SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
83,324 Commits 2 Branches 1 Tag
b4beaafb2455facd6aa4f444979ffdeedd17a684
Commit Graph
83324 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Lennart Poettering b4beaafb24 update TODO 2025-08-14 08:35:15 +02:00
Luca Boccassi 4f9f0e5041 ukify: drop NX bit from UKI if kernel doesn't have it 
If the kernel is not NX_COMPAT ready (W^X memory compatible) then the
UKI should not be marked as NX_COMPAT ready either, as the kernel
section is the loadable code in the image.

https://microsoft.github.io/mu/WhatAndWhy/enhancedmemoryprotection/
https://www.kraxel.org/blog/2023/12/uefi-nx-linux-boot/

While the sd-stub EFI code itself is NX ready, it is more useful
to think of it as one unit of execution together with the kernel
it embeds, as that's what it is used for.

Fixes https://github.com/systemd/systemd/issues/38545
 2025-08-14 03:49:20 +09:00
Yu Watanabe 30f1d29f39 tree-wide: various terminal related fixlets (#38544) 
Fixes #38524.
Fixes #38527.
Fixes #38552.
 2025-08-14 03:40:44 +09:00
Yu Watanabe 660244a7fc core: do not start watchdog for frozen service on daemon-reload/-reexec (#38553) 
Fixes #38551.
 2025-08-14 01:18:50 +09:00
Yu Watanabe 53878b5b3e TEST-72-SYSUPDATE: fix indentation and drop space in blank line 2025-08-13 23:54:26 +09:00
Yu Watanabe 535539222d TEST-72-SYSUPDATE: make randomly generated image file not have compression header 
Otherwise, the generated image may be wrongly detected as compressed,
and importing the image may fail:
```
[   35.194578] TEST-72-SYSUPDATE.sh[411]: + dd if=/dev/urandom of=/var/tmp/test-72-N7uTeO/source/part1-v5.raw bs=4096 count=2048
[   35.236342] TEST-72-SYSUPDATE.sh[1075]: 2048+0 records in
[   35.236342] TEST-72-SYSUPDATE.sh[1075]: 2048+0 records out
[   35.236342] TEST-72-SYSUPDATE.sh[1075]: 8388608 bytes (8.4 MB, 8.0 MiB) copied, 0.0408601 s, 205 MB/s
(snip)
[   35.948634] TEST-72-SYSUPDATE.sh[1085]: \ Acquiring /var/tmp/test-72-N7uTeO/source/part1-v5.raw → /proc/self/fd/3p2...
[   35.952878] TEST-72-SYSUPDATE.sh[1085]: Successfully forked off '(sd-import-raw)' as PID 1089.
[   35.958952] TEST-72-SYSUPDATE.sh[1089]: Importing '/var/tmp/test-72-N7uTeO/source/part1-v5.raw', saving at offset 9437184 in '/dev/loop0'.
[   35.959575] TEST-72-SYSUPDATE.sh[1089]: Failed to decode and write: Input/output error
[   35.959575] TEST-72-SYSUPDATE.sh[1089]: Exiting.
```

