SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
69,447 Commits 2 Branches 1 Tag
8722c7e7bc0a680b734da37e9a08b671d1f141ce
Commit Graph
69447 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Yuan 0f15d14c76 logind: test: make sure string of HandleAction and SleepOperation match 2023-12-05 22:18:32 +08:00
Mike Yuan 181c525e9d logind: put more struct members into designated initializer 2023-12-05 22:18:32 +08:00
Mike Yuan c794877f1d logind: take HandleAction instead of HandleActionData at several places 
Preparation for addition of HANDLE_SLEEP.
 2023-12-05 22:18:31 +08:00
huyubiao 3769ba7570 fix: The example2 in hwdb.xml is unreasonable 
use evdev:atkbd:dmi:bvnAcer:bvr:bdXXXXX:bd08/05/2010:svnAcer:pnX123: instead of evdev:atkbd:dmi:bvnAcer:bdXXXXX:bd08/05/2010:svnAcer:pnX123
 2023-12-05 14:09:18 +01:00
Mike Yuan 24ab77c3cd hibernate-resume: always clear HibernateLocation if system info matches 
Follow-up for a628d933cc

HibernateInfo.from_efi is not actually useful. info.efi is only
set if the system identifier stored in EFI variable matches with
that of the running system, and thus the variable should be cleared
no matter whether resume= is set from kernel cmdline or not.
 2023-12-05 16:52:19 +08:00
Mike Yuan 1fe536aa37 sleep: reduce the scope of hibernation_device 2023-12-05 16:52:19 +08:00
Mike Yuan 232efdc5bd hibernate-util: return 1 for hibernation_is_safe only when all checks pass 
The return value is currently not used, but let's correct this.
 2023-12-05 16:52:19 +08:00
Frantisek Sumsal 52c1fb6885 test: set correct group for systemd-journal-upload tests 
We can't use the systemd-journal-upload user here, since it's created
dynamically by DynamicUser=yes. However, we can use the group specified
in SupplementaryGroups=, so do exactly that.
 2023-12-05 09:07:14 +01:00
Frantisek Sumsal e4d216f2dc Revert "sysusers.d: create the user for systemd-journal-upload.service" 
I have no idea what was my reasoning that led to this change, but it is
simply wrong: systemd-journal-upload.service uses
User=systemd-journal-upload together with DynamicUser=yes, so the user
doesn't have to (and shouldn't) exist before starting the service.

See:
  - https://github.com/systemd/systemd/commit/941afc4b902af21b0675e9e5d417c2ee6b202f30
  - https://src.fedoraproject.org/rpms/systemd/c/db8b8fe77ce30244ad82e70ec4e8302b0c9dbf41

This reverts commit 5b9dfd33c6.
 2023-12-04 19:44:10 +01:00
Luca Boccassi 26522a66a3 Merge pull request #30313 from mrc0mmand/ubuntu-ci 
Reduce the number of deny-list files for Ubuntu CI
 2023-12-04 18:23:34 +00:00
Yu Watanabe 67bc3c1a8c tools/meson-vcs-tag: the third argument is optional 
Follow-up for 1a71ac07ad.
 2023-12-04 10:29:52 +00:00
Luca Boccassi a483c75822 Merge pull request #30314 from DaanDeMeyer/dmi 
Document kernel configs required for reading credentials from SMBIOS
 2023-12-04 10:29:06 +00:00
Daan De Meyer 6ee9467d4c mkosi: Update comment why we can't use linux-kvm yet 2023-12-04 11:16:52 +01:00
Daan De Meyer 2d05492040 Document kernel configs required for reading credentials from SMBIOS 2023-12-04 11:13:59 +01:00
Frantisek Sumsal 30349b09bd test: reenable TEST-30 on i*86 
The original reason for deny-listing it was that it's flaky there. I'm
not sure if that's still the case, but the Ubuntu CI jobs for i*86 are
gone, so this file shouldn't be needed anymore anyway.
 2023-12-04 11:12:51 +01:00
Frantisek Sumsal fc55ef9b69 test: skip TEST-36 on s390x and powerpc 
As QEMU there doesn't support NUMA nodes. Also, drop the now unneeded
deny-list file for Ubuntu CI.
 2023-12-04 11:12:51 +01:00
Frantisek Sumsal 6743066875 test: check if 'btrfs filesystem' supports 'mkswapfile' 
Instead of deny-listing the test on Ubuntu CI, so it gets enabled
automagically once btrfs-progs is updated to a newer version there.
 2023-12-04 11:12:51 +01:00
Frantisek Sumsal a311d4dd30 test: reenable TEST-25-IMPORT in Ubuntu CI 
Let's see if #13973 is still an issue.
 2023-12-04 10:16:02 +01:00
Luca Boccassi cc9f4cad8c executor: apply LogLevelMax earlier 
SELinux logs before we have a chance to apply it, move it up as it
breaks TEST-04-JOURNAL:

