Let's update the window title with an ANSI sequence if we can. We'll
insert a blue dot, to match the blue tinting of the terminal screen,
indicating that we are in a container.
Common sense says that to "try" something means "to not fail if
something turns out not to be possible", thus do not make this
combination a hard error.
The actual implementation ignores any --link-journal= setting when
--ephemeral is in effect, so the semantics are upheld.
When I added the --background= switch I placed the empty line that was
supposed to separate the options from the next section before the switch
rather than after. Fix that.
To make issues like this harder to run into next time, let's move the \n
from the end of the preceeding line to the beginning of the section
title, since that's pretty much where they belong to.
Follow-up for: 3d8ba7b83f
These are wrappers around getpwuid_r() and friends, and will allocate the
right-sized buffer for this call.
We so far had multiple implementations of a buffer allocation loop
around getpwuid_r() and friends, and they all suck in some way. Let's
clean this up and add a common implementation, and use it everywhere.
Also, be more careful with error numbers, in particular systematically
turn ENOENT into ENOSRCH (the former is what is returned if /etc/passwd
is absent, which we want to consider identical to user not existing,
which is ENOSRCH). We so far did this at some invocations, but not all.
There are some invocations of getpwuid() left in the codebase. We really
should fix those too, and have a single unified implementation of the
logic, but those are not as trivial to convert, so left for another
time.
Let's grey the text out, and prefix it with a vertical grey bar, to make
clear this is output from the host, not the payload, and make it clearly
distinguishable from what follows.
Let's also make the image name clickable (with new enough
shared-mime-info this should allow you to look into the image with
gnome-disk-utility or a similar tool.
If the requested new name for a network interface is already assigned as a
alternative name, then it is not necessary to and cannot rename the
interface.
This also changes to use sd_device to get some attributes.
So, on moving interfaces back to the parent, we need to populate sysfs
associated to the client netns.
That may look redundant and complicated, but it makes later change
easier, and hopefully faster.
On Linux only the "w" access bit is necessary to connect to an AF_UNIX
socket, hence let's only set that and nothing else, to limit exposure.
Just paranoia.
This is gets the resource limits off a specified process, and is very
similar to prlimit() with a NULL new_rlimit argument. In fact, it tries
that first. However, it then falls back to use /proc/$PID/limits. Why?
Simply because Linux prohibits access to prlimit() for processes with a
different UID, but /proc/$PID/limits still works.
This is preparation to allow nspawn to run unprivileged.
THis brings the list of attributes to delegate to managers of subcgroups
to the state of kernel 6.6.
We probably should unify this list, and maybe generate it automatically
from /sys/kernel/cgroup/delegate, but let's do that another time.
Currently the check doesn't take any settings from nspawn settings
files into account, so let's delay the check until after we've
loaded any settings file.
This reverts commit 30462563b1.
fchmodat2(), while accepting AT_SYMLINK_NOFOLLOW as a valid flag,
always returns EOPNOTSUPP when operating on a symlink. The Linux kernel
simply doesn't support changing the mode of a symlink.
Fixes#30157
Introduce a new env variable $SYSTEMD_NSPAWN_CHECK_OS_RELEASE, that can
be used to disable the os-release check for bootable OS trees. Useful
when trying to boot a container with empty /etc/ and bind-mounted /usr/.
Resolves: #29185
Lennart Poettering
Sam Leonard
Yu Watanabe
Luca Boccassi
Mike Yuan
Ivan Shapovalov
Frantisek Sumsal
Matteo Croce
Daan De Meyer
Zbigniew Jędrzejewski-Szmek