Create a unit test for systemd timer DeferReactivation config option.
The test works by creating a timer which fires every 5 seconds and
starts an unit which runs for 5 seconds.
With DeferReactivation=true, the timer must fire every 5+5 seconds,
instead of the 5 it fires normally.
As we need at least two timer runs to check if the delta is correct,
the test duration on success will be at least 20 seconds.
To be safe, the test script waits 35 seconds: this is enough to get
at least three runs but low enough to avoid clogging the CI.
By default, in instances where timers are running on a realtime schedule,
if a service takes longer to run than the interval of a timer, the
service will immediately start again when the previous invocation finishes.
This is caused by the fact that the next elapse is calculated based on
the last trigger time, which, combined with the fact that the interval
is shorter than the runtime of the service, causes that elapse to be in
the past, which in turn means the timer will trigger as soon as the
service finishes running.
This behavior can be changed by enabling the new DeferReactivation setting,
which will cause the next calendar elapse to be calculated based on when
the trigger unit enters inactivity, rather than the last trigger time.
Thus, if a timer is on an realtime interval, the trigger will always
adhere to that specified interval.
E.g. if you have a timer that runs on a minutely interval, the setting
guarantees that triggers will happen at *:*:00 times, whereas by default
this may skew depending on how long the service runs.
Co-authored-by: Matteo Croce <teknoraver@meta.com>
bpf_current_task_under_cgroup() returns 1 if the task is under the
specified cgroup, 0 if not, negative if an error happens.
Differentiate the 1 and -1 cases, and report to userspace when we got
and error.
An error like this is mostly unlikely, the only common one is that the
userspace doesn't populate the map, and the call returns -EAGAIN.
Tested by mocking the return value of bpf_current_task_under_cgroup():
Enumeration completed
enp1s0f0np0: Configuring with /etc/systemd/network/20-test.network.
Sysctl monitor BPF returned error: Link number out of range
Sysctl monitor BPF returned error: No CSI structure available
Sysctl monitor BPF returned error: Invalid exchange
Sysctl monitor BPF returned error: Exchange full
Sysctl monitor BPF returned error: Invalid request code
Sysctl monitor BPF returned error: Unknown error 58
Sysctl monitor BPF returned error: Device not a stream
Sysctl monitor BPF returned error: Timer expired
Sysctl monitor BPF returned error: Machine is not on the network
Sysctl monitor BPF returned error: Object is remote
Sysctl monitor BPF returned error: Advertise error
- make it accept an empty string,
- use config_parse_in_addr_prefix(),
- move null address checker to address_section_verify().
No functional change, just refactoring.
Previously, the below was refused and the IPv6 address would not assigned.
===
[Address]
Address=2001:db8:0:f101::15/64
Broadcast=192.168.0.255
===
However, in the following case, networkd warned about the broadcast
address would be ignored, and the IPv6 address would be configured.
===
[Address]
Broadcast=192.168.0.255
Address=2001:db8:0:f101::15/64
===
Also, this makes the settings parsed independently, and the
inconsistency will be checked in the section verifier.
No functional change, just refactoring.
Follow-up for 3543456f84
I don't think list is particularly useful here. The passed fds are
constant for the lifetime of service, and with this commit we track
the number of extra fds in a dedicated var anyway.
This is a new syscall provided by the kernel used to implement faster
uprobes. It's not supposed to be called by userspace, but only by kernel
generated uprobe code.
It should be fine to allow this, as the kernel authenticates the
invocation itself, and we shouldn't break compat with things.
Note that this allowlisting is not sufficient to make ureprobe() work.
libseccomp must be tought the syscall too, but this can happen
independently.
Fixes: #34615
We do half a validation currently ourselves (i.e. check the header fits
into the rest of the data), and leave the other half to the
caller (i.e. check the table fits into the rest of the data).
get_smbios_table() is changed to accept the minimum object size and
validates it before returning a table.
Based on a discussion with @anonymix007.
Let's more clearly indicate that we failed to set up the server
which forwards messages from the remote client to the local bus
instead of logging a generic bus client message.
Let's move this check to bus_connect_transport_systemd() so that
bus_connect_system_systemd() will only ever connect to the manager
private manager bus instance and fail otherwise.
We have various callsites that explicitly need the manager bus and
won't work with the system bus, like daemon-reexec and friends which
can't properly wait until the operation has finished unless using the
manager bus.
If we silently fall back to the system bus for these operations, we
can end up with rather hard to debug issues so let's remove the fallback
as it was added back in 2013 in a6aa89122d
without a clear explanation of why it was needed (I expect as a fallback
if kdbus wasn't available but that's not a thing anymore these days).
We might also fail to connect to the private manager bus itself if
the daemon-reexec is still ongoing, so let's handle that as well by
retrying on ECONNREFUSED.
When building unprivileged, the testuser home directory ends up
owned by root:root because mkosi can't chown directories to other
owners when running unprivileged. So let's fix up the testuser
ownership on first boot with tmpfiles instead.
Matteo Croce
Arthur ShauandMatteo Croce
Yu Watanabe
Daan De Meyer
Lucas Adriano Salles
Mike Yuan
Lennart Poettering
anonymix007