Fixes #38524.
 2025-08-13 23:54:18 +09:00
Yu Watanabe 2633ed01ca import: add a debugging log of importing blob 
This should be helpful for debugging issue #38524.
 2025-08-13 23:44:58 +09:00
Yu Watanabe defac931c0 import: align table 2025-08-13 23:44:58 +09:00
Yu Watanabe 00085ba6c2 import,sysupdate: make notify event processed before SIGCHLD of worker processes 
This fixes the following warning:
```
[    5.628796] TEST-13-NSPAWN.sh[299]: + importctl import-raw --class=confext /var/tmp/importtest
(snip)
[    5.638894] systemd-importd[302]: (transfer1) Operation completed successfully.
[    5.640760] TEST-13-NSPAWN.sh[318]: ^MTotal:   0%^MTotal:  40%
[    5.638902] systemd-importd[302]: (transfer1) Exiting.
[    5.638931] systemd-importd[302]: Got percentage from client: 40%
[    5.638956] systemd-importd[302]: Transfer process succeeded.
[    5.638988] systemd-importd[302]: Got notification datagram from unexpected peer, ignoring.
```
 2025-08-13 23:44:58 +09:00
Yu Watanabe 3796391497 pretty-print: show progress bar only when we are running on a TTY 
Otherwise, when a command is running with e.g. StandardError=journal+console,
journal contains [xxxB blob data]:
```
[    5.628796] TEST-13-NSPAWN.sh[299]: + importctl import-raw --class=confext /var/tmp/importtest
[    5.632350] systemd-importd[302]: Successfully forked off '(sd-transfer)' as PID 319.
[    5.633671] TEST-13-NSPAWN.sh[318]: [83B blob data]
[    5.632598] (sd-transfer)[319]: Calling: /usr/lib/systemd/systemd-import raw --class confext - importtest
[    5.637769] systemd-importd[302]: (transfer1) Importing '/var/tmp/importtest', saving as 'importtest'.
[    5.637947] TEST-13-NSPAWN.sh[318]: [82B blob data]
[    5.638313] TEST-13-NSPAWN.sh[318]: [75B blob data]
[    5.638151] systemd-importd[302]: (transfer1) Operating on image directory '/var/lib/confexts'.
[    5.638863] systemd-importd[302]: (transfer1) Imported 40%.
[    5.638882] systemd-importd[302]: (transfer1) Wrote 40K.
[    5.639653] TEST-13-NSPAWN.sh[318]: [39B blob data]
[    5.639653] TEST-13-NSPAWN.sh[318]: [36B blob data]
[    5.639653] TEST-13-NSPAWN.sh[318]: [59B blob data]
[    5.639653] TEST-13-NSPAWN.sh[318]: [34B blob data]
[    5.638894] systemd-importd[302]: (transfer1) Operation completed successfully.
[    5.640760] TEST-13-NSPAWN.sh[318]: [25B blob data]
[    5.638902] systemd-importd[302]: (transfer1) Exiting.
```
The blob data entries are something like the following:
```
[    5.628796] TEST-13-NSPAWN.sh[299]: + importctl import-raw --class=confext /var/tmp/importtest
[    5.632350] systemd-importd[302]: Successfully forked off '(sd-transfer)' as PID 319.
[    5.633671] TEST-13-NSPAWN.sh[318]: ^M           ^MEnqueued transfer job 1. Press C-c to continue download in background.
[    5.632598] (sd-transfer)[319]: Calling: /usr/lib/systemd/systemd-import raw --class confext - importtest
[    5.637769] systemd-importd[302]: (transfer1) Importing '/var/tmp/importtest', saving as 'importtest'.
[    5.637947] TEST-13-NSPAWN.sh[318]: ^MTotal:   0%^M           ^MImporting '/var/tmp/importtest', saving as 'importtest'.
[    5.638313] TEST-13-NSPAWN.sh[318]: ^MTotal:   0%^M           ^MOperating on image directory '/var/lib/confexts'.
[    5.638151] systemd-importd[302]: (transfer1) Operating on image directory '/var/lib/confexts'.
[    5.638863] systemd-importd[302]: (transfer1) Imported 40%.
[    5.638882] systemd-importd[302]: (transfer1) Wrote 40K.
[    5.639653] TEST-13-NSPAWN.sh[318]: ^MTotal:   0%^M           ^MImported 40%.
[    5.639653] TEST-13-NSPAWN.sh[318]: ^MTotal:   0%^M           ^MWrote 40K.
[    5.639653] TEST-13-NSPAWN.sh[318]: ^MTotal:   0%^M           ^MOperation completed successfully.
[    5.639653] TEST-13-NSPAWN.sh[318]: ^MTotal:   0%^M           ^MExiting.
[    5.638894] systemd-importd[302]: (transfer1) Operation completed successfully.
[    5.640760] TEST-13-NSPAWN.sh[318]: ^MTotal:   0%^MTotal:  40%
[    5.638902] systemd-importd[302]: (transfer1) Exiting.
```

