SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
65,852 Commits 2 Branches 1 Tag
535134bc51e2c66626796c0cd2249b52177654c7
Commit Graph
65852 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Yu Watanabe 535134bc51 network,ndisc: use correct free function for captive portal 
Fixes memleak introduced by 64de00c49f.
Fixes #28277.
 2023-07-06 20:30:22 +01:00
Luca Boccassi f00022eb86 Merge pull request #28242 from berrange/cond-sec-cvm 
Detect and expose the confidential virtualization technology in various places
 2023-07-06 19:14:26 +01:00
Luca Boccassi b9b0f338be Merge pull request #28274 from DaanDeMeyer/dissect-root 
dissect: Allow a few verbs to operate on directories as well as image files
 2023-07-06 14:41:48 +01:00
Daniel P. Berrangé 6e2e83b487 udev: add 'conf-virt' constant for confidential virtualization tech 
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 2023-07-06 12:20:04 +01:00
Daniel P. Berrangé 0895124572 core: set SYSTEMD_CONFIDENTIAL_VIRTUALIZATION env for generators 
This reports the confidential virtualization type that was detected

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 2023-07-06 12:20:04 +01:00
Daniel P. Berrangé 024469ddb9 core: log detected confidential virtualization type 
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 2023-07-06 12:20:04 +01:00
Daniel P. Berrangé 1257274ad8 dbus: add 'ConfidentialVirtualization' property to manager object 
This property reports whether the system is running inside a confidential
virtual machine.

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 2023-07-06 12:20:04 +01:00
Daniel P. Berrangé 95d043b159 unit: add "cvm" option for ConditionSecurity 
The "cvm" flag indicates whether the OS is running inside a confidential
virtual machine.

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 2023-07-06 12:20:04 +01:00
Daniel P. Berrangé f460fec915 detect-virt: add --list-cvm option 
The --list-cvm option reports the known types of confidential virtualization
technology that can be detected.

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 2023-07-06 12:20:04 +01:00
Daniel P. Berrangé 5e0c61f64d detect-virt: add --cvm option 
The --cvm option detects whether the OS is running inside a confidential
virtual machine.

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 2023-07-06 12:20:04 +01:00
Daniel P. Berrangé a577a61625 add APIs for detecting confidential virtualization 
This code uses various CPUID checks to be able to identify

 * AMD SEV
 * AMD SEV-ES
 * AMD SEV-SNP
 * Intel TDX

On HyperV/Azure, it has special checks for detecting SEV-SNP
since the normal CPUID is blocked.

