Commit Graph
57114 Commits
Author SHA1 Message Date
Lennart Poettering fdf02a4f26 path-util: use STR_IN_SET() where appropriate 2022-04-01 15:23:43 +02:00
Lennart Poettering 6cdd6d1acc notify: remove spurious whitespace 2022-04-01 15:23:43 +02:00
Lennart Poettering ca782b85fc Merge pull request #22934 from poettering/tls-test-fix-root
tests: make test-resolved-stream suceed even when run as root with restrictive access mode on build tree dir
2022-04-01 15:22:43 +02:00
Lennart Poettering aed3c5eca3 process-util: refactor APIs for reading /proc/self/xyz symlinks
The three functions for reading cwd, exe and root symlinks of processes
already share a common core: get_process_link_contents(). Let's refactor
that a bit, and move formatting of the /proc/self/ path into this helper
function instead of doing that in the caller, thus sharing more code.

While we are at it, make the return parameters optional, in case the
information if the links are readable is interesting, but the contents
is not. (This also means safe_getcwd() and readlinkat_malloc() are
updated to make the return parameter optional, as these are called by
the relevant three functions)
2022-04-01 15:22:27 +02:00
Yu Watanabe b8529cf376 Merge pull request #22872 from yuwata/udevadm-wait
udevadm: introduce 'wait' command
2022-04-01 18:41:03 +09:00
Lennart Poettering ed59b44309 test-resolved-stream: before entering user/network namespaces check if that's safe
I regularly run my tests also as root, since some of the tested code
uses privileged APIs. The test-resolved-stream so far tried to run its
tests in a user/network namespace if that can be allocated. This caused
the tests to fail on my system where once the user namespace is opened
access to the build tree in my $HOME is prohibited (due to restricted
access modes on my home dir). Let's add a check for that: before
actually isolating the test in a user/network namespace, let's see if
that would make it impossible for us to access the build tree (which we
need to do load the TLS certificates the test requires).

This should make the test pass when run as root from a build tree with
restrictive access mode.
2022-04-01 11:14:56 +02:00
Lennart Poettering 8419213d99 tests: modernize load_testdata_env() a bit
Let's add assert() around everyhing we don't expect to fail.

Port to path_extract_directory().

Log errrors from load_env_file_pairs() which we ignore.
2022-04-01 11:14:56 +02:00
Lennart Poettering 5b89bff55f update TODO 2022-04-01 11:03:59 +02:00
Yu Watanabe 78e278ad48 udev: use sd_device_open() where appropriate 2022-04-01 15:21:05 +09:00
Yu Watanabe 9534d6c9ea test: add test for sd_device_open() 2022-04-01 15:20:48 +09:00
Yu Watanabe f9a726abef sd-device: introduce sd_device_open()
We usually open() device node obtained by sd_device_get_devname().
However, the device node corresponds to the sd-device object may be
already removed, and another device node with the same path may be
created, hence an unexpected device may be opened.

The sd_device_open() opens device node, and checks the devnum and
diskseq of opened devnum, to avoid the above possibility.

Prompted by https://github.com/systemd/systemd/issues/22906#issuecomment-1082736443.
2022-04-01 15:13:18 +09:00
Yu Watanabe 7e93a65868 fd-util: rename loop_get_diskseq() -> fd_get_diskseq()
And move it from loop-util.[ch] -> fd-util.[ch]
2022-04-01 15:13:18 +09:00
Yu Watanabe 2076612f84 basic/missing: move BLKGETDISKSEQ to missing_fs.h
As it is defined at linux/fs.h.
2022-04-01 15:13:18 +09:00
Yu Watanabe e529abe24d test: replace helper_wait_for_dev() with 'udevadm wait' 2022-04-01 15:13:18 +09:00
Yu Watanabe aa2b0d8d29 udevadm: introduce new 'wait' command
Prompted by https://github.com/systemd/systemd/pull/22717#issuecomment-1067348496.

