When starting a wayland session through a systemd service for a non-root
user, the compositor (based on wlroots) is denied the authorization to
change vt.
Once the user logs in, either through a local console or via ssh, the
compositor can work properly.
This is related to the login polkit policy:
- `allow_inactive` has value `auth_admin_keep`, denying any non-root
user session the authorization to change vt
- `allow_active` has value `yes`, which explains why the vt change
becomes possible once the user logs in through another channel
By changing the `allow_inactive` value to `yes`, any user session setup
in a service file can switch vt, allowing wayland sessions for non-root
users.
We used to log the following error:
"Start job for unit user-1000.slice failed with 'canceled'"
which can be really misleading if the actual job failed at *stopping* a unit.
Indeed "Start" was hard coded but it was wrong since we can also fail with stop
jobs which are enqueued when a session is stopped.
When specifying `DHCPv4.SendOption=`, it is used by systemd-networkd to
set the value of that option within the DHCP request that is sent out.
This differs to setting `DHCPServer.SendOption=`, which will place all
the options together as suboptions into the vendor-specific information
(code 43) option.
This commit adds two new config options, `DHCPv4.SendVendorOption=` and
`DHCPServer.SendVendorOption=`. These both have the behaviour of the old
`DHCPServer.SendOption=` flag, and set the value of the suboption in the
vendor-specific information option.
The behaviour of `DHCPServer.SendOption=` is then changed to reflect
that of `DHCPv4.SendOption=`. It will set the value of the corresponding
option in the DHCP request.
Calling `mac_selinux_enforcing()`, which calls `security_getenforce()`, on a SELinux disabled system causes the following error message to be printed:
Failed to get SELinux enforced status: No such file or directory
Fixes: 257188f80c ("selinux: cache enforced status and treat retrieve failure as enforced mode")
Supersedes: #15145
codesearch.debian.net shows no uses (except for the definition in systemd and
elogind).
$ cat > test.c
int main() {
sd_bus_try_close(NULL);
return 0;
}
$ gcc -Isrc/systemd -Wall -o testbus test.c -lsystemd
test.c: In function ‘main’:
test.c:4:3: warning: ‘sd_bus_try_close’ is deprecated [-Wdeprecated-declarations]
4 | sd_bus_try_close(NULL);
| ^~~~~~~~~~~~~~~~
In file included from test.c:1:
src/systemd/sd-bus.h:180:5: note: declared here
180 | int sd_bus_try_close(sd_bus *bus) _sd_deprecated_; /* deprecated */
| ^~~~~~~~~~~~~~~~
$ sudo ln -svf multi-user.target /run/systemd/generator.early/default.target
'/run/systemd/generator.early/default.target' -> 'multi-user.target'
$ sudo build/systemctl set-default --root=/ sysinit.target
Removed /etc/systemd/system/default.target.
Created symlink /etc/systemd/system/default.target → /usr/lib/systemd/system/sysinit.target.
Note: "multi-user.target" is the default unit (possibly a runtime override).
The output is not super informative, but it should be enough to point the user in
the right direction.
Fixes#3645.
In practice we are very unlikely to fail at this point, but for
consistency, we should always warn when allocation fails, and
we have free_and_strdup_warn() for this.
This regression was introduced in #14913.
The current_file variable can be NULL, as, for example, with the
following commands:
* journalctl --list-boots
* journalctl -b -1 --no-pager
Since current_file is only checked for pointer equality with f, removing
the assertion is safe here.
Giving --echo to systemd-ask-password allows to echo the user input instead
of masking it. This is useful when querying for usernames or similar.
Showing "(press TAB for no echo)" does not make sense there, so do not.
Note that pressing TAB or ESC still disables echo.
Without changing the SELinux label for private /dev of a service, it will take
a generic file system label:
system_u:object_r:tmpfs_t:s0
After this change it is the same as without `PrivateDevices=yes`:
system_u:object_r:device_t:s0
This helps writing SELinux policies, as the same rules for `/dev` will apply
despite any `PrivateDevices=yes` setting.
Arnaud Ferraris
Franck Bui
Zbigniew Jędrzejewski-Szmek
David Wood
Susant Sahani
Christian Göttsche
Yu Watanabe
Anita Zhang
Michal Sekletár
Haochen Tong
Georg Müller
Christian Hesse
nabijaczleweli
Topi Miettinen