Let's restrict how we apply credential globbing in ImportCredential=, so
that we have some flexibility in automatically extending the glob
expression with per-instance data eventually without getting into
conflict with the globbing parts.
In our current uses we only allow globbing at the end of the expression,
and this is a new, unreleased feature hence let's be restrictive on this
initially. We can still relax this later if we feel the need to after
all.
Fixes: #28022
This setting allows services to run in an ephemeral copy of the root
directory or root image. To make sure the ephemeral copies are always
cleaned up, we add a tmpfiles snippet to unconditionally clean up
/var/lib/systemd/ephemeral. To prevent in use ephemeral copies from
being cleaned up by tmpfiles, we use the newly added COPY_LOCK_BSD
and BTRFS_SNAPSHOT_LOCK_BSD flags to take a BSD lock on the ephemeral
copies which instruct tmpfiles to not touch those ephemeral copies as
long as the BSD lock is held.
Let's visually separate the options associated with cpu, io, memory, …
in subsections
This patch tries to be minimal. It just adds the section titles, and
does minimal reordering to make sure the options on the same kind of
resource are placed close to each other.
The order of the description of each item should match the order that they are declared. Un-document effect of deprecated non-unified CGroup hierarchy on
DefaultCPUAccounting=. Mention that the default value for DefaultCPUAccouting= is
affected by the kernel version.
D'oh. Nobody noticed in 3 years, I guess nobody calls these directly
and instead the manager's methods are used. Still we'll have to keep
this around, so just hide it.
serve stale feature to keep the DNS resource records beyond TTL to return them as stale records in case of upstream server is not reachable or returns negative response.
SD_RESOLVED_NO_STALE flag has been added to disable serving stale records via dbus.
added serve stale test cases to TEST-75-RESOLVED
Fixes: #21815
This makes a bond or bridge interface in the degraded-carrier state but has a routable address
handled as routable operational state.
If the carrier is degraded but the address state is routable then the operational state should be
seen as routable and not degraded because that may be the case for bonds if some of the links are down,
but when that happens the bond as whole is still routable.
This also makes operational state to degraded if address state is degraded even if the link state is
degraded-carrier.
Fixes#22713.
The idea is to make it easy to generate all the signing key and certs
that can be used for local signing. The verb is the modeled after
'mkosi genkey', but there are some important differences: we generate
the keys to the paths where they will be read from, both pcr signing
keys and the SecureBoot certificate+key.
If any of the outputs exist, operation is refused. Maybe we could add a
--force option in the future, but this operation should be rare, so I think
it's better to refuse to overwrite anything initially.
I'm only doing a token man page change here.
https://github.com/systemd/systemd/pull/27621 reworks the man page,
and the changes done here would conflict heavily with that work. I'll
submit a follow-up patch later.
Doesn't really matter since the two unicode symbols are supposedly
equivalent, but let's better follow the unicode recommendations to
prefer greek small letter mu, as per:
https://www.unicode.org/reports/tr25
This is a rework of #24764 by Cristian Rodríguez
<crodriguez@owncloud.com>, which stalled.
Instead of assigning -1 we'll use a macro defined to INT_MAX however.
Let's mention what /usr/lib/clock-epoch precisely does, and underline we
only *advance* the time based on it.
Inspired by Darkdragon-001's #23214.
Replaces #23214
Add a parameter to the integritytab file to set the mode in which to
open the integrity volume. The mode can be journaled (the default),
bitmap without a journal, or direct mode without a journal or a bitmap.
This change removes the `no-journal' option because it is redundant,
being replaced with `mode=direct'.
Supercedes commit bcc1ee56c, from a week ago, which implemented
`no-journal'.
Resolves#27587
These will be used in UIs to refer to the company or organization which
produces the OS separately from referring to the OS itself.
Signed-off-by: Philip Withnall <pwithnall@endlessos.org>
Fixes: #27777
ImportCredential= takes a credential name and searches for a matching
credential in all the credential stores we know about it. It supports
globs which are expanded so that all matching credentials are loaded.
Ronan Pigott
Lennart Poettering
Jan Luebbe
Daan De Meyer
Zbigniew Jędrzejewski-Szmek
cvlc12
Frantisek Sumsal
Sam Morris
licunlong
Luca Boccassi
Kiran Vemula
zhmylove
Frantisek Sumsal
Henrik Holst
Anatoli Babenia
Nick Rosbrook
Alfred Klomp
Philip Withnall
Mike Yuan