If mode= is not set in rootflags= add mode=0755 when a tmpfs
is used on the rootfs, otherwise it will be group/world writable
as that's the default mode for tmpfs filesystems.
Follow-up for 725ad3b062
Previously, the extra stub listners were stopped but new ones were not
started. Also, the main stub listners were not restarted, hence the
new settings were not applied. This fixes the above two issues.
Note, to fix the issue, we need to keep CAP_NET_BIND_SERVICE capability
to make it allow to bind stub listner later.
Fixes#37843.
- set defaults after all existing configs and setups cleared,
- mention failures are ignored in log messages,
- drop one redundant log message,
- do not return negative errno but exit event loop on critical failure.
This also makes ip6tnl can be created without specifying Mode= setting,
as the kernel accepts new-link netlink message without the
IFLA_IPTUN_PROTO attribute.
No effective functional change, just refactoring and preparation for
later change.
With 9ccc369ff3, PersistLeases= is
disabled on the host side virtual interfaces for containers.
However, even it is not necessary to save the leases for containers
on a persistent storage, still we should save them on somewhere.
Otherwise, leases will be lost when networkd on the host is restarted
or the host side interface is reconfigured.
This introduce PersistLeases=runtime to save and load leases on runtime
storage.
Add the following network option to enable BOOTP:
[DHCPv4]
Bootp=yes
This will allow a two message request / reply sequence that doesn't
require DHCP message types.
Co-authored-by: Avram Dorfman <dorfman@est.org>
BOOTP can be used to sign a static IP to clients. Instead of using the
four message exchange, and Option 53 (DHCP Message Type) there is only a
two message exchange. This adds the support for this exchange.
Co-authored-by: Avram Dorfman <dorfman@est.org>
Co-authored-by: Yu Watanabe <watanabe.yu+github@gmail.com>
Previously, the property was checked only when an uevent is received,
so even if an interface has ID_NET_MANAGED_BY property, the interface
will be configured by networkd when reconfiguration is triggered e.g.
when interface state is changed.
Follow-up for ba87a61d05.
Fixes#36997.
Since shim 16, it is not possible anymore to override the security arch
protocol to avoid signature check and measurements.
Also on Dell servers, EFI_SECURITY2_ARCH_PROTOCOL is not implemented, so
unexpected measurements on PCR 4 were still happening.
This just loads and run the kernel pe. We verify that there is no relocation
needed. Also for simplification, we assume and verify that the base address is
expected to be 0.
mDNS replies always have to come from the mDNS port (unlike mDNS
queries, which are also allowed from non-mDNS ports). Hence refuse this.
Fixes: #33806
The pkcs7_new() function currently uses the hash algorithm from the X509
certificate's signature, but the content signature may use a different
hash algorithm. This adds a parameter to allow specifying what hash
algorithm the content signature generation used.
Lennart Poettering
Mike Yuan
Luca Boccassi
Yu Watanabe
Ryan Blue
Valentin David
Colin FosterandAvram Dorfman
Luca Boccassi