Fixes a bug in a4a6e21673.
Fixes the following memleak:
```
$ sudo valgrind --leak-check=full build/udevadm cat /usr/lib/udev/rules.d
==3975939==
==3975939== HEAP SUMMARY:
==3975939== in use at exit: 640 bytes in 1 blocks
==3975939== total heap usage: 7,657 allocs, 7,656 frees, 964,328 bytes allocated
==3975939==
==3975939== 640 bytes in 1 blocks are definitely lost in loss record 1 of 1
==3975939== at 0x4841866: malloc (vg_replace_malloc.c:446)
==3975939== by 0x4ACA71F: malloc_multiply (alloc-util.h:92)
==3975939== by 0x4ACF988: _hashmap_dump_entries_sorted (hashmap.c:2167)
==3975939== by 0x4ACFC76: _hashmap_dump_sorted (hashmap.c:2209)
==3975939== by 0x4AA60A4: hashmap_dump_sorted (hashmap.h:311)
==3975939== by 0x4AA9077: dump_files (conf-files.c:397)
==3975939== by 0x4AAA14E: conf_files_list_strv_full (conf-files.c:596)
==3975939== by 0x42426A: search_rules_file (udevadm-util.c:301)
==3975939== by 0x424768: search_rules_files (udevadm-util.c:334)
==3975939== by 0x41287D: cat_main (udevadm-cat.c:110)
==3975939== by 0x4A7B911: dispatch_verb (verbs.c:139)
==3975939== by 0x427272: udevadm_main (udevadm.c:121)
==3975939==
==3975939== LEAK SUMMARY:
==3975939== definitely lost: 640 bytes in 1 blocks
==3975939== indirectly lost: 0 bytes in 0 blocks
==3975939== possibly lost: 0 bytes in 0 blocks
==3975939== still reachable: 0 bytes in 0 blocks
==3975939== suppressed: 0 bytes in 0 blocks
==3975939==
==3975939== For lists of detected and suppressed errors, rerun with: -s
==3975939== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
```
The header provides _MIPS_SIM_ABI32 and friends. Glibc indirectly includes
the header through sys/syscall.h or unistd.h, but let's explicitly include
the header where we use _MIPS_SIM_ABI32 and friends.
The header linux/quota.h provides e.g. QIF_DQBLKSIZE or PRJQUOTA, which
is used where the quota-util.h is included.
Let's explicitly include the header with 'IWYU pragma: export' tag.
Continuation of #37960.
The same concern as expalined in #37960 exists also in
missing_syscall.h. If we use enough new glibc, a function we want to use
may be already provided by glibc, but our baseline glibc may not. And it
is hard to detect in our daily development.
This moves all prototypes of syscalls to relevant headers, and missing
syscall functions are defined in relevant .c files of libc wrapper. This
way, we can use usual header as is, e.g. when we want to write code with
`move_mount()`, we can simply use sys/mount.h without checking if it is
supported by our baseline glibc.
This introduces `struct ConfFile` that stores detailed information of an
enumerated file, and introduces `conf_files_list_full()` and friends
that provide results in `ConfFile`.
Then make udev, hwdb, catalog, and cat-files use the new function and
struct to make them not read files outside of specified root directory.
Then, move syscall definitions to the wrapper, and prototypes are moved
to relevant headers.
This also adds checks for add_key() and request_key(), as one day
glibc may be going to add some of them separatedly.
The check for fspick in meson.build is dropped, as it is currently
unused in our code.
This also moves
- basic/missing_bpf.h -> include/override/linux/bpf.h,
- basic/missing_keyctl.h -> include/override/linux/keyctl.h.
This also moves syscall tables and generators to the same directory.
Note, inclusion of asm/sgidefs.h is dropped, as it is already included
by unistd.h and sys/syscall.h.
- pass our system include directories to make generators use our libc
wrappers and latest kernel headers,
- include relevant headers in generated gperf file,
- use files() rather than find_program(), as the result of
find_program() cannot be passed to 'input' of custom_target(),
- move generate-bpf-delegate-configs.py to src/core/, as it is only used
by libcore.
Previously, the logger is only used in error paths, but since
fe3f2ac073, the logger is also used in a
success path. Let's not log loudly on success.
This also drops unused log_selinux_enforcing().
Then, make the function show the original and resolved path if they are
different.
With this change, procfs needs to be mounted on /proc/, hence the test
code is slightly updated.
- drop redundant error messages in cat_files(), as cat_file() internally
logs errors,
- show an empty line and filename before opening file, to make not mix
any error messages with the previous file,
- drop unnecessary fflush(),
- use RET_GATHER() and continue to show files even if some files cannot
be shown.
This was the only test failure building systemd-252-51.el9 in a
container, also previously reported against 252-rc1 under Gentoo in
#25015
This is a forward-port of the patch we actually started using for CIQ's
builds of the EL9-derived package, which was:
```diff
--- systemd-252/src/test/test-cgroup.c 2022-10-31 18:59:18.000000000 +0000
+++ systemd-252-test/src/test/test-cgroup.c 2025-07-10 00:47:07.541000000 +0000
@@ -62,7 +62,7 @@
log_info("Paths for test:\n%s\n%s", test_a, test_b);
r = cg_create(SYSTEMD_CGROUP_CONTROLLER, test_a);
- if (IN_SET(r, -EPERM, -EACCES, -EROFS)) {
+ if (IN_SET(r, -EPERM, -EACCES, -EROFS, -ENOENT)) {
log_info_errno(r, "Skipping %s: %m", __func__);
return;
}
```
I confirmed that the `ERRNO_IS_NEG_FS_WRITE_REFUSED` macro is equivalent
to checking the first 3 error codes above, so the addition of the check
for `ENOENT` is still just as relevant as it was in 252, but adding it
into the macro would be inconsistent with its name, description, and
possible other uses. Hence, in this PR I'm adding the extra check into
the `if`.
This PR rearranges fields in io.systemd.Manager.Describe according to
the guidance by Lennart:
> If a property can be set in a unit file, ever, then it belongs in context.
> Otherwise, it belongs to runtime.
Closes#38124.
This PR does minimal changes to introduce varlink support. Ideally, the
code should switch to using `mac_selinux_get_our_label()` and new
`mac_selinux_get_peer_label()`. But I leave it for now to minimize
breakage. `mac_selinux_get_peer_label()` remains unused.
This is a prep step to merge
https://github.com/systemd/systemd/pull/38032
Otherwise, integration-test-wrapper.py will fail.
```
Traceback (most recent call last):
File "/home/runner/work/systemd/systemd/test/integration-tests/integration-test-wrapper.py", line 693, in <module>
main()
~~~~^^
File "/home/runner/work/systemd/systemd/test/integration-tests/integration-test-wrapper.py", line 677, in main
runner = os.environ['TEST_RUNNER']
~~~~~~~~~~^^^^^^^^^^^^^^^
File "<frozen os>", line 717, in __getitem__
KeyError: 'TEST_RUNNER'
```
Follow-up for c0a5801f7b.
closes#37602, see there for extra motivation and considered
alternatives.
On typical systems, only few services need to create SUID/SGID files.
This often is limited to the user explicitly setting suid/sgid, the
`systemd-tmpfiles*` services, and the package manager. Allowing a
default to globally restrict creation of suid/sgid files makes it easier
to apply this restriction precisely.
## testing done
- built on aarch64-linux and x86_64-linux
- ran a VM test on x86_64-linux, checking for:
- VM system boots successfully
- defaults apply (both `yes`, `no`, and undefined)
- systemd tmpfiles can set suid/sgid on journal log path
- Other services explicitly defining `RestrictSUIDSGID=no` can create
suid files
Add a new option `PrivateBPF=` to mount a private instance of bpffs.
Add also four configuration options
`BPFDelegate{Commands,Maps,Programs,Attachments}=` which set the
corresponding bpffs mount options in order to create BPF tokens:
https://lwn.net/Articles/947173/
Closes#35108.
Based on https://github.com/systemd/systemd/issues/7820, this adds support for
quota enforcement to State, Cache, and Log exec directories.
* Add new directives, StateDirectoryQuota=, CacheDirectoryQuota=, and
LogDirectoryQuota=, to define quotas as percentages (hard limits for
blocks and inodes) or absolute values (hard limits for blocks only).
* Add new directives, StateDirectoryQuotaAccounting=,
CacheDirectoryQuotaAccounting= and LogDirectoryQuotaAccounting= to keep
track of storage quotas but not enforce them (effectively just assigning
a project ID to defined exec directories).
Example:
```
StateDirectory=quotadir
StateDirectoryQuota=1%
Jan 06 22:55:46 abeltran: Storage quotas set for /var/lib/private/quotadir. Block limit = 2639404, inode limit = 671088
root@abeltran:/var/lib/private# lsattr -pR
3153000189 --------------e----P-- ./quotadir
root@abeltran:/var/lib/private# repquota -P /datadrive
*** Report for project quotas on device /dev/sdc1
Block grace time: 7days; Inode grace time: 7days
Block limits File limits
Project used soft hard grace used soft hard grace
----------------------------------------------------------------------
#0 -- 213200 0 0 4086 0 0
#3153000189 -- 2639404 0 2639404 2 0 671088
```
This was all very confusing and not matching our coding style
recommendations. Let's fix that.
Prompted by #37897, which really should make use of BootEntryType, but
we better clean it up first.
struct timex is defined by sys/timex.h -> bits/timex.h.
Glibc includes the header in time.h, but let's explicitly include it
when the struct is used.
Similar to 4f18ff2e29, but for sys/timex.h.
These source files uses symbols provided by sys/stat.h, e.g. struct stat,
S_IFREG, S_IFBLK, and so on. Let's explicitly include sys/stat.h where
necessary.
Glibc's fcntl.h includes bits/stat.h, which provides these symbols, so
these symbols can be used without explicitly including sys/stat.h. But,
based on the discussion in #37922, we should explicitly include relevant
headers, and should not rely on the indirect inclusion.
Similar to 4f18ff2e29, but for sys/stat.h.
If one of the header is included in a C++ source file, then using
_Static_assert() triggers compile error for some reasons.
Let's use static_assert(), which can be used by both C and C++ code.
The source file uses symbols e.g. execl(), execvp(), _exit(), and so on,
without including unistd.h.
Continuation of 4f18ff2e29.
Follow-up for 9a08000d18.
These source files uses symbols provided by sched.h, e.g.
setns(), unshare(), CLONE_NEWNS, and friends, but they do not explicitly
include sched.h. Currently, it is included indirectly via missing_syscall.h,
which is included by e.g. pidfd-util.h.
Let's explicitly include headers that provides symbols used in the code.
This is similar to 4f18ff2e29, but for sched.h.
- use unsigned for the return value of read_nr_open(), as it does not
fail, and the kernel internally uses unsigned for the value,
- when bumping the value by PID1, let's start from the kernel's maximum
value defined in fs/file.c. The maximum value should be mostly an API
of the kernel, but may changed in a future, hence still try several
times if we fail to bump the value.
Co-authored-by: Jared Baur <jaredbaur@fastmail.com>
Co-authored-by: John Rinehart <johnrichardrinehart@gmail.com>
When OpenSSL is built without UI support, OPENSSL_NO_UI_CONSOLE is
defined. Or, even openssl is built with UI support, people may want to
build systemd without using OpenSSL's UI feature by specifying
-Dc_args='-DOPENSSL_NO_UI_CONSOLE=1'. This adds support for such cases.
Not tested, but hopefully, now systemd can be built with other ssl library,
like BoringSSL, which deos not support UIs.
Closes#38024.
With these two changes the vscode parser works nicely again. Once the
EDG frontend adds support for this feature I'll fix it to check for the
fixed version like for GCC.
Some device node refuses to be opened with read-write mode.
Let's not open with O_RDWR, but open with O_PATH, and use
FORMAT_PROC_FD_PATH().
Follow-up for 1abb592f2f.
Fixes#38033.
- use STRV_MAKE() macro,
- add several missing assertions,
- use more suitable ASSERT_XYZ() macros,
- drop TEST(dns_search_domain_unlink_all), as it is already tested in
TEST(dns_search_domain_new_system_limit).
Yu Watanabe
