Commit Graph
80213 Commits
Author SHA1 Message Date
Lennart Poettering b0fe8df5a9 Several fixlets for Coverity (#36791) 2025-03-19 22:27:00 +01:00
Yu Watanabe bb8c74d7f2 Introduce ConditionVersion (#36468)
Add a new condition which can check against systemd version.

        $ systemctl --version
        systemd 258 (258~devel-g53ca5f6)

        $ systemd-analyze condition 'ConditionVersion=systemd>255'
        test.service: ConditionVersion=>255 succeeded.

        $ systemd-analyze condition 'ConditionVersion=systemd>260'
        test.service: ConditionVersion=>260 failed.

        $ systemd-analyze condition 'ConditionVersion=systemd>=258'
        test.service: ConditionVersion=>=258 succeeded.

        $ systemd-analyze condition 'ConditionVersion=systemd>=257.1'
        test.service: ConditionVersion=>=257.1 succeeded.

        $ uname -r
        6.12.13-200.fc41.aarch64

        $ systemd-analyze condition 'ConditionVersion=kernel > 4.4'
        test.service: ConditionVersion=kernel > 4.4 succeeded.

        $ systemd-analyze condition 'ConditionVersion=kernel > 6.20'
        test.service: ConditionVersion=kernel > 6.20 failed.

        $ systemd-analyze condition 'ConditionVersion=kernel < 9.0'
        test.service: ConditionVersion=kernel < 9.0 succeeded.
2025-03-20 06:15:35 +09:00
Lennart Poettering bb160976b0 cgroup: whenever we migrate a PID to a unit, explicitly drop unit from empty notification queue
A unit might be pending in the empty queue still when we add a PID to
the cgroup. At that point, let's explicitly remove the unit from that
queue.

Fixes: #36781
2025-03-19 21:40:33 +01:00
Lennart Poettering 0015502168 tpm2-util: return better errors if we try to unlock a tpm key on the wrong tpm
Let's improve error handling in case one tries to unlock a TPM2 locked
volume on a different machine via TPM than it was originally enrolled
on. Let's recognize this case and print a clearer error message.
2025-03-19 21:27:54 +01:00
Daan De Meyer 0e0f4cc60c various verity generator tweaks (#36802) 2025-03-19 19:26:03 +01:00
Lennart Poettering f21090d217 generator: skip fsck early for non-blockdev file systems, or file systems that are always read-only 2025-03-19 18:18:43 +01:00
Lennart Poettering 179dcf924f sd-event: make pidfd copy in event_add_child_pidref()
So far we'd directly use the pidfd passed into event_add_child_pidref(),
hoping it would not be closed by the caller before we are done. This was
violated by vmspawn however.

