Commit Graph
38331 Commits
Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek 6ef00eb846 Merge pull request #23200 from keszybz/oomd-docs
Extend the documentation for oomd a bit
2022-04-28 17:46:03 +02:00
Zbigniew Jędrzejewski-Szmek 4d620b90d9 oomd: "descendent" → "descendant"
The latter is the common spelling apparently.
2022-04-28 15:46:44 +02:00
Luca Boccassi 705d6b34ee meson: add systemd-boot and systemd-stub build target aliases
Allows to quickly build systemd-boot by itself without having to
reference the full path of the build target:

$ ninja -C foo systemd-stub
ninja: Entering directory `foo'
[21/21] Generating src/boot/efi/linuxx64.efi.stub with a custom command
$ ninja -C foo systemd-boot
ninja: Entering directory `foo'
[10/10] Generating src/boot/efi/systemd-bootx64.efi with a custom command
2022-04-27 22:24:58 +01:00
Luca Boccassi 0a5e638cc7 meson: add install_tag to sd-boot, libsystemd and libudev
Allows to 'meson install --tags systemd-boot --no-rebuild' to install only the EFI
binaries, skipping the rest, for a very quick build:

$ ninja src/boot/efi/linuxx64.efi.stub
[21/21] Generating src/boot/efi/linuxx64.efi.stub with a custom command
$ ninja src/boot/efi/systemd-bootx64.efi
[10/10] Generating src/boot/efi/systemd-bootx64.efi with a custom command
$ DESTDIR=/tmp/foo meson install --tags systemd-boot --no-rebuild
Installing src/boot/efi/systemd-bootx64.efi to /tmp/foo/usr/lib/systemd/boot/efi

Requires Meson 0.60 to be used, prints a warning for unknown keyword
in earlier versions, but there's no failure

https://mesonbuild.com/Installing.html#installation-tags
2022-04-27 22:24:53 +01:00
Zbigniew Jędrzejewski-Szmek 4d5713bb7e Merge pull request #23119 from yuwata/test-sd-device-exclude-bdi
test: exclude "bdi" subsystem
2022-04-27 16:56:53 +02:00
Zbigniew Jędrzejewski-Szmek 3d8a7e6f51 Merge pull request #23131 from poettering/shared-compress
move compress.[ch] → src/basic/
2022-04-27 10:47:54 +02:00
Yu Watanabe ff56124b11 test: exclude "bdi" subsystem and loop block devices
On several CI environments, it seems that some loop block devices and
corresponding bdi devices are sometimes removed during the test is
running. Let's exclude them.

Fixes #22970.
2022-04-27 16:32:42 +09:00
Yu Watanabe 9409710097 sd-device-enumerator: introduce sd_device_enumerator_add_nomatch_sysname() 2022-04-27 16:32:42 +09:00
Yu Watanabe c11810ed30 sd-device-enumerator: use set_fnmatch() 2022-04-27 16:32:42 +09:00
Yu Watanabe d25d4f189c set: introduce set_fnmatch() 2022-04-27 16:32:15 +09:00
Lennart Poettering cf393c5f44 Merge pull request #23161 from yuwata/nss-ipv6-disabled
nss: do not return IPv6 address when IPv6 is disabled
2022-04-26 22:52:09 +02:00
Lennart Poettering d4cc5c8037 journal-verify: tighten check for compression of non-objects 2022-04-26 21:55:49 +02:00
Lennart Poettering 4d698d12de compress: make Compression a regular non-sparse enum
Given we have two different types for the journal object flags and the
Compression enum, let's make the latter a regular non-sparse enum, and
thus remove some surprises. We have to convert anyway between the two,
and already do via COMPRESSION_FROM_OBJECT().
2022-04-26 21:55:49 +02:00
Lennart Poettering acc50c92eb basic: move compress.[ch] → src/basic/
The compression helpers are used both in journal code and in coredump
code, and there's a good chance we'll use them later for other stuff.

