We often forget to run this command when updating manpages, and notice
only much later. Add a step in the CI to flag it, as we already do for
the D-Bus docs.
Cache the IPv6 enabled state while sizing and filling NSS result
buffers, so a transient sysctl read result cannot change the tuple or
address layout after the scratch buffer size has been computed. Also
zero-initialize gaih_addrtuple records before filling IPv4 addresses.
Follow-up for e8a7a31539
Automatic key modes tolerate a failed TPM2 sealing attempt and
fall back to a host or null key. Do not consume TPM2 blob output in
that case, tpm2_seal() leaves it empty on failure, so the fallback
path should continue without TPM2 metadata.
Follow-up for 9e4379945b
NDisc packets received through the socket path are filtered before
parser dispatch, but parser entry points should still reject malformed
packet bytes instead of asserting on them. Return EBADMSG for non-zero
ICMPv6 code values in RA, NA, and Redirect messages.
Follow-up for c34cb1d645
Follow-up for 696eb2b8de
Follow-up for 44e8cf303b
An OCI index redirect already carries the digest of the selected
manifest. Store it in the expected checksum field so pull-job
verifies the downloaded manifest instead of overwriting the digest
with the computed checksum before comparison.
Follow-up for a9f6ba0496
efi_get_variable() allocates one byte for probing whether efivarfs
has grown since fstat(), then three more bytes for NUL termination.
Account for both sizes separately so a full readv() result is treated
as concurrent growth and retried before the terminators are written.
Follow-up for ab69a04600
When MACAddress= is unspecified, a stable MAC is generated to seed a newly
created netdev. Since existing netdevs are reconfigured on reload/restart,
this seed got re-applied to an already existing interface, conflicting with
an explicit MACAddress= from the matching .network file and flipping MAC.
Now, when MACAddress= is unspecified, only generate a new address if
addr_assign_type is not NET_ADDR_SET (i.e. not already set by userspace). On
first creation the interface does not exist yet, so this is a no-op and the
address is generated as before. Mirrors src/udev/net/link-config.c.
Fixes: #42457
Stores the TPM2 SRK within the credential header, allowing for parameter decryption to be utilized when decrypting the credential.
A new dimension is added to the credential ID matrix to encode this capability.
This also allows for usage of TPM2-bound credentials when a TPM owner password is set since `Esys_CreatePrimary` is no longer used for sealing credentials.
When encrypting with the `--with-key=null` option systemd-creds
is currently doing the encryption via IPC. This is not needed
for the null key, no privs are required so we can just do the
in-process operation. So instead simply check for the null-key and
if its requested use the in-process path.
* b322b8d98e Install new files for upstream build
* 3fd1b81c94 Update changelog for 261.1-3 release
* 8f95f1370c Move modules-load from systemd package to udev package
* bcdf90c670 debian/libpam-systemd.postinst: pam-auth-update does not use getopt
* 743e3399ac d/README.source: document policy for adding new binary packages
* cbea74783c Install new files for upstream build
* ef267b3ad6 debian/libpam-systemd.postinst: run pam-auth-update with --root=$DPKG_ROOT
* 54df2859b4 d/t/upstream: use mkosi from archive for Ubuntu autopkgtest
* 21959e8a59 Fix zsh installation path, again
* f01dddb047 Fix zsh installation path
* e31737edc4 Install new files for upstream build
* ca0630a51e Update changelog for 261.1-2 release
* 1ebb987599 d/t/control: pull in cpio for upstream suite
* fcf5a24f47 Two more fixups for d/copyright
* 6ad198086d d/t/control: pull new packages in upstream test suite
* bb9fd757fd Make systemd actually temporarily depend on systemd-tpm
These are the next 3 commits from #42651. Split out again, in the hope
to get a review from claude.
ptal.
full test suite and docs are in #42651. test suite passed there.
This PR only sets the default to "relaxed" - I can change the default
to "tofu" if desired. But for that we will also need to update the NEWS
file to ensure everyone is aware of this new default.
---
This PR adds a new `systemd.credentials-boot=` kernel
commandline that allows to control if credentials with
a `null` key are accepted.
The possible options are:
* strict: always insist on tpm encryption
* tofu: allow null encryption in firstboot mode and when no tpm is
available
* relaxed: allow null encryption when sb is off, or no tpm is available
* off: allow null encryption always
The default is `relaxed` which is exactly the behavior we had before.
This replaces the initial idea of using plaintext credentials
at firstboot (thanks to Lennart for this nicer and simpler design).
---
With that we can drop `- firstboot: optionally accept credentials at
firstboot without authentication` from TODO.md
Extend real_has_cpu_with_flag to support aarch64 CPU Features using
hwcaps.
