Two error conditions are unreachable, as now both glibc and kernel
support statx(). In other many places, failure in statx() are handled as
critical, even if it is filtered by seccomp or so. Let's follow the same
way here.
struct statx in glibc header was introduced in glibc-2.28
(fd70af45528d59a00eb3190ef6706cb299488fcd), but at that time,
sys/stat.h conflicts with linux/stat.h. Since glibc-2.30
(5dad6ffbb2b76215cfcd38c3001778536ada8e8a), sys/stat.h includes
linux/stat.h if exists.
Since now our baseline of glibc is 2.31. Hence, we can drop workarounds
for struct statx by importing linux/stat.h from newer kernel (v6.14-rc4).
The current glibc versions used by major distributions:
CentOS 9: 2.34
CentOS 10: 2.39
Fedora 40: 2.39
Fedora 41: 2.40
Fedora 42: 2.41
Ubuntu 20.04 LTS (focal): 2.31
Ubuntu 22.04 LTS (jammy): 2.35
Ubuntu 24.04 LTS (noble): 2.39
Ubuntu 24.10 (oracular): 2.40
Debian 11 (Bullseye, oldstable): 2.31
Debian 12 (Bookworm, stable): 2.36
openSUSE SLE-15-SP6: 2.38
openSUSE Tumbleweed: 2.40
Hence, based on our supporting policy, we can bump the base line to 2.31.
This commit does not change anything on our source code. But, will drop
many workarounds for supporting older glibc in later commits.
- split out verifications into two functions,
- also check the following scenarios:
* unmanaging an existing interface,
* re-managing an unmanaged interface,
* adding a new unmanaged interface,
* removing an unmanaged interface.
- FUSE is unconditionally enabled in the container, as our kernel base
line (v5.4) supports userns-safe FUSE, which is supported since v4.18.
- Create /dev/net/tun only when it is accessible.
- Replaces several loops with FOREACH_ARRAY().
- make it return NULL,
- suppress log message about reference counter of writer unless trace
logging is enabled,
- introduce cleanup function for RemoteSource.
Follow-up for 985ea98e7f.
When DevicePolicy= is enabled, but DeviceAllow= for /dev/net/tun is not
specified, bind-mounting the device node from the host system is
meaningless, as it cannot be used in the container anyway.
Let's check the device node is accessible before creating or
bind-mounting.
FUSE is userns-safe since kernel v4.18 (da315f6e03988a7127680bbc26e1028991b899b8),
and now our kernel base line is 5.4. Let's drop the logic of checking
the version of FUSE, and unconditionally enable FUSE.
This split-out common logic from link_drop_routes() and friends.
This is mostly a refactoring, and not change behavior in most cases.
But slightly change behavior for how foreign nexthops and routing
policy rules are managed.
E.g. when KeepConfiguration=static, previously all foreign nexthops and
routing policy rules were kept, but now only foreign nexthops and rules
with RTPROT_STATIC are kept and others are dropped.
Similary, when KeepConfiguration=dynamic, previously all foreign nexthops
and rules were removed, but now foreign configs with a dynamic protocol
e.g. RTPROT_DHCP are kept, and still configs with RTPROT_STATIC are
dropped.
Currently, we do not set/get/manage protocol for neighbor entries.
Hence, the logic of managing foreign neighbor entries is unchanged.
Without this change, only foreign routes with RTPROT_KERNEL, RTPROT_STATIC,
RTPROT_DHCP, RTPROT_RA, and RTPROT_REDIRECT are kept, and foreign routes with
other protocol e.g. RTPROT_BOOT are removed even if KeepConfiguration=yes.
Fixes a regression in dd6d53a8dc (v257).
Fixes#36411.
Since kernel v4.17 (1b71af6053af1bd2f849e9fda4f71c1e3f145dcf), the
attribute is always set in each netlink message for routing policy rule.
Now, our base line is v5.4. Hence, we can drop the workaround.
This makes,
- When a wildcard value '*' is specified, use the first supported
compression algorithm,
- disable compression if Accept-Encoding header is unspecified or
no supported compression algorithm specified in the header,
- ignore all errors in parsing the header.
Follow-ups for cfaf78001c.
- use OrderedHashmap to manage configured compression algorithms, then
drop CompressionArgs,
- rename CompressionOpts -> CompressionConfig,
- refuse 'none' in Compression= setting, but accept boolean false, which
disables compression,
- when Compression= option is unspecified, enable all supported compression
algorithms by default,
- do not set 'none' to the Accept-Encoding header.
When a new device is processed, there should be no watch handle for
the device, hence udev_watch_clear() provides -1. Let's not try to call
inotify_rm_watch() in that case.
This should not change any behavior. Just for suppressing spurious
debugging log:
=====
(udev-worker)[3626140]: zram1: Removing watch handle -1.
=====
While killing cgroup v1 I want to turn all cg_* helpers to take
cgroupfs_fd + cg path, which means all relevant path operations must
support openat() semantics. `removexattrat()` is currently missing. I
took the chance to do a bigger refactor for xattr-util.
This adds `--json=MODE` command line option to `udevadm test`.
This may be useful for parsing e.g. network interface name or device
node symlinks.
Closes#23661.
Follow-up for 97318131fd.
By default, suite of each built test is determined by the directory of
the source file. Hence, before the mentioned commit, all tests in
src/boot/efi/ are in the 'efi' suite. The commit changed the directory
tree, but forgot to update the name of the test suite.
This adds --json=MODE option for 'udevadm test' command.
When specified, all messages, except for the final result, will be
written to stderr, and the final result is shown in JSON format to
stdout. It may be useful for parsing the test result.
Yu Watanabe