Commit Graph
65358 Commits
Author SHA1 Message Date
Lennart Poettering 43b49c0f14 resolvectl: fix double free issue
Follow-up for: #28012

Addresses these: https://github.com/systemd/systemd/pull/28012#issuecomment-1590889386
2023-06-14 18:31:32 +02:00
Lennart Poettering c4ccb80e39 bootctl: warn if the ESP random seed is stored on a world-readable dir
This takes heavy inspiration from @zx2c4 (Jason A. Donenfeld)'s
PR #25531 but changes it considerably, but always going by fd instead of
paths, and only warning about the side file itself and the ESP mount
point, nothing else. This shuld be more than enough and should not be
brittle against concurrent path modifications.

Replaces: #25531
2023-06-14 18:00:24 +02:00
Zbigniew Jędrzejewski-Szmek 2b8628c704 Merge pull request #27946 from keszybz/ukify-genkey-verb
Add 'genkey' verb to ukify
2023-06-14 17:57:24 +02:00
Frantisek Sumsal 9352db7abb coverage: fix build with g++
Guard the coverage-related shenanigans from g++ when building the one
C++ unit test we have, so we don't have to make it C++ compatible:

[1573/2109] Compiling C++ object test-bus-vtable-cc.p/src_libsystemd_sd-bus_test-bus-vtable-cc.cc.o
FAILED: test-bus-vtable-cc.p/src_libsystemd_sd-bus_test-bus-vtable-cc.cc.o
ccache c++ -Itest-bus-vtable-cc. ... -c ../src/libsystemd/sd-bus/test-bus-vtable-cc.cc
In file included from <command-line>:
../src/basic/coverage.h:17:15: error: ‘_Noreturn’ does not name a type
   17 | static inline _Noreturn void _coverage__exit(int status) {
      |               ^~~~~~~~~
../src/basic/coverage.h:46:29: error: conflicting declaration of ‘int _coverage_execveat(int, const char*, char* const*, char* const*, int)’ with ‘C’ linkage
   46 | #define execveat(d,p,a,e,f) _coverage_execveat(d, p, a, e, f)
      |                             ^~~~~~~~~~~~~~~~~~
../src/basic/coverage.h:34:19: note: previous declaration with ‘C++’ linkage
   34 | static inline int _coverage_execveat(
      |                   ^~~~~~~~~~~~~~~~~~
../src/basic/coverage.h:46:29: error: declaration of ‘int _coverage_execveat(int, const char*, char* const*, char* const*, int) noexcept’ has a different exception specifier
   46 | #define execveat(d,p,a,e,f) _coverage_execveat(d, p, a, e, f)
      |                             ^~~~~~~~~~~~~~~~~~
../src/basic/coverage.h:34:19: note: from previous declaration ‘int _coverage_execveat(int, const char*, char* const*, char* const*, int)’
   34 | static inline int _coverage_execveat(
      |                   ^~~~~~~~~~~~~~~~~~
../src/basic/coverage.h:58:24: error: conflicting declaration of ‘int _coverage_execvpe(const char*, char* const*, char* const*)’ with ‘C’ linkage
   58 | #define execvpe(f,a,e) _coverage_execvpe(f, a, e)
      |                        ^~~~~~~~~~~~~~~~~
../src/basic/coverage.h:48:19: note: previous declaration with ‘C++’ linkage
   48 | static inline int _coverage_execvpe(
      |                   ^~~~~~~~~~~~~~~~~
../src/basic/coverage.h:58:24: error: declaration of ‘int _coverage_execvpe(const char*, char* const*, char* const*) noexcept’ has a different exception specifier
   58 | #define execvpe(f,a,e) _coverage_execvpe(f, a, e)
      |                        ^~~~~~~~~~~~~~~~~
../src/basic/coverage.h:48:19: note: from previous declaration ‘int _coverage_execvpe(const char*, char* const*, char* const*)’
   48 | static inline int _coverage_execvpe(
      |                   ^~~~~~~~~~~~~~~~~
[1582/2109] Compiling C object test-event.p/src_libsystemd_sd-event_test-event.c.o
ninja: build stopped: subcommand failed.
2023-06-14 16:44:57 +02:00
Christoph Anton Mitterer 14941724ec sleep-config: add comment about security
Adds information about attacks that might become possible when the hibernate
location is automatically determined.
2023-06-14 15:27:41 +02:00
Lennart Poettering f66d040d95 Merge pull request #28032 from poettering/mumumµ
deal with µ unicode ambiguities
2023-06-14 14:00:10 +02:00
Zbigniew Jędrzejewski-Szmek 814e4d7a67 ukify: make the certficate validity configurable
Requested in https://github.com/systemd/systemd/pull/27946/commits/4cc743319ae378d458050d6e0cfdeaa03addd379#r1228592001
2023-06-14 13:18:00 +02:00
Zbigniew Jędrzejewski-Szmek a3f758b310 man/ukify: add structure to describe verbs, document genkey
This just adds two paragraphs of text, but moves a lot of the text
one level down into a subsection.
2023-06-14 13:18:00 +02:00
Zbigniew Jędrzejewski-Szmek 13a29b0efb test_ukify: skip test requiring cryptography
I'll add the dep in Fedora spec so it does get tested at least
in some cases.
2023-06-14 13:18:00 +02:00
Zbigniew Jędrzejewski-Szmek 27140fc7d1 man: add example how to configure automatic signing
Fixes #978.
2023-06-14 13:18:00 +02:00
Zbigniew Jędrzejewski-Szmek ff7580e280 test_ukify: cleanups suggested by pylint 2023-06-14 13:18:00 +02:00
Zbigniew Jędrzejewski-Szmek a1c80efddc ukify: add 'genkey' verb
The idea is to make it easy to generate all the signing key and certs
that can be used for local signing. The verb is the modeled after
'mkosi genkey', but there are some important differences: we generate
the keys to the paths where they will be read from, both pcr signing
keys and the SecureBoot certificate+key.

If any of the outputs exist, operation is refused. Maybe we could add a
--force option in the future, but this operation should be rare, so I think
it's better to refuse to overwrite anything initially.

I'm only doing a token man page change here.
https://github.com/systemd/systemd/pull/27621 reworks the man page,
and the changes done here would conflict heavily with that work. I'll
submit a follow-up patch later.
2023-06-14 13:17:33 +02:00
Lennart Poettering 2d0855154f bootctl: fix docs/--help to say that "bootctl random-seed" not just initializes but also refreshes ESP random seeds 2023-06-14 11:58:37 +01:00
Lennart Poettering d754cdc994 Merge pull request #28012 from poettering/resolvectl-dump-cache
add "resolvectl show-cache" call and IPC backend for that
2023-06-14 10:33:13 +02:00
Lennart Poettering e503019bc7 tree-wide: when in doubt use greek small letter mu rather than micro symbol
Doesn't really matter since the two unicode symbols are supposedly
equivalent, but let's better follow the unicode recommendations to
prefer greek small letter mu, as per:

https://www.unicode.org/reports/tr25
2023-06-14 10:23:56 +02:00
Lennart Poettering d0a6d7c4d1 time-util,socket: accept both kinds of unicode µ symbols
Apparently there are two µ symbols, accept both when parsing.

One is the greek small letter mu (μ) the other is the micro sign (µ).
Unicode recommendation considers both equivalent, and says use of greek
small letter mu is preferred. See:

https://www.unicode.org/reports/tr25

Hence accept both when parsing.