The new command 'udevadm wait' waits for device or device symlink being
created. This may be useful to wait for a device is processed by udevd
after e.g. formatting or partitioning the device.
2022-04-01 15:13:18 +09:00
Yu Watanabe 209294ad24 test: add more tests for sd_device_new_from_xxx() 2022-04-01 15:13:14 +09:00
Yu Watanabe e418f9658b sd-device: introduce sd_device_new_from_devname()
and sd_device_new_from_path() which takes devname or syspath.
2022-04-01 15:03:33 +09:00
Lennart Poettering 45bff9b4e2 systemctl: show tainted state 2022-03-31 22:11:32 +01:00
Lennart Poettering 40efaaed42 pid1: check for kernels older than baseline
Let's make this detectable explicitly.
2022-03-31 22:11:20 +01:00
Luca Boccassi 58270534bf Merge pull request #22923 from poettering/userns-check-refactor
virt: minor running_in_userns() modernizations
2022-03-31 22:11:03 +01:00
Lennart Poettering d6d450074f Merge pull request #22919 from poettering/cryptsetup-tweaks
various minor tweaks to cryptsetup/veritysetup/integritysetup
2022-03-31 16:50:37 +02:00
Lennart Poettering 16fa47463c virt: use read_virtual_file() for reading /proc/self/setgroups 2022-03-31 16:34:41 +02:00
Lennart Poettering b2a331f2e0 virt: simplify userns_has_mapping() by using fscanf() instead of scanf()
And while we are at it, also fix propagation of an uninitialized errno
error.
2022-03-31 16:34:41 +02:00
Antonio Alvarez Feijoo 49be03838d cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
If any TPM2 operation fails, the boot process should continue and
prompt for a text password (if configured to do so).

Fixes #22870
2022-03-31 14:58:21 +01:00
Lennart Poettering 9e83d3e45f update TODO 2022-03-31 14:39:55 +02:00
Martin Liska 0bd292567a Support -D_FORTIFY_SOURCE=3 by using __builtin_dynamic_object_size.
As explained in the issue, -D_FORTIFY_SOURCE=3 requires usage
of __builtin_dynamic_object_size in MALLOC_SIZEOF_SAFE macro.

Fixes: #22801
2022-03-31 21:13:34 +09:00
Franck Bui f887eab1da meson: build kernel-install man page when necessary 2022-03-31 21:12:05 +09:00
Sebastian Pucilowski f81ac115dc Fix "link-local" language inconsistencies
"Link-local" and "link local" are used throughout man pages and program
output, with the former used far more than the latter. This commit makes
it consistent throughout the project.
2022-03-31 12:08:29 +02:00
Lennart Poettering e2bc5194af integritysetup: also validate volume name
Exactly like for veritysetup/cryptsetup
2022-03-31 11:44:46 +02:00
Lennart Poettering 752d859442 integritysetup: also port to mangle_none()
Let's make the tool work more like veritysetup/cryptsetup in this regard
too.
2022-03-31 11:44:46 +02:00
Lennart Poettering 2b4b030044 integritysetup: log when attempted to detach already detached volume
To make the tool behave more like cryptsetup/veritysetup
2022-03-31 11:44:46 +02:00
Lennart Poettering 042fcbbf7e integritysetup: rename action → verb, to match other code 2022-03-31 11:44:46 +02:00
Lennart Poettering 542bb9be7c tree-wide: unify some code that looks for --help in the command line 2022-03-31 11:44:46 +02:00
Lennart Poettering 9959d78280 veritysetup: do some superficial checking on volume name
cryptsetup does this too, so let's better be safe here, too.
2022-03-31 11:44:46 +02:00
Lennart Poettering bb3ff7a996 veritysetup: mangle option strings like in cryptsetup 2022-03-31 11:44:46 +02:00
Lennart Poettering 49a4a81dd7 veritysetup: give command line parameters proper names
Accessing the various arguments always through argv[] is nasty, since
it's not obvious what we are talking about here. Let's give things nice
names.

