Also, if a device ACL list is defined, also go via IPC (instead of
trying to patch it, as before).
The outcome is that the tighter rules continue to apply when configured.
Fixes: #35959
The credential mounts should be managed singlehandedly by pid1.
Preparation for the future introduction of RefreshOnReload=credential,
where refreshing creds will be properly supported on reload.
This allows for "per-instance" credentials for units. The use case
is best explained with an example. Currently all our getty units
have the following stanzas in their unit file:
"""
ImportCredential=agetty.*
ImportCredential=login.*
"""
This means that setting agetty.autologin=root as a system credential
will make every instance of our all our getty units autologin as the
root user. This prevents us from doing autologin on /dev/hvc0 while
still requiring manual login on all other ttys.
To solve the issue, we introduce support for renaming credentials with
ImportCredential=. This will allow us to add the following to e.g.
serial-getty@.service:
"""
ImportCredential=tty.serial.%I.agetty.*:agetty.
ImportCredential=tty.serial.%I.login.*:login.
"""
which for serial-getty@hvc0.service will make the service manager read
all credentials of the form "tty.serial.hvc0.agetty.xxx" and pass them
to the service in the form "agetty.xxx" (same goes for login). We can
apply the same to each of the getty units to allow setting agetty and
login credentials for individual ttys instead of globally.
This reverts commit 1e1225614c.
This was an incomplete workaround of the race. Now that
we stop generating mount units for credential mounts,
the logic could be dropped.
When a unit has credentials, stopping the service unmounts the credentials
directory. On shutdown, stopping the service and the corresponding mount
unit may be done mostly simultaneously, and if we invoke umount command soon
after umount() being called on stopping the service, the mount unit will
fail.
This makes Mount.invalidated_state flag set when umount() is called for a path,
and re-read /proc/self/mouninfo before invoking umount command if the flag is set.
Fixes#25527.
Replaces #26959.
Lennart Poettering
Daan De Meyer
Mike Yuan
Yu Watanabe