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 2023-07-06 12:20:04 +01:00
Joerg Behrmann 5bc9ea070f treewide: fix "an" before consonant U sounds 
The article "a" goes before consonant sounds and "an" goes before vowel
sounds. This commit changes an to a for UKI, UDP, UTF-8, URL, UUID, U-Label, UI
and USB, since they start with the sound /ˌjuː/.
 2023-07-06 11:59:41 +01:00
Andrew Baxter 1b91662ca0 Hwdb: Add Sanwa Direct 400-MA128 external trackpad (#28272) 
* Hwdb: Add Sanwa Direct 400-MA128 external trackpad

```
$ udevadm info /dev/input/by-path/pci-0000:28:00.3-usb-0:1.4.4.1:1.1-event-mouse
P: /devices/pci0000:00/0000:00:07.1/0000:28:00.3/usb5/5-1/5-1.4/5-1.4.4/5-1.4.4.1/5-1.4.4.1:1.1/0003:258A:0501.0097/input/input256/event15
M: event15
R: 15
U: input
D: c 13:79
N: input/event15
L: 0
S: input/by-id/usb-SINO_WEALTH_USB_TOUCHPAD-if01-event-mouse
S: input/by-path/pci-0000:28:00.3-usb-0:1.4.4.1:1.1-event-mouse
E: DEVPATH=/devices/pci0000:00/0000:00:07.1/0000:28:00.3/usb5/5-1/5-1.4/5-1.4.4/5-1.4.4.1/5-1.4.4.1:1.1/0003:258A:0501.0097/input/input256/event15
E: DEVNAME=/dev/input/event15
E: MAJOR=13
E: MINOR=79
E: SUBSYSTEM=input
E: USEC_INITIALIZED=3436890430330
E: ID_INPUT=1
E: ID_INPUT_TOUCHPAD=1
E: ID_INPUT_WIDTH_MM=106
E: ID_INPUT_HEIGHT_MM=77
E: ID_BUS=usb
E: ID_MODEL=USB_TOUCHPAD
E: ID_MODEL_ENC=USB\x20TOUCHPAD
E: ID_MODEL_ID=0501
E: ID_SERIAL=SINO_WEALTH_USB_TOUCHPAD
E: ID_VENDOR=SINO_WEALTH
E: ID_VENDOR_ENC=SINO\x20WEALTH
E: ID_VENDOR_ID=258a
E: ID_REVISION=0521
E: ID_TYPE=hid
E: ID_USB_MODEL=USB_TOUCHPAD
E: ID_USB_MODEL_ENC=USB\x20TOUCHPAD
E: ID_USB_MODEL_ID=0501
E: ID_USB_SERIAL=SINO_WEALTH_USB_TOUCHPAD
E: ID_USB_VENDOR=SINO_WEALTH
E: ID_USB_VENDOR_ENC=SINO\x20WEALTH
E: ID_USB_VENDOR_ID=258a
E: ID_USB_REVISION=0521
E: ID_USB_TYPE=hid
E: ID_USB_INTERFACES=:030101:030000:
E: ID_USB_INTERFACE_NUM=01
E: ID_USB_DRIVER=usbhid
E: ID_PATH=pci-0000:28:00.3-usb-0:1.4.4.1:1.1
E: ID_PATH_TAG=pci-0000_28_00_3-usb-0_1_4_4_1_1_1
E: ID_INPUT_TOUCHPAD_INTEGRATION=internal
E: LIBINPUT_DEVICE_GROUP=3/258a/501:usb-0000:28:00.3-1.4.4
E: DEVLINKS=/dev/input/by-id/usb-SINO_WEALTH_USB_TOUCHPAD-if01-event-mouse /dev/input/by-path/pci-0000:28:00.3-usb-0:1.4.4.1:1.1-event-mouse
```
Link to product: https://www.amazon.co.jp/gp/product/B07Z5HCMFP
 2023-07-06 11:42:33 +01:00
Thomas GentyandYu Watanabe 7d06cd73c2 hwdb: add support for Archos 101 Cesium to 60-sensor.hwdb (#28270) 
Co-authored-by: Yu Watanabe <watanabe.yu+github@gmail.com>
 2023-07-06 18:39:28 +08:00
Daan De Meyer 12d58b6c74 dissect: Add --mtree-hash= option 
Let's make including hashes in the mtree output configurable to allow
speeding up the --mtree command in cases where file hashes are not
required.
 2023-07-06 12:11:45 +02:00
Daan De Meyer 2292fa1e31 dissect: Allow a few verbs to operate on directories as well as image files 
--copy-to, --copy-from, --list and --mtree are useful for image directories
as well as image files, so for those verbs, let's check if we were passed
a directory and skip all the image file setup if that's the case.
 2023-07-06 12:11:42 +02:00
Antonio Alvarez Feijoo 0a3d108f46 tpm2-util: remove unnecessary semicolon 2023-07-06 10:44:23 +01:00
Yu Watanabe efa5521be8 network/json: introduce PreferredLifetimeUSec and ValidLifetimeUSec 2023-07-06 11:41:49 +02:00
Lennart Poettering 9103278ff7 Merge pull request #28265 from yuwata/network-captive-portal-follow-ups 
network: several follow-ups for captive portal support
 2023-07-06 11:39:24 +02:00
Lennart Poettering 4ab426bf56 service: explicitly cast float to usec_t 
Let's cast these floats explicitly to usec_t, since implicit
float-to-integer casts are dangerous business, and we should underline
that there's a cast happening here.
 2023-07-06 11:21:35 +02:00
Yu Watanabe ea792cacb9 core/service: make restart delay increase more smoothly 
Suggested in https://github.com/systemd/systemd/pull/26902#issuecomment-1620400583.
 2023-07-06 11:20:13 +02:00
Lennart Poettering eade959b90 NEWS: more preparation for 254-rc1 2023-07-06 11:16:16 +02:00
Lennart Poettering a130b09513 Merge pull request #27713 from ddstreet/tpm2_replace_make_primary 
Tpm2 replace make primary
 2023-07-06 10:22:12 +02:00
Lennart Poettering e40cad1f3c Merge pull request #28243 from bluca/sbat_initrd 
ukify: enable --sbat for UKIs too
 2023-07-06 10:21:44 +02:00
Yu Watanabe 52ee8ecf07 networkctl: urlify captive portal entry 2023-07-06 14:55:58 +09:00
Yu Watanabe 62eaf8d039 test-network: drop ExecReload= in networkd.service and udevd.service 
Follow-up for 0e07cdb0e7 and
f84331539d.
 2023-07-06 14:55:58 +09:00
Yu Watanabe 2c5bca1734 network/ndisc: downgrade log level 
The failures may be critical for per-link operation, but not critical
for the service.
 2023-07-06 14:55:58 +09:00
Yu Watanabe 64de00c49f network: handle captive portal with multiple routers 
Before this patch, if a network has multiple routers and one of them
provides a captive portal, then the portal was overwritten or cleared
when another RA from another router is received.

