After Delegate= was converted from boolean to a controller list, the dump
output was changed to have a separate line about the delegated controllers:
...
DevicePolicy: auto
DisableControllers:
Delegate: yes
ManagedOOMSwap: auto
ManagedOOMMemoryPressure: auto
ManagedOOMMemoryPressureLimit: 0.00%
ManagedOOMPreference: none
DelegateControllers: cpu memory pids
...
The line with "Delegate:" is redundant, it effectively shows if
"DelegateControllers:" is non-empty. It is nicer to keep the lines
about controllers adjacent. And to avoid duplicate output, Delegate:
will now show which controllers are enabled. This makes the output
for that line again match the configuration stanza Delegate=:
DisableControllers:
Delegate: cpu io memory pids
ManagedOOMSwap: auto
ManagedOOMMemoryPressure: auto
ManagedOOMMemoryPressureLimit: 0.00%
ManagedOOMPreference: none
MemoryPressureWatch: auto
MemoryPressureThresholdSec: 100ms
Dump output is for debugging, we don't need to maintain strict
backwards-compat.
Reloading might be slow, especially when under memory pressure, and watchdogs
might be triggered. It is useful to have timestamped telemetry in the journal
to see how long a reload takes.
For any user on a semi-recent kernel, effectively this setting is pointless.
We should deprecate it once not needed anymore for the v1 hierarchy. For
now, adjust the description.
If the default target is masked, `systemctl get-default` prints
Failed to get default target: Operation not possible due to RF-kill
That's a bit too cryptic, so let's make it clear what's actually
happening.
Fixes#26589.
This function was moved from cgroup-util.c to cgroup-setup.c a while
back, but the prototype in the matching header files wasn't migrated.
Let's fix that.
Return the output of malloc_info() via a file descriptor (in case it
gets large on a busy system). Useful to get live data about memory
usage when it is not possible to run under a profiler from the get-go.
Do not formally register the method, but add a 'hidden' interface
so that it cannot be seen by introspection or by looking at the
object.
If a PAM service sets some ambient caps, we should honour that, hence
query it, and merge it with our own ambient settings.
This needs to be done manually since otherwise dropping privs via
setresuid() will undo all such caps, and we need to manually tweak
things to keep them.
Even when a mount namespace is created, previously host's sysfs is used,
especially with RootDirectory= or RootImage=, thus service processes can
still access the properties of the network interfaces in the main network
namespace through sysfs.
This makes, sysfs is remounted with the new network namespace tag, except
when PrivateMounts= is explicitly disabled. Hence, the properties of the
network interfaces in the main network namespace cannot be accessed by
service processes through sysfs.
Fixes#26422.
Most of the support for valgrind was under HAVE_VALGRIND_VALGRIND_H, i.e. we
would enable if the valgrind headers were found. The operations then we be
conditionalized on RUNNING_UNDER_VALGRIND.
But in a few places we had code which was conditionalized on VALGRIND, i.e. the
config option. I noticed because I compiled with -Dvalgrind=true on a machine
that didn't have valgrind.h, and the build failed because
RUNNING_UNDER_VALGRIND was not defined. My first idea was to add a check that
the header is present if the option is set, but it seems better to just remove
the option. The code to support valgrind is trivial, and if we're
!RUNNING_UNDER_VALGRIND, it has negligible cost. And the case of running under
valgrind is always some special testing/debugging mode, so we should just do
those extra steps to make valgrind output cleaner. Removing the option makes
things simpler and we don't have to think if something should be covered by the
one or the other configuration bit.
I had a vague recollection that in some places we used -Dvalgrind=true not
for valgrind support, but to enable additional cleanup under other sanitizers.
But that code would fail to build without the valgrind headers anyway, so
I'm not sure if that was still used. If there are uses like that, we can
extend the condition for cleanup_pools().
Although this slightly more verbose it makes it much easier to reason
about. The code that produces the tests heavily benefits from this.
Test lists are also now sorted by test name.
We should be more careful with distinguishing the cases "all bits set in
caps mask" from "cap mask invalid". We so far mostly used UINT64_MAX for
both, which is not correct though (as it would mean
AmbientCapabilities=~0 followed by AmbientCapabilities=0) would result
in capability 63 to be set (which we don't really allow, since that
means unset).
This augments the existing KillUnit() + Kill() methods with
QueueSignalUnit() + QueueSignal(), which are what sigqueue() is to
kill().
This is useful for sending our new SIGRTMIN+18 control signals to system
services.
Lennart Poettering
Yu Watanabe
Zbigniew Jędrzejewski-Szmek
Luca Boccassi
Jan Engelhardt
David Tardon
Jan Janssen
Aidan Dang
Ronan Pigott
Dmitry V. Levin