This is analogous to a change in mkosi[1] with the same motivation: some
scripts are run to bootstrap the distribution tree and are thus running
directly on the host system which may not have `/bin/bash` (e.g. NixOS).
As with the `mkosi` change, do that for each shebang for consistency
reasons.
[1] https://github.com/systemd/mkosi/commit/8d2cd50e5192cada7211724ecff3514f0c85cf0f
A recent commit made the standalone binaries always buildable
on demand, but as a side effect due to how 'meson install' works,
they are always built and installed by 'meson install' even
if the standalone-binaries= option is disabled.
Fix it so that 'meson install' only installs them if the
option is explicitly enabled, while still allowing
building them on demand.
Follow-up for 54492552a1
Currently mount options are handled in such a way that the first
definition for a given partition wins, and documented as such.
Change them so that they behave like other options, and the
last specified wins.
Applies to RootImageOptions=, MountImages= and ExtensionImages=.
Switch from a linked list to an array indexed by the partition
specifier to store them.
Transparent Hugepages (THP) is a Linux kernel feature that manages
memory using larger pages (2MB on x86, compared to the default 4KB). The
main goal is to improve memory management efficiency and system
performance, especially for memory-intensive applications. However, it
can cause drawbacks in some scenarios, such as memory regression and
latency spikes. THP policy is governed for the entire system via
/sys/kernel/mm/transparent_hugepage/enabled.
However, it can be overridden for individual workloads via prctl(2) call.
MemoryTHP= is used to disable THPs at exec-invoke to stop providing THPs
for workloads where the drawbacks outweigh the advantages. When set to
"disable", MemoryTHP= disables THPs completely for the process,
irrespective of global THP controls.
[1] https://man7.org/linux/man-pages/man2/PR_SET_THP_DISABLE.2const.html
[2] https://man7.org/linux/man-pages/man2/madvise.2.html
[3] https://github.com/torvalds/linux/commit/9dc21bbd62edeae6f63e6f25e1edb7167452457b
Transparent Hugepages (THP) is a Linux kernel feature that manages
memory using larger pages (2MB on x86, compared to the default 4KB).
The main goal is to improve memory management efficiency and system
performance, especially for memory-intensive applications.
However, it can cause drawbacks in some scenarios, such as memory
regression and latency spikes. THP policy is governed for the entire
system via /sys/kernel/mm/transparent_hugepage/enabled.
However, it can be overridden for individual workloads via prctl(2)
call.
MemoryTHP= is used to disable THPs at exec-invoke to stop
providing THPs for workloads where the drawbacks outweigh the advantages.
When set to "disable", MemoryTHP= disables THPs completely for the
process, irrespecitive of global THP controls.
When set to "madvise", MemoryTHP= disables THPs for the process except
when specifically madvised by the process with MADV_HUGEPAGE or MADV_COLLAPSE.
As announced by a few releases now, finally drop support for
sysvinit scripts.
Keep rc-local generator for now, as it's really a distinct
feature even though from the same era.
They are separate and independent settings, so adjust meson rules
and unit files accordingly. It is possible to enable support for
rc-local script without support for sysvinit scripts, and viceversa.
This will become useful later when sysvinit scripts support is
removed.
Adds missing scancodes for Lenovo Legion Go, Go S, and Go 2. When long
pressing the power button the device should issue a LEFTMETA + F16
combo. The LEFTMETA code fires properly, but the F16 is not mapped.
Go and Go S devices detect as AT Translated Set 2 Keyboard, while Go 2
detects as AT Raw Set 2 Keyboard, hence the multiple entries.
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Otherwise, if the VM is unexpectedly rebooted, then `importctl --user pull-tar`
may fail as the file may already exist.
```
[ 123.351751] TEST-13-NSPAWN.sh[3946]: + run0 -u testuser importctl --user pull-tar file:///var/tmp/image-tar/kurps.tar.gz nurps --verify=checksum -m
[ 123.541603] TEST-13-NSPAWN.sh[4311]: Enqueued transfer job 3. Press C-c to continue download in background.
[ 123.552456] TEST-13-NSPAWN.sh[4311]: Pulling 'file:///var/tmp/image-tar/kurps.tar.gz', saving as 'nurps'.
[ 123.552788] TEST-13-NSPAWN.sh[4311]: Operating on image directory '/home/testuser/.local/state/machines'.
[ 123.819942] TEST-13-NSPAWN.sh[4311]: Got 1% of file:///var/tmp/image-tar/kurps.tar.gz.
