Commit Graph
85499 Commits
Author SHA1 Message Date
Yu Watanabe f29a0b3151 dissect-image: fix typo
Follow-up for 771085291d.
2026-01-02 04:32:48 +09:00
Yu Watanabe 78247787e9 ssh-proxy: fix typo
Follow-up for dc3e544104.
2026-01-02 04:30:58 +09:00
Mike Yuan 05aea9f73b core/dynamic-user: drop unused /run/systemd/dynamic-uid/direct: kludge
Follow-up for 1684c56f40
This effectively reverts fd63e712b2

This was originally introduced to resolve deadlock caused by
dbus broker calling into nss-systemd which in turn goes via
dbus for user lookup. This is now handled differently and
the interface has been sitting unused for half a decade now.
Kill it.
2026-01-02 04:28:01 +09:00
Daan De Meyer aec52c1e6e string-table: Introduce DECLARE_STRING_TABLE_LOOKUP() and friends
Let's introduce these for the following two reasons:
- Using them makes sure the parameter names match between declaration
  and definition (if both use the corresponding macros).
- They make sure developers can't forget the _const_ and _pure_
  attributes for the declarations.

This commit also includes some include sorting fixes
2026-01-02 04:05:45 +09:00
Daan De Meyer daff8ea8bb tree-wide: Introduce DECLARE_TRIVIAL_REF_UNREF_FUNC() and friends 2026-01-02 04:04:19 +09:00
David Santamaría Rogado 11adc8bad5 quirks: Re-add D330 accel_matrix as identity one (#40226)
When testing to correct accelerometer values I set locally the identity
matrix to override the quirk. The values were fine but removing all the
matrices give incorrect values.

The mistake was thinking that identity matrix is the default one when no
quirks are set. It is, but only when the ACPI doesn't have another one.

Set identity matrix for this device to correct accelerometer values.

Follow-up for a07b184e8c.
2026-01-02 03:52:56 +09:00
David Santamaría Rogado e9b3bfb3f5 quirks: sensor: add info about ACPI accel_matrix
Just inform about if an ACPI accel matrix exists, is the default one instead
the indentity matrix.
2026-01-02 03:49:45 +09:00
tuhaowen 3c586354aa udev/scsi_id: increase MAX_SERIAL_LEN from 256 to 512
The current MAX_SERIAL_LEN value of 256 is insufficient for some SCSI
devices with non-standard serial number lengths. In do_scsi_page80_inquiry(),
the required buffer length is calculated as:

    len = 1 + VENDOR_LENGTH + MODEL_LENGTH + buf[3]
        = 1 + 8 + 16 + buf[3]
        = 25 + buf[3]

where buf[3] contains the serial number length reported by the device.
According to the SCSI specification, this field is an unsigned 8-bit
value, meaning it can theoretically be up to 255 bytes. This results
in a maximum required length of 280 bytes, exceeding the current limit
of 256 bytes.

When this occurs, scsi_id fails with an error message like:
    "length 256 too short - need 280"

This has been observed with certain vendor devices that report unusually
long serial numbers in VPD page 0x80.

Increase MAX_SERIAL_LEN to 512 to accommodate the maximum possible
serial number length plus all required prefixes (vendor, model, and
type identifiers), providing sufficient headroom for non-compliant
devices while maintaining reasonable memory usage.

Signed-off-by: tuhaowen <tuhaowen@uniontech.com>
2026-01-02 03:48:28 +09:00
dependabot[bot] ecfe1bddaf build(deps): bump meson from 1.9.1 to 1.10.0 in /.github/workflows
Bumps [meson](https://github.com/mesonbuild/meson) from 1.9.1 to 1.10.0.
- [Release notes](https://github.com/mesonbuild/meson/releases)
- [Commits](https://github.com/mesonbuild/meson/compare/1.9.1...1.10.0)

---
updated-dependencies:
- dependency-name: meson
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-02 03:35:50 +09:00
dependabot[bot] 31ca68030b build(deps): bump actions/labeler from 5.0.0 to 6.0.1
Bumps [actions/labeler](https://github.com/actions/labeler) from 5.0.0 to 6.0.1.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/8558fd74291d67161a8a78ce36a881fa63b766a9...634933edcd8ababfe52f92936142cc22ac488b1b)

