Commit graph

1722 commits

Author SHA1 Message Date
Lennart Poettering 4e945a6f79 resolved: beef up DNS server configuration logic
We now maintain two lists of DNS servers: system servers and fallback
servers.

system servers are used in combination with any per-link servers.

fallback servers are only used if there are no system servers or
per-link servers configