Then, added explanations for the missing arguments. Also mentioned that
the memfd is sealed by the function.
(cherry picked from commit 20604d980057da1a606339fb7a660242e8d2db02)
A verity signature partition carries a JSON object that must be followed by
NUL bytes only, up to the end of the partition (dissect refuses anything
else). The split-out artifact repart generates for it however is trimmed of
that padding since b54ef83414, so that it is a plain JSON text file (which
jq nowadays insists on).
sysupdate installs such a file into a partition by simply writing it at the
partition's offset, leaving whatever follows in place. Hence, once a shorter
signature (e.g. after rotating to a different key type) is installed into a
partition that previously held a longer one, the tail of the old signature
survives right after the new JSON object, and the partition becomes
unparsable.
Add a new PartitionZeroFill= boolean setting to the [Target] section, which
makes the importer continue writing zeroes up to the end of the partition
once the payload has been written, by passing --zero-fill= to systemd-import
and systemd-pull. It defaults to off, except for verity signature partitions
(which are tiny, hence this is cheap) where it defaults to on.
Fixes: #43567
(cherry picked from commit d3b6d765a5b320d6d864591c6a7b87e1047d0c78)
Before this commit, if you attach a portable service using a profile
that doesn't exist, it just doesn't add the profile dropin and no
warning nor anything is shown:
$ portablectl attach -p nonexistent xxx
(Matching unit files with prefix 'xxx'.)
Created directory /etc/systemd/system.attached.
Created directory /etc/systemd/system.attached/xxx-capsule.service.d.
Written /etc/systemd/system.attached/xxx-capsule.service.d/20-portable.conf.
Copied /etc/systemd/system.attached/xxx-capsule.service.
Created symlink /etc/portables/xxx.raw → /var/lib/portables/xxx.raw.
$ ls /etc/systemd/system.attached/xxx-capsule.service.d/
20-portable.conf
The 10-profile.conf is not added.
If no profile is attached, the /run bind mount is not added and then lot
of things inside fail in ways that don't make sense.
This patch just makes portable_attach() and reattach check the profile
exists. If it doesn't exist, it shows this error now:
# portablectl -p doesntexists reattach xxx
(Matching unit files with prefix 'xxx'.)
ReattachImage failed: Profile 'doesntexists' does not exist, refusing. (Available profiles are: default, nonetwork, strict, trusted)
In reattach we do it early, before detach, so we don't detach and then
fail to attach it and leave the service detached.
An empty profile name is rejected too by the call to
filename_is_valid(). portablectl already rejects empty profile names.
Please note that we don't change install_profile_dropin(), as that skips
non-existing profiles because that is done at the unit type level and
it's okay if it doesn't exist for some unit types. For example,
/usr/lib/systemd/portable/profile/trusted/ ships a service.conf, but not
timer.conf, socket.conf, etc.
(cherry picked from commit 5642eb3d848300f7225dff25fdd82940e55101c9)
UKI/SignInitrdPCRs was added together with --sign-initrd-pcrs, but only
that command-line option is documented. Document the configuration key
and move the entry to the [UKI] section.
Fixes#43863.
(cherry picked from commit 4f8ca5032fd0633c6b5caff4868a375ac91b5b0f)
It was added as experimental in v255: "this component is experimental and
its public interface is subject to change". This status was never changed
and the meson config still disables vmspawn by default in non-developer
builds. I think this makes sense to keep things this way and remove all
experimental markings at once with an official announcement once we're
sure about the interface.
(cherry picked from commit f2323da4da8c3311b855f505cdddc66400c501ee)
The text implied that the changes may happen randomly at any time.
Obviously, they can only happen after an update, but also we're unlikely
to do that not on a major release boundary. So town down that part of the
message. At the same time, it's important that the change might just
happen. For stable features, we also sometimes implement incompatible
changes, but this is preceded by announcements and lengthy deprecation
periods. So use the phrase "without advance notice".
OTOH, the text implicitly promised future stabilization. This might or
might not happen, so remind the users that it might not.
(cherry picked from commit 96cb6a5c74c8cd64334c48ddcca18e128e9a40ea)
The blurbs were added to be shared, but no sharing was actually
done.
Also, rename "singular"/"plural" to "option"/"options", so that we
can later have "component"/"components" and possibly other
variants.
The text were a bit different in various places, but I don't think
it was a useful distinction.