---
updated-dependencies:
- dependency-name: actions/labeler
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-02 03:35:36 +09:00
dependabot[bot] 5323c6e47c build(deps): bump redhat-plumbers-in-action/gather-pull-request-metadata
Bumps [redhat-plumbers-in-action/gather-pull-request-metadata](https://github.com/redhat-plumbers-in-action/gather-pull-request-metadata) from 1.8.0 to 1.8.1.
- [Release notes](https://github.com/redhat-plumbers-in-action/gather-pull-request-metadata/releases)
- [Commits](https://github.com/redhat-plumbers-in-action/gather-pull-request-metadata/compare/5da2967931dd7c4b9ccd22f49b045e2c1f05165b...b3dbc3f843e8343dbcb2af5bffba72c974d3a07a)

---
updated-dependencies:
- dependency-name: redhat-plumbers-in-action/gather-pull-request-metadata
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-02 03:35:21 +09:00
Guiorgy f5530c10b8 Support Bash completions for short option group in journalctl (#40214)
Currently, the Bash completions for journalctl tries to match the
previous word _**exactly**_, which leads to the following issue:
`journalctl -u dock` correctly auto completes to `journalctl -u
docker.service`, but `journalctl -eu` provides no completions at all,
which is a shame since I never use the `-u` option alone (almost always
`-eu` or `-efu`, I wish the `-e` option was the default but I digress).

The proposed solution is to assume words that start with only a single
dash and consist of only letters are short option groups and handle them
as if the previous word was the short option using the last character,
e.g. `-efu` -> `-u`.
2025-12-31 14:58:58 +00:00
kiamvdd 506b790d71 Add Lenovo Y50-70 touchpad to 60-evdev.hwdb 2025-12-31 14:56:48 +00:00
smosia 4a0743e398 hwdb: touchpad config for Apple MacbookPro12,1 Early 2015 2025-12-31 14:55:43 +00:00
Zongyuan He 8560f41192 po: Translated using Weblate (Chinese (Simplified) (zh_CN))
Currently translated at 100.0% (264 of 264 strings)

Co-authored-by: Zongyuan He <lovenemesis@gmail.com>
Translate-URL: https://translate.fedoraproject.org/projects/systemd/main/zh_CN/
Translation: systemd/main
2025-12-31 22:02:35 +09:00
Daan De Meyer f76f0f9935 core: several follow-ups for BindNetworkInterface= (#40202) 2025-12-28 12:55:30 +01:00
DaanDeMeyer f3c67f7e16 docs: Add explicit reference to unprivileged userns docs of mkosi
Fixes #40216
2025-12-28 09:31:47 +00:00
Mike Yuan e69ac871a0 bus-unit-util: BindNetworkInterface= is a cgroup property 2025-12-27 23:47:55 +01:00
Mike Yuan ecd677bcc9 core/cgroup: no need to handle empty bind_network_interface
We always normalize empty setting to NULL, hence per our usual
coding style a simply NULL check would suffice.
2025-12-27 23:47:55 +01:00
Mike Yuan 705d2c527f core/dbus-cgroup: actually allow empty assignment for BindNetworkInterface= 2025-12-27 23:47:55 +01:00
Mike Yuan 5af2df38df core/cgroup: fix bpf-bind-iface serialization
Follow-up for c1c787651b