Inspired by: #28029
2023-06-14 10:15:41 +02:00
Lennart Poettering 5bc4570fd4 Merge pull request #26728 from keszybz/meson-update
Meson version update
2023-06-13 23:38:41 +02:00
Joyce 3f2ff79763 Fix scorecard version comment format (#28027)
* Update scorecards.yml version comments

Signed-off-by: Joyce <joycebrum@google.com>
2023-06-13 22:36:32 +01:00
Lennart Poettering 18cad4ebda Merge pull request #27846 from keszybz/link-mode-generation
Autogenerate list of link modes
2023-06-13 23:03:51 +02:00
김인수 09c24f81ff po: Translated using Weblate (Korean)
Currently translated at 100.0% (193 of 193 strings)

Co-authored-by: 김인수 <simmon@nplob.com>
Translate-URL: https://translate.fedoraproject.org/projects/systemd/master/ko/
Translation: systemd/main
2023-06-13 22:53:09 +02:00
Yu WatanabeandFranck Bui 331aa7aa15 udev-node: optimize device node symlink creation
If multiple devices requested the same device node symlink with the same
priority, then previously we read O(N^2) of files saved in
/run/udev/links.

This makes if the requested symlink already exists with equal or higher
priority, then the symlink is kept, and skip to read all existing files,
except for one related to the current device node, in /run/udev/links.
Hence, the total amount of file read becomes O(N).

This improves performance of testcase_simultaneous_events_2 added by the
previous commit about 30%.
Before (32.8 sec):
```
 ## 3 iterations start: 11:13:44.690953163
 ## 3 iterations end: 11:14:17.493974927
```
After (23.8 sec):
```
 ## 3 iterations start: 11:17:53.869938387
 ## 3 iterations end: 11:18:17.624268345
```

This is based on the idea and analysis by Franck Bui.

Replaces #25839.

Co-authored-by: Franck Bui <fbui@suse.com>
2023-06-13 22:51:00 +02:00
Daniele Medri 0b75d6579b it.po: minor updates 2023-06-13 21:18:16 +01:00
Lennart Poettering c27e8cd272 Merge pull request #28020 from DaanDeMeyer/followups
Followups
2023-06-13 22:14:33 +02:00
Luca Boccassi 59936b66d1 Merge pull request #27952 from mrc0mmand/drop-TEST-61
test: merge TEST-61-UNITTESTS-QEMU with TEST-02-UNITTESTS
2023-06-13 21:13:14 +01:00
Daan De Meyer 22afd5cb2c Merge pull request #27977 from DaanDeMeyer/update-mkosi
Update mkosi
2023-06-13 16:56:54 +02:00
Anatoli Babenia 5c193a7c3c man: document "s" is default --vacuum-time= suffix 2023-06-13 16:14:30 +02:00
Daan De Meyer a6ae99363d rm-rf: Fix assertion
This doesn't cover every case but cases where people try to do
rm_rf(dir_fd, ".") are covered by unlinkat() simply failing.
2023-06-13 16:13:49 +02:00
Daan De Meyer 549a9a671a fd-util: Add extra shortcut to path_is_root_at() 2023-06-13 16:13:43 +02:00
Daan De Meyer e089efd7a7 btrfs-util: Drop redundant parentheses 2023-06-13 16:13:22 +02:00
Daan De Meyer fd9b68d925 repart: Store dm_name in DecryptedPartitionTarget
This means we don't have to do a fallible allocation in the
DecryptedPartitionTarget destructor. Also use log_warning_error_errno()
for the failure we ignore in the destructor.
2023-06-13 16:13:19 +02:00
Daan De Meyer 6aca147f82 mkosi: Remove explicit /testok check
vsock should work properly after the latest release of mkosi. But
to make sure it works, let's exit with 123 in case of success and
check for that in Github Actions.
2023-06-13 16:04:10 +02:00
Daan De Meyer abeecde242 mkosi: Update to latest
We update our configuration to replace the removed
RepositoryDirectories= option with the new PackageManagerTrees=
option.
2023-06-13 16:04:08 +02:00
Daan De Meyer 33d960cbed mkosi: Make sure we build custom kernels with EROFS support 2023-06-13 15:42:17 +02:00
Daan De Meyer 63e5ee4096 mkosi: Add bpftool to final image
Useful for debugging bpf.
2023-06-13 15:42:17 +02:00
Daan De Meyer 569bbc1f43 mkosi: Add socat to the final image
Useful for debugging vsock stuff
2023-06-13 15:42:17 +02:00
Daan De Meyer 17f5942f8a Merge pull request #28010 from DaanDeMeyer/vsock-type
Vsock improvements
2023-06-13 15:41:58 +02:00
David Tardon 1b6e11f58d udevadm-control: fix error message
Extracted from #25523 by Lennart.
2023-06-13 15:31:29 +02:00
Daan De Meyer 7f78d3431b sd-daemon: Add vsock fallback to SOCK_STREAM
SOCK_SEQPACKET is only supported on recent kernels. Let's add a
fallback to SOCK_STREAM if it is not supported.