Let's hence move them into src/basic/, to make them a proper internal
API we can use from everywhere where that's desirable. (pstore might be
a candidate, for example)

No real code changes, just some moving around, build system
rearrangements, and stripping of journal-def.h inclusion.
2022-04-26 21:45:03 +02:00
Zbigniew Jędrzejewski-Szmek c0a96b1b1d oomd: actually fail if configuration is bad
Follow-up for a858355e4a.
2022-04-26 08:54:39 +02:00
Zbigniew Jędrzejewski-Szmek 23ce0271dc Merge pull request #23160 from keszybz/compress-defines
meson: simplify setting of default compression
2022-04-25 10:57:51 +02:00
Yu Watanabe 8ac6b05b7c tree-wide: Fix typo 2022-04-25 10:06:08 +09:00
Jan Janssen d5a99b7c9c tree-wide: Simplify variable declarations behind #ifdef 2022-04-24 01:31:05 +09:00
Lennart Poettering 5662811e34 loopback-setup: tweak message if loopback device is already set up 2022-04-23 08:45:45 +09:00
Yu Watanabe b1aca4da60 udevadm: wait: check if specified path not exist on --remove
Even if the corresponding device node or syspath are already removed,
the specified symlink to the device node may still exist.

Fixes #23166.
2022-04-23 08:45:01 +09:00
Yu Watanabe bb78da17fd test: do not accept IPv6 local address if IPv6 is disabled 2022-04-23 04:19:49 +09:00
Yu Watanabe db50d326a4 nss-myhostname: do not return IPv6 local address if IPv6 is disabled 2022-04-23 04:18:51 +09:00
MkfsSion 70e723c000 cryptenroll,homectl: Introduce --fido2-credential-algorithm option
* Some authenticators(like Yubikey) support credential algorithm other than ES256
* Introduce a new option so users can make use of it
2022-04-22 20:22:40 +02:00
Zbigniew Jędrzejewski-Szmek ee00684c50 meson: use a single constant for default compression setting
Suggested by Daniele Nicolodi:
https://github.com/systemd/systemd/pull/23160#discussion_r855853716

This is possible only if the macro is never used in #if, but only in C code.
This means that all places that use #if have to be refactored into C, but we
reduce the duplication a bit, and C is nicer to read than preprocessor
conditionals.
2022-04-22 15:08:28 +02:00
Zbigniew Jędrzejewski-Szmek 1d997b8114 meson: simplify setting of default compression
Follow-up for da13d2ca07. Instead of having
separate definitions of the bitmask flags, just define DEFAULT_COMPRESSION_FOO=0|1
directly.

(It *should* be possible to do this more simply, but the problem is that
anything that is used in #if cannot refer to C constants or enums. This is the
simplest I could come up with that preserves the property that we don't use #ifdef.)

The return value from compress_blob() is changed to propagate the error instead
of always returning -EOPNOTSUPP. The callers don't care about the specific error
value. compress_blob_*() are changed to return the compression method on success, so
that compress_blob() can be simplified. compress_stream_*() and compress_stream() are
changed in the same way for consistency, even though the callers do not currently use
this information (outside of tests).
2022-04-22 12:02:29 +02:00
Lennart Poettering 94602bff1f execute: add more debug logging 2022-04-22 11:32:47 +02:00
Lennart Poettering 1d68a2e168 execute: restore ability that SetCredential= can act as fallback for LoadCredential=
If SetCredential= and LoadCredentials= are combined for the same
credential name, then the former shall act as fallback for the latter in
case the source file does not exist. That's documented, but didn't work.
Let's fix that.
2022-04-22 11:32:47 +02:00
Lennart Poettering f344f7fdca execute: restore ability to propagate creds from further up (i.e. container manager and such)
This was broken in 3989bdc1ad let's
restore the functionality.

Basically, we want that if a relative name is specified as source to
load from we take it relative to the credentials dir the service manager
itself got passed.
2022-04-22 11:32:47 +02:00
Lennart Poettering 61c5a49eb2 execute: share error path between reg file/dir credential loading 2022-04-22 11:32:47 +02:00
Lennart Poettering 9e6e9d61bd execute: correct comments
This is not done first, but second.

Also, while we are at it, explain why faccessat() is OK here.
2022-04-22 11:32:47 +02:00
Lennart Poettering 9883cbb203 execute: sort directory entries when loading credentials recursively
Given that the recusive credential loading allows two ways to load the
same credentials, it's important to define a clear order so that it is
always the same one that wins.

