polkitd by default just waves through requests from a root process.
A new POLKIT_CHECK_AUTHORIZATION_FLAGS_ALWAYS_CHECK flag was added
to main (will be part of v125 when it ships) that forces it to go
through the policy checks for root too. Previous versions will just
ignore it.
Change the flags handling slightly so that we pass this or the
interactive flags through, as the values match what polkit expects.
When we patch in a bg color we must make sure that when certain "reset"
sequences are transferred we fix up the bg color again.
Do so for \033[!p ("soft terminal reset") and \033c ("reset to initial
state" aka "full reset").
CentOS Stream 10 has a newer util-linux which means the terminal
gets correctly resized to the size specified by mkosi. This is a
much nicer experience than CentOS Stream 9 where you're stuck on
80x24 so let's make CentOS Stream 10 the default release to build.
Let's document in detail how to build the integration test image and run
the integration tests without building systemd. To streamline the process,
we stop automatically using binaries from build/ when invoking mkosi directly
and don't automatically use a tools tree anymore if systemd on the host is too
old. Instead, we document these options in HACKING.md and change the mkosi meson
target to automatically use the current build directory as an extra binary search
path for mkosi.
This is a common case, and nothing noteworthy at all. For example, if we
establish an enumerator for listing all devices tagged by some tag, then
the per-tag dir is not going to exist if there are currently no devices
tagged that way, but that's a really common case, and doesn't really
deserve any mention, not even at debug level.
It has bugged me for a while that we show the exact same welcome message
at boot twice: once in the initrd, and once after the initrd→host
transition. That's very confusing.
Let's change the text a bit, and tone down the initrd message a bit (by
removing the empty line before and after it), because it is the less
relevant one.
In previous commits, we've changed the JSON name mangling logic. This,
of course, will cause breaking changes to occur on anything that relied
on the JSON mangling logic.
This commit fixes those breaking changes by manually forcing the JSON
name back to what it was before.
First, when displaying JSON we convert dashes into underscores. We want
to avoid using dashes in JSON field names in new code, because some
JSON parsers don't support dashes very well.
Second, we make the first character of every word lower-case. This
better matches our JSON field name style, and makes the automatic
JSON name mangling a lot more useful for vertical tables, where fields
are given a display name. For example, "Foo Bar" would be converted into
"foo_bar" instead of "Foo_Bar", which much better matches our style.
We don't make the whole string lowercase to support cases like:
"fooBar" should stay as "fooBar".
Some situations don't behave quite perfectly, such as "Foo BarBaz" gets
converted into "foo_barBaz", or all-caps headings get mangled
incorrectly. In these situations, the JSON field should be overridden
manually. In most cases, or at least more cases than before, this
heuristic does good enough.
Lets you conveniently set JSON field names in table_add_many. Especially
useful for vertical tables. For example:
table_add_many(t,
TABLE_FIELD, "Display Name",
TABLE_STRING, obj->display_name,
TABLE_SET_JSON_FIELD_NAME, "displayName",
TABLE_FIELD, "Timestamp",
TABLE_TIMESTAMP, obj->timestamp,
TABLE_SET_JSON_FIELD_NAME, "timestampUSec");
We already have selinux=0 in the default kernel command line so
enforcing=0 is redundant. Instead, pass in enforcing=0 when we
enable selinux in TEST-06-SELINUX.
Previously, unit_freezer_new_freeze() would only return
UnitFreezer object if FreezeUnit() succeeds. This is not
ideal though, as a failed bus call doesn't mean the action
actually failed. E.g. a timeout might occur because pid1
is waiting for cgroup event from kernel, while the bus call
timeout was exceeded (#33269). In such a case, ThawUnit()
will never be called, resulting in frozen units remain that
way after resuming from sleep.
Therefore, let's get rid of unit_freezer_new_freeze(),
and make sure as long as unit freezer is involved, we'll
call ThawUnit() when we're done. This should make things
a lot more robust.
As per DPS the UUID for /var/ should be keyed by the local machine-id,
which is non-trivial to do in a script. Enhance 'systemd-id128' to
take 'var-partition-uuid' as a verb, and if so perform the
calculation.
In some cases userspace may need to create dmabuffers from userspace
on such example is the software ISP part of libcamera which needs to
allocate dma-buffers for the output of the software ISP.
At first the plan was to allow console users access to /dev/dma_heap/*,
this was discussed with various kernel folks here:
https://lore.kernel.org/all/bb372250-e8b8-4458-bc99-dd8365b06991@redhat.com/
Giving console users access to the dma_heap's was deemed a bad idea
because memory allocated this way is not accounted in cgroup limits.
Giving access to /dev/udmabuf OTOH was deemed acceptable so that
is what this patch adds.
Resolves: #32662
Prompted by #33737
The intention of b37e8184a5
is to expose sd_id128_get_app_specific() on command line.
But combining that with GPT type list makes little sense.
Same as the other aliases. Allows chaining commands like:
$ systemd-id128 show -P root-$(dpkg-architecture --query DEB_HOST_ARCH)
4f68bce3e8cd4db196e7fbcaf984b709
Let's make things a little more consistent and build the initrd
explicitly as a subimage as well instead of relying on mkosi building
it as part of the main image build.
We drop the opensuse initrd postinst script as we don't use erofs by
default anymore. We can always reintroduce it again later if needed.
Luca Boccassi
Daan De Meyer
Lennart Poettering
Mike Yuan
Adrian Vovk
migleeson
Hans de Goede