To accomodate SOCK_STREAM, we also modify
pid_notify_with_fds_internal() to do sendmsg() in a loop as with
SOCK_STREAM, sendmsg() is not guaranteed to write all data in a single
syscall or fail otherwise.
2023-06-13 14:24:44 +02:00
Daan De Meyer 56d02f2969 sd-daemon: Use socket type from vsock address if set
If a socket type is explicitly provided in the vsock address, let's
make sure we try only that socket type.
2023-06-13 14:24:44 +02:00
Daan De Meyer c31984e3d0 socket-util: Allow specifying socket type in vsock address 2023-06-13 14:24:44 +02:00
Lennart Poettering 768fcd779f socket: bump listen() backlog to INT_MAX everywhere
This is a rework of #24764 by Cristian Rodríguez
<crodriguez@owncloud.com>, which stalled.

Instead of assigning -1 we'll use a macro defined to INT_MAX however.
2023-06-13 14:17:25 +02:00
Lennart Poettering 39b5f49f28 Merge pull request #28014 from bluca/portable_fixes
portabled fixes
2023-06-13 13:19:02 +02:00
Lennart Poettering 05d53d529a Merge pull request #28017 from poettering/link-tmpfile-flags
teach link_tmpfile_at() to properly sync
2023-06-13 13:18:42 +02:00
Luca Boccassi 7d812d7ca1 portable: make sure to fsync after extracting/copying
Just in case we are on a flimsy filesystem/disk
2023-06-13 10:12:00 +01:00
Frantisek Sumsal fb310ba9eb test: re-enable TEST-02 on ppc64le 2023-06-13 10:15:27 +02:00
Frantisek Sumsal f087837c46 test: make sure ping works for unprivileged users 2023-06-13 10:15:27 +02:00
Frantisek Sumsal a6695a431f test: copy file xattrs (if any) as well 2023-06-13 10:15:27 +02:00
Frantisek Sumsal bdee55672a test: merge TEST-61-UNITTESTS-QEMU with TEST-02-UNITTESTS
The test was originally introduced for Ubuntu CI, as it uses
PREFER_NSPAWN=1, but it was subsequently disabled two years ago [0], so
it was pretty much useless. Let's merge it into TEST-02 and tweak it a
bit to run only certain tests under QEMU when $TEST_PREFER_NSPAWN is
set.

[0] b152adbfa9
2023-06-13 10:15:27 +02:00
Frantisek Sumsal d5a937a62a proc-cmdline: parse the whole /proc/cmdline
The kernel command line may contain newlines which kernel happily
accepts, but we'd ignore everything past the first newline. Let's fix
that by replacing read_one_line_file() with read_full_file().
2023-06-13 09:54:02 +02:00
Lennart Poettering 8dfd099b50 tree-wide: start properly syncing at various places we so far didn't
Let's better be safe than sorry, and install files fully safely now that
is is easy.
2023-06-13 09:50:10 +02:00