Fixes #38552.
 2025-08-13 23:44:58 +09:00
Yu Watanabe d62adb5554 core/execute: add one more FIXME comment 2025-08-13 23:44:58 +09:00
Yu Watanabe 379d9ae222 core: do not touch tty when StandardOutput=/StandardError=journal+console/kmsg+console 2025-08-13 23:44:42 +09:00
Yu Watanabe da34c27bb1 core: make is_terminal_input() and friends inline 
Then, rename them to exec_input_is_terminal() and so on.
 2025-08-13 23:43:52 +09:00
Yu Watanabe 18924bc784 core: do not print OSC sequence on reverting TTY settings when running on a dumb terminal 
Like we do in prepare_terminal() in exec-invoke.c.
 2025-08-13 23:43:52 +09:00
Yu Watanabe 92366b8fbc nspawn: always set TERM=dumb when running with a pipe 
Otherwise, we will get unexpected OSC sequences.
 2025-08-13 23:43:52 +09:00
Yu Watanabe f79f89c202 profile: do not prompt OSC sequences when running on a dumb terminal 2025-08-13 23:43:51 +09:00
Yu Watanabe cace9cf6f6 machinectl: set TERM=dumb when running on a dumb terminal or with a pipe 
Fixes #38527.
 2025-08-13 23:43:51 +09:00
keentux 3e14d02500 detect-virt: bare-metal GCE only for x86 and i386 
From the previous changes, bare-metal support has been added by using
the `detect_vm_cpuid()` which works only for x86_64 and i386 architecture.
Do not use this change for other architectures to avoid wrong result of
the detect-virt tool.

Follow-up for fb71571d3a.
Fixes #38125.
 2025-08-13 21:16:19 +09:00
Antonio Alvarez Feijoo 13358b7ce2 bootctl: specify that kernel image commands require a kernel image argument 2025-08-13 11:28:22 +01:00
Yu Watanabe 5e4115e59e TEST-17-UDEV: rotate journal before checking 
Otherwise, journal files may be rotated during checking journal entries
and the main system journal file may not be loaded:
```
[  350.372652] TEST-17-UDEV.sh[5841]: + test b253:2 = b253:2
[  350.373288] TEST-17-UDEV.sh[5841]: + [[ 1 == \1 ]]
[  350.373722] TEST-17-UDEV.sh[5841]: + journalctl -n 1 -q -u systemd-udevd.service --invocation=0 --grep 'Found inotify watch .*457'
[  350.374534] TEST-17-UDEV.sh[5970]: Journal file /run/log/journal/edc1fb58daff00ad89d6c8d9689bf172/system.journal is truncated, ignoring file.
[  350.375415] TEST-17-UDEV.sh[415]: + echo 'Subtest /usr/lib/systemd/tests/testdata/units/TEST-17-UDEV.watch.sh failed'
```

Fixes #38559.
 2025-08-13 09:36:35 +01:00
Yu Watanabe ee76ac1411 TEST-38-FREEZER: use 'systemctl show' to get freezer state 
Also, use timeout command for waiting freezer state applied.
 2025-08-13 12:30:31 +09:00
Yu Watanabe 0e25939a9d TEST-38-FREEZER: check if watchdog is not restarted by systemctl daemon-reload or daemon-reexec 2025-08-13 10:45:36 +09:00
Yu Watanabe b39815ebf7 core/cgroup: allow to set cgroup path for frozen unit 
Otherwise, after 'systemctl daemon-reload' or 'daemon-reexec', frozen
units cannot gain cgroup paths and we cannot operate anything on them,
especially, we cannot thaw or stop them.
```
Aug 12 16:26:09 systemd[1]: wd.service: Job 1278 wd.service/stop finished, result=frozen
Aug 12 16:26:09 systemd[1]: Cannot stop frozen unit wd.service.
Aug 12 16:26:09 systemd[1]: wd.service: Cannot realize cgroup for frozen unit.
Aug 12 16:26:09 systemd[1]: Failed to realize cgroups for queued unit wd.service, ignoring: Device or resource busy
```