[  408.578624] testsuite-04.sh[11463]: ++ journalctl -b -q -u silent-success.service
[  408.578743] testsuite-04.sh[11098]: + [[ -z Dec 03 13:38:41 H systemd-executor[11459]: SELinux enabled state cached to: disabled ]]

Follow-up for: bb5232b6a3
 2023-12-04 11:45:22 +09:00
Yu Watanabe b88f0fdc87 Merge pull request #30305 from yuwata/seccomp-fix 
seccomp: override the default action only when the filter is allow-list
 2023-12-04 11:44:58 +09:00
Zbigniew Jędrzejewski-Szmek 8244f394da tests: fix section mapping in test_ukify.py 
The regexp only worked if the sections were small enough for the size to
start with "0". I have an initrd that is 0x1078ec7e bytes, so the tests
would spuriously fail.
 2023-12-03 12:34:43 +00:00
Luca Boccassi 1707d5daf8 Merge pull request #30297 from keszybz/fixups 
A few unrelated fixups for recent commits
 2023-12-03 12:34:24 +00:00
Yu Watanabe 78b2ad7d67 seccomp-util: also use ENOSYS for unknown syscalls in seccomp_load_syscall_filter_set() 
Follow-up for 2331c02d06.

Note, currently, the function is always called with SCMP_ACT_ALLOW as
the default action, except for the test. So, this should not change
anything in the runtime code.
 2023-12-03 18:01:30 +09:00
Yu Watanabe 03c0730ffe seccomp-util: override default action only when the filter is allow-list 
Follow-up for 2331c02d06.

Fixes #30304.
 2023-12-03 18:00:20 +09:00
Zbigniew Jędrzejewski-Szmek 465a9d2af8 man/systemctl: fix indentation of <xi:include>'s 2023-12-02 21:21:52 +01:00
Zbigniew Jędrzejewski-Szmek 753beeb914 shared/verb: indentation 2023-12-02 16:59:07 +01:00
Mike Yuan 2b98926f98 networkctl: introduce --runtime for editing network config under /run/ 2023-12-02 17:04:57 +08:00
Mike Yuan 7050f7419b networkctl: drop one assertion 
If there're no existing drop-ins, the assertions
are unnecessarily triggered.
 2023-12-02 17:04:57 +08:00
Mike Yuan e9b7408eb9 networkctl: use RET_GATHER more 2023-12-02 17:04:56 +08:00
Zbigniew Jędrzejewski-Szmek ccd31de8bf stdio-bridge: return immediately if we can 
Follow-up for 0321248b79.
 2023-12-02 09:47:45 +01:00
Zbigniew Jędrzejewski-Szmek 9ce3440a6f run: fix bad escaping and memory ownership confusion 
arg_description was either set to arg_unit (i.e. a const char*), or to
char *description, the result of allocation in run(). But description
was decorated with _cleanup_, so it would be freed when going out of the
function. Nothing bad would happen, because the program would exit after
exiting from run(), but this is just all too messy.

Also, strv_join(" ") + shell_escape() is not a good way to escape command
lines. In particular, one the join has happened, we cannot distinguish
empty arguments, or arguments with whitespace, etc. We have a helper
function to do the escaping properly, so let's use that.

Fixup for 2c29813da3.
 2023-12-02 09:47:45 +01:00
Zbigniew Jędrzejewski-Szmek cffa43255a run: adjust indentation 2023-12-02 09:47:45 +01:00
Zbigniew Jędrzejewski-Szmek 72420d39d7 test-macro: use capital test names for macro tests 
It's just easier if the test is named as the thing being tested. Also, this way
inconsistent, because lower in the file uppercase test names are used.
 2023-12-02 09:47:11 +01:00
Luca Boccassi c7ce20f01f NEWS: finalize for v255-rc4 2023-12-02 02:05:30 +00:00
Luca Boccassi ebaf2821e6 Merge pull request #30291 from keszybz/seccomp-unknown-syscall 
Backwardscompatibly handle syscalls unknown to us or libseccomp
 2023-12-02 02:04:24 +00:00
Zbigniew Jędrzejewski-Szmek e6c5386dee core: turn on higher optimization level in seccomp 
This mirrors what d75615f398 did for nspawn.

