The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. --help now goes through the pager, like other
commands with --no-pager.
Synopses are adjusted. --user-unit/--unit without any unit names is
technically allowed, but not very meaningful, since it's the same as
the default mode. So [] is dropped. And the prog help string is then
adjusted to match the man page.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. "COMMAND…" is marked as optional, since
'cat' is the default verb.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is changed to use the imperative
form ("Register …" instead of "Registers …"), consistent with the other
commands. --help now goes through the pager, like other commands with
--no-pager.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is changed to use the imperative
form ("Configure …" instead of "Configures …"), consistent with the
other commands.
After c9cd66ee3a and
c81b5d36b9, the comment about systemd-backlight
and systemd-veritysetup was outdated. We can test them as any other program.
Also, use an array to make list easier to extend in the future and
adjust $PATH so we don't need to care about the split between public
and non-public programs.
The getty.auto credential is a textual configuration value, but credentials
are read as raw file contents. A value written by common text-file workflows
can therefore end in a newline, causing false\n to be rejected and ignored.
Reproducer:
printf 'false\n' > "$CREDENTIALS_DIRECTORY/getty.auto"
Before: getty units could still be generated because the credential was
ignored as invalid.
Expected: false\n is parsed the same as false and disables getty
generation.
Strip the value in getty-generator before parsing it. This keeps the
credential framework byte-preserving while applying text semantics where
getty.auto is consumed.
Follow-up for: 3a883e89bc
Previously, the systemd-resolve compat alias was described in the same
CommandDescription structure and resolvectl. But they have different
option sets, so this doesn't really work. The alias is deprecated, so
describe it as such in the abstract, but give it a separate entry.
$ build/resolvectl --introspect-cli
{
"mediaType": "application/vnd.io.systemd.cli-introspection-0",
"commands": [
{
"names": [ "resolvconf" ],
"abstract": [
"Register DNS server and domain configuration with systemd-resolved."
],
...
},
{
"names": [ "resolvectl" ],
"abstract": [
"Send control commands to the network name resolution manager, or\nresolve domain names, IPv4 and IPv6 addresses, DNS records, and services."
],
...
},
{
"names": [ "systemd-resolve" ],
"abstract": [
"Send control commands to the network name resolution manager, or\nresolve domain names, IPv4 and IPv6 addresses, DNS records, and services.\n\nThis command is deprecated. Use resolvectl.1 instead."
],
...
}
]
}
The resolvconf compatibility parser ignored errors from
nameserver, domain, and search lines. If one of those lines was
malformed, resolvectl could still send the partially parsed
configuration to resolved and overwrite the previous link state.
Reproducer:
IF=enp1s0
TMP="$(mktemp -d)"
ln -s "$(command -v resolvectl)" "$TMP/resolvconf"
sudo resolvectl dns "$IF" 1.1.1.1
sudo resolvectl domain "$IF" keep.example
resolvectl domain "$IF"
printf 'nameserver 1.1.1.1\nsearch "unterminated\n' |
sudo "$TMP/resolvconf" -a "$IF" || true
resolvectl domain "$IF"
Before:
The malformed search line was ignored and the previous domain
was cleared:
Link 2 (enp1s0): keep.example
Link 2 (enp1s0):
After:
The malformed input fails before updating resolved, so
keep.example remains configured.
Follow-up for: 097f130731
--raw only affects ResolveRecord output. Without --type= or an
RFC4501 dns: URI, query takes the ResolveHostname/ResolveAddress
paths, where --raw was silently ignored.
Reproducer:
build/resolvectl --raw query localhost
Before:
The command exited successfully and printed regular text output,
such as:
localhost: 127.0.0.1
After:
The command fails before issuing a lookup:
--raw may only be combined with --type= or dns: URIs.
Follow-up for: 05ea7e87b6
The service verb documents the one- and two-argument forms as
SRV lookups. They should not request TXT records by default.
Only the three-argument DNS-SD form should request TXT metadata.