Follow-up for 23ac08115a.
 2025-08-13 10:45:25 +09:00
Yu Watanabe c70816fd09 core/service: do not start watchdog on frozen unit when service manager is reloaded or reexecuted 
Otherwise, when service manager is reloaded or reexecuted, watchdong
will be started for frozen services, and they may be killed after
timeout.

Fixes #38551.
 2025-08-13 10:38:04 +09:00
Luca Boccassi 998bb9600e test-cgroup: cleanup test cgroup 
One test cgroup gets left behind by the test, as it moves itself
into it. Move itself and back to the original cgroup at the end
and clean up.

This fixes a failure when running the test first as root, and then
as unprivileged (initial cleanup fails as the leftover test cgroup
is owned by root).
 2025-08-13 10:00:33 +09:00
Luca Boccassi e1311b10f8 CI: run ruff format before ruff check 
Otherwise you get a failure but no hint on how to fix it
 2025-08-13 10:00:21 +09:00
Luca Boccassi 637b3904c1 tpm2-util: fixlets for tpm2_serialize/_deserialize() (#38520) 
Fixes #38507.
 2025-08-12 19:54:44 +01:00
Matteo Croce 814bff5e28 core: suppress warning 
Avoid definition of `exec_context_get_tty_for_pam` if pam support is
disabled, to avoid the following warning:
```
../src/core/exec-invoke.c:1231:12: warning: ‘exec_context_get_tty_for_pam’ defined but not used [-Wunused-function]
 1231 | static int exec_context_get_tty_for_pam(const ExecContext *context, char **ret) {
      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
 2025-08-12 19:45:04 +01:00
Yu Watanabe 48d06b99e6 tpm2-util: copy serialized result in tpm2_serialize() 
For safety, though typically Esys_Free() is just a simple wrapper of
free(), but let's do unconditionally. See the comment in the code.

While at it, this makes it store the result into struct iovec.
 2025-08-12 06:11:34 +09:00
Yu Watanabe 8d40f3f42e tpm2-util: gracefully skip deserialization when no input 
While at it, this also makes tpm2_deserialize() take struct iovec.

Fixes #38507.
 2025-08-12 06:11:34 +09:00
Lennart Poettering 5bd2538405 Enable KEY_PERFORMANCE key present on Linux 6.17 (#38533) 
Linux 6.17 defines a key called KEY_PERFORMANCE for machines that have a
perfomance mode, like Alienware and Dell G-series.
 2025-08-11 18:38:58 +02:00
Yu Watanabe 59c26be53c pcrlock: make-policy should use path specified by --policy= rather than --pcrlock 
Follow-up for a434270139.
Fixes #38506.
 2025-08-11 18:34:07 +02:00
Marcos Alano d5f65056ee Enable KEY_PERFORMANCE key present on Linux 6.17 
Note, this change does not require the kernel running on the host is
equal or newer than 6.17. But systemd-udevd needs to be built with the
kernel headers with KEY_PERFORMANCE, and the relevant kernel header is
already updated by the previous commit.
 2025-08-11 22:22:18 +09:00
Yu Watanabe 4dfadc90fd include: update kernel headers from v6.17-rc1 2025-08-11 22:22:16 +09:00
Luca Boccassi 208ba34a43 test: add coverage for kernel keyring in TEST-50-DISSECT 
Use the kernel keyring to verify images in the dissect test.
The userspace keyring is still covered by the DDI and mountfsd tests.
 2025-08-11 10:59:51 +01:00
Tobias Heider 5a64f158ec chid: don't hardcode magic numbers for non-official CHIDs 
They are constructed from EXTRA_CHID_BASE + offset
 2025-08-11 11:18:53 +02:00