It isn't really a fatal failure if we can't set that, so ignore it in libseccomp
cannot set the attribute.

 line  OP   JT   JF   K
=================================
 0000: 0x20 0x00 0x00 0x00000004   ld  $data[4]
 0001: 0x15 0x00 0xb7 0x40000003   jeq 1073741827 true:0002 false:0185
 0002: 0x20 0x00 0x00 0x00000000   ld  $data[0]
 0003: 0x15 0xb5 0x00 0x00000000   jeq 0    true:0185 false:0004
 0004: 0x15 0xb4 0x00 0x00000001   jeq 1    true:0185 false:0005
 0005: 0x15 0xb3 0x00 0x00000002   jeq 2    true:0185 false:0006
 0006: 0x15 0xb2 0x00 0x00000003   jeq 3    true:0185 false:0007
 0007: 0x15 0xb1 0x00 0x00000004   jeq 4    true:0185 false:0008
 0008: 0x15 0xb0 0x00 0x00000005   jeq 5    true:0185 false:0009
 0009: 0x15 0xaf 0x00 0x00000006   jeq 6    true:0185 false:0010
 ...
 0438: 0x15 0x03 0x00 0x000001be   jeq 446  true:0442 false:0439
 0439: 0x15 0x02 0x00 0x000001bf   jeq 447  true:0442 false:0440
 0440: 0x15 0x01 0x00 0x000001c0   jeq 448  true:0442 false:0441
 0441: 0x06 0x00 0x00 0x00050026   ret ERRNO(38)
 0442: 0x06 0x00 0x00 0x7fff0000   ret ALLOW

 line  OP   JT   JF   K
=================================
 0000: 0x20 0x00 0x00 0x00000004   ld  $data[4]
 0001: 0x15 0x00 0x27 0x40000003   jeq 1073741827 true:0002 false:0041
 0002: 0x20 0x00 0x00 0x00000000   ld  $data[0]
 0003: 0x25 0x01 0x00 0x000000b5   jgt 181  true:0005 false:0004
 0004: 0x05 0x00 0x00 0x00000143   jmp 0328
 0005: 0x25 0x00 0xa1 0x00000139   jgt 313  true:0006 false:0167
 0006: 0x25 0x00 0x51 0x00000179   jgt 377  true:0007 false:0088
 0007: 0x25 0x00 0x29 0x000001a0   jgt 416  true:0008 false:0049
 0008: 0x25 0x00 0x13 0x000001b0   jgt 432  true:0009 false:0028
 0009: 0x25 0x00 0x09 0x000001b8   jgt 440  true:0010 false:0019
 ...
 0551: 0x15 0x03 0x00 0x00000002   jeq 2    true:0555 false:0552
 0552: 0x15 0x02 0x01 0x00000001   jeq 1    true:0555 false:0554
 0553: 0x15 0x01 0x00 0x00000000   jeq 0    true:0555 false:0554
 0554: 0x06 0x00 0x00 0x00050026   ret ERRNO(38)
 0555: 0x06 0x00 0x00 0x7fff0000   ret ALLOW

The program is longer but hopefully faster because of the binary search.
 2023-12-02 01:21:53 +01:00
Zbigniew Jędrzejewski-Szmek 309a4212cf shared/seccomp-util: use the same error message for the same condition 
We were calling seccomp_syscall_resolve_name three times and using a
slightly different error message in each of the cases.
 2023-12-02 01:21:53 +01:00
Zbigniew Jędrzejewski-Szmek 2331c02d06 core: when applying syscall filters, use ENOSYS for unknown calls 
glibc starting using fchmodat2 to implement fchmod with flags [1], but
current version of libseccomp does not support fchmodat2 [2]. This is
causing problems with programs sandboxed by systemd. libseccomp needs to know
a syscall to be able to set any kind of filter for it, so for syscalls unknown
by libseccomp we would always do the default action, i.e. either return the
errno set by SystemCallErrorNumber or send a fatal signal. For glibc to ignore
the unknown syscall and gracefully fall back to the older implementation,
we need to return ENOSYS. In particular, tar now fails with the default
SystemCallFilter="@system-service" sandbox [3].

This is of course a wider problem: any time the kernel gains new syscalls,
before libseccomp and systemd have caught up, we'd behave incorrectly. Let's
do the same as we already were doing in nspawn since
3573e032f2, and do the "default action" only
for syscalls which are known by us and libseccomp, and return ENOSYS for
anything else. This means that users can start using a sandbox with the new
syscalls only after libseccomp and systemd have been updated, but before that
happens they behaviour that is backwards-compatible.