This makes captive portals managed in the similar way as DNS servers or
DNS domains. So now captive portal can safely handled even if a network
has multiple routers.
 2023-07-06 14:55:58 +09:00
Yu Watanabe 04eaf63c66 network: update comment 2023-07-06 14:55:58 +09:00
Yu Watanabe 6341ea5467 network: introduce link_get_captive_portal() 
Then, downgrade log level of the message about mis-match of captive
portals in different protocols.
 2023-07-06 14:55:46 +09:00
Yu Watanabe 21da5178ec Merge pull request #28262 from YHNdnzj/transaction-followup 
Follow-ups for PropagatesStopTo= fix
 2023-07-06 12:55:25 +09:00
Dan Streetman 20988602ff tpm2: remove tpm2_make_primary() 
Replace use of tpm2_make_primary() with tpm2_create_loaded()
 2023-07-05 17:39:33 -04:00
Dan Streetman 98497426d6 tpm2: move local vars in tpm2_unseal() to point of use 
No functional change; cosmetic only.
 2023-07-05 17:39:18 -04:00
Dan Streetman cea525a902 tpm2: add tpm2_get_or_create_srk() 
Add function to simplify getting the TPM SRK; if one exists, it is provided,
otherwise one is created and then the new SRK provided.

This also add tpm2_create_loaded() and updates tpm2_seal() to use the new
functions instead of tpm2_make_primary().
 2023-07-05 17:39:18 -04:00
Dan Streetman d2d29c3be2 tpm2: add tpm2_persist_handle() 
Add function to convert a transient handle in the TPM into a persistent handle
in the TPM.
 2023-07-05 17:38:31 -04:00
Dan Streetman cbc92a3172 tpm2: cache TPM algorithms 
Cache the supported algorithms when creating a new context.
 2023-07-05 17:33:55 -04:00
Dan Streetman adbf0c8cfb tpm2: cache the TPM supported commands, add tpm2_supports_command() 
Cache the TPM's supported commands and provide a function to check if a command
is supported.
 2023-07-05 17:33:55 -04:00
Dan Streetman 3f27ba9954 basic/alloc-util: add greedy_realloc_append() 
Add function to perform greedy realloc as well as copying the new data into the
newly allocated space.
 2023-07-05 17:33:55 -04:00
Dan Streetman 9ea0ffe612 tpm2: replace tpm2_capability_pcrs() macro with direct c->capaiblity_pcrs use 2023-07-05 17:33:55 -04:00
Dan Streetman e3f1f21076 tpm2: add tpm2_create() 
This allows creating a new object (e.g. sealed secret) or key using the TPM.

Note that the new object/key is not loaded in the TPM after creation.
 2023-07-05 17:33:55 -04:00
Dan Streetman 180444b885 tpm2: replace magic number in hmac_sensitive initialization 
Instead of setting hmac_sensitive.sensitive.data.size to '32' use the actual
hash size as set in the hmac_template.
 2023-07-05 17:33:55 -04:00
Dan Streetman ee6a8713ab tpm2: move local vars in tpm2_seal() to point of use 
No functional change; cosmetic only.
 2023-07-05 17:33:55 -04:00
Dan Streetman efe153bdc2 tpm2: add tpm2_load_external() 
This allows loading an external object/key (e.g. an openssl public key) into
the TPM.
 2023-07-05 17:33:55 -04:00
Dan Streetman d1d0de735d tpm2: add tpm2_load() 
This function allows loading an object (e.g. a sealed secret) or key into the
TPM.
 2023-07-05 17:33:55 -04:00
Lennart Poettering 6c1d10fe03 update syscall tables for upcoming v254 2023-07-05 23:18:16 +02:00
Lennart Poettering 61905882c9 update hwdb autosuspend data for v254 2023-07-05 23:18:16 +02:00
Lennart Poettering 4560f9821b meson: run forgotten 'update-man-rules' 2023-07-05 23:18:16 +02:00
Mike Yuan bf3dfa6202 TEST-03-JOBS: test indirect PropagatesStopTo= 2023-07-06 05:12:04 +08:00
Mike Yuan 4893902be8 core/transaction: correctly skip unneeded operations for PropagatesStopTo= 
Follow-up for 48cb073db8

Break out from LIST_FOREACH correctly if nt == JOB_NOP.
Shouldn't have functional changes, just optimization.
 2023-07-06 05:12:04 +08:00
Luca Boccassi 9d54e578f7 Merge pull request #28258 from poettering/boot-feature-catchup 
sd-boot/sd-stub boot feature flag catchup
 2023-07-05 21:40:43 +01:00