Let's make this safe, and simply duplicate the fd, and make us
independent of the caller.
2025-03-19 18:14:24 +01:00
Lennart Poettering bed546d187 veritysetup-generator: repeat format string arguments a bit less 2025-03-19 16:32:02 +01:00
Lennart Poettering 64f8df2f31 veritysetup-generator: specify source for generator_open_unit_file() 2025-03-19 16:32:02 +01:00
Lennart Poettering eedd0b9886 veritysetup-generator: exit on first error 2025-03-19 16:32:02 +01:00
Lennart Poettering 0ec1a83eea veritysetup: automatically generate unit name, instead of hardcoding it 2025-03-19 16:32:02 +01:00
Daan De Meyer 511bf79b4e userdb: Add userdb.user.* and userdb.group.* credentials (#36740)
Let's allow providing extra userdb users and groups via credentials.
Similarly to systemd-udev-load-credentials.service, we ship
systemd-userdb-load-credentials.service which transform the JSON
user/group records provided via the corresponding credentials to static
userdb dropins in /run/userdb.
2025-03-19 10:30:52 +01:00
Daan De Meyer 04a44e25b9 units: Add systemd-machined.socket 2025-03-19 09:28:12 +01:00
Yu Watanabe 707bea6a48 ptyfwd: use usec_add()
Fixes CID#1548038.
2025-03-19 11:41:25 +09:00
Yu Watanabe 4b4181f4ac io-util: add one more assertion for Coverity
Fixes CID#1548067.
2025-03-19 11:41:25 +09:00
Yu Watanabe 91c4d1affd nspawn-oci: update overflow check
Fixes CID#1548072.
2025-03-19 11:41:25 +09:00
Yu Watanabe 816c6ec883 sd-dhcp-client: use event_reset_time_relative()
Fixes CID#1548073.
2025-03-19 11:41:25 +09:00
Yu Watanabe 11065c598c logs-show: comment out dead code
Follow-up for 280e85224e.
Fixes CID#1548921 and CID#1548922.
2025-03-19 11:41:12 +09:00
Yu Watanabe e8784005a6 logind-action: use BIT_SET() and SET_BIT()
Hopefully fixes CID#1529417.
2025-03-19 10:47:34 +09:00
Yu Watanabe b0282ecf45 journal: fix indentation 2025-03-19 10:41:29 +09:00
Yu Watanabe 6a6cc56125 bus-unit-procs: add one more assertion for Coverity
Hopefully fixes CID#1562447.
2025-03-19 10:41:29 +09:00
Yu Watanabe 9dc735426a boot: always pass an array of PeSectionVector to pe_locate_sections()
Hopefully silences false-positive warnings by Coverity.
Fixes CID#1549198, CID#1549199, CID#1564903.
2025-03-19 10:40:31 +09:00
Yu Watanabe c995855266 bitfield: check if specified index is non-negative
Hopefully silences false-positive warnings by Coverity e.g. CID#1590746.
2025-03-19 09:56:04 +09:00
Daan De Meyer 95f94bc804 Update TODO 2025-03-18 22:46:10 +01:00
Daan De Meyer a8a44b7ce5 mkosi: Create testuser at runtime
Now that we have userdb credentials, let's ship testuser as a userdb
credential instead of including it in the image.
2025-03-18 22:46:10 +01:00
Daan De Meyer fe0342edf4 userdb: Add userdb.user.* and userdb.group.* credentials
Let's allow providing extra userdb users and groups via credentials.
Similarly to systemd-udev-load-credentials.service, we ship
systemd-userdb-load-credentials.service which transform the JSON
user/group records provided via the corresponding credentials to static
userdb dropins in /etc/userdb.

Replaces #33811
2025-03-18 22:46:10 +01:00
Daan De Meyer e5039d459e mkosi: Make sure systemd-userdbd.socket is enabled 2025-03-18 22:46:10 +01:00
Daan De Meyer 5ecc08e033 mkosi: Add unix_chkpwd to sanitizer wrapped binaries
unix_chkpwd will retrieve the user name of the uid it is invoked as
and as such needs the asan workaround.
2025-03-18 22:46:10 +01:00
Daan De Meyer 9165d92406 mkosi: Bump to Fedora 42
Beta was just released, let's switch to Fedora 42 which coincidentally
also has a crucial fix for its nsswitch.conf to make the next commits
actually work.
2025-03-18 20:35:59 +01:00
Daan De Meyer d2ce0db7a7 Several fixes and cleanups around sd_listen_fds() (#36788) 2025-03-18 20:10:33 +01:00
Lennart Poettering bc78fc4de3 update TODO 2025-03-18 18:12:48 +01:00
Yu Watanabe b8d5303733 nspawn: make failure in sd_listen_fds() critical
Also, drop doubled call of sd_listen_fds().
2025-03-19 02:09:40 +09:00
Yu Watanabe 024bb0c63e oomd: do not ignore failure in sd_lisen_fds()
Also, use -EBADF for an invalid file descriptor.
2025-03-19 01:47:48 +09:00
Yu Watanabe d50b9cbe56 vmspawn: do not use r for loop count
In a future, we may call some functions and r may be used for storing
error code of them. Let's not use r for the maximum number of loop count.
2025-03-19 01:47:48 +09:00
Yu Watanabe a65d2de6d1 sd-varlink: fix overwrite of loop count
Fixes a bug introduced by 206504a594 (v255).
2025-03-19 01:47:20 +09:00
Yu Watanabe 59cb9b12ab initctl: fix error handling
Fixes a bug introduced by cc090ca7fe (v246).
2025-03-19 01:44:01 +09:00
Yu Watanabe a0272b8356 nsresourced: fix assignment of target_gid
Follow-up for 00b1f67313.

Fixes CID#1593901.
2025-03-18 12:13:38 +00:00
Lennart Poettering 160a4281f5 man: base64 is not hex 2025-03-18 12:13:15 +00:00
Lennart Poettering 7b0c843b87 TODO 2025-03-18 11:48:37 +01:00
Lennart Poettering 8d3acc8387 update TODO 2025-03-18 10:45:32 +01:00
Matteo Croce c154bb65ad condition: introduce ConditionVersion=/AssertVersion=
Add a new condition wich checks against systemd version.
Change condition_test_kernel_version() into a generic condition_test_version()
so most of the code can be reused.

