Closes#40883. As described in the issue, it's not "jobs" that are
marked, and also the name is unnecessarilly long.
I think we don't need any compatibility measures here. At least in the
rpm world, package upgrade scripts go through the helper which is part
of the package so the new systemctl and the new helper are upgraded
together.
After kernel commit 907bc9268a ("Input: atkbd - map F23 key to support default copilot shortcut")
Fn+F5 combination (switch touchpad on/off) stopped working correctly.
Fn produces F23, it is probably a bug in BIOS, ther eis no "Copilot" key.
It was ignored before that commit, but now we have to remap it here in hwdb.
This workaround is similar to systemd commit d2502f55a2
("hwdb/keyboard: Map FN key on TUXEDO InfinityFlex 14 Gen1")
Hardware probe of this notebook: https://linux-hardware.org/?probe=7aca7ed668
See also: https://bugzilla.rosa.ru/show_bug.cgi?id=19950
Closes#40883. As described in the issue, it's not "jobs" that are
marked, and also the name is unnecessarilly long.
I think we don't need any compatibility measures here. At least in the
rpm world, package upgrade scripts go through the helper which is part
of the package so the new systemctl and the new helper are upgraded
together.
Follow-up for 93d768e0f3. The commit with
the fix didn't mention this, but the reported reproducer was:
> Install openSUSE Tumbleweed with account-utils and systemd v258.
> Compile and install systemd v260. Run "varlinkctl list-methods
> /run/account/newidmapd-socket" -> the newidmap service crashes in
> varlink_idl_format_all_fields(). Recompile newidmap with systemd v260
> headers -> varlinkctl list-methods works again.
Other people might hit the same issue, so let's mention that this was
fixed.
So far statx_mount_same() assumed STATX_MNT_ID_UNIQUE didn't exist.
However it does exist, hence do something useful if we see it set. Note
that this creates a certain ambiguity: if we compare one statx struct
with STATX_MNT_ID_UNIQUE and one without it (but with the regular mnt
id), then we cnanot really come to a clear conclusion, hence need to
introduce a third, unknown state.
Note that we don't request STATX_MNT_ID_UNIQUE yet wherever we call
statx_mount_same(). THis will be added in a later commit.
The old name suggested this would only check if the two inodes are on
the same mount, but it actually checks if they are the same inodes too.
Let's rename it to make this clearer, in particular as we have
both statx_inode_same() and statx_mount_same() already, and they are
even used here, and hence very confusing.
This also drops two checks from the test case, which are simply wrong.
Given they apparently weren't load bearing (since no CI tripped up),
let's just drop them.
The same optimization is already applied in the very similar
dir_fd_is_root() check a few lines up – with the exception that it
doesn't accept AT_FCWD there. And frankly turning off
CHASE_AT_RESOLVE_IN_ROOT if we operate on AT_FCWD is simply wrong. Hence
remove this code.
Let's harden things in case concurrent access is allowed to a root tree
passed via CHASE_AT_RESOLVE_IN_ROOT: let's not just validate via the
path if we hit the root of the tree, but also by comparing inodes +
mount ids.
Hardening opportunity reported by Sebastian Wick.
In one of the next commits we want to acquire .stx_mnt_id from statx()
for each inode we traverse (plain fstat() doesn't provide that field).
Hence let's port chase() over to statx() as preparation for that.
No change in behaviour.
Let's add some protections in case we deal with inodes owned by an
untrusted person, with concurrent access: let's put a limit on how long
we traverse, and fail eventually so that live changes cannot send us in
circles indefinitely.
This reworks the current CHASE_MAX logic so that it not only applies to
symlinks transitions, but to any transitions.
This also bumps CHASE_MAX a bit, given that it's now bumped on every
single iteration of the loop.
When install_subdir encounters a mkosi.tools tree with a /bin to
/usr/bin symlink it fails to copy it because it dereferences but still
treats it like a file.
Work around the Meson bug by excluding the mkosi.tools tree from
installation like mkosi.local is excluded. We anyway don't want the
tools tree end up there.
When removing marked routes, the condition `if (ret)` incorrectly
overwrites any previously accumulated error in `ret` with the latest
return value `r`, even if `r >= 0` (success). This means an earlier
real error can be silently cleared by a subsequent successful
route_remove() call.
The parallel address_remove() block just above uses the correct
`if (r < 0)` pattern. Apply the same fix to the route_remove() block.
sd_lldp_tx_describe() returns a single object (the LLDP TX configuration),
but the IDL declared LLDP as SD_VARLINK_ARRAY|SD_VARLINK_NULLABLE. This
caused server-side validation failures ("Field 'LLDP' should be an array,
but it is of type 'object'") whenever networkctl status was called on an
interface with LLDP TX active.
Also fix the field comment: the LLDP field represents the transmit
configuration, not received neighbors.
