SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
67,743 Commits 2 Branches 1 Tag
8aa59287c06d40a9098f24ef5c8a18cdfd1823fa
Commit Graph
67743 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Luca Boccassi e2ae5f0224 docs: rephrase sentence about addons measuring in UEFI_SECURITY.md 2023-10-03 10:08:33 +01:00
Yu Watanabe fcf17d693c man: update the list of ignored options by Anonymize=yes 
Closes #29362.
 2023-10-03 10:02:02 +01:00
Luca Boccassi 8867122783 Merge pull request #29390 from yuwata/sd-netlink-make-default-timeout-configurable 
sd-netlink: make the default timeout configurable
 2023-10-02 22:59:07 +01:00
NRK 6c7b1ea1be udevadm: avoid side-effect in assert() 
this was found when trying to use __builtin_assume() with clang:
https://github.com/systemd/systemd/pull/29409#issuecomment-1743575402
 2023-10-02 22:58:45 +01:00
Dan Streetman 3ed342562a tpm2: edit tpm2_get_or_create_srk() comment 
Adjust the comment to correct the return value, i.e. 1 for SRK created, 0 for
SRK already exists, <0 on error.
 2023-10-02 22:58:13 +01:00
Luca Boccassi 359d4b04e8 docs: rename src/boot/efi/SECURITY.md as UEFI_SECURITY.md 2023-10-02 19:02:30 +01:00
Luca Boccassi 1f75b649e7 doc: add compiler hardening details to UEFI SECURITY.md 2023-10-02 18:27:13 +01:00
dependabot[bot] 273aca8b62 build(deps): bump systemd/mkosi 
Bumps [systemd/mkosi](https://github.com/systemd/mkosi) from adaa41512aa30c952daae5ba0abcf2622d66b93b to a8ecff0defa132d729dcdab38380dcae31138e7e.
- [Release notes](https://github.com/systemd/mkosi/releases)
- [Changelog](https://github.com/systemd/mkosi/blob/main/NEWS.md)
- [Commits](https://github.com/systemd/mkosi/compare/adaa41512aa30c952daae5ba0abcf2622d66b93b...a8ecff0defa132d729dcdab38380dcae31138e7e)

---
updated-dependencies:
- dependency-name: systemd/mkosi
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-10-02 16:54:01 +00:00
Luca Boccassi fdb0b47bf7 Merge pull request #29407 from CM4all/test-kernel-acl-dummy 
src/test: fixups for kernels without ACL and net-dummy
 2023-10-02 16:30:39 +01:00
Luca Boccassi df3e378a5d Merge pull request #29339 from bluca/mount_namespace_new_api 
Use new mount API for bind/image mount tunnel
 2023-10-02 16:04:26 +01:00
Benjamin Peterson 8ec951e8d5 resolve: tolerate merging a zero-ttl RR and a nonzero-ttl RR if not mDNS 
resolved rejected RRsets containing a RR with a zero TTL and a RR with a nonzero TTL. In practice—see the linked issues—, this case triggered when an AF_UNSPEC query to a CNAMEd domain returned a zero TTL for the CNAME on one address family and a nonzero TTL for the CNAME on the other address family.

The zero-nonzero TTL check cites RFC 2181 § 5.2 in a comment. That section says DNS clients should reject any RRset containing differing TTLs, which the check only implements a very special case of. That the old behavior caused real-world false NXDOMAIN results is reason enough to completely ignore the RFC's recommendation. However, mDNS treats zero TTLs specially, so the error case needs to be kept for mDNS.