    $ systemctl --version
    systemd 258 (258~devel-g53ca5f6)

    $ systemd-analyze condition 'ConditionVersion=systemd>255'
    test.service: ConditionVersion=>255 succeeded.

    $ systemd-analyze condition 'ConditionVersion=systemd>260'
    test.service: ConditionVersion=>260 failed.

    $ systemd-analyze condition 'ConditionVersion=systemd>=258'
    test.service: ConditionVersion=>=258 succeeded.

    $ systemd-analyze condition 'ConditionVersion=systemd>=257.1'
    test.service: ConditionVersion=>=257.1 succeeded.

    $ uname -r
    6.12.13-200.fc41.aarch64

    $ systemd-analyze condition 'ConditionVersion=kernel > 4.4'
    test.service: ConditionVersion=kernel > 4.4 succeeded.

    $ systemd-analyze condition 'ConditionVersion=kernel > 6.20'
    test.service: ConditionVersion=kernel > 6.20 failed.

    $ systemd-analyze condition 'ConditionVersion=kernel < 9.0'
    test.service: ConditionVersion=kernel < 9.0 succeeded.
2025-03-18 18:36:59 +09:00
Yu Watanabe f91273f4fc condition: align string table 2025-03-18 18:36:59 +09:00
Yu Watanabe a483c39fc2 analyze-condition: rewrite condition parser
No functional change, just a refactoring.
2025-03-18 18:36:55 +09:00
Yu Watanabe 910dcd7049 getty-generator: unify add_serial_getty() and add_container_getty()
This also makes the generator not trigger an assertion added by
1cd3c49d09. If getty.ttys.container
credential contains a line prefixed with '/dev/', then the assertion
    assert(!path_startswith(tty, "/dev/"));
was triggered. This drops the offending assertion, and such lines
are handled gracefully now.

Also, an empty string, "/dev/", and "/dev/pts/" (that is, a directory
without tty name) are gracefully skipped now.
2025-03-18 18:25:10 +09:00
Lennart Poettering 0364329a03 xattr-util: refuse embedded NUL bytes in getxattr_at_malloc() (#36713) 2025-03-18 09:10:19 +01:00
Lennart Poettering 2d47f43b43 cgroup-util: remove cg_get_xattr(), it's apparently unused 2025-03-18 07:17:10 +01:00
Lennart Poettering 33cbda04eb xattr-util: rework getxattr_at_malloc()
Let's return the size in a return parameter instead of the return value.
And if NULL is specified this tells us the caller doesn't care about the
size and expects a NUL terminated string. In that case look for an
embedded NUL byte, and refuse in that case.

This should lock things down a bit, as we'll systematically refuse
embedded NUL strings now when we expect strings.
2025-03-18 07:17:10 +01:00
Sonia Zorba 147511c643 hwdb: fix backspace not working on HP Pavilion laptop (#36777)
PR #34685 moved the handling of keys 66/65 from specific models to
generic HP laptops.

Key 66 has been linked to the `pickup_phone` function; however, this
action key is not available on all HP laptop models, particularly older
versions. On my HP Pavilion laptop, key 66 is mapped to the `backspace`
function, which caused the backspace key to stop working after the
change.

The following PR fixes the issue on my **HP Pavilion Laptop 15-eg0xxx**.
I have placed the modifications under the Pavilion section, but I cannot
guarantee that this solution will apply to all Pavilion models.

Additionally, I have included a line that checks for "HP" instead of
solely searching for "Hewlett-Packard," as my model is simply labeled as
HP.
2025-03-18 09:25:51 +09:00
Yu Watanabe c9c2679a62 some user record fixes (#36776)
Fixes: https://github.com/systemd/systemd/issues/36775
2025-03-18 09:24:05 +09:00
Mike Yuan 2b983b43c6 run: Ref() the unit again after reconnecting to the bus
Follow-up for c8f59296bf

Currently, the unit is only reffed in transient_unit_set_properties()
via AddRef(), which however would be dropped if a reconnection
is attempted. Make sure to explicitly re-add reference in that case.
2025-03-18 09:23:44 +09:00