Reproducer:
Run resolvectl service _mysvc._tcp signed.test in the
TEST-75-RESOLVED environment, where signed.test contains:
_mysvc._tcp SRV 10 5 1234 myservice
_mysvc._tcp TXT "This is TXT for myservice"
myservice A 10.0.0.20
Before:
resolvectl service _mysvc._tcp signed.test printed TXT data
for the plain SRV form:
_mysvc._tcp/signed.test: myservice.signed.test:1234 [priority=10, weight=5]
10.0.0.20
fd00:dead:beef:cafe::17
This is TXT for myservice
After:
The plain SRV form suppresses TXT data. The DNS-SD form still
shows it:
resolvectl service '' _mysvc._tcp signed.test
Follow-up for: a7a4c60a25
Test failed with the following:
TEST-07-PID1.sh[20020]: + systemctl stop issue8102-nop-dep.service
TEST-07-PID1.sh[20409]: ++ systemctl show -P ActiveState issue8102-nop-dep.service
TEST-07-PID1.sh[20020]: + [[ failed == inactive ]]
systemctl start only waits for the jobs of the units named on the
command line, so the start job pulled in for issue8102-nop-dep.service
via Wants= was not waited for. When the following stop landed while its
ExecStart= was still running, the process was SIGTERMed, and since
Type=oneshot does not treat termination by signal as a clean exit, the
unit ended up failed instead of inactive:
issue8102-nop-dep.service: Changed start -> stop-sigterm
issue8102-nop-dep.service: Main process exited, code=killed, status=15/TERM
issue8102-nop-dep.service: Failed with result 'signal'.
Start both units explicitly so both jobs are waited for.
Signed-off-by: Paul Meyer <katexochen0@gmail.com>
SetLinkDomains() marks old link domains and then builds the replacement
list in place. The marked old domains still counted against
LINK_SEARCH_DOMAINS_MAX, so replacing a non-empty list with exactly the
maximum number of new domains failed while adding the last entry. The error
path then unlinked all domains, so a failed setter call also destroyed the
previous configuration.
Reproducer:
resolvectl domain dnsbug1 old.example
busctl call org.freedesktop.resolve1 /org/freedesktop/resolve1 \
org.freedesktop.resolve1.Manager SetLinkDomains 'ia(sb)' "$ifindex" 1024 "${args[@]}"
resolvectl domain dnsbug1
Before: the bus call failed with "Argument list too long" and the link's
domain list became empty.
Follow-up for: d2ec6608b9
The DNS delegate parser tries to filter duplicate DNS= entries, but the
duplicate branch returned from the whole parser. This made a duplicate
server truncate the rest of the same DNS= line, silently dropping later
valid servers.
Reproducer:
DNS=192.168.77.78 192.168.77.78 192.168.77.79
Before: only 192.168.77.78 appeared in the delegate server list.
Follow-up for: 7928c0e0a1
The tlsa command accepts an optional service family before the domain list.
When the only argument was "tcp", "udp", or "sctp", we consumed it as the
family and returned success without issuing any query.
Reproducer:
build/resolvectl tlsa tcp
Before: the command printed nothing and exited with status 0.
Follow-up for: ebbc70e511
verb_chid(), verb_blame() and verb_identify_tpm2() all render their
output via table_print_with_pager() with arg_json_format_flags, so JSON
output has been implemented for them since each verb was introduced.
None of them was ever added to the verb allowlist
that gates --json=, so e.g. systemd-analyze chid --json=pretty failed
with:
Option --json= is only supported for security, inspect-elf,
dlopen-metadata, ...
This adds them to the allowlist and the error message. After a sweep of
src/analyze/ for arg_json_format_flags, these are the only remaining
verbs that render through it but were not allowlisted.
has-tpm2 is deliberately not included: verb_has_tpm2() defers to
verb_has_tpm2_generic(), which writes plain text via printf() and has no
JSON support, so accepting --json= there would silently ignore it. The
table_print_with_pager() call in analyze-has-tpm2.c
belongs to verb_identify_tpm2(), which is what got allowlisted instead.
The chid gap went unnoticed because its TEST-65-ANALYZE coverage is
guarded behind a check for SMBIOS board_vendor and a non-container
environment, so it only runs on bare-metal/VM runners.
Teach the harness a --coco=tdx|sev-snp|any flag: it gates the test on
host coco capability (exit 77 otherwise), binds /dev/kvm and the coco
device(s) into the boot-mode container, and passes the resolved type to
the test via $COCO_TYPE.
TEST-94-COCO boots the mkosi image as a confidential guest with
systemd-vmspawn --coco= (using the /vm-images bind) and checks the guest
reports the expected type via systemd-detect-virt --cvm. Runs only on
coco-capable bare-metal hosts, skips elsewhere.
Signed-off-by: Paul Meyer <katexochen0@gmail.com>
Integration tests that boot a nested VM (e.g. with systemd-vmspawn) need
the mkosi-built images, which are build outputs rather than installed
test artifacts. Add a --vm-images wrapper flag and 'vm-images' test
option that bind-mount the mkosi output directory read-only into the
boot-mode container at /work/vm-images, instead of exposing the whole
build tree via RuntimeBuildSources.
Signed-off-by: Paul Meyer <katexochen0@gmail.com>
Both verbs render through arg_json_format_flags but --json= was rejected for
them until the previous commit, and nothing in TEST-65-ANALYZE exercised it.
