This new setting is supposed to be useful in most cases where
"MountFlags=slave" is currently used, i.e. as an explicit way to run a
service in its own mount namespace and decouple propagation from all
mounts of the new mount namespace towards the host.
The effect of MountFlags=slave and PrivateMounts=yes is mostly the same,
as both cause a CLONE_NEWNS namespace to be opened, and both will result
in all mounts within it to be mounted MS_SLAVE. The difference is mostly
on the conceptual/philosophical level: configuring the propagation mode
is nothing people should have to think about, in particular as the
matter is not precisely easyto grok. Moreover, MountFlags= allows configuration
of "private" and "slave" modes which don't really make much sense to use
in real-life and are quite confusing. In particular PrivateMounts=private means
mounts made on the host stay pinned for good by the service which is
particularly nasty for removable media mount. And PrivateMounts=shared
is in most ways a NOP when used a alone...
The main technical difference between setting only MountFlags=slave or
only PrivateMounts=yes in a unit file is that the former remounts all
mounts to MS_SLAVE and leaves them there, while that latter remounts
them to MS_SHARED again right after. The latter is generally a nicer
approach, since it disables propagation, while MS_SHARED is afterwards
in effect, which is really nice as that means further namespacing down
the tree will get MS_SHARED logic by default and we unify how
applications see our mounts as we always pass them as MS_SHARED
regardless whether any mount namespacing is used or not.
The effect of PrivateMounts=yes was implied already by all the other
mount namespacing options. With this new option we add an explicit knob
for it, to request it without any other option used as well.
See: #4393
Currently the completion adds template units for commands such as
is-active, is-failed, is-enabled, status, show and others.
At the same time systemctl barfs at us, since an instanced template unit
is needed. Follow the example list from bash-completion as to which
commands should not list template units.
Note: The above is observed regardless of DefaultInstance.
Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
Template units lacking DefaultInstance cannot be enabled/disabled or
started/restarted.
By adding DefaultInstance the unit can be enabled/disabled but it
still cannot be started/restarted.
Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
Earlier patch added the current word to the performance critical paths.
Here we add it to every place, for consistency sake.
Suggested-by: Yu Watanabe (yuwata)
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
This effectively ports over b1bdb6496c
from the bash completion to zsh.
Modulo the new function, since it's unrelated perf. improvement.
Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
Using a leading * and $SUFFIX produces misleading results. Let's imagine
that one mistypes nect instead of netc, they will get a rather
misleading completion like: sys-fs-fuse-connections.mount
Not to mention that the execution time is up by ~1/3.
time systemctl list-unit-files netctl* -> ~12ms
time systemctl list-unit-files *netctl* -> ~17ms
Furthermore more units are matched, leading to greater execution time
of `systemctl show' in _filter_units_by_property
Use only $PREFIX*, removing the leading * and trailing $SUFFIX*.
Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
Pass the partial name of the unit file to list-unit-files and
list-units. This allows for faster completion, since systemctl does
not need to list all the unit files.
For reference:
- time systemctl list-unit-files -> ~200ms
- time systemctl list-unit-files netctl* -> ~15ms
- time systemctl list-units -> ~5ms
- time systemctl list-units netctl* -> ~5ms
While the list-units time itself is unaffected, now a shorter list is
produced. Thus as we pass it to `systemctl show' (via
__filter_units_by_properties) the execution time will be decreased even
further.
v2: Update list-units hunk in commit message, add quotes around $2*
v3: Remove funky indentation, quote all $cur instances
Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
This drops needless safety checks that ensure we only reference block
devices for blockio/io settings. The backing code was already able to
accept regular file system paths too, in which case the backing device
node of that file system would be used. Hence, let's drop the artificial
restrictions and open up this underlying functionality.
We document the rule that return values >= 0 of functions are supposed
to indicate success, and that in case of success all return parameters
should be initialized. Let's actually do so.
Just a tiny coding style fix-up.
../src/test/test-sizeof.c: In function ‘main’:
../src/test/test-sizeof.c:70:24: error: result of ‘1 << 31’ requires 33 bits to represent, but ‘int’ only has 32 bits [-Werror=shift-overflow=]
X = (1 << 31),
^~
cc1: some warnings being treated as errors
Follow-up for b05ecb8cad.
Jun 11 14:29:12 krowka systemd[1]: /etc/systemd/system/workingdir.service:6: = path is not normalizedWorkingDirectory: /../../etc
↓
Jun 11 14:32:12 krowka systemd[1]: /etc/systemd/system/workingdir.service:6: WorkingDirectory= path is not normalized: /../../etc
Since bb28e68477 parsing failures of
certain unit file settings will result in load failures of units. This
introduces a new load state "bad-setting" that is entered in precisely
this case.
With this addition error messages on bad settings should be a lot more
explicit, as we don't have to show some generic "errno" error in that
case, but can explicitly say that a bad setting is at fault.
Internally this unit load state is entered as soon as any configuration
loader call returns ENOEXEC. Hence: config parser calls should return
ENOEXEC now for such essential unit file settings. Turns out, they
generally already do.
Fixes: #9107
These states should never be visible to the outside, as they are used
only internally while loading unit. Hence let's drop them from the
documentation.
The load_error is only valid in some load_state cases, lets generate
prettier messages for other cases too, by reusing the
bus_unit_validate_load_state() call which does jus that.
Clients (such as systemctl) ignored LoadError unles LoadState was
"error" before. With this change they could even show LoadError in other
cases and it would show a useful name.
Let's use a switch() statement, cover more cases with pretty messages.
Also let's rename it to "validate", as that's more specific that
"check", as it implies checking for a "valid"/"good" state, which is
what this function does.
This makes two changes: first of all we will now explicitly check
whether a domain to test against an NSEC record is actually below the
signer's name. This is relevant for NSEC records that chain up the end
and the beginning of a zone: we shouldn't alow that NSEC record to match
against domains outside of the zone.
This also fixes how we handle NSEC checks for domains that are prefixes
of the NSEC RR domain itself, fixing #8164 which triggers this specific
case. The non-wildcard NSEC check is simplified for that, we can
directly make our between check, there's no need to find the "Next
Closer" first, as the between check should not be affected by additional
prefixes. For the wild card NSEC check we'll prepend the asterisk in
this case to the NSEC RR itself to make a correct check.
Fixes: #8164
Lennart Poettering
Michael Biebl
Zbigniew Jędrzejewski-Szmek
Iwan Timmer
Michal Sekletar
Emil Velikov
Bruno Vernay
xginn8