In mkosi CI, we want persistent journals when running interactively
and runtime journals when running in CI, so let's add a credential
that allows us to configure which one to use.
When we fail to add an entry to a journal file, typically when the file
is full or corrupted, it is not necessary to rotate other journal files.
Not only that's unnecessary, rotating all journal files allows
unprivileged users to wipe system or other user's journals by writing
many journal entries to their own user journal file.
Let's rotate all journal files only when
- it is really requested by a privileged user (e.g. by journalctl --rotate), or
- the system time jumps backwards.
And, otherwise rotate only the journal file we are currently writing.
Clarify that `-p, --priority=` always treats its option as a priority range, even when given
a single log level per the full man page description.
Co-authored-by: Mike Yuan <me@yhndnzj.com>
The dot must follow the machine ID immediately, let's check for that.
Also, I think it's generally better to parse the machine ID and then
comparing it, instead of comparing the string representation. That's
more in line how we usually do it, as we parse 128bit IDs generally
case-insensitively.
The common case will be that no namespaces are defined, hence by default
we'd just output "NAMESPACE" and exit, which is very confusing.
Generate a nice message instead, how many of our tools do it. Suppress
it on --quiet however.
In many of our internal functions that take a pointer + a size we have
introduced the rule that SIZE_MAX as size means: take strlen().
sd_journal_add_match() has something similar, but the special value is
0, not SIZE_MAX. This is a bit ugly, since a zero size data block is
theoretically fine. The only reason sd_journal_add_match() gets away
with using this special value is because valid matches must consist of
at least 2 chars, hence cannot be zero.
But let's make this more robust and less surprising when compared to the
rest of our code, and *also* accept SIZE_MAX to mean strlen().
No actual code changes, just some clean-up.
gcrypt is used only for journal sealing operations in libsystemd, so it
can be made into a dlopen dependency that is used only on demand. This
allows to reduce the footprint of libsystemd in the most common cases.
Keep systemd-pull and systemd-resolved with normal linking, as they are
executables, and usually built with OpenSSL support anyway.
The function add_match_this_boot() calls sd_journal_add_conjunction(),
hence, we cannot specify multiple devices in the extra match arguments,
e.g., "journalctl /dev/sda /dev/sdb" shows no entry.
I am not sure it is explicitly documented that /var/log/journal should
be a directory, rather than a symlink to a directory, but the current
code of journald seems not to support symlinked directory well. Let's
refuse that at least here and now.
- split it into small pieces to reduce indentation,
- return earlier if no filter specified,
- use journal_add_matchf() and journal_add_match_pair(),
chase_and_stat(), is_symlink(), and sd_device_new_from_devname(),
- replace sd_device_get_devname() + stat() with sd_device_get_devnum(),
- refuse to install filter by path with --root, --image, or --machine
at least now, as previously it has not worked anyway.
- add missing assertions,
- use set_ensure_consume() and strv_consume(),
- use string_hash_ops_free and _cleanup_set_free_,
- use strv_fnmatch_full(),
- replace unused counter with a boolean flag,
- return earlier if no unit filtering is requested.
Fixes a regression introduced by 81fb5375b3.
If one of the cursor option is specified, we first seek to the cursor position.
So, the current position may be out of the time range specified by --until,
and we need to verify the timestamp of the current position.
Fixes#31776.
Co-authored-by: Reid Wahl <nrwahl@protonmail.com>
This means the main config file is loaded also from /run and /usr.
We should load the main config file from all the places where we load drop-ins.
I realize I had a giant blind spot: I always assumed that we load config files
from /etc, /run, /usr/local/lib, /usr/lib. But it turns out that we only used
those paths for drop-ins. For the main config file, we only looked in /etc. The
docs actually partially described this behaviour, i.e. most SYNOPSIS sections
and some parts of the text, but not others.
This is strange, because 6495361c7d was completely
bogus with the behaviour before this patch. We had a huge discussion before it
was merged, and clearly nobody noticed this. Similarly, in the previous version
of the current pull request, we had a long discussion about the appropriate
order of directories, and apparently nobody noticed that there was no order,
because only looked in one directory. So the blind spot seems to have been
shared.
Also, systemd-analyze cat-config behaved incorrectly, i.e. its behaviour matches
the new behaviour.
Possibly, in the future it'll make it easier to add support for --root.
This essentially reverts 5656cdfeea. I find it
much easier to understand what is going on when the
path-relative-to-the-search-path is passed in full, instead of being constructed
from two parts, with one of the parts being implicit in some places.
Also, we call 'systemd-analyze cat-config <path>' with <path> with the same
meaning, so this makes the internal and external APIs more consistent.
Dynamically load liblz4, libzstd and liblzma with dlopen().
This helps to reduce the size of the initrd image when these libraries
are not really needed.
let's make userspace verity signature checking optional. This adds a
dissection flag to enable the logic and patches through all our users to
enable it by default, thus effectively not changing anything from the
status quo ante. However, know we have a knob to turn this off in
certain scenarios.
The 1-based VT indexes are what people usually expect, since the primary
name of VTs uses them (i.e. /dev/tty1, /dev/tty2, …). Hence, let's
always use 1-based VT indexes, and early on convert 0-based VT indexes
to minimize confusion.
If specified we'll not try to find a free V, but instead just output
directly to the specified TTY. This is particularly useful for
debugging, as it means "systemd-bsod --tty=/dev/tty" just works.
Adds a SAFE_FD_FLAGS define to list out all the safe FD flags, and also
an UNSAFE_FD_FLAGS() macro to strip out the safe flags and leave only
the unsafe flags. This can be used to quickly check if any unsafe flags
are set and print them for diagnostic purposes
Daan De Meyer
Mike Yuan
Yu Watanabe
WinterhumanandMike Yuan
Lennart Poettering
Luca Boccassi
Antonio Alvarez Feijoo
Zbigniew Jędrzejewski-Szmek
Matteo Croce
Adrian Vovk