SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
53,329 Commits 2 Branches 1 Tag
ca3f47eff30e2f3aed2008a9c4d2226d547dcfc2
Commit Graph
53329 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Lennart Poettering ca3f47eff3 Merge pull request #20691 from poettering/gpt-sig 
dissect: add support for GPT images with embedded dm-verity signatures
 2021-09-28 20:52:01 +02:00
Lennart Poettering 636c8a1f55 update TODO 2021-09-28 17:06:51 +02:00
Lennart Poettering 2c424ee0aa tests: extend TEST-50-DISSECT to look for verity signatures 2021-09-28 17:06:45 +02:00
Lennart Poettering 54dcf847b1 docs: document the three new env vars for tweaking GPT dissection/validation 2021-09-28 17:03:44 +02:00
Lennart Poettering 77617993ee docs: document the new Verity signature partition type, and its UUIDs 2021-09-28 17:03:39 +02:00
Lennart Poettering c2fa92e7e8 dissect-image: optionally, validate dm-verity signatures in userspace 
Getting certificates for dm-verity roothash signing into the trusted
kernel keychain is a royal PITA (means recompiling or rebooting with
shim), hence let's add a minimal userspace PKCS7 validation as well.

The mechanism is really simple and compatible with the verification the
kernel does. The only difference is that the certificates are searched
in /etc/verity.d/*.crt (and similar dirs in /usr/lib/, …).

We'll first try validation by passing the PKCS#7 data to the kernel, but
if that doesn't work we'll see if one of the certificates found that way
works and then attempt to attach the image without passing the PKCS#7
data to the kernel.

This makes it very easy to have fully validated GPT disk images. For
example, just copy the 'mkosi.secure-boot.crt' file you have in your
mkosi build dir to /etc/verity.d/ and things should just work.
 2021-09-28 17:03:31 +02:00
Lennart Poettering d5fcc5b053 dissect-image: add env var for disabling "sidecar" loading of verity params 
Just to make debugging easier.
 2021-09-28 17:03:26 +02:00
Lennart Poettering 88b3300fdc dissect-image: load embedded verity signature info from image 
This adds support for actually using embedded signature data from
partitions.
 2021-09-28 17:02:54 +02:00
Lennart Poettering 8ee9615e10 dissect-image: discover verity signature partitions 
This doesn't make use of the discovered partitions yet, but it finds
them at least.
 2021-09-28 17:02:27 +02:00
Lennart Poettering 1420cfb4b4 gpt: add partition type for PKCS#7 signatures for root hashes 2021-09-28 17:01:29 +02:00
Lennart Poettering 1641c2b112 cryptsetup: handle more gracefully if "keyslots" LUKS2 JSON header field is invalid 
The field is not owned by us (even though is in our JSON objects) but by
the LUKS2 spec. Hence let's handle this a bit more gracefully: let's not
get confused by it, just warn and skip over it.

Fixes: #20847
 2021-09-28 16:47:08 +02:00
Albert Brox 5918a93355 core: implement RuntimeMaxDeltaSec directive 2021-09-28 16:46:20 +02:00
Daan De Meyer 64782655e1 mkosi: Remove build script umask workaround 
A fix for this landed in meson 3 years ago so the workaround in the
build script can now be removed (https://github.com/mesonbuild/meson/pull/3225).
 2021-09-28 23:09:11 +09:00
alexlzhu 8c35c10d20 core: Add ExecSearchPath parameter to specify the directory relative to which binaries executed by Exec*= should be found 
Currently there does not exist a way to specify a path relative to which
all binaries executed by Exec should be found. The only way is to
specify the absolute path.

This change implements the functionality to specify a path relative to which
binaries executed by Exec*= can be found.