[1] https://github.com/bminor/glibc/commit/65341f7bbea824d2ff9d37db15d8be162df42bd3
[2] https://github.com/seccomp/libseccomp/issues/406
[2] https://github.com/systemd/systemd/issues/30250

Fixes https://github.com/systemd/systemd/issues/30250.

In seccomp_restrict_sxid() there's a chunk conditionalized with
'#if defined(__SNR_fchmodat2)'. We need to kep that because seccomp_restrict_sxid()
seccomp_restrict_suid_sgid() uses SCMP_ACT_ALLOW as the default action.
 2023-12-02 01:20:28 +01:00
Mike Yuan a8aed6a9b6 core/cgroup: for non-cached attrs, don't return ENODATA blindly 
Follow-up for f17b07f4d7

Hope I won't break this thing again...
 2023-12-02 00:13:46 +00:00
Zbigniew Jędrzejewski-Szmek 26747824fd Merge pull request #30294 from bluca/news 
hwdb and NEWS updates
 2023-12-02 01:08:45 +01:00
Neil Wilson 627966ab01 systemd-homed.service.in: add quotactl to SystemCallFilter 
Standard directories make a call to the quotactl system call to enforce disk size limits.

Fixes #30287
 2023-12-01 22:43:31 +00:00
Luca Boccassi 8163ef5712 hwdb: update 2023-12-01 22:07:08 +00:00
Luca Boccassi 9a848052e4 NEWS: update contributors list 2023-12-01 22:05:08 +00:00
Zbigniew Jędrzejewski-Szmek ac116f8c27 Merge pull request #30268 from yuwata/network-fix-too-many-waiting-replies 
network: fix issue caused by too many waiting replies
 2023-12-01 19:54:18 +01:00
Zbigniew Jędrzejewski-Szmek 86a1ee93f3 core: fix comment 2023-12-01 19:40:26 +01:00
Дамјан Георгиевски ef87c84e81 fix: prefix of dmesg pstore files 
A change in the kernel[1] renamed the prefix of the pstore files from
`dmesg-efi-` to `dmesg-efi_pstore-`.

[1]
https://git.kernel.org/linus/893c5f1de620
 2023-12-01 17:34:43 +00:00
Neil Wilson 145dc0a0f6 homework-quota.c: correct error message in home_update_quota_btrfs 
Fixes #30286
 2023-12-01 16:41:29 +00:00
dependabot[bot] ba47598aef build(deps): bump meson from 1.2.3 to 1.3.0 in /.github/workflows 
Bumps [meson](https://github.com/mesonbuild/meson) from 1.2.3 to 1.3.0.
- [Release notes](https://github.com/mesonbuild/meson/releases)
- [Commits](https://github.com/mesonbuild/meson/compare/1.2.3...1.3.0)

---
updated-dependencies:
- dependency-name: meson
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-12-01 14:49:19 +00:00
dependabot[bot] d50a357dce build(deps): bump redhat-plumbers-in-action/differential-shellcheck 
Bumps [redhat-plumbers-in-action/differential-shellcheck](https://github.com/redhat-plumbers-in-action/differential-shellcheck) from 5.0.1 to 5.0.2.
- [Release notes](https://github.com/redhat-plumbers-in-action/differential-shellcheck/releases)
- [Changelog](https://github.com/redhat-plumbers-in-action/differential-shellcheck/blob/main/docs/CHANGELOG.md)
- [Commits](https://github.com/redhat-plumbers-in-action/differential-shellcheck/compare/aa647ec4466543e8555c2c3b648124a9813cee44...91e2582e40236f831458392d905578d680baa138)

---
updated-dependencies:
- dependency-name: redhat-plumbers-in-action/differential-shellcheck
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-12-01 14:48:48 +00:00
dependabot[bot] 135c249147 build(deps): bump redhat-plumbers-in-action/devel-freezer 
Bumps [redhat-plumbers-in-action/devel-freezer](https://github.com/redhat-plumbers-in-action/devel-freezer) from 1.0.7 to 1.0.8.
- [Release notes](https://github.com/redhat-plumbers-in-action/devel-freezer/releases)
- [Commits](https://github.com/redhat-plumbers-in-action/devel-freezer/compare/13b6551f19ade74ca79be4cab06b815a4ffffa64...67aec4a153bd9fca5322e1c4dd4d7c419fb36362)

---
updated-dependencies:
- dependency-name: redhat-plumbers-in-action/devel-freezer
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-12-01 14:48:14 +00:00