cache/log dir? Three reasons:
1. Specifiers should be independent of configuration of the unit itself,
and StateDirectory= and friends are unit configuration. See
03fc9c723c and related work.
2. We permit multiple StateDirectory= values per unit, and it hence
wouldn't be clear which one is passed.
3. We already have %t for the runtime directory root, and we should
continue with the same scheme.
This creates a second private resolve.conf file which lists the stub resolver
and the resolved acquired search domains.
This runtime file should be used as a symlink target for /etc/resolv.conf such
that non-nss based applications can resolve search domains.
Fixes: #7009
Explanation:
"Please note the login session may be limited to a stub
process or two. User processes may instead be started from their
systemd user manager, e.g. GUI applications started using DBus
activation, as well as service processes which are shared between
multiple logins of the same user."
The most glaring example being when you run commands from gnome-terminal,
or as you see nowadays, "gnome-terminal-server".
*_get_session() is still currently used (directly or indirectly) by Xorg,
Weston etc. running within the session scope. That setup is perfectly
functional, although code will be more generally useful if it is able to
run outside the session scope.[1]
[1] https://wiki.archlinux.org/index.php/Systemd/User#Xorg_as_a_systemd_user_service
Re-order the man pages a bit at the same time. This is to avoid having the
first and titular entry introduce the session concept, and then immediately
try and persuade you not to use it :).
Zbigniew Jędrzejewski-Szmek
Lennart Poettering
Yu Watanabe
Roland Hieber
Alan Jenkins
Shuang Liu
Boucman
tblume
John Lin
Alessandro Ghedini
Shawn Landden
Lars Karlitski
Dimitri John Ledkov