Since shim 16, it is not possible anymore to override the security arch
protocol to avoid signature check and measurements.
Also on Dell servers, EFI_SECURITY2_ARCH_PROTOCOL is not implemented, so
unexpected measurements on PCR 4 were still happening.
This just loads and run the kernel pe. We verify that there is no relocation
needed. Also for simplification, we assume and verify that the base address is
expected to be 0.
mDNS replies always have to come from the mDNS port (unlike mDNS
queries, which are also allowed from non-mDNS ports). Hence refuse this.
Fixes: #33806
The pkcs7_new() function currently uses the hash algorithm from the X509
certificate's signature, but the content signature may use a different
hash algorithm. This adds a parameter to allow specifying what hash
algorithm the content signature generation used.
The pkcs7_new() function currently uses the hash algorithm from the X509
certificate's signature, but the content signature may use a different hash
algorithm. This adds a parameter to allow specifying what hash algorithm the
content signature generation used.
Add a --now option that starts the program instantly, instead of waiting for a
connection on the socket. This is useful, for instance, when developing:
Say I have a Rust, socket-activated web service. I can test it with:
systemd-socket-activate -l 8080 --fdname=http cargo run
However this delays running the service (which potentially involves compilation)
to when I try to connect to it, which wastes time. Since it delays compilation,
I also don't see any warning or errors in the code until it gets a connection
either.
The name's now a bit of a misnomer, since starting the service immediately isn't
really socket activation, but oh well ¯\_(ツ)_/⁻
Check user configuration errors and warnings (e.g. more than one socket passed
with --inetd) earlier in runtime. There's no reason not to do this, and it means
invalid configuration will be reported to the user earlier.
Also let the user know that --fdname= has no effect with --inetd.
It was added in 1a40a3393e for autotools,
sadly with no explanation, and forward-ported to meson in
5c23128dab. Things seems to work fine without
it now so drop it.
Tested with clang-20.1.5-1.fc43.x86_64.
- config.h is not necessary when generating lists, hence drop it.
- linux/audit.h and libaudit.h are included by missing_audit.h,
hence not necessary to include them explicitly.
The header uses __THROW, which is defined in features.h, to make the
header self-consistent.
Note, src/basic/include/sys/mount.h also uses __THROW, and includes
features.h.
This does not change anything, as poll.h is a one-line wrapper of sys/poll.h.
Note that man pages e.g. poll(2) indicate to include poll.h rather than sys/poll.h.
So, let's use poll.h.
_PATH_WTMPX is a kind of internal definition in glibc, and
WTMPX_FILE should be an exposed definition. Both are same,
let's use WTMPX_FILE.
Note, for utmp, we use UTMPX_FILE, rather than _PATH_UTMPX.
Let's use consistent macros.
It provides several important constants, especially _PATH_BSHELL, which
is used in PID1, executor, and run. The header has been included
indirectly through e.g. libmount.h, mntent.h, utmpx.h, and so on.
Let's explicitly include it in forward.h, as libmount.h and friends that
includes paths.h are irrelevant to _PATH_BSHELL, and we may easily fail
to build when code is touched.
The header is not heavy, hence should not hurt anything.
Necessary for crypto_random_bytes(), which is used in the branch that
HAVE_CRYPT_GENSALT_RA is false. Unfortunately, our CIs tested only the
other branch.
These method calls all already have polkit hookup, hence actually allow
them to go through on all levels.
This is mostly playing catchup with a variety of calls added over the
years.
Not sure why the test failed, but maybe the test environment is too
slow? Even this does not fix the failure, by enabling debugging logs,
this hopefully provides more useful information for debugging.
For issue #37685.
Yu Watanabe
Valentin David
Mike Yuan
Luke Yeager
Lennart Poettering
Luca Boccassi
Dan Streetman
Dai MIKURUBE
Craig McLure
Daniel Foster
Américo Monteiro
Luca Boccassi
Zbigniew Jędrzejewski-Szmek
Antonio Alvarez Feijoo
Daan De Meyer