With this PR, users can find out if their Arm system supports
architecture-specific features such as BTI as follows:
```
$ systemd-analyze condition 'ConditionCPUFeature=bti'
```
These are philosophically similar concepts: one deletes old versions
based on whether they are old, and the other deletes old files based on
whether they are orphaned, let's list them together.
These do what updatectl's verbs of the same name does, but are
implemented as low-level concepts in sysupdate itself.
(The idea is to eventually wrap this in Varlink IPC, and make updatectl
use them that way.)
Let's switch to string_is_safe(), and make this available to the rest of
the sysupdate sources too.
This both relaxes and tighten the rules slightly. i.e. control character
and stuff are no longer allowed, but valid UTF-8 (as opposed to ASCII)
now is.
This is currently effectively not supported (as we sometimes prefix the
definitions path with root and sometimes not), let's make this official
for now and refuse it. We could in theory support the combination but I
don't see the big benefit of it for now, hence let's just refuse it.
When we have two match patterns, e.g., because the repository layout
changed and we look for old and new style files, we can have the case
that one pattern suggests a descend into a subdir but the other pattern
would be a direct match. This was missed and only the descent was done.
Yet the other way round also has to be covered: We can't just use the
direct match because it might be that it's rejected if the type doesn't
fit (directory vs. regular file). In this case we should still descent.
Remember that we want to descend but continue checking the other
pattern first to maybe get a direct match. Introduce a new combined
return code YES_AND_RETRY to give the full information to the caller
which now can decide to fallback to a descent. While at it, use the
stat info for the directory check. Also add tests to ensure that the
order of patterns doesn't matter and we handle the above corner cases.
While for sysupdate it's fine to consume a large set of all possible
update payloads in a single directory this is not so handy for managing
and serving the update payloads. Since this large update folder is not
where the build output directly gets written to one has to create
copies and later possibly delete this added set of files.
Support matching for filenames in subdirectories by having a new **/
match pattern prefix which matches any number of nested subdirectories
or no subdirectory at all. For simplicity it's only allowed at the start
of a pattern and not a regular wildcard as the rest because the main
use case is to descend into subdirectories and only do the pattern
matching for the basenames. This way one can create a SHA256SUMS file
in the top folder and have it include all update payloads from the
release-specific (or arch-specific) subdirectories. Something similar
was already supported for directory sources where the match pattern can
start with a subdirectory path. Do also support this for SHA256SUMS for
parity while we are at it. Having the new wildcard makes mirroring also
easier because one does not have to follow the exact subdirectory layout
and one can filter by folder instead of by filename. It also makes it
possible to point the same transfer files with the new wildcard to
either a SHA256SUMS file that uses release-specific (or arch-specific)
subdirectories and includes all versions or to a SHA256SUMS file as
generated from mkosi that does not use subdirectories because it only
has files for a single version.
With the upcoming UAPI.16 JSON format we will also be able to encode
subdirectories and it makes sense to add this to SHA256SUMS for being
able to convert them. It also supports custom URLs for each entry which
is more powerful than the (arbitrary) subdirectory feature used here but
subdirectories have the advantage that they don't break mirroring.
This change also fixes the existing subdirectory handling bugs where
everything greater than two subdirectory levels failed to work because
rel_joined instead of de->d_name got used, symlinks were followed, and
we would continue silently on non-ENOENT errors.
Adds dm-clone device setup at boot via a new /etc/clonetab config file,
following the crypttab/veritytab pattern.
- Add systemd-clonesetup-generator to parse /etc/clonetab and generate units.
- Add systemd-clonesetup binary to create/remove dm-clone devices via ioctl.
- Add clonesetup.target for ordering dm-clone activation at boot.
- Add region_size= option in clonetab to configure dm-clone hydration granularity.
- Add clonetab(5) and systemd-clonesetup-generator(8) man pages.
Fixes: https://github.com/systemd/systemd/issues/39500
Commit 9b917abe02 (udev-builtin:
simplify code a bit) changed builtin lookup from copying the first
command word and comparing it with streq() to comparing only the first
command word length with strneq().
That made prefixes such as "k" or "key" resolve to the "keyboard"
builtin, depending on the builtins table order. This was not the
original behavior.
Require the matched builtin name to end at the first command word
boundary so only complete builtin names are accepted. Arguments after
the builtin name continue to work as before.
Extend ConditionCPUFeature to support architecture prefixes in feature names.
The goal is avoiding ambiguities on mixed-arch fleets, where CPU feature names
may potentially conflict.
With this patch, ConditionCPUFeature=arm64.bti is now equivalent to
ConditionCPUFeature=bti on arm64 systems.
Signed-off-by: Emanuele Rocca <emanuele.rocca@arm.com>
Extend real_has_cpu_with_flag to support aarch64 CPU Features using hwcaps.
With this patch, users can find out if their Arm system supports
architecture-specific features such as BTI as follows:
$ systemd-analyze condition 'ConditionCPUFeature=bti'
Signed-off-by: Emanuele Rocca <emanuele.rocca@arm.com>
Add an override file for all capabilities missing in glibc v2.34 and musl
1.2.6. The constant AT_HWCAP3 is also not in glibc v2.34, ship a glibc-specific
elf.h in order to provide it.
Signed-off-by: Emanuele Rocca <emanuele.rocca@arm.com>
This PR optimizes the handling of `dlopen` ELF notes and reduces binary
footprints across the tree.
By enabling compiler section-splitting
(`-ffunction-sections`/`-fdata-sections`), the linker can now accurately
garbage-collect unused code and data. To align with this,
`SD_ELF_NOTE_DLOPEN_ANCHORED()` macro is introduced, which ties `dlopen`
notes to their calling functions so that unused notes are automatically
removed by `--gc-sections`.
Additionally, this explicitly embeds required `dlopen` notes into
individual executables to fix a visibility issue where package managers
missed runtime dependencies invoked indirectly through
`libsystemd-shared.so`.
--on-clock-change and --on-timezone-change are documented as shortcuts for
setting the corresponding timer properties with --timer-property=.
However, --timer-property= only treated the monotonic and calendar timer
settings as actual timer triggers. OnClockChange= and OnTimezoneChange=
were stored as timer properties, but arg_with_timer remained false and the
command was rejected as having no timer options.
Treat both properties as timer triggers too, matching the shortcut options
and the documented equivalent command line.
The OCI runtime specification names the memory swappiness knob
"swappiness" (memory.swappiness), but the dispatch table
in oci_cgroup_memory() registered it as "swapiness".
Since sd_json_dispatch_full() matches object keys by exact string
comparison, a spec-correct config carrying "swappiness" never hit the
intended oci_unsupported() handler and was instead routed to the
bad-field callback oci_unexpected(), which returns -EINVAL and thus
fails the whole memory cgroup section.
Register the correct key so that real OCI bundles parse, keep the
misspelt one around for compatibility, mark both as such, and drop the
now-resolved reminder from the file header TODO list.
udevadm info --cleanup-db cleaned links and tags by comparing them
against /run/udev/data, but asserted when that data directory was
missing.
Treat a missing data directory as an empty database, so stale link
and tag entries can be removed without aborting.
Add a database test that runs cleanup-db with links and tags present
but no data directory.
Reproducer:
$ sudo unshare --mount --propagation private sh -c '
mount -t tmpfs tmpfs /run/udev
mkdir -p /run/udev/links/foo
udevadm info --cleanup-db
'
Assertion 'datadir' failed at src/udev/udevadm-info.c:676, function cleanup_dirs_after_db_cleanup(). Aborting.
Aborted (core dumped)
The command should handle a missing /run/udev/data directory instead
of aborting.
The --children-max= option parsed into an unsigned value and then
stored it in an int sentinel field.
Values above INT_MAX could wrap negative and make the command look as
if no control option had been specified.
Reject oversized values before assigning the parsed value.
Reproducer:
$ udevadm control --children-max=2147483648
No control command option is specified.
$ echo $?
1
The value should be rejected as out of range instead of being wrapped
into the unset sentinel value.
When IMPORT{program} output was truncated, the code intended to drop
the last incomplete result line before importing properties.
It edited the command buffer instead of the output buffer, so the
incomplete line could still be parsed and imported.
Trim the result buffer and cover the behavior with the existing IMPORT
test.
Follow-up for 6b6e471a32.
Reproducer:
Configure an IMPORT{program} rule whose output exceeds UDEV_LINE_SIZE
and ends with an incomplete property line, for example:
TRUNCATED_OK=yes
TRUNCATED_BAD=<very long value without terminating newline>
Only TRUNCATED_OK should be imported. Before this fix, the truncation
handler edited the command buffer instead of the output buffer, so
TRUNCATED_BAD could still be parsed from the truncated result.
The deprecated udevadm hwdb command parsed --root for both update and
test modes, but the test path always queried the host database.
Pass the configured root to hwdb_query() so --root affects --test in
the same way as systemd-hwdb query.
