In some environments, such as a LXD container, the netns setup might
fail because ip netns exec fails trying to mount /sys:
$ systemd-detect-virt
lxc
$ ip link add dummy-test-exec type dummy
$ ip netns add test-execute-netns
$ ip netns exec test-execute-netns ip link add dummy-test-ns type dummy
mount of /sys failed: Operation not permitted
If this setup fails, test_exec_networknamespacepath will fail, so check
the exit codes for these setup calls and skip the test if necessary.
This partially reverts commit 9ca133e97a.
Not only there is no reason to introduce a new transaction failure state,
but also the commit introduces several severe issues.
Fixes#30776, #30779.
- fix indentation,
- drop incorrect comment, dns_packet_ede_rcode() can handle unknown EDE rcode.
- 0 is a valid EDE rcode,
- DnsTransaction.answer_ede_msg may be NULL, so needs to use strempty()
on logging,
- drop redundant ede_rcode temporary variable.
Follow-up for ac6844460c.
This makes the following:
- make dns_packet_ede_rcode() return -EINVAL when EDE code not found.
Otherwise, the caller may be confused that the packet has an unknown
error code.
- make the function escape EDE message only when non-utf8 message is received.
- the message handling logic is applied even if the error code is unknown, as
there is no reason that we escape EDE message only when an known error code
is received.
- reduce scope of variables,
- drop redundant 'else',
- append full stop to the log messages,
- drop redundant log message in the caller,
- split out error in the function and returned EDE error code.
Follow-up for ac6844460c.
We had both uid-range.h and uid-alloc-range.h. The latter now contains helpers
like {uid,gid}_is_{system,dynamic,container}(), uid_for_system_journal(), so
the existing name is outdated. I think the uid-range.[ch] should stay separate
because it has a bunch of helpers for parsing and printing of uid ranges. So
let's rename as in $subject to better reflect the contents of the file and make
the two sets of files harder to confuse.
We don't "uncapitalize" parts of an already-capitalized name when concatenating
words. In particular, we had UidRange in basic/uid-range.h and UGIDAllocationRange
in basic/uid-alloc-range.h, which is annoying.
that way clients can distinguish whether there is no cid or whether
hostnamed doesn't support it nicely, by just looking if the prop exists
(but is null) or not.
This is similar how we already handle all other props in the JSON
record.
When we run in a container we should show our own system's info, not the
hosts hence suppress this info in that case.
This matches the behaviour of most other calls in hostnamed to expose
system properties.
man:
- `verify` requires an argument
- `security` does not require an argument
- `fdstore` requires an argument
- `image-policy` requires an argument
`--help` text:
- missing `image-policy` command
- `cat-config` requires NAME or PATH
Some of these checks before bitwise operations are redundant and compilers
do not always recognize them, so let's simplify the code to make the intentions
clearer.
mkdir_p() uses the specified access mode for all dirs that are missing,
hence if we call it on /run/systemd/nspawn/locking and
/run/systemd/nspawn/ doesn't exist yet, we#d create it 0700 here. But
that was never the intention, and all other code creating that dir sets
the mode to 0755. Fix this here to match the rest.
To make things symmetric to the $SYSTEMD_SSH logic that the varlink
transport supports, let's also honour such a variable in sd-bus when
picking ssh transport.
This uses openssh 9.4's -W support for AF_UNIX. Unfortunately older versions
don't work with this, and I couldn#t figure a way that would work for
older versions too, would not be racy and where we'd still could keep
track of the forked off ssh process.
Unfortunately, on older versions -W will just hang (because it tries to
resolve the AF_UNIX path as regular host name), which sucks, but hopefully this
issue will go away sooner or later on its own, as distributions update.
Fedora is still stuck at 9.3 at the time of posting this (even on
Fedora), even though 9.4, 9.5, 9.6 have all already been released by
now.
Example:
varlinkctl call -j ssh:root@somehost:/run/systemd/io.systemd.Credentials io.systemd.Credentials.Encrypt '{"text":"foobar"}'
If we invoke our own varlink implementation we'll turn on O_NONBLOCK
right-away again, hence there is little point in turning it off,
however, I generally think we probably should always path this fd as
blocking, since that is the default after all, and invoked processes
might want to use it like that.
Or to see this differently: I think the varlink fd passed for activation
in many ways is similar to and as fundamental as stdin/stderr/stdout,
hence should probably be synchronous by default.
When using the `--image` or `-E` options, `arg_exclude_prefixes` is extended via
the `exclude_default_prefixes` function, which calls `strv_extend_strv`, adding
values using `strdup` that must be freed on exit.
Also changing `arg_include_prefixes` to use the same model, although there is no
leak here.
Lennart Poettering
Nick Rosbrook
Mike Yuan
Antonio Alvarez Feijoo
Yu Watanabe
Luca Boccassi
Zbigniew Jędrzejewski-Szmek
AtariDreams