Zbigniew Jędrzejewski-Szmek 491b6d0182 Missing man page and fixes for man page links (#38540) 2025-08-11 10:53:45 +02:00
Zbigniew Jędrzejewski-Szmek f8976ad3c1 man: fix links 
Found using linkchecker.
For virtiofsd, the man page is maintained upstream, but doesn't seem to be
available in any of the usual places. So let's link to the Debian version.
systemd.filter I have no idea what it is.
 2025-08-11 10:30:26 +02:00
Yu Watanabe 1405d46bf9 core/exec-invoke: fallback to set TTY specified by TTYPath= to PAM 
Follow-up for 2b0087e5b1.
Fixes #38486.
 2025-08-11 10:26:51 +09:00
Luca Boccassi 25178aadb2 service: stop/reset watchdog on freeze/thaw 
Otherwise the unit will be killed by the watchdog given it's frozen
but the clock keeps ticking

Fixes https://github.com/systemd/systemd/issues/38517
 2025-08-11 10:26:32 +09:00
Luca Boccassi 5ecd16be68 ci: add mkosi job for debian stable 
Debian 13 has just been released and can build and run everything,
so add CI coverage for it
 2025-08-11 10:23:38 +09:00
Vasiliy Kovalev 8557ea5daa hwdb: Add launch emoji keyboard mapping for Asus M1607KA 
By default, pressing Fn+F8 maps the scancode to KEY_BLUETOOTH (in evtest,
MSC_SCAN 7e -> KEY_BLUETOOTH). Windows/the manufacturer may intercept the
same scancode to execute "Launch Emoji keyboard."
On Linux, we get the "raw" KEY_BLUETOOTH code, which is unacceptable.

prog1 is already reserved by default for launching MyAsus (a Windows
application) with the Fn+F12 combination, so we will use prog2.

Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
 2025-08-11 10:17:29 +09:00
Zbigniew Jędrzejewski-Szmek ee1ded6cd6 man: add sd-path page 
We have similar pages for other parts of libsystemd too.
 2025-08-10 13:40:32 +02:00
kanitha chim 8fcd3e2ebd po: Translated using Weblate (Khmer (Central)) 
Currently translated at 16.2% (43 of 264 strings)

Co-authored-by: kanitha chim <kchim@redhat.com>
Translate-URL: https://translate.fedoraproject.org/projects/systemd/main/km/
Translation: systemd/main
 2025-08-09 23:25:16 +09:00
Yu Watanabe d858b1b10a udev-rules: add missing device name prefix in log message 
Otherwise, it is hard to find the dump in journal. With this change,
we can find the entry by e.g.
journalctl -b -u systemd-udevd.service DEVICE=eth0

Follow-up for b4ffb77669.
 2025-08-09 11:41:57 +01:00
Luca Boccassi 6c40197464 ci: stop triggering suse-specific package build on OBS 
Packages are now unified as the fedora spec can cohexist with suse's
 2025-08-08 18:46:07 +01:00
Luca Boccassi 71b6836638 network: fix segfault in setting bridge vlan (#38519) 2025-08-08 15:04:33 +01:00
Yu Watanabe 570210eb28 network/bridge-vlan: fix segfault 
Fixes a bug introduced by 78738adf88.
Fixes #38515.
 2025-08-08 19:39:31 +09:00
Yu Watanabe df75dd34f6 test-network: also save the current state of socket units for resolved and stop them 
Silence the following waring:
```
Stopping 'systemd-resolved.service', but its triggering units are still active:
systemd-resolved-varlink.socket, systemd-resolved-monitor.socket
```

Follow-up for 0fa188307b.
 2025-08-08 19:38:27 +09:00
Luca Boccassi c892e33979 nspawn: fix recursive bind mounts 
Follow-up for 90fa161b5b

Fixes https://github.com/systemd/systemd/issues/38505
 2025-08-08 10:53:02 +09:00