Update hwdb, even though we are pretty far from a release in order to:
- incrementally test upstream additions to hwdb
- allow backports to stable branches
This integration test demonstrates that a containerized systemd instance can
write to a bind mounted file observable to the host. Specifically, the bash
script uses systemd-run to start a systemd instance as a transient unit
container. This systemd-run command bind mounts a directory the container will
share with the host, and runs an internal service which creates and writes to a
file from the container's view of this directory. When finished writing, the
service runs the exit target, terminating the internal systemd instance, and
ending the lifetime of the container.
The script waits for the container to finish running, then verifies that the
expected file contents were written on the host side of the filesystem mount.
This test employs a workaround, creating an unmasked procfs mount on the host
which enables the privileged guest to create its own mounts internally. This
may indicate a systemd bug, as the privileged container should not rely on
the existence of an unmasked procfs on the host in order to mount its own
filesystems internally.
As usual, it seems to be mostly additions and corrections.
The last update was in 0d740f4bc0, Dec 10th. I
think it's reasonable to update the hwdb more often. In particular, I want to
push an update to the stable branches, but it should be updated in 'main'
first.
Add hwdb entries for ADI PLUTO. Note that when in DFU (Device Firmware
mode) mode, the pid is different. Thus, the two entries.
We also want to make sure that no AT commands are sent to us and so we
set 'ID_MM_DEVICE_IGNORE=1'.
On linux sockets have a really good, unique identifier, the SO_COOKIE,
which is used by sockdiag and BPF and elsewhere. Let's expose this more
prominently in the service name of per-connection services invoked via
Accept=yes sockets.
This is really nice, because together with our $SO_COOKIE env var we can
now match up services, process execution contexts, and "ss" outputs, BPF
rules, and more.
Our baseline is v5.4 and cgroup v2 is enforced now,
which means CPU accounting is cheap everywhere without
requiring any controller, hence just remove the directive.
This commit cleans up the includes for all the small tools across
the tree.
A few cases of returning EXIT_SUCCESS are replaced with returning
0 to avoid including <stdlib.h>.
Split out of #37344.
Instead of recalculating the length of the string again after
reading it, let's make sd_netlink_message_read_string() return the
length of the string that we then use to check if the last character
is a dot or not.
This allows us to get rid of the string-util.h include in #37344.
On OBS the build VM is heavily locked down, with network
disabled in various ways in the custom kernel, to isolate the
build, including disabling CONFIG_UNIX_DIAG.
[ 456s] /* test_af_unix_get_qlen */
[ 456s] src/test/test-socket-netlink.c:393: Assertion failed: Expected "af_unix_get_qlen(unix_fd, &q)" to succeed, but got error: No such file or directory
[ 454s] /* test_sock_diag_unix */
[ 454s] src/libsystemd/sd-netlink/test-netlink.c:727: Assertion failed: Expected "sd_netlink_call(nl, message, 0, &reply)" to succeed, but got error: No such file or directory
Follow-up for 89e546e927
Follow-up for 4a3bf440f2
capability_quintet_mangle() can be called with capability sets
containing unknown capabilities. Let's not crash when this is the
case but instead ignore the unknown capabilities.
Fixes d5e12dc75e
Eisuke Kawashima
Lennart Poettering
Daan De Meyer
Yu Watanabe
Jelle van der Waa
Mike Yuan
Luca Boccassi
Tommy Unger
Zbigniew Jędrzejewski-Szmek
Nuno Sá
Luca Boccassi