Follow-up for dd2934d44e.
/run/systemd/inaccessible/ exists only on host - in the container we have
/run/host/inaccessible/, and since all the inaccessible mounts have
MOUNT_IN_USERNS we need to use the latter one, otherwise the masking
gets silently skipped:
~# SYSTEMD_LOG_LEVEL=debug systemd-nspawn -q --directory=foo ls -la /proc/kallsyms
...
Bind-mounting /run/systemd/inaccessible/reg on /proc/kallsyms (MS_BIND "")...
Failed to mount /run/systemd/inaccessible/reg (type n/a) on /proc/kallsyms (MS_BIND ""): No such file or directory
Changing mount flags /proc/kallsyms (MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_BIND "")...
Failed to mount n/a (type n/a) on /proc/kallsyms (MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_BIND ""): Invalid argument
Bind-mounting /run/systemd/inaccessible/reg on /proc/kcore (MS_BIND "")...
Failed to mount /run/systemd/inaccessible/reg (type n/a) on /proc/kcore (MS_BIND ""): No such file or directory
Changing mount flags /proc/kcore (MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_BIND "")...
Failed to mount n/a (type n/a) on /proc/kcore (MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_BIND ""): Invalid argument
...
Inner child finished, invoking payload.
-r--r--r--. 1 root root 0 Feb 25 13:19 /proc/kallsyms
Add missing NoSessionPIDFD error to the interface definition; the error
is emitted by vl_method_create_session() when the session leader process
does not have a pidfd available, but was never declared in the IDL.
Drop SD_JSON_MANDATORY from the ReleaseSession.Id dispatch entry so that
omitting the field (which the IDL allows via SD_VARLINK_NULLABLE)
resolves to the caller's own session via session_is_self(NULL).
The error is emitted by vl_method_create_session() when the session leader
process does not have a pidfd available, but was never declared in the IDL.
Fixes: 3180c4d461
The ReleaseSession method's Id field is declared as nullable (?string) in
the IDL, allowing callers to omit it so that the method releases the
caller's own session via session_is_self(NULL). The SD_JSON_MANDATORY flag
in the dispatch table contradicts this and makes omitting Id return -EINVAL
("Invalid argument", parameter "Id") instead.
Drop the flag so omitting Id is treated as passing NULL.
Fixes: 2baca6c22b
If a pidfd id is passed to us, it must have originated from
somewhere, i.e. pidfs should be supported on the system.
Hence let's be honest about -EOPNOTSUPP, which might indicate
some bigger problems under the hood, rather than allowing
it to be turned into mild -ESRCH.
Fix typo: DNS_TYPE_DNSKEY should be used instead of DNS_TYPE_KEY.
- DNS_TYPE_KEY is deprecated
- Source code at resolved-dns-trust-anchor.c#L313 handles
DNS_TYPE_DNSKEY records, but not DNS_TYPE_KEY
So DNS_TYPE_KEY is not referenced anywhere
The error is emitted by `vl_method_resolve_service_complete()` when an
SRV record with a root domain hostname is found, indicating the service
is explicitly not offered on the queried domain (RFC 2782 Usage Rules),
but was not declared in the `io.systemd.Resolve` interface definition.
Follow-up for 3d8f2c1464.
It was noticed that cryptsetup luksDump outputs
tpm2-primary-alg: ecc
regardless of the actual primary key type. Namely, in the situation when
RSA SRK is passed to 'systemd-cryptenroll', the output is incorrect and
misleading. Turns out 'tpm2-primary-alg' is not currently used for
unsealing as 'tpm2_srk' object has it in its properties but the
misleading information problem stays.
Fix the issue with a two-fold fix:
- Put the SRK primary alg type to the JSON token so 'cryptsetup
luksDump' has a chance to actually print the right information without
the need to inspect SRK.
- Avoid printing 'tpm2-primary-alg' when it is unset in the JSON as the
default 'ECC' may not match the reality.
No real functional change for the sealing/unsealing expected.
I found the existing explanation of RestartSteps to be simply
impenetrable. Even providing the full docs context to several of our new
AI overlords resulted in wildly different (and completely incorrect)
explanations of the final restart intervals.
Digging through the code, I found the restart delay computation in
`service_restart_usec_next` in `src/core/service.c`.
I've updated the documentation for RestartSteps with an example,
suggested value range and a detailed enough explanation that accurately
describes the current behavior.
Luca Boccassi
Mike Yuan
Zbigniew Jędrzejewski-Szmek
Mikhail Novosyolov
Yu Watanabe
Bouke van der Bijl
Eisuke Kawashima
naly zzwd
Jim Spentzos
Lennart Poettering
Kai Lüke
noxiouz
Frantisek Sumsal
Skye Soss
Thomas Weißschuh
Ronan Pigott
Val Markovic