[ 124.156557] TEST-13-NSPAWN.sh[4311]: * shutting down connection #0
[ 124.156896] TEST-13-NSPAWN.sh[4311]: * Could not open file /var/tmp/image-tar/kurps.tar.gz.sha256
[ 124.157223] TEST-13-NSPAWN.sh[4311]: * closing connection #-1
[ 124.159198] TEST-13-NSPAWN.sh[4311]: * Could not open file /var/tmp/image-tar/kurps.nspawn
[ 124.159493] TEST-13-NSPAWN.sh[4311]: * closing connection #-1
[ 124.159818] TEST-13-NSPAWN.sh[4311]: Acquired 68.5M.
[ 124.160395] TEST-13-NSPAWN.sh[4311]: Download of file:///var/tmp/image-tar/kurps.tar.gz complete.
[ 124.160664] TEST-13-NSPAWN.sh[4311]: Transfer failed: Could not read a file:// file
[ 124.160923] TEST-13-NSPAWN.sh[4311]: Settings file could not be retrieved, proceeding without.
[ 124.404733] TEST-13-NSPAWN.sh[4311]: * shutting down connection #1
[ 124.405162] TEST-13-NSPAWN.sh[4311]: Acquired 79B.
[ 124.406170] TEST-13-NSPAWN.sh[4311]: Download of file:///var/tmp/image-tar/SHA256SUMS complete.
[ 124.406734] TEST-13-NSPAWN.sh[4311]: SHA256 checksum of file:///var/tmp/image-tar/kurps.tar.gz is valid.
[ 124.455446] TEST-13-NSPAWN.sh[4311]: Failed to rename to final image name to /home/testuser/.local/state/machines/.tar-file:\x2f\x2f\x2fvar\x2ftmp\x2fimage-tar\x2fkurps\x2etar\x2egz: File exists
[ 124.457251] TEST-13-NSPAWN.sh[4311]: Exiting.
```
Workaround for issue #38240.
The qemu update migrated to noble-updates a couple weeks ago, so it is
no longer necessary to enable noble-proposed (or add the associated apt
pinning config).
The primary motivation for this is to allow users of ukify to build
UKI-like objects, without having them later be detected as a UKI by
tools like kernel-install and bootctl.
The common code used by these tools to determine if a PE binary is a UKI
checks that both .osrel and .linux sections are present. Hence, adding
a mechansim to skip .osrel provides a way to avoid being labeled a UKI.
The current tree doesn't even compile with libidn(1) after
2c7bdaf9f1, which included
a non-existent call to check_dlopen_blocked() somehow.
Hence, it feels safe to just nuke legacy support from
our repo.
The verity user certs weren't looked up in the given --root= for
systemd-sysext which made it fail to set up extensions with a strict
image policy.
Look up verity user certs from inside the --root= when we operate on
images in it. The main use case where this matters is when the initrd
sets up the extensions for the final system and thus systemd-sysext
should do the same thing as it would do in the final system.
This has been supported since systemd v242 (specifically commit
7619cb32f0 if I’m not mistaken; added to NEWS in commit 4107452e51), but
the man page still claimed otherwise.
The `sg_adm` and `sg_mem` fields are not always set in shadow groups,
which can lead to issues with foreign tools like shadow's `sg` command.
Since other NSS implementations properly set these fields and it would
otherwise be impossible to access `administrators` and `members`
information from JSON files, it's bets to always fill these fields.
Even though `sg` is a nice example which should be already installed,
the issue itself can be reproduced with this simple program as well. It
relies on filled `sg_adm` and `sg_mem` fields just like `sg` does:
```
#include <err.h>
#include <gshadow.h>
#include <stdio.h>
int
main(int argc, char *argv[])
{
struct sgrp *s;
char **p;
if (argc != 2)
errx(1, "usage: poc group");
s = getsgnam(argv[1]);
printf("name: %s\n", s->sg_namp);
printf("admins:\n");
p = s->sg_adm;
while (*p != NULL) {
printf("- %s\n", *p);
p++;
}
printf("members:\n");
p = s->sg_mem;
while (*p != NULL) {
printf("- %s\n", *p);
p++;
}
}
```
Run it like this: `./poc root`
Proof of Concept (Arch Linux, which uses systemd with systemd-userdbd
and shadow's sg):
```
$ grep systemd /etc/nsswitch.conf
passwd: files systemd
group: files [SUCCESS=merge] systemd
shadow: files systemd
gshadow: files systemd
```
Issue with intrinsic groups:
Run as unprivileged user, who has no access to `/etc/gshadow` to trigger
nss-systemd (strace disables setuid of sg)
```
$ strace sg root
write(2, "sg: list.c:169: is_on_list: Asse"..., 61sg: list.c:169: is_on_list: Assertion `NULL != list' failed.