We did the same in cryptsetup a while back.
2022-03-31 11:24:10 +02:00
Lennart Poettering 2e4aae981e cryptsetup: adjust some log levels
Let's upgrade log levels of some noteworthy messages from LOG_DEBUG to
LOG_NOTICE. These messages contain information that previous log
messages in the error path didn't say, namely that we'll now fall back
to traditional unlocking.

Note that this leaves similar log messages for cases where
TPM2/PKCS#11/FIDO2 support is disabled at build at LOG_DEBUG, since in
that case nothing really failed, we just systematically can't do
TPM2/PKCS#11/FIDO2 and hence it is pointless and not actionable for
users to do anything about it...
2022-03-31 11:24:07 +02:00
Lennart Poettering 2fabbad898 cryptsetup: add helper for mangling "none" option strings
let's unify some code here, and let's do so in cryptsetup-util.h so that
we can later reuse this in integritysetup/veritysetup
2022-03-31 11:24:01 +02:00
Lennart Poettering dcbc38c916 cryptsetup: rename functions that try to do FIDO2/TPM2/PKCS#11 via cryptsetup plugins to say so
The are so many different flavours of functions that attach volumes,
hence say explicitly that these are about libcryptsetup plugins, and
nothing else.

Just some renaming, no code changes beyond that.
2022-03-31 11:23:16 +02:00
Yu Watanabe b2e7ded16b Merge pull request #22899 from yuwata/network-ignore-carrier-loss
network: automatically determine timeout of waiting for carrier regain
2022-03-31 11:40:30 +09:00
Yu Watanabe da94a69b8d network: shorten code a bit
Currently, there exist only two MTU sources, static and DHCPv4, and they
are exclusive. Hence, it is not necessary to check the existence of the
MTU option in the acquired DHCP lease. Let's unconditionally reset the
MTU. Note that, if the current and original MTU are equivalent, then
link_request_to_set_mtu() handles that gracefully.
2022-03-31 09:29:42 +09:00
Yu Watanabe b732606950 network: automatically determine timeout of waiting for carrier regain
The commit 6706ce2fd2 made
IgnoreCarrierLoss= setting also take timespan, to make users handle
issues like #18738 or #20887. But still users needed to explicitly set
a timespan.

This makes networkd automatically determine the timeout when the
situations #18738 or #19832 is detected. Unfortunately, still users have
issue #20887 need to specify a value.

Closes #19832.
2022-03-31 09:29:42 +09:00
Yu Watanabe a14b9ca2c3 Merge pull request #22913 from yuwata/sd-device-cleanups
sd-device,udev: several cleanups
2022-03-31 09:24:38 +09:00
Zbigniew Jędrzejewski-Szmek 2fe8749de7 veritysetup: fix parsing of root-hash-signature= option
The function was named confusingly and we managed to confused ourselves. The
parameter was assigned incorrectly and then reassigned correctly in the caller.
Let's simplify the whole thing by just saving the optarg param.

I considered moving the unhexmemming and/or reading of the file to the parse
function, but decided against it. I think it's nicer to parse all options
before opening external files.
2022-03-30 23:32:11 +01:00
Yu Watanabe 03a24ce76b udev: rename functions to emphasize whole disk is locked 2022-03-31 07:25:24 +09:00
Yu Watanabe 20ba5a3fe7 udev: ignore one more error in device_get_block_device() 2022-03-31 07:25:24 +09:00
Yu Watanabe df88f02bb1 sd-device: do not ignore critical errors in device_new_from_child() 2022-03-31 07:25:24 +09:00
Yu Watanabe 07c90f02d2 sd-device: use path_extract_directory() at one more place 2022-03-31 07:25:24 +09:00
Yu Watanabe becbcca5b8 sd-device: try to get DISKSEQ from uevent file
Otherwise, if the sd-device object is created from e.g. syspath, then
sd_device_get_diskseq() returns -ENOENT.
2022-03-31 07:25:24 +09:00
Yu Watanabe a43129b0a0 sd-device: drop /sys/subsystem support
Follow-ups for 37cf83d9bf.
2022-03-31 07:25:24 +09:00