Zbigniew Jędrzejewski-Szmek
ca6ce62d2a
When generators are executed during early boot, /tmp might not be available yet. This causes problems with bash, because here-docs don't work. Even non-shell code can often assume that /tmp is available. This limitation is known to trip up people, and when the code is tested on a "normal" system, everything works. We can solve this nicely, and get another small benefit, by making most of the file system read-only and "punching holes" for some dirs that should be writable. The generator code runs with full privileges and can do anything it wants by writing appropriate systemd units, so it doesn't make much sense to do any significant sandboxing around generators. But making root read-only is nice because it can catch stupid mistakes where the generator tries to write to a wrong path or something like that. We effectively also get a "private /tmp" for the generators, which protects them against existing files in /tmp. The path does the following: when executing generators, we fork, and the child unshares root and makes it recursively read-only, with the exception of /sys and /run. Error handling is permissive — if some of this setup fails, we're in the same state as before the patch. Fixes #24430.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list or join our IRC channel.
Stable branches with backported patches are available in the stable repo.