Add coverage in line with the other JSON-capable verbs.
identify-tpm2 is only invoked when has-tpm2 reports full support, as it
fails with EOPNOTSUPP when built without TPM2 support.
SetLinkDomains() tracks whether the configured search domain list changed
so it can skip redundant persistence. The route_only flag is part of the
D-Bus API and is persisted as a ~ prefix, but flipping an existing domain
between search and route-only only updated in-memory state and left
changed false. The method then skipped link_save_user() and
manager_write_resolv_conf(), leaving stale state until restart.
Reproduced on Ubuntu with systemd 259:
sudo resolvectl domain enp1s0 route-only-repro.test
sudo resolvectl domain enp1s0 '~route-only-repro.test'
resolvectl domain enp1s0
grep '^DOMAINS=' /run/systemd/resolve/netif/$(cat /sys/class/net/enp1s0/ifindex)
grep -H route-only-repro.test /run/systemd/resolve/*.conf
Before, resolvectl showed ~route-only-repro.test, but the persisted state
file still showed DOMAINS=route-only-repro.test, and the generated
resolv.conf files still contained search route-only-repro.test.
After this change, the state file is updated to
DOMAINS=~route-only-repro.test and the generated resolv.conf files are
refreshed so the route-only domain is not emitted as a search domain.
Follow-up for: cbf23f3853
When stdio is passed as file descriptors, the provider of those
descriptors remains responsible for their ownership and access mode.
This keeps run0 in a pipeline from changing the caller's TTY ownership
to the target user, which can otherwise break later terminal access from
the original user.
Fixes#43336
This was introduced all the way back in 2019 where this particular test
case was the last one in the file, so it worked as intended.
Unfortunately, since then we added new tests after this one, which means
this particular `set +e` masked fails in any of them (except for
assert_*() calls, which call exit on fail).
This was introduced all the way back in 2019 where this particular test
case was the last one in the file, so it worked as intended.
Unfortunately, since then we added new tests after this one, which means
this particular `set +e` masked fails in any of them (except for
assert_*() calls, which call exit on fail).
Stay `set +e` in the test masked that this test has apparently never
worked in the first place: when a unit is killed with a signal, any
bound unit is stopped retroactively via
retroactively_stop_dependencies() but it's not restarted again, as the
restart for the bound unit is queued as TRY_RESTART in a following
transaction - but at this point the bound unit is already inactive, so
the TRY_RESTART job collapses into a NOP.
Let's account for this and also add a couple of test cases for
RestartMode= with an explicit restart, which should trigger the bound
unit as well (assuming it's active).
Follow-up for 9b42c58a2b.
Have the attach helper print whether the loader enabled union filesystem
resolution and assert that this agrees with the kernel BTF.
Then mount the signed minimal image as an overlayfs lower layer with a
tmpfs upper. On kernels with bpf_real_data_inode() executing through the
overlay works while a file created in the upper layer or copied up into
it is denied. Without the kfunc execution through the overlay is denied
outright.
The overlay uses metacopy=off so that the copy-up test really does move
the data over to the untrusted upper layer.
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
When --json is requested, resolution errors returned by resolved still went
through text logging. That made scripts parse stderr even though the
varlink error already carried structured fields such as rcode and EDE.
Add a small JSON error dumper for resolvectl query errors. It outputs the
queried name and varlink error id alongside the original varlink parameters
so DNSError and DNSSECValidationFailed expose rcode, extendedDNSErrorCode,
extendedDNSErrorMessage, queryString, and result without duplicating the
schema in resolvectl.
Keep non-JSON text output and silent warn_missing NXDOMAIN handling
unchanged. Document the JSON resolution error object in resolvectl(1),
including the distinction between resolved errors and local invocation or
connection errors.
Closes#42904
TEST-92-TPM2-SWTPM requires about 15 minutes on GitHub,
if it starts at the very end, the total CI run simply waits for
the test finished, and wastes the last 15 minutes.
Starting earlier should slightly improve the performance.
We currently blindly send the configured reload signal (e.g. SIGHUP or
SIGUSR1) to the main service PID for Type=notify-reload units, even if
the service hasn't installed a userspace handler. This can lead to
invoking unintended default behavior (typically process termination) in
daemons which later deprecate and remove their reload handler.
This is a real problem we have seen in production on multiple occasions.
In one particularly egregious instance, a production distributed storage
service had a large percentage of its nodes all terminate at once when
sent a reload signal. In this case a signal handler had been removed,
but another place still sending the signal was missed.