i.e. if you use LoadCredential=foobar:/tmp/xyz and there are two files
/tmp/xyz/abc/cde and /tmp/xyz/abc_cde these would both result in a
credential foobar_abc_cde being set, hence it is important to make clear
which one shall win, and that it is always the same one.
2022-04-22 11:32:47 +02:00
Lennart Poettering 5bec447afb execute: drop 'seen_creds' set
When checking whether we already loaded a credential before, let's just
use faccessat() in the credential dir we are populating. First of all,
we already do it exactly that way when appliying SetCredential= settings
later. Secondly, this is not performance relevant, and by using
faccessat() things simply become a lot simpler.
2022-04-22 11:32:46 +02:00
Lennart Poettering 461345a164 execute: simplify 'load_creds_args' struct a bit
Given we only need a single field off the ExecLoadCredential structure
we don't have to link it as a whole, but just copy that one bit over
directly, simplifying the struct a bit.
2022-04-22 11:32:46 +02:00
Lennart Poettering 1134838615 execute: let recurse_dir() concate the cred name for us
recurse_dir() allows specifiying a freely choosable initial path to
which to append the subdirs as it descends into the tree. If we pass the
configured id there, recurse_dir() will suffix the subdir to that for
us, so that we don't have to do that manually anymore in the callback,
simplifying things a bit.
2022-04-22 11:32:46 +02:00
Lennart Poettering 3691083ce5 execute: passing NULL as second argument for recurse_dir() is equivalent to "" 2022-04-22 11:32:46 +02:00
Lennart Poettering 1451435ca5 execute: debug log if a generated recursive cred name is too long 2022-04-22 11:32:46 +02:00
Lennart Poettering 10b44e1dc1 execute: rework load_credential() not to take an ExecLoadCredential object we must synthesize
Let's just simplify the logic and pass the fields we need as regular
arguments, even if that means the function now has a lot. It's otherwise
really weird that we have to fake a local ExecLoadCredential from the
real one.
2022-04-22 11:32:46 +02:00
Lennart Poettering 9a6994e971 execute: drop double empty line 2022-04-22 10:58:41 +02:00
Lennart Poettering 6394e5cd34 execute: use ASSERT_PTR where appropriate 2022-04-22 10:58:41 +02:00
Lennart Poettering 44d5dd655e tpm2-util: if we run in a container, ignore /sys/class/tpmrm/* contents 2022-04-22 10:15:21 +02:00
Daan De Meyer a2a9d54108 kernel-install: Skip execution if $KERNEL_INSTALL_BYPASS=1 2022-04-22 09:12:08 +09:00
Sonali Srivastava 92c9f47d05 hostnamed: update to use new style sd-bus macros 2022-04-21 23:22:52 +02:00
Lennart Poettering 255689ae92 bus-unit-util: make sure we can set LoadCredentials= property with a single string
LoadCredentials= in unit files supports a syntax passing a single string
only (in which case the credentials are propagated down from the host).
but systemd-run's --property= setting doesn't allow that yet. Fix that.
2022-04-21 15:28:57 +02:00
Lennart Poettering fa998da2df creds-util: upgrade message about TPM2 not working 2022-04-21 10:51:00 +02:00
Lennart Poettering d2cba923be creds-util: also warn about unencrypted creds host key if we are creating it
Previously we'd only warn when we consume it, but it's even more
relevant to warn if we save it to an unencrypted storage location.
2022-04-21 10:50:09 +02:00
Lennart Poettering e921a00d41 main: voidify call to kmod_setup() 2022-04-21 10:37:32 +02:00
Lennart Poettering 7f40cb7c86 sd-bus: switch to a manual overflow check in sd_bus_track_add_name()
This is generally used in a directly client controllable way, hence we
should handle ref count overflow gracefully, instead of hitting an
assert().

As discussed:

https://github.com/systemd/systemd/pull/23099#discussion_r854341850
2022-04-21 08:58:35 +09:00
Lennart Poettering 7d3e856e82 macro: upgrade ref counting overflow check assert() → assert_se()
The overflow check for ref counting should not be subject to NDEBUG,
hence upgrade assert() → assert_se(). (The check for zero is an
immediate bug in our code, and should be impossible to trigger, hence
it's fine if the check is optimized away if people are crazy enough to
set NDEBUG, so that can stay assert())

https://github.com/systemd/systemd/pull/23099#discussion_r854341850
2022-04-21 08:56:32 +09:00
Lennart Poettering 231a1caf5e Merge pull request #23122 from poettering/creds-has-tpm2
tpm2: beef up tpm2 support checks
2022-04-20 23:18:02 +02:00
Yu Watanabe f4bdbae725 Merge pull request #23084 from poettering/creds-no-tpm2-fallback
creds: add semi-automatic fallback support for initrd credentials on systems lacking TPM2
2022-04-21 04:11:19 +09:00