Reproducer:
$ tmp=$(mktemp -d)
$ mkdir -p "$tmp/etc/udev/hwdb.d"
$ printf 'test:codex-root-test\n ID_TEST_CODEX=from-root\n' > "$tmp/etc/udev/hwdb.d/99-codex.hwdb"
$ systemd-hwdb --root="$tmp" update
$ systemd-hwdb --root="$tmp" query test:codex-root-test
ID_TEST_CODEX=from-root
$ udevadm hwdb --root="$tmp" --test=test:codex-root-test
udevadm hwdb is deprecated. Use systemd-hwdb instead.
The last command was expected to print ID_TEST_CODEX=from-root, but
queried the host database instead.
CONST{cvm} is documented and already handled when udev rules are
executed, but the parser rejected it before the rule could be used.
Include cvm in the supported CONST key list.
Follow-up for 6e2e83b48734e86992cbdbb329c48cc066cf7c96.
Reproducer:
$ printf 'CONST{cvm}=="none", NAME="x"\n' > /tmp/codex-cvm.rules
$ udevadm verify /tmp/codex-cvm.rules
/tmp/codex-cvm.rules:1 Invalid attribute for CONST.
/tmp/codex-cvm.rules: udev rules check failed.
1 udev rules files have been checked.
Success: 0
Fail: 1
Even though systemd-networkd and systemd-udevd do not support
ConditionSecurity= in .network, .netdev, and .link files, the unified
condition_test() function maintained a function pointer table that
unconditionally referenced condition_test_security(). Consequently,
linker garbage collection (--gc-sections) could not drop the security
test code, inadvertently pulling in dlopen dependencies and ELF notes
for apparmor, audit, and tpm2 libraries into these binaries.
To resolve this, introduce condition_test_net() and condition_test_list_net(),
which utilize a trimmed-down function pointer table that excludes
security-related condition evaluators.
By migrating networkd and udevd to these new network-specific variants,
the reference to condition_test_security() is completely severed in
their dependency chains. This allows the compiler and linker to
successfully garbage-collect the unused security logic and safely drops
the unnecessary dlopen notes from those binaries.
Previously, even though sd-journal does not support bzip2 and gzip
compression, the dlopen ELF notes for those libraries were still being
attached to libsystemd.so and various journal-handling executables.
This occurred because the unified compression/decompression interfaces
handled all formats unconditionally, causing the compiler and linker to
pull in all associated dlopen notes across the board.
To resolve this, split these functions into generic and journal-specific
variants (e.g., introducing compress_blob_journal() and decompress_blob_journal()).
The journal-specific variants only handle formats actually supported by
the journal (LZ4, XZ, and ZSTD).
By updating sd-journal, journald, journalctl, and related utilities to
use these new `_journal` interfaces and switching them to the narrower
COMPRESS_JOURNAL_NOTE macro, we ensure that unnecessary dlopen notes
(for bzip2 and gzip) are no longer embedded into these binaries.
Enable the `dlopen` unit test suite in GitHub Actions, except for the
following configurations where linker garbage collection (`--gc-sections`)
or dead-code elimination fails to drop unused dlopen symbols:
- ppc64le (both GCC and Clang)
- s390x (GCC only)
- Sanitizer-enabled setups
This introduces a test utility to validate the presence and correctness
of dlopen ELF notes.
The test extracts and compares dlopen ELF notes between the dynamic and
static versions of target binaries to catch missing entries. Furthermore,
it scans the code for dlopen_foo() invocations to ensure that no stale or
unused notes remain in the final binary, thereby verifying the linker's
garbage-collection integration.
When compiler optimization or LTO (Link Time Optimization) is enabled,
dlopen helper functions (such as dlopen_libfoo()) can be aggressively
inlined into their callers or cloned for specific call sites.
While this is beneficial for production builds, it alters or completely
removes the original function symbols from the final executable.
Consequently, this breaks the test (to be added in this series) that
checks whether the dlopen_libfoo() function corresponding to a dlopen
ELF note is actually called.
To resolve this, introduce the `_dlopen_loader_` macro. Under developer
builds, it applies the `_noclone_` and `_noinline_` attributes to guarantee
that helper symbols remain intact and discoverable by the test suite. In
production builds, the macro evaluates to nothing, allowing full compiler
optimization to proceed unimpeded.
Previously, when a library was dynamically loaded via a helper function
inside libsystemd-shared.so, the resulting dlopen ELF note was not
propagated to the invoking executable's ELF metadata.
This commit explicitly annotates each executable with the relevant
dlopen ELF notes for any optional dependencies it might potentially
load. This ensures that package managers and build systems can properly
discover runtime dependencies that are triggered indirectly.
Lennart Poettering
Luca Boccassi
Hans de Goede
Shihao Ren
Popax21
Michael Vogt
Yu Watanabe
Kai Lüke
Simran Singh
dongshengyuan
Emanuele Rocca
hanjinpeng