To mitigate this, introduce two new checks for Type=notify-reload
services:
1. On READY=1: When the service first sends READY=1 during initial
startup, we check for the handler. If it's missing, the service startup
is failed with SERVICE_FAILURE_PROTOCOL. This enforces the contract that
services *must* install their handler before signalling readiness.
2. On reload: Immediately before sending the reload signal, we check
again. If the handler is now missing, we log a warning but still send
the signal. This preserves the requested operator action while making
the missing handler visible.
The startup check catches definite static misconfiguration before the
service is accepted as ready. The reload check is advisory because the
service has already started successfully, but warns if its handler later
disappears. Together these provide a best-effort safety net while
preserving the agreed reload semantics.
Add a new integration test to verify the signal handler validation for
Type=notify-reload services, as introduced in the previous commit.
The test adds a shell harness and four service files to cover all scenarios:
1. `notify-reload-no-handler.service`: Verifies that the service fails to
start with Result=protocol when the handler is missing at the first
READY=1.
2. `notify-reload-sigstop.service`: Verifies that SIGSTOP is exempt from
handler validation because it cannot be caught or blocked.
3. `notify-reload-toggle-handler.service`: Verifies that removing the
handler at runtime results in a warning on reload, but the signal is still
sent, causing the service to terminate from unhandled SIGHUP.
4. `notify-reload-well-behaved.service`: Verifies the happy path where a
service with a handler starts and reloads successfully.
Use bounded FIFO operations and journal cursors so failures are prompt and log
assertions cannot race a relative time window.
- --strict=/--full moved to the OPTION_LONG() parser framework that
replaced getopt in the meantime
- the is-supported commit is dropped, main grew that verb independently.
That also gets rid of the early tpm2_support() gate that broke CI back
then, and TEST-70-TPM2 runs with a software TPM these days anyway
- special_glyph() → glyph() renames
- the log table PCR filter needs an EVENT_LOG_RECORD_IS_PCR() guard now
that the event log has NV-index records
Combining --ephemeral with --grow-image= truncated the file passed to
--image= to the requested size before the VM was started, so a mode whose
entire purpose is to leave the original image untouched modified it on
disk.
Skip growing the original image when running ephemeral, and instead create
the qcow2 overlay with the requested virtual size, so the guest sees the
larger disk while the base image stays read-only. As only the overlay is
sized in that case, the base image format no longer matters, so allow
--grow-image= together with qcow2 images when running ephemeral. The round
up to a multiple of 4096 moves to option parsing so both paths apply the
same value.
The vmspawn drive test grows an ephemeral VM and checks that the image
passed to --image= keeps its size, and that the overlay QEMU runs off is
created at the requested one.
group_record_match() handled the other filters, but ignored match->uuid,
so userdbctl group --uuid=... could still return non-matching groups.
Add the same UUID check used by user_record_match().
Reproduced locally:
build/userdbctl --uuid=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa \
--output=json group root
Before result:
The command succeeded and printed the root group record.
Follow-up for: 466562c69b
systemd-sysusers currently skips entries for groups that already exists.
However, if a group exists only in /etc/gshadow and not in /etc/group,
systemd-sysusers panics:
~# groupdel sgx
~# systemd-sysusers; echo $?
Creating group 'sgx' with GID 106.
0
~# systemd-sysusers; echo $?
0
~# sed -i '/sgx/d' /etc/group
~# systemd-sysusers; echo $?
Creating group 'sgx' with GID 106.
/etc/gshadow: Group "sgx" already exists.
1
To fix this, let's mirror the logic from the user path
(write_temporary_shadow()) where we simply drop the user from the "todo"
queue if it already exists in /etc/shadow instead of throwing an error.
The openpgp and tlsa verbs rejected --json= even though they
already determine the RR type they query. Allow JSON output for
these shortcut commands.
Accept matching explicit --type= values as well, but reject
mismatched types so openpgp only queries OPENPGPKEY records and
tlsa only queries TLSA records.
Refuse unauthenticated key records in JSON format so scripts do
not accidentally consume cryptographic DNS data that would only
produce a warning in human-readable output.
Fixes#43245
Introduce Slice.ActivatingConcurrencyMax to limit how many units
within a slice hierarchy may be in activating state concurrently.
Expose the setting over D-Bus, support transient/property parsing,
enforce it during unit start dispatch, and re-check queued starts when
units leave activating state.
Document the new slice option and add a PID1 concurrency test covering
queued startup behavior.
Zbigniew Jędrzejewski-Szmek
dongshengyuan
Yu Watanabe
Luca Boccassi
Paul Meyer
Ivan Kruglov
Frantisek Sumsal
Christian Brauner
Jan Macku
Chris Down
Ludwig NusselandAkarithos
Daan De Meyer
Morteza Pourkazemi