The commit added serialization, but deserialization wasn't in place.
Follow the usual practice of pinning the bpf link fd until we install
the new instance.
2025-12-27 23:44:53 +01:00
Mike Yuan e78f615763 core/cgroup: fix potential bpf link fd leak during deserialization
Also add a comment explaining the deserialization mechanism, as requested
in https://github.com/systemd/systemd/pull/40202#discussion_r2649274628
2025-12-27 20:51:05 +01:00
Mike Yuan d90cfb7e30 core/bpf-restrict-ifaces: avoid duplicate unit_get_cgroup_runtime() call 2025-12-27 20:14:57 +01:00
Mike Yuan e4c43ca7d6 core/cgroup: CGContext must be available if Unit has CGRuntime
Follow-up for e03e5056db
2025-12-27 20:14:56 +01:00
Tobias Stoeckmann 0afbf1a8aa nss-systemd: fix typo in comment
"likely" should be "like" in this context.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
2025-12-27 16:28:25 +01:00
DaanDeMeyer 664f211c9e mkosi: update mkosi commit reference to e3642f81d3a7f8f9310c0c734b2ba9dd41e50e14
* e3642f81d3 kmod: Only use --modname if available
* ddea81d81e arch: Download archlinux-keyring with pacman
* 4a44e1831b Remove unneeded lambdas
* 9c3d23757c Configure pyright included files
* 5e037d514c qemu: Register with systemd-machined in user session
* c4c3d793d0 Create package cache dir before invoking pacman
* d53761c4dd distribution: do not default to release=VERSION_ID for openSUSE Tumbleweed
* c5bc9138fc Wrap build_microcode_initrd in complete_step
* 635159975d Fix typo in manpage
* 59f5f0741e mkosi-addon: drop Output=addon, addon.py already has a default
* be85b8ca0b sandbox: return raw error code from the kernel and friends on failure
* 56f25c1a41 config: replace deprecated sandbox verb with box in help message
* ae24c527d7 sandbox: fix wrong errno passed to OSError()
* e7b9612760 verity: do not copy signing cert in addons/portables/extensions
* f3a029b736 Bump version to 27~devel
* 84af20892b Release 26
* 3fcd3a0fde Adjust logging messages for kmod/fw resolution
* d44aae12b4 Revert "Do not try to install packages that are listed in RemovePackages="
* 1873ad0184 portable: Make sure mountpoints exist in the image
* 5dc693feb0 initrd: Inherit keymap, timezone, hostname and rootpw by default
2025-12-26 22:49:26 +01:00
Luca Boccassi 9463b3b51c man: document version for BindNetworkInterface instead of using ignore list
The ignore list is for older stuff, all new interfaces must be documented
with a version.

Follow-up for c1c787651b
2025-12-24 19:25:21 +01:00
DaanDeMeyer 11f47cb700 bootctl-install: Fix OpenSSL UI
Follow up for a86a366eb0.
2025-12-24 18:04:57 +01:00
Lennart Poettering ceaa36c21e terminal-util: use the right ANSI ST sequence
There are multiple ways to encode ANSI ST, and we generally prefer ESC \
for it, for reasons explained in terminal-util.h. Hence, let's actually
follow this rule in the terminal reset logic, and use the ANSI_ST macro.

This will change the byte sequence generated (as it means we use ESC \
rather than BEL), but it doesn't change behaviour, as the two sequences
should be equivalent.
2025-12-24 09:40:43 +01:00
Mike Yuan 22eb3a6bd9 ptyfwd: turn off O_NONBLOCK on output after soft reset
Follow-up for 3d97db8f3c

terminal_reset_ansi_req() would try to put terminal in nonblocking
mode temporarily again, hence just avoid the back and forth
and reset nonblocking as last step.
2025-12-24 08:07:59 +01:00
Jörg Behrmann 1afe5c7b4b terminal-util: also send ANSI_NORMAL in terminal_reset_ansi_seq
Certain terminal emulators (alacritty, ghostty and kitty) require ANSI_NORMAL
to be sent to reset the colours.

Followup for 3d97db8f3c.

Fixes: #40163
2025-12-24 07:59:42 +01:00
Lennart Poettering 1978e42197 update TODO 2025-12-24 07:38:28 +01:00
Lennart Poettering 77639f179b update TODO 2025-12-24 07:38:15 +01:00
Luiz Amaral c1c787651b Add support for binding a unit to a network iface 2025-12-24 07:37:58 +01:00
DaanDeMeyer 875b568f56 repart: Fix OpenSSL UI
Follow up for 0158eabb01
2025-12-23 20:55:32 +01:00
Daan De Meyer 738bad8f35 mkosi: Use initrd as exitrd
Let's speed up image builds by avoiding building
an exitrd and instead reusing the initrd image for
the same purpose.
2025-12-21 20:31:24 +01:00
Daan De Meyer 64991b2148 repart: Fix --defer-partitions-empty= docs
Fixes #40176
2025-12-21 19:30:06 +00:00
Luca Boccassi 8d1e58f9fd test: fix (again) race condition in TEST-80-NOTIFYACCESS
Even with the previous fix, it can still happen that pid1
sends SIGHUP to the script after 'sdnotify --ready' but before
'wait', so the test can still get stuck:

[ 2444.373448] reload-timeout.sh[158]: + set -o pipefail
[ 2444.373502] reload-timeout.sh[158]: + COUNTER=0
[ 2444.373590] reload-timeout.sh[158]: + trap sighup_handler SIGHUP
[ 2444.373639] reload-timeout.sh[158]: + export SYSTEMD_LOG_LEVEL=debug
[ 2444.373670] reload-timeout.sh[158]: + SYSTEMD_LOG_LEVEL=debug
[ 2444.373790] reload-timeout.sh[158]: + wait_for_signal 1
[ 2444.373871] reload-timeout.sh[158]: + local notify=1
[ 2444.373912] reload-timeout.sh[158]: + local p
[ 2444.374079] reload-timeout.sh[158]: + p=159
[ 2444.374123] reload-timeout.sh[159]: + sleep infinity
[ 2444.375358] systemd[1]: reload-timeout.service: Got notification message from PID 158: READY=1
[ 2444.375363] systemd[1]: reload-timeout.service: Changed start -> running
[ 2444.375368] systemd[1]: reload-timeout.service: Job 294 reload-timeout.service/start finished, result=done
[ 2444.375374] systemd[1]: Started reload-timeout.service.
[ 2444.375766] systemd[1]: reload-timeout.service: Failed to send unit change signal for reload-timeout.service: Connection reset by peer
[ 2444.376464] reload-timeout.sh[158]: + '[' 1 -eq 1 ']'
[ 2444.376464] reload-timeout.sh[158]: + systemd-notify --ready
[ 2444.376518] TEST-80-NOTIFYACCESS.sh[157]: Job for reload-timeout.service finished.
[ 2444.376518] TEST-80-NOTIFYACCESS.sh[157]: Got result done/Success for job reload-timeout.service.
[ 2444.376518] TEST-80-NOTIFYACCESS.sh[157]: Bus n/a: changing state RUNNING → CLOSED
[ 2444.376952] TEST-80-NOTIFYACCESS.sh[92]: + systemctl reload --no-block reload-timeout.service
[ 2444.379548] TEST-80-NOTIFYACCESS.sh[161]: Bus n/a: changing state UNSET → OPENING
[ 2444.379548] TEST-80-NOTIFYACCESS.sh[161]: sd-bus: starting bus by connecting to /run/systemd/private...
[ 2444.379548] TEST-80-NOTIFYACCESS.sh[161]: Bus n/a: changing state OPENING → AUTHENTICATING
[ 2444.379548] TEST-80-NOTIFYACCESS.sh[161]: Executing dbus call org.freedesktop.systemd1.Manager ReloadUnit(reload-timeout.service, replace)
[ 2444.379548] TEST-80-NOTIFYACCESS.sh[161]: Bus n/a: changing state AUTHENTICATING → RUNNING
[ 2444.379910] systemd-notify[160]: Notify message sent to '/run/systemd/notify': "READY=1"
[ 2444.379931] systemd-notify[160]: Notify message sent to '/run/systemd/notify': "BARRIER=1"
[ 2444.382218] systemd[1]: reload-timeout.service: Trying to enqueue job reload-timeout.service/reload/replace
[ 2444.382241] systemd[1]: reload-timeout.service: Installed new job reload-timeout.service/reload as 366
[ 2444.382248] systemd[1]: reload-timeout.service: Enqueued job reload-timeout.service/reload as 366
[ 2444.383905] systemd[1]: reload-timeout.service: Service has no extensions to reload.
[ 2444.384925] systemd[1]: reload-timeout.service: Changed running -> reload-signal
[ 2444.384935] systemd[1]: Reloading reload-timeout.service...
[ 2444.386410] reload-timeout.sh[158]: ++ sighup_handler
[ 2444.386410] reload-timeout.sh[158]: ++ echo hup1
[ 2444.386455] TEST-80-NOTIFYACCESS.sh[161]: Bus n/a: changing state RUNNING → CLOSED
[ 2444.386555] TEST-80-NOTIFYACCESS.sh[92]: + timeout 10 bash -c 'until [[ $(systemctl show reload-timeout.service -P SubState) == "reload-signal" ]]; do sleep .5; done'
[ 2444.395566] TEST-80-NOTIFYACCESS.sh[165]: Bus n/a: changing state UNSET → OPENING
[ 2444.395566] TEST-80-NOTIFYACCESS.sh[165]: sd-bus: starting bus by connecting to /run/systemd/private...
[ 2444.396041] TEST-80-NOTIFYACCESS.sh[165]: Bus n/a: changing state OPENING → AUTHENTICATING
[ 2444.396041] TEST-80-NOTIFYACCESS.sh[165]: Showing one /org/freedesktop/systemd1/unit/reload_2dtimeout_2eservice
[ 2444.401911] TEST-80-NOTIFYACCESS.sh[165]: Bus n/a: changing state AUTHENTICATING → RUNNING
[ 2444.401911] TEST-80-NOTIFYACCESS.sh[165]: Bus n/a: changing state RUNNING → CLOSED
[ 2444.403806] TEST-80-NOTIFYACCESS.sh[92]: + sync_in hup1
[ 2444.403806] TEST-80-NOTIFYACCESS.sh[92]: + read -r x
[ 2444.403964] reload-timeout.sh[158]: + wait 159
[ 2444.403988] TEST-80-NOTIFYACCESS.sh[92]: + test hup1 = hup1
[ 2444.403988] TEST-80-NOTIFYACCESS.sh[92]: + timeout 10 bash -c 'until [[ $(systemctl show reload-timeout.service -P SubState) == "reload-notify" ]]; do sleep .5; done'

Try to check if the signal handler has ran by checking the counter,
and avoid waiting and immediately return if it has changed

Fixes https://github.com/systemd/systemd/issues/39581

Follow-up for 8fba2ed258
2025-12-21 19:29:55 +01:00
Daan De Meyer 5b830eda79 signal-util: Use act instead of __act in comment
The clang-tidy check ignores trailing and
preceeding underscores, so let's just use act
instead of __act.
2025-12-21 19:21:08 +01:00
Daan De Meyer b295c166f9 mkosi: update fedora commit reference to 67538c79f250eecbd904aa87e72a44cb3b5ef6f4
* 67538c79f2 Make dbus and systemd-pam recommended dependencies
* c052029197 Drop libcap-devel BuildRequires
2025-12-21 11:43:00 +00:00
Daan De Meyer f9708c53aa Follow ups for #39806
We drop the optimization for verify_sigchld as the
check differs based on the options passed and the
extra syscalls are certainly not going to matter
compared to the cost of forking a child process.

Fixes #40166
2025-12-21 08:16:03 +01:00
Lennart Poettering 471fe52d57 preparatory work from the OCI PR (#40149)
This adds 11 commits with minor preparatory commits for PR #39621. That
PR has tests that cover all this, even if this one doesn't, but the bits
added here are relatively minor.
2025-12-21 07:38:29 +01:00
Lennart Poettering 9cfefbf983 dissect-image: automatically convert O_PATH fd to proper fd in mountfsd client
Let's make the mountfsd client code a bit easier to use, and convert an
O_PATH fd to a real one if necessary, automatically.
2025-12-21 07:04:42 +01:00
Lennart Poettering b7d1d17b9c dissect-image: teach mountfsd_make_directory() the new access mode parameter 2025-12-21 07:04:42 +01:00
Lennart Poettering a9b60de478 mountfsd: return a better error when invalid file flags are specified on image fd
We already defined an error for this that we return for invalid dir fds
passed in, let's add the same niceness to the image fds.
2025-12-21 07:04:42 +01:00
Lennart Poettering d4f8be786c mountfsd: allow O_NONBLOCK on image fds
Let's accept O_NONBLOCK on image fds. It's usually wise to open block
device with O_NONBLOCK as it means that drivers with removable media
won't block until a medium is inserted. Otherwise it has no effect. It
also has no effect when opening regular files. Since block devices and
raw devices are the only two things we accept in mountfsd, it's hence
safe to allow it.
2025-12-21 07:04:42 +01:00
Lennart Poettering 46341769b7 mountfsd: optionally accept an access mode for the dir created by MakeDirectory()
So far we expected the client to access the access mode themselves, and
set a restrictive 0700 server-side.

However, in some scenarios it's handy if the inode is created
server-side already with the right mode, in particular when the client
doesn't do anything with the dir just yet, and just needs it to be there
with the right mode. If it has to adjust the mode client-side it might
otherwise need to fork something off, join the selected userns, adjust
the mode, and kill the child off again.
2025-12-21 07:04:42 +01:00
Lennart Poettering 6e07fc6bcc json-util: add a generic parser for parsing access mode/umask
Let's move this from user-record.c into generic code and let's beef it
up a bit: allow parsing octal strings. This is particular relevant given
json_variant_new_stat() generates the mode in that format, and we
probably should be able to parse our own fields (even though we
currently don't do that for the data from json_variant_new_stat()).
2025-12-21 07:04:42 +01:00
Lennart Poettering 00421e3166 dissect-image: make verity params for mountfsd_mount_image() optional 2025-12-21 07:04:42 +01:00
Lennart Poettering 468cfd25a0 dissect-image: add fd-based flavour of mountfsd_mount_image() 2025-12-21 07:04:42 +01:00