Fixes https://github.com/systemd/systemd/issues/22177
Fixes https://github.com/systemd/systemd/issues/20617
Fixes https://github.com/systemd/systemd/issues/19118
 2023-10-02 16:47:36 +02:00
Lennart Poettering 015d19e3ac Merge pull request #29405 from poettering/boot-xmalloc0 
boot: add xmalloc0() + memzero() helpers
 2023-10-02 16:45:40 +02:00
Max Kellermann 8a87a16bbb test/test-execute: skip PrivateNetwork tests if kernel has no dummy netdevice support 2023-10-02 15:32:04 +02:00
Max Kellermann ec757e920c test/test-chown-rec: skip ACL tests if kernel has no ACL support 
The second half of `chown_recursive` works only if the kernel has ACL support.
 2023-10-02 15:32:04 +02:00
Luca Boccassi ddba5a1ad6 mount-util: use new mount API for image mount tunnel 2023-10-02 14:30:23 +01:00
Luca Boccassi 858a0dfce6 docs: add document about UEFI security posture in src/boot/efi/ 
This is not intended as a user guide, but to describe the generic security
posture of the UEFI components. Hence we do not publish it on systemd.io
but only in the repository.
 2023-10-02 14:29:10 +01:00
Luca Boccassi e428f1dd8a Merge pull request #29400 from yuwata/network-limit-read-size 
network: limit read size
 2023-10-02 14:23:51 +01:00
Yu Watanabe 7233c679d4 fuzz: limit size for fuzz-manager-serialize 
Fixes #29357 and oss-fuzz#62756
(https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62756).
 2023-10-02 14:23:34 +01:00
Luca Boccassi 3e1072726b dissect-image: support verity_dissect_and_mount() in two steps too 
With the new mount API first the image is opened, and later mounted
 2023-10-02 14:02:32 +01:00
Lennart Poettering 8d9a1d5979 dissect-image: optionally allow mounting via new kernel mount API in two steps 
This adds support for the new fsmount() logic of the kernel: we'll first
create an unattached fsmount fd, and then in a second step attach this
to some real file system inode – as opposed to attaching file system
directly. The benefit of this is that we can pass the open fsmount fds
over some sockets if need be, to isolate the mounting code from the
attaching code.
 2023-10-02 14:02:32 +01:00
Lennart Poettering 44cc82bfbf mount-util: add make_fsmount() 2023-10-02 14:02:32 +01:00
Luca Boccassi a7e0199ece mount-util: use new mount API for bind mount tunnel 
If we have the new mount API we can simplify bind mounting into a namespace
a lot
 2023-10-02 14:02:32 +01:00
Luca Boccassi f273c09c51 mountpoint-util: add bool mount_new_api_supported() helper 2023-10-02 14:02:32 +01:00
Luca Boccassi c7986bc9b6 test: fix check in test unit in TEST-50-DISSECT 
'[[ not found'
 2023-10-02 14:02:32 +01:00
Lennart Poettering 5a71b83002 util: add xmalloc0() helper 2023-10-02 15:02:26 +02:00
Lennart Poettering 4ac79c2b77 memory-util: move memzero() to src/fundamental/ to share with UEFI 
(and while we are at it, make sure it returns the input pointer as
output)
 2023-10-02 15:00:13 +02:00
Daan De Meyer 1e5e902f60 Merge pull request #29343 from DaanDeMeyer/tmp 
Use a subdirectory of /run/systemd for PrivateDevices=
 2023-10-02 14:29:32 +02:00
Daan De Meyer cd7f3702eb core: Use a subdirectory of /run/ for PrivateDevices= 
When we're starting early boot services such as systemd-userdbd.service,
/tmp might not yet be mounted, so let's use a directory in /run instead
which is guaranteed to be available.
 2023-10-02 12:23:13 +02:00
Luca Boccassi 34d4181fbb Merge pull request #29335 from abderrahim/version-info-check 
man: add checks for missing version information
 2023-10-02 10:56:15 +01:00
Daan De Meyer ce427d0e73 mount: Log when we can't create the mount point 
Debugging mount unit failures caused by systemd not being able to
create the mount point is currently rather hard. Let's log about
failures to create mount points to simplify debugging.
 2023-10-02 11:24:03 +09:00
Yu Watanabe 185e201690 journalctl: find boot ID more gracefully in corrupted journal 
In discover_next_boot(), first we find a new boot ID based on the value
stored in the entry object. Then, find the tail (or head when we are going
upwards) entry of the boot based on the _BOOT_ID= field data.

If boot IDs of an entry in the entry object and _BOOT_ID field data
are inconsistent, which may happen on corrupted journal, then previously
discover_next_boot() failed with -ENODATA.

This makes the function check if the two boot IDs in each entry are
consistent, and skip the entry if not.

