- FUSE is unconditionally enabled in the container, as our kernel base
line (v5.4) supports userns-safe FUSE, which is supported since v4.18.
- Create /dev/net/tun only when it is accessible.
- Replaces several loops with FOREACH_ARRAY().
- make it return NULL,
- suppress log message about reference counter of writer unless trace
logging is enabled,
- introduce cleanup function for RemoteSource.
Follow-up for 985ea98e7f.
When DevicePolicy= is enabled, but DeviceAllow= for /dev/net/tun is not
specified, bind-mounting the device node from the host system is
meaningless, as it cannot be used in the container anyway.
Let's check the device node is accessible before creating or
bind-mounting.
FUSE is userns-safe since kernel v4.18 (da315f6e03988a7127680bbc26e1028991b899b8),
and now our kernel base line is 5.4. Let's drop the logic of checking
the version of FUSE, and unconditionally enable FUSE.
This split-out common logic from link_drop_routes() and friends.
This is mostly a refactoring, and not change behavior in most cases.
But slightly change behavior for how foreign nexthops and routing
policy rules are managed.
E.g. when KeepConfiguration=static, previously all foreign nexthops and
routing policy rules were kept, but now only foreign nexthops and rules
with RTPROT_STATIC are kept and others are dropped.
Similary, when KeepConfiguration=dynamic, previously all foreign nexthops
and rules were removed, but now foreign configs with a dynamic protocol
e.g. RTPROT_DHCP are kept, and still configs with RTPROT_STATIC are
dropped.
Currently, we do not set/get/manage protocol for neighbor entries.
Hence, the logic of managing foreign neighbor entries is unchanged.
Without this change, only foreign routes with RTPROT_KERNEL, RTPROT_STATIC,
RTPROT_DHCP, RTPROT_RA, and RTPROT_REDIRECT are kept, and foreign routes with
other protocol e.g. RTPROT_BOOT are removed even if KeepConfiguration=yes.
Fixes a regression in dd6d53a8dc (v257).
Fixes#36411.
Since kernel v4.17 (1b71af6053af1bd2f849e9fda4f71c1e3f145dcf), the
attribute is always set in each netlink message for routing policy rule.
Now, our base line is v5.4. Hence, we can drop the workaround.
This makes,
- When a wildcard value '*' is specified, use the first supported
compression algorithm,
- disable compression if Accept-Encoding header is unspecified or
no supported compression algorithm specified in the header,
- ignore all errors in parsing the header.
Follow-ups for cfaf78001c.
- use OrderedHashmap to manage configured compression algorithms, then
drop CompressionArgs,
- rename CompressionOpts -> CompressionConfig,
- refuse 'none' in Compression= setting, but accept boolean false, which
disables compression,
- when Compression= option is unspecified, enable all supported compression
algorithms by default,
- do not set 'none' to the Accept-Encoding header.
When a new device is processed, there should be no watch handle for
the device, hence udev_watch_clear() provides -1. Let's not try to call
inotify_rm_watch() in that case.
This should not change any behavior. Just for suppressing spurious
debugging log:
=====
(udev-worker)[3626140]: zram1: Removing watch handle -1.
=====
While killing cgroup v1 I want to turn all cg_* helpers to take
cgroupfs_fd + cg path, which means all relevant path operations must
support openat() semantics. `removexattrat()` is currently missing. I
took the chance to do a bigger refactor for xattr-util.
This adds `--json=MODE` command line option to `udevadm test`.
This may be useful for parsing e.g. network interface name or device
node symlinks.
Closes#23661.
Follow-up for 97318131fd.
By default, suite of each built test is determined by the directory of
the source file. Hence, before the mentioned commit, all tests in
src/boot/efi/ are in the 'efi' suite. The commit changed the directory
tree, but forgot to update the name of the test suite.
This adds --json=MODE option for 'udevadm test' command.
When specified, all messages, except for the final result, will be
written to stderr, and the final result is shown in JSON format to
stdout. It may be useful for parsing the test result.
Let's derive XKBLAYOUT and friends from the given keymap and populate
these as well in vconsole.conf so that if the user configures a keymap
it's also respected in display managers such as gdm.
- introduces UDEV_BUILTIN_DESTRUCTOR macro,
- normalize log messages on initialize/finalize,
- explicitly initialize global variable,
- drop using _UDEV_BUILTIN_INVALID.
Previously, when comparing an existing and requested routing policy
rules, `all` flag was unset, thus the from and to addresses in the two
rules were not compared. Hence, a new request with from and/or to
addresses might be considered as it already exists even the addresses of
existing one were different from the newly requested one.
All existing rules have valid family, i.e. AF_INET or AF_INET6. And,
all requesting rules with from and/or to addresses also have a valid
family. Hence, even `all` flag is unset, the addresses can be and must
be compared in that case.
Fixes a regression caused by fc58350aa4 (v257).
Fixes#35874.
In the kernel, all routing policy rules are not assigned to any interface,
and we can configure them even if the relevant interface is down state.
Fixes a regression caused by 4f8b153d90 (v257).
Fixes#36244.
When '--resolve-names=late', systemd-udevd resolves user/group names
during each event being processed, and does not verify names on parse.
When '--resolve-names=never', systemd-udevd refuses any user/group names
on parse. Hence, the parser of udev rules behaves diffrently. Let's not
convert 'never' -> 'late' silently, and use the specified option as is.
This also updates man page and shell completion for --resolve-names
option.
- drop unnecessary one line function dump_device_action_table(),
- make parse_device_action() log about invalid action string,
- rename output argument of parse_device_action().
This also
- renames efifirmware_match_by_fwid() -> efi_firmware_match_by_fwid(),
- drops unnecessary wrapper efifw_get_fwid(),
- drops unnecessary inclusion of header <endian.h>,
- sort files in meson.build.
No functional change, just refactoring and follow-ups for
83bf58f39d.
Yu Watanabe
