Commit Graph
7758 Commits
Author SHA1 Message Date
Luca Boccassi 9027aff9d4 Merge pull request #27867 from keszybz/vconsole-reload-again
Restore ordering between vconsole-setup and firstboot services
2023-07-14 23:06:18 +01:00
Luca Boccassi ef32125c65 Merge pull request #28387 from yuwata/network-route-table-name
network: cleanups for route table name
2023-07-14 22:57:31 +01:00
Yu Watanabe e8e91a81ee network: refuse to override predefined route table name 2023-07-15 02:56:25 +09:00
Yu Watanabe 7cfef4bb48 battery-check: allow to skip by passing systemd.battery-check=0 2023-07-14 15:56:29 +01:00
Zbigniew Jędrzejewski-Szmek 84214541fa Revert "pid1: order units using TTYVHangup= after vconsole setup"
This reverts commit e019ea738d.

In the new approach, a lock on /dev/console will be used. This lock will solve
the issue for services which run in early boot. Services which run later are
ordered after sysinit.target, so they'll run much later anyway so this
automatic dependency is not useful. Let's remove it again to make the code
simpler.
2023-07-12 15:54:33 +02:00
Zbigniew Jędrzejewski-Szmek 6cfb3ebc60 units/systemd-firstboot: start the service after systemd-vconsole-setup.service
This way, we don't start user interaction before (or while) the configured
fonts are loading.

Tweak the comments a bit while at it.
2023-07-12 15:54:33 +02:00
Yu Watanabe 627cdcc785 tree-wide: fix typos reported by Fossies Codespell report 2023-07-12 10:14:50 +09:00
Yu Watanabe 16a07ffc64 man: move <varlistentry> in <variablelist> 2023-07-12 10:03:43 +09:00
Christian Hesse 24752c41a4 man/systemd.unit: document restart behavior on Upholds=
Behavior on constantly failing (or oneshot) unit was unclear. Let's
document it here.
2023-07-07 10:10:56 +01:00
Luca Boccassi b2deaaf01b Merge pull request #27584 from rphibel/add-restartquick-option
service: add new RestartMode option
2023-07-06 20:37:31 +01:00
Luca Boccassi f00022eb86 Merge pull request #28242 from berrange/cond-sec-cvm
Detect and expose the confidential virtualization technology in various places
2023-07-06 19:14:26 +01:00
Luca Boccassi b9b0f338be Merge pull request #28274 from DaanDeMeyer/dissect-root
dissect: Allow a few verbs to operate on directories as well as image files
2023-07-06 14:41:48 +01:00
Richard Phibel e568fea9fc service: add new RestartMode option
When this option is set to direct, the service restarts without entering a failed
state. Dependent units are not notified of transitory failure.

This is useful for the following use case:

We have a target with Requires=my-service, After=my-service.
my-service.service is a oneshot service and has Restart=on-failure in
its definition.

my-service.service can get stuck for various reasons and time out, in
which case it is restarted. Currently, when it fails the first time, the
target fails, even though my-service is restarted.

The behavior we're looking for is that until my-service is not restarted
anymore, the target stays pending waiting for my-service.service to
start successfully or fail without being restarted anymore.
2023-07-06 14:33:52 +02:00
Daniel P. Berrangé 6e2e83b487 udev: add 'conf-virt' constant for confidential virtualization tech
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé 0895124572 core: set SYSTEMD_CONFIDENTIAL_VIRTUALIZATION env for generators
This reports the confidential virtualization type that was detected

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé 1257274ad8 dbus: add 'ConfidentialVirtualization' property to manager object
This property reports whether the system is running inside a confidential
virtual machine.

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé 95d043b159 unit: add "cvm" option for ConditionSecurity
The "cvm" flag indicates whether the OS is running inside a confidential
virtual machine.

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé f460fec915 detect-virt: add --list-cvm option
The --list-cvm option reports the known types of confidential virtualization
technology that can be detected.

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé 5e0c61f64d detect-virt: add --cvm option
The --cvm option detects whether the OS is running inside a confidential
virtual machine.

Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2023-07-06 12:20:04 +01:00
Joerg Behrmann 5bc9ea070f treewide: fix "an" before consonant U sounds
The article "a" goes before consonant sounds and "an" goes before vowel
sounds. This commit changes an to a for UKI, UDP, UTF-8, URL, UUID, U-Label, UI
and USB, since they start with the sound /ˌjuː/.
2023-07-06 11:59:41 +01:00
Daan De Meyer 12d58b6c74 dissect: Add --mtree-hash= option
Let's make including hashes in the mtree output configurable to allow
speeding up the --mtree command in cases where file hashes are not
required.
2023-07-06 12:11:45 +02:00
Daan De Meyer 2292fa1e31 dissect: Allow a few verbs to operate on directories as well as image files
--copy-to, --copy-from, --list and --mtree are useful for image directories
as well as image files, so for those verbs, let's check if we were passed
a directory and skip all the image file setup if that's the case.
2023-07-06 12:11:42 +02:00
Lennart Poettering e40cad1f3c Merge pull request #28243 from bluca/sbat_initrd
ukify: enable --sbat for UKIs too
2023-07-06 10:21:44 +02:00
Lennart Poettering 4560f9821b meson: run forgotten 'update-man-rules' 2023-07-05 23:18:16 +02:00
Luca Boccassi a8b645dec8 ukify: enable --sbat for UKIs too
For confidential computing they want to be able to revoke initrds too, so allow
passing a specific --sbat section when building a UKI too, not just an addon.
Merge it with the stub and kernel sections.
2023-07-05 21:31:08 +01:00
Mike Yuan 3121374ca4 Merge pull request #28252 from yuwata/journal-open-machine
journal: introduce journal_open_machine()
2023-07-06 03:08:18 +08:00
Yu Watanabe 4a45a2e0e3 sd-journal: introduce SD_JOURNAL_TAKE_DIRECTORY_FD flag for sd_journal_open_directory_fd()
If it is called with the flag, then the provided file descriptor will be
owned by the sd_journal object, and will be closed in sd_journal_close().
2023-07-06 00:06:20 +09:00
Lennart Poettering 529ba8a1a3 Merge pull request #26844 from YHNdnzj/propagate-stop-fixup
core: introduce UNIT_ATOM_PROPAGATE_STOP_GRACEFUL for PropagatesStopTo=
2023-07-05 15:56:21 +02:00
Mike Yuan e9bd185316 man/systemctl: document --job-mode=restart-dependencies
Follow-up for 09d04ad325
2023-07-05 08:15:34 +08:00
Lennart Poettering de70ecb328 import-creds: add support for binary credentials specified on the kernel cmdline 2023-07-04 23:19:48 +02:00
Lennart Poettering 49850c1ee3 man: document where PID 1 imports credentials from 2023-07-04 23:18:59 +02:00
Lennart Poettering 771c76294a man: document how credentials are passed into generators 2023-07-04 23:18:11 +02:00
Lennart Poettering cdd133b3dd getty-generator: allow configuring additional gettys via credentials 2023-07-04 23:11:03 +02:00
Lennart Poettering 6ac62485cf fstab-generator: optional read addtional fstab lines from credentials
Fixes: #27260
2023-07-04 23:06:48 +02:00
Lennart Poettering deb0d489ea core: consult credentials for machine ID to use for host
Let's hook up one more thing with credentials: the machine ID to use
when none is initialized yet.

This requires some reordering of initialization steps in PID 1: we need
to import credentials first, and only then initialize the machine ID.
2023-07-04 23:01:42 +02:00
Lennart Poettering 0dea5b7719 import-creds: define a new dir where initrd configurators can pass credentials to host 2023-07-04 22:59:07 +02:00
Lennart Poettering 8914f7e8e4 man: make sure credentials properly show up in directives index 2023-07-04 22:56:59 +02:00
Igor Tsiglyar 9f6e0bd417 journal-remote: upload journals from namespace 2023-07-04 18:47:54 +01:00
Lennart Poettering c86a95082b systemctl: implement a new "whoami" verb, that just returns unit of caller/PID 2023-07-04 01:05:02 +01:00
Yu Watanabe 86c2a76e09 Merge pull request #28132 from rpigott/dhcp-captive-portal
Implement RFC8910: captive portal dhcp options
2023-07-03 14:51:56 +09:00
Zbigniew Jędrzejewski-Szmek da89046643 tree-wide: "<n>bit" → "<n>-bit"
In some places, "<n> bits" is used when more appropriate.
2023-07-02 11:10:12 +01:00
Ronan Pigott d74c4ce103 network: Introduce UseCaptivePortal IPv6RA option
Accepts a boolean. When enabled retains captive portal configuration
advertised by the router.
2023-07-02 01:13:43 -07:00
Ronan Pigott a75feb554b network: Introduce UseCaptivePortal DHCPv6 option
Acepts a boolean. When enabled requests and retains captive portal
configuration from the DHCPv6 server.
2023-07-02 01:13:43 -07:00
Ronan Pigott edb88a7201 network: Introduce UseCaptivePortal DHCPv4 option
Accepts a boolean. When enabled, UseCaptivePortal will request and
retain the captive portal configuration from the DHCP server.
2023-07-02 01:13:43 -07:00
Luca Boccassi cc5afe481e Merge pull request #28187 from bluca/sbat
ukify: merge .sbat sections from stub and kernel
2023-06-30 21:55:58 +01:00
Lennart Poettering 95dafd30da battery-check: rework unit
Let's rename the unit to systemd-battery-check.service. We usually want
to name our own unit files like our tools they wrap, in particular if
they are entirely defined by us (i.e. not just wrappers of foreign
concepts)

While we are at it, also hook this in from initrd.target, and order it
against initrd-root-device.target so that it runs before the root device
is possibly written to (i.e. mounted or fsck'ed).

This is heavily inspired by @aafeijoo-suse's PR #28208, but quite
different ;-)
2023-07-01 03:19:16 +08:00
Luca Boccassi d5f91cf793 boot: measure .sbat section
We are now merging .sbat sections from sd-stub and kernel image, so
measure it in PCR11.
2023-06-30 17:17:56 +01:00
Luca Boccassi c3f7501c4d ukify: merge .sbat sections from stub and kernel
If the kernel contains a .sbat section (they should start soon) then merge
it with the stub's so that revocations can apply to either component.

Fixes https://github.com/systemd/systemd/issues/27866
2023-06-30 17:17:56 +01:00
Ivan Vecera 88d2bda812 udev-builtin-net_id: align VF representor names with VF names
Certain cards support to set their eswitch to switchdev mode. In this
mode for each created VF there is also created so called VF representor.
This representor is helper network interface used for configuration of
mentioned eswitch and belongs to an appropriate PF.

VF representors are identified by the specific value of phys_port_name
attribute and the value has format "pfMvfN" where M is PF function
number and N is VF number inside this PF.

As the VF representor interfaces belong to PF PCI device the naming
scheme used for them is the same like for other PCI devices. In this
case name of PF interface is used and phys_port_name suffix is appended.

E.g.
 PF=enp65s0f0np0 # phys_port_name for PF interface is 'p0'
 VF=enp65s0f0np0v0 # v0 is appended for VF0 in case of NAMING_SR_IOV_V
REP=enp65s0f0np0pf0vf0 # phys_port_name for VF0 representor is 'pf0vf0'

First as the phys_port_name for representors is long (6+ chars) then the
generated name does not fit into IFNAMSIZ so this name is used only as
alternate interface name and for the primary one is used generic one
like eth<N>. Second 'f0' and 'pf0' in REP name is redundant.

This patch fixes this issue by introducing another naming scheme for VF
representors and appending 'rN' suffix to PF interface name for them.
N is VF number so the name used for representor interface is similar to
VF interface and differs only by the suffix.

For the example above we get:
 PF=enp65s0f0np0
 VF=enp65s0f0np0v0
REP=enp65s0f0np0r0

This eases for userspace to determine which representor interface
represents particular VF.

Signed-off-by: Ivan Vecera <ivecera@redhat.com>
2023-06-29 22:18:05 +01:00
Luca Boccassi 3a6a93220a Merge pull request #28191 from yuwata/network-ipv6-privacy-extensions
network: introduce global setting for IPv6 privacy extensions
2023-06-29 22:16:10 +01:00