Let's keep the comments together with the lines they describe, this is easier
to read and probably more maintainable in the long run.
Also, () → {} for idiomaticity.
smb3 is an alias for modern CIFS, not the old SMB fs (see kmod alias list, i.e. modinfo fs-smb3).
(the old smbfs has long been removed from the kernel actually, it's dead
and obsolete)
There are a bunch of filesystems that actually are just aliases for
other filesystems. So far we listed them as "ungrouped", suggesting they
should be added to some file system group. But that's not really
something needed, since they are after all not file systems in their own
right, but aliases only (and usually legacy at that).
hence, let's hide them from display (but debug log about them)
devtmpfs and cpuset are not actual filesystems of their own. cpuset used
to be but is now an alias for cgroupsfs. devtmpfs is the same as tmpfs
as its just a "named superblock", i.e. a specific instance of tmpfs, but
not a file system of its own.
This group shall cover file systems whose job is to make stuff that
isn't actually storing anything in itself, and isn't just an API file
system, but allows exposing stuff with special semantics in the VFS.
1. @anonymous → for file systems that aren't real file systems but
simply the backing for sockets, pipes and other "anonymous" fds.
2. @security → for the various MAC security file systems.
Let's first move the home dir to a new mount point that is only visible
in our own private namespace. Then, do FITRIM and stuff there, so that
we know the regular userspace can't interfere with that, and we know
that the home fs is not used anymore.
(This will become even more important once we add auto-grow/auto-shrink
for home dirs)
When networkd detects an unmanaged link, then the state is changed in
the following order:
pending -> initialized -> unmanaged
The "initialized" state was added by bd08ce5615.
by moving the read permissions to the top level and
granting additional permissions to the specific jobs.
It should help to prevent new jobs that could be added
there eventually from having write access to resources they
most likely would never need.
With glibc-2.34.9000-17.fc36.x86_64, dynamically programs newly fail in early
init with a restrictive syscall filter that does not include @system-service.
I think this is caused by 2dd87703d4386f2776c5b5f375a494c91d7f9fe4:
Author: Florian Weimer <fweimer@redhat.com>
Date: Mon May 10 10:31:41 2021 +0200
nptl: Move changing of stack permissions into ld.so
All the stack lists are now in _rtld_global, so it is possible
to change stack permissions directly from there, instead of
calling into libpthread to do the change.
It seems that this call will now be very widely used, so let's just move it to
default to avoid too many failures.
Zbigniew Jędrzejewski-Szmek
Lennart Poettering
Evgeny Vereshchagin
dependabot[bot]
Luca Boccassi
Taiki Sugawara
Yu Watanabe
Jan Janssen