Closes #6308
 2021-09-28 14:52:27 +01:00
Zbigniew Jędrzejewski-Szmek 5b32e48f6e Merge pull request #20837 from bluca/coveralls 
CI: add code coverage reports via lcov and coveralls.io
 2021-09-28 13:45:59 +02:00
Yu Watanabe 545c30c9ba Merge pull request #20861 from yuwata/sd-lldp-rx-cleanups 
sd-lldp-rx: several trivial cleanups
 2021-09-28 20:22:21 +09:00
Yu Watanabe 35777f5178 sd-lldp-rx: make lldp_rx_free() and lldp_neighbor_free() accept NULL 2021-09-28 17:55:19 +09:00
Yu Watanabe 92466b8da2 sd-lldp-rx: sd_event should be attached when lldp_rx_start_timer() is called 2021-09-28 17:55:19 +09:00
Yu Watanabe 3e4a202519 sd-lldp-rx: do not enable timer event source in sd_lldp_rx_get_neighbors() 
It must be just a simple getter.
 2021-09-28 17:55:19 +09:00
Yu Watanabe 0cd7e072b4 sd-lldp-rx: use _cleanup_ attribute at one more place 2021-09-28 17:55:19 +09:00
Yu Watanabe 71c4f7e895 sd-lldp-rx: wrap long line 2021-09-28 17:55:19 +09:00
Yu Watanabe 90496cc68c sd-lldp-rx: add missing assertions 2021-09-28 17:55:19 +09:00
Yu Watanabe b0a67b202d sd-lldp-rx: delay allocating hashmap and prioq to store neighbors 2021-09-28 17:55:16 +09:00
Yu Watanabe 5bff20ea62 prioq: introduce prioq_ensure_put() 2021-09-28 15:15:12 +09:00
Yu Watanabe aa3f8d4ca1 sd-lldp-rx: ensure no event will be triggered after sd_lldp_rx_detach_event() is called 2021-09-28 15:07:37 +09:00
Yu Watanabe e9ea43136c sd-lldp-rx: add comments about the three multicast addresses 2021-09-28 15:07:13 +09:00
Yu Watanabe b5dce07a5e sd-lldp-rx: introduce sd_lldp_rx_is_running() 2021-09-28 14:51:24 +09:00
Yu Watanabe 4be699a8db sd-lldp-rx: ignore all errors in processing datagram 2021-09-28 14:44:12 +09:00
Yu Watanabe 07db7f6bb8 Merge pull request #20846 from yuwata/sd-lldp-tx 
network: move LLDP transmission feature to libsystemd-network
 2021-09-28 11:29:34 +09:00
Yu Watanabe bed159888e Merge pull request #20855 from dannf/update-net-name-schemes 
Update net name schemes
 2021-09-28 11:28:07 +09:00
Lennart Poettering a50dadf2fd resolved: suppress writing DNS server info into /etc/resolv.conf for non-standard UDP ports 
glibc doesn't support this, hence don#t generate it.

Fixes: #20836
 2021-09-28 11:27:36 +09:00
Luca Boccassi 3542da2442 parse-util: prefix load average macros with LOAD_AVG_ 
Follow-up for #20839
 2021-09-27 20:34:41 +02:00
dann frazier c3138b46bc Remind developers to update the list of net naming schemes that can be selected as a build-time defaults. 2021-09-27 11:12:32 -06:00
dann frazier aa0a23ec86 Add remaining supported schemes as options for default-net-naming-scheme 2021-09-27 11:12:22 -06:00
Yu Watanabe c01b9b879c network: use sd-lldp-tx 2021-09-28 01:35:51 +09:00
Yu Watanabe 7df9656782 sd-lldp-tx: introduce sd-lldp-tx 2021-09-28 01:35:47 +09:00
Yu Watanabe 3daf701014 hostname-util: introduce get_pretty_hostname() 2021-09-28 01:34:02 +09:00
Yu Watanabe 3be1e84fe9 sd-lldp: introduce SD_LLDP_OUI_IANA_MUD macro 2021-09-28 01:34:00 +09:00
Yu Watanabe 19b68e9e96 sd-lldp: constify OUI 2021-09-28 01:32:40 +09:00
Yu Watanabe 910fd79e8e sd-lldp-rx: split out enum definitions 2021-09-27 23:55:11 +09:00
Yu Watanabe 35778343ab sd-lldp-rx: rename sd_lldp -> sd_lldp_rx 2021-09-27 23:55:11 +09:00
Yu Watanabe 94832e6e55 test: also rename {test,fuzz}-lldp.c 2021-09-27 23:55:11 +09:00
Yu Watanabe 3a2ee8554e sd-lldp: rename sd-lldp.[ch] -> sd-lldp-rx.[ch] 2021-09-27 23:55:11 +09:00
Yu Watanabe 82e0689cd8 meson: sort files 2021-09-27 23:55:11 +09:00
Lennart Poettering 49e9218ae3 Merge pull request #20768 from pdmorrow/shutdown_cgroup_ctrl 
cgroups: apply StartupAllowedCPUs= and StartupAllowedMemoryNodes= during shutdown
 2021-09-27 13:44:54 +02:00
Luca Boccassi 3bf94dac91 CI: do manpages build only on the clang unit test run 
It's slow and unaffected by compiler/flags, so no point in repeating it
 2021-09-27 12:24:48 +01:00
Luca Boccassi 1f1d48f96e CI: add code coverage reports via lcov and coveralls.io 2021-09-27 12:22:22 +01:00
Luca Boccassi 8b036b223a CI: run unit tests in a network namespace 
It seems some of the tests break network connectivity on the host,
as the code coverage upload fails to establish a connection.
Run them in a network namespace with 'unshare -n'.
 2021-09-27 12:22:22 +01:00
Luca Boccassi 059c0578d7 test: double test-hashmap timeout 
When coverage flags are used, sometimes it goes just over 90s on a
slow CI machine
 2021-09-27 12:22:22 +01:00
Zbigniew Jędrzejewski-Szmek 66a0e22293 Merge pull request #20849 from keszybz/man-page-tags-and-links 
Add license tags to doc pages, fixups and more internal links in man pages
 2021-09-27 12:09:48 +02:00