) = 61
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa7e9c0c000
gettid() = 1882
getpid() = 1882
tgkill(1882, 1882, SIGABRT) = 0
--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=1882, si_uid=1000} ---
+++ killed by SIGABRT (core dumped) +++
Aborted (core dumped) strace sg root
```
Issue with groups through systemd-userdbd:
1. Create a custom group (as root)
```
cat > /etc/userdb/sg-poc.group << EOF
{
"groupName": "sg-poc",
"gid": 6123,
"administrators": [
"root"
],
"members": [
"bin"
]
}
EOF
ln -s sg-poc.group /etc/userdb/6123.group
```
2. Verify that group actually exists
```
$ userdbctl group sg-poc
Group name: sg-poc
Disposition: regular
GID: 6123
Admins: root
Service: io.systemd.NameServiceSwitch
```
3. Run `sg` to switch into group `sg-poc` as regular user, this time
with setuid, i.e. no strace as before
```
$ sg sg-poc
sg: list.c:169: is_on_list: Assertion `NULL != list' failed.
Aborted (core dumped) sg sg-poc
```
In recent Fedora, preset-all fails:
[ 155s] Failed to preset unit: File '/buildroot/etc/systemd/user/dbus.service'
already exists and is a symlink to /usr/lib/systemd/user/dbus-broker.service
[ 155s] ‣ "systemctl --root=/buildroot --global preset-all" returned non-zero exit code 1.
Strictly speaking, this is an error in configuration. The presets specify that
both dbus-broker.service and dbus-daemon.service shall be enabled and they both
claim the 'dbus.service' alias. But this kind of error is very easy to make.
Failing the preset operation is too harsh, since in most cases the system will
work fine without an alias and changes in unrelated components can cause the
conflict.
Let's reuse the same logic that was added in
ad5fdd3912: when enabling the unit through
'preset' or 'preset-all', print the message, but suppress the error. When
enabling through 'enable', fail the operation.
Add a test for getsgnam_r to verify that sg_adm and sg_mem always point
to a NULL-terminated string vector.
Extend the gr_mem check of struct group for non-NULL values as well.
Fill sg_adm and sg_mem in nss_pack_group_record_shadow to stay
compatible with other NSS getsgnam implementations which set these
members to NULL terminated string arrays.
Tools like shadow's sg would trigger a NULL pointer dereference with
groups only found through nss-systemd otherwise.
The sg_adm and sg_mem fields are supposed to point to a NULL terminated
string array. If these are NULL, some foreign tools like shadow's sg
trigger NULL pointer dereferences (or fortunately their asset() calls).
Previously, if execution failed, we'd log at error level both from the
child and the parent, and we were using a bogus variable for the argument
name:
$ build/systemd-inhibit list
Failed to execute : No such file or directory
list failed with exit status 1.
In general, we can and should assume that the program the user is calling
is well behaved, so it'll log the error on its own if appropriate. So we
shouldn't log on "normal errors", but only if the child is terminated by
a signal.
And since the program name is controlled by the user, use quotes everywhere
to avoid ambiguity.
Now:
$ build/systemd-inhibit false
(nothing)
$ build/systemd-inhibit bash -c 'kill -SEGV $$'
src/basic/process-util.c:895: 'bash' terminated by signal SEGV.
menu-force and menu-hidden were added in 97f077df05,
menu-disable was added in 6efdd7fec5, a year later.
So we can assume that if the feature flag is set, the other string values are
supported too. The comment that there's no way check that was added later in
5b45fad4fc, but it was incorrect even at that
time.
Fixes https://github.com/systemd/systemd/issues/39167. As described in the
issue, we documented various string values in the BLI, but bootctl didn't use
the string values. At the time menu-force and menu-hidden were added, using
numerical values for compatibility made sense. But that stopped being needed
when a string value that didn't have a strictly equivalent numerical value and
a feature flag were added.
When converting a large number to menu-force, message is downgraded to debug,
since the severity of the issue is very minor. Debug messages are added in
other places when the requested setting is modified too.
Maximilian Bosch
Yu Watanabe
Luca Boccassi
francescoza6
Usama Arif
Derek J. Clark
Alexis-Emmanuel Haeringer
Tobias Stoeckmann
Zbigniew Jędrzejewski-Szmek
Nick Rosbrook
Cathy Hu
Pablo Fraile Alonso
Mike Yuan
Kai Lueke
Lucas Werkmeister