Fixes the failure of `journalctl -b -1` for 'truncated' journal:
https://github.com/systemd/systemd/pull/29334#issuecomment-1736567951
 2023-10-02 10:59:33 +09:00
Yu Watanabe d287ece7f1 test: split test-tables into three 
Let's drop dependency to libjournal_core and libudevd_core from
test-tables.
 2023-10-02 10:52:45 +09:00
Yu Watanabe 1d3ef11dfe journal: move several tests to libsystemd/sd-journal 
This also renames test-journal-xyz for journald (rather than sd-journal)
to test-journald-xyz.
 2023-10-02 10:52:45 +09:00
Yu Watanabe f7b349e88d journal-remote: drop dependencies to journald 
Now journal-remote can be built without libjournal_core.
 2023-10-02 10:52:45 +09:00
Yu Watanabe 1e09470303 journald: move and rename journal/managed-journal-file.[ch] -> shared/journal-file-util.[ch] 
The files are used by both journald and journal-remote.
Let's move them to src/shared.
 2023-10-02 10:52:45 +09:00
Yu Watanabe 45c0ecba2d journald: drop ManagedJournalFile 
The ManagedJournalFile object is a trivial wrapper of JournalFile.
Let's drop it, and also drop 'managed_' prefix from the functions.
 2023-10-02 10:52:45 +09:00
Yu Watanabe 5f6b79b73b journald: split-out closing journal files from managed_journal_file_open() 
No functional change, just refactoring and preparation for later
commits.
 2023-10-02 10:52:45 +09:00
Yu Watanabe 34d17ac128 journald: do not close all files stored in Server.deferred_closes 
Just before the call of managed_journal_file_open(), we already called
server_vacuum_deferred_closes(), so there is a room to store the file.
 2023-10-02 10:52:45 +09:00
Yu Watanabe 4ed95fafad network: set maximum length to be read by read_full_file_full() 
Fixes #29264 and oss-fuzz#62556
(https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62556).
 2023-10-02 10:36:43 +09:00
Yu Watanabe 7e2a5fbd85 fileio: make read_full_file_full() usable with size and READ_FULL_FILE_UNBASE64 
When READ_FULL_FILE_UNBASE64 (or READ_FULL_FILE_UNHEX) is specified,
setting size argument by caller is difficult, as it is hard to estimate
the encoded length.

This makes when size is specified with decoding option, let's read file
more, and check decoded size later with the specified size.
 2023-10-02 10:36:43 +09:00
dependabot[bot] b503c76689 build(deps): bump meson from 1.2.1 to 1.2.2 in /.github/workflows 
Bumps [meson](https://github.com/mesonbuild/meson) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/mesonbuild/meson/releases)
- [Commits](https://github.com/mesonbuild/meson/compare/1.2.1...1.2.2)

---
updated-dependencies:
- dependency-name: meson
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-10-01 18:16:06 +00:00
dependabot[bot] 8ee09da6e8 build(deps): bump actions/checkout from 3.6.0 to 4.1.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.6.0 to 4.1.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/f43a0e5ff2bd294095638e18286ca9a3d1956744...8ade135a41bc03ea155e62e844d188df1ea18608)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-10-01 18:15:04 +00:00
dependabot[bot] a14438a85c build(deps): bump github/codeql-action from 2.21.5 to 2.21.9 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.21.5 to 2.21.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/00e563ead9f72a8461b24876bee2d0c2e8bd2ee8...ddccb873888234080b77e9bc2d4764d5ccaaccf9)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-10-01 18:14:32 +00:00
Abderrahim Kitouni b8f7a53751 man: add version info for newly added systemd-tpm2-setup.service 2023-10-01 11:54:29 +01:00
Abderrahim Kitouni 8074a03656 man: re-add some version info for sd_pid_get_owner_uid.xml 
These were mistakenly removed in 00f95506e2
 2023-10-01 11:54:29 +01:00
Abderrahim Kitouni 2de0bb2fad man: add a couple missing version annotations 
These were discovered by the newly added checks
 2023-10-01 11:54:29 +01:00
Abderrahim Kitouni 3691e7fce7 man: add checks for missing version information 
This adds a new script tools/check-version-history.py and a corresponding
test when building in developer mode. It checks manpages (except dbus
documentation which is handled by update-dbus-docs) for missing version
history information.

It also adds ignore lists based on version 183 (the version that our version
annotations go back to). These can be augmented if we want to ignore other
elements if it doesn't make sense for them to have version annotations.
 2023-10-01 11:54:29 +01:00
Jan Janssen a8b53f4f15 meson: Pass all -static-pie args to linker 
Fixes: #29381
 2023-10-01 11:49:51 +01:00
Luca Boccassi cf8c641733 Merge pull request #29384 from yuwata/sd-journal-cleanups-for-generic-array-get 
sd-journal: cleanups for generic_array_get()
 2023-10-01 11:28:32 +01:00
Yu Watanabe b05a88c1ae meson: drop unused home_includes 2023-10-01 10:28:55 +02:00