(cherry picked from commit 69dd30fddf2bbf358e05a632b0ef3383eb46b028)
The metric list is built with conf_files_list_strv(), but each metric's
value is then looked up again by walking report_files_dirs[] by hand,
and the two disagreed whenever an earlier directory had an entry that is
not a regular file:
- conf_files_list_strv() skipped such an entry and listed the one from
a later directory, so the metric was advertised by Describe();
- file_metric_generate() only moved on to the next directory on
-ENOENT, so it hit the non-regular entry, logged a warning and
produced nothing.
The practical case is masking a vendor-supplied entry with a symlink to
/dev/null: the metric kept being described, was never listed, and every
scrape logged "Failed to open ..., skipping: File descriptor in bad
state".
Honour masks in the enumeration via CONF_FILES_FILTER_MASKED_BY_SYMLINK,
as other conf dirs do, and make the lookup skip non-regular entries the
same way the enumeration does. Document the masking in the man page and
cover both cases in TEST-74-AUX-UTILS.report.
(cherry picked from commit 08be8677539642f45c6127085283cf08b6a410b7)
cgroupfs has a single shared global superblock but
programs running in managed user namespaces still
need to be able to write it to make cgroup delegation
work. d381a0d9d5 broke
this by insisting the user namespace owns the
superblock. Let's fix this by excluding cgroupfs from
this check.
(cherry picked from commit 889bc48f101a7cbb56cb4be202e85e1f6d933151)
If KExecsCount > 0 then do not attempt to mark a UKI, as the stub (and also
any addon and the bootloader) will not have been exercised, so there's no
guaranteed a full reboot with the same image will actually work.
Fixes https://github.com/systemd/systemd/issues/43738
(cherry picked from commit 06c2dfa73c)
-ENODATA is returned when the message carries no (reply) cookie, but the
text stated the message "carries a reply cookie field". Say it does not
carry one.
- It does not accept NUL for type.
- ret_size is zero and ret_ptr is non-NULL when it returns positive.
- Fixed argument names: ptr -> ret_ptr, size -> ret_size.
Similar as the previous commit: the field was renamed by accident, and
we should revert to the old name to not break compat needlessly, and
because the old name actually made sense, given the underlying .transfer
file knob is AppStream=
The "isEnabled" name was changed from "enabled" post v261 by accident
(because a6f7ded859 replaced json
formatting via table formatter to a native json generator which was
introduced for varlink, which changed the names). THis was later made
official in #43603, but it should rather have changed things back to the
original name, in particular as the underling .feature file field
actually is called "Enabled=" and not "IsEnabled=".
We really should take care to generate the same names for Varlink JSON
data as for the data returned by the systemd-sysupdate cli.
a6f7ded859 ensured that, so that's great.
But at the same time I think the varlink names should be adjusted to the
old names, since varlink support for this was just added in this cycle.
Given that v262 is not tagged yet, let's now revert to the old name.
The `systemd-nspawn` manpage says:
The `--private-users-ownership=auto` option is implied if
`--private-users=pick` is used.
This is true for the CLI, but not when set in a `.nspawn` file.
Assuming these defaults should be the same across both.
This default was also not updated when `managed` was added by #35685.
As a result, this is a change in behavior for users who didn't set an
explicit `PrivateUsersOwnership=` value in their `.nspawn` file.
## Summary
Clarify `ConditionPathExists=` in `systemd.unit(5)`:
- It checks for any filesystem object (regular file, directory, device
node, FIFO, socket), not only regular files.
- Symbolic links are followed, so a broken symbolic link is not
considered to exist.
Fixes#41900
This updates a couple of links talking about Varlink:
1. anything that refers to specific Varlink concepts now point to the
UAPI.20 spec
2. More general references to Varlink as a whole point to both the
varlink.org domain and the spec.
## Summary
`updatectl features` failed because it expected the old feature JSON
fields,
while `systemd-sysupdate` now returns `id`, `isEnabled`, and
`documentation`
as an array.
This change:
- Aligns `updatectl` with the current feature JSON schema.
- Unifies JSON output between `systemd-sysupdate`, D-Bus, and Varlink.
- Adds support for multiple `Documentation=` entries for Features and
Components.
- Exposes and parses `appstream` and `suggested` metadata.
- Propagates condition-evaluation errors through `condition_test_list()`
and
`feature_is_suggested()`.
- Reports suggestion-evaluation failures instead of silently treating
them as
`false`.
- Improves JSON dump error handling.
- Expands `TEST-72-SYSUPDATE` coverage and fixes its unknown-field
assertion.
- Documents the `DescribeFeature()` JSON field transition in `NEWS`.
- Keeps the existing Component name list for `sysupdated` compatibility.
The `name`/`enabled` to `id`/`isEnabled` transition is intentional and
documented as a v262 payload change.
Fixes#43603
The feature JSON payload switched to `id`, `isEnabled`, and `appstream`,
and made `documentation` an array of URLs.
`updatectl` still parsed legacy table-derived names and a single URL.
This broke feature JSON parsing and made output inconsistent.
Features without documentation could also cause a null dereference.
Align `updatectl` with the current schema and preserve all
documentation URLs across sysupdate, D-Bus, and Varlink payloads.
Propagate condition evaluation errors through `condition_test_list()`
and `feature_is_suggested()`, with consistent JSON error handling and
tests.
The `suggested` field is now optional and always a boolean when
present; it is omitted rather than set to an error string when
SuggestOn*= conditions cannot be evaluated.
Add `suggested` metadata and document the field transition.
Follow-up for 3e34ccf6df.
Follow-up for 75a247d4de.
Follow-up for 40e727c93b.
Fixes#43603
--recursive=no is not silently ignored when all tasks are counted,
as claimed: cgtop rejects it with an error unless -P or -k is used,
since task counting is always recursive. Also document that --cpu
without an argument is equivalent to --cpu=time.
The new unit is nice, but it might not be appropriate in all scenarios. It
requires a new kernel, which might be known to not be available, and also
changes sysctl kernel.core_pattern at runtime, which might not be desired.
Replace static enablement by a normal [Install] section and add the unit
to presets to enable it by default.
The awkward instructions in the man page are simplified and adjusted.
The PolicyPCR digest is not always the complete input to an offline
signature. PolicyAuthorize also includes the hashed policy reference.
This is now required for NVPCRs to work in the initrd.
Expose the complete data as "tbs" (to-be-signed) and use it when ukify
matches offline signatures. Keep "pol" as the compatibility fallback.
Fixes: https://github.com/systemd/systemd/issues/43635
Follow-up for f0f3687700
When --sign-initrd-pcrs is used with --policy-digest, generate the
extra enter-initrd policy with the "initrd" policy reference. This
matches the policy produced when ukify signs with a private key.
Fixes building UKIs with offline signing (e.g.: on OBS) and using
NVPCRs.
Follow-up for f0f3687700
Since the D-Bus DNS-SD API was introduced in c3036641f0ed (v236),
`RegisterService()` has created an `sd_bus_track` object to destroy the
registered service when the registering client disconnects from the bus.
However, the track object is a `_cleanup_(sd_bus_track_unrefp)` local in
`bus_method_register_service()` that is never stored anywhere, so it is
destroyed again as soon as the method handler returns. The vanish
handler (`dnssd_registered_service_on_bus_track()`) has thus been dead
code for the past ~8 years.
The observable effect: services registered via D-Bus silently persist
after the client disconnects — unowned, advertised until resolved exits,
and impossible to re-register since the identifier stays taken
(`DNSSD_SERVICE_EXISTS`). At the same time, the registration doesn't
survive a resolved restart, so the current behavior is neither reliably
ephemeral nor reliably persistent. Noticed while reviewing a project
that (unknowingly relying on this bug) registers a service with a
one-shot `gdbus call` and expects it to persist.
This PR:
1. splits the goodbye/zone-removal logic out of
`bus_dnssd_method_unregister()` into a helper — the vanish path needs
the full teardown, not just `dnssd_registered_service_free()`, which
would leave the service's RRs published in the per-link mDNS zones;
2. stores the track object in `DnssdRegisteredService`, making client
tracking work as originally intended;
3. documents the lifetime semantics in `org.freedesktop.resolve1(5)`
(matching the equivalent Avahi D-Bus API, whose entry groups are
likewise bound to the client connection) and points to `*.dnssd` files
for registrations independent of a client's lifetime;
4. adds a TEST-75 case covering the connection-bound lifetime.
Note this is a behavioral change for fire-and-forget clients (one-shot
`busctl`/`gdbus` invocations). Arguably those were never working
reliably (registrations silently vanished on any resolved restart, and
stale entries blocked re-registration), but if this is deemed too risky,
the alternative would be to drop the dead tracking code and codify the
persist-until-exit behavior instead — I'd argue tracking as originally
intended is the better contract.
Verification: code compiles; the new integration test is included.
Since the D-Bus DNS-SD API was introduced in c3036641f0 ("resolved:
implement D-Bus API for DNS-SD", v236), RegisterService() has set up an
sd_bus_track object so that a registered service is destroyed when the
client that registered it disconnects from the bus — there's even a
handler logging "Client of active request vanished, destroying DNS-SD
service."
However, the track object was never stored anywhere: it is declared as
a _cleanup_(sd_bus_track_unrefp) local in bus_method_register_service()
and hence destroyed again when the method handler returns, taking the
tracking down with it. The vanish handler was thus dead code, and
services registered via D-Bus silently persisted after their client
disconnected — unowned, impossible to re-register (the identifier
stays taken, failing with DNSSD_SERVICE_EXISTS), and advertised until
systemd-resolved itself exited.
Store the track object in DnssdRegisteredService, pinning it for the
lifetime of the service, so that client tracking works as originally
intended. Route the vanish path through the full unregistration logic
(goodbye packets + removal from the per-link mDNS zones), since freeing
the service alone would leave its RRs published in the zones.
Note for fire-and-forget clients (e.g. one-shot busctl/gdbus calls):
these were never reliable — the registration silently vanished on any
resolved restart — and now behave as documented for the corresponding
Avahi API as well: the bus connection must be kept open for as long as
the service is to remain registered. Document that in the man page and
NEWS, and point to *.dnssd files for registrations independent of a
client's lifetime.
Describe the system-wide W^X rule and the new proc_mem.force_override=never
and seccomp prerequisites, and drop the advice to block writable and
executable mappings by other means, which the policy now does itself.
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
The petnames wordlist added in [1] is Apache-2.0 and this
causes problems with the distribution of systemd as the
GPL-2 and Apache-2.0 are considered incompatible by the FSF.
So this commit replaces the previous wordlist with
a new one:
- weather (basic english weather adjectives)
- colors (basic english color names)
- worlds (planets, moons, minor bodies of the solar system)
All common vocabulary and compiled for this project, not taken
from anywhere.
An example with the new list:
- wintry-rust-dione-9393
- warm-yellow-saturn-39f9
The "worlds" are picked on the following principles:
- well-known
- memorable
- short(ish)
- cool
This is why e.g. we have "thetis" (an astroid) instead of
"tethys" (a moon): easier to spell and more well known.
[1] https://github.com/systemd/systemd/pull/42566
Use the new copy timestamp clamping mechanism from the previous commit
to fix unreproducible wall-clock files in the generated images.
That covers both modes: online mode writes through the kernel, and
offline mode stages the tree in a temporary directory before handing it
to mkfs or mcopy. `mcopy -m` then carries the clamped mtimes into the
FAT.
This complements commit 34c3d57474 (directory times) and commit
f191ca982c (FAT insertion order).
Cover all combinations (online/offline, with and without epoch) in the
new `testcase_vfat_reproducibility()`. Update `testcase_make_symlinks()`
to cover the symlink creation/re-fix their parent directory code paths.
Sadly, images are still not reproducible byte for byte. Document
systemd-repart's $SOURCE_DATE_EPOCH handling and remaining
reproducibility issues in the manpage.
When a partition is deleted from a table containing multiple partitions
of the same type, filling the resulting partition-number gap can place
a new partition before an existing partition matched to an earlier
definition. This changes definition matching on the next invocation and
breaks idempotency.
Keep new partitions after existing partitions of the same type. If no
partition table slot is available after them, fall back to the first
unused slot.
Which existing partition is matched to which definition is still
determined by partition type and partition number order, as documented,
and is unchanged by this.
Fixes#43449
When an administrator installed a custom keyring under /etc,
signature verification selected it instead of the vendor keyring
under /usr. That could make vendor-signed system updates stop
verifying after adding local keys.
Collect all readable default keyrings, including the current and
legacy /etc paths, and pass temporary copies to GnuPG with
separate --keyring options. Keep SYSTEMD_OPENPGP_KEYRING as an
explicit override, add regression coverage for keyring
coexistence, override behavior, and current-path signing, and
silence the expected shellcheck false positive in the test
cleanup helper.
Closes: #40702
Yu Watanabe
Lennart Poettering
Rodrigo Campos
vidir-semaphor
Jonghyun An
Zbigniew Jędrzejewski-Szmek
Armaan Sandhu
iacopo
Daan De Meyer
Luca Boccassi
Cathal Mullan
KingPointer
Zbigniew Jędrzejewski-Szmek
dongshengyuan
tunaichao
benkigeek
Ivan Kruglov
Stefan Agner
Christian Brauner
Fabian Vogt
Michael Vogt
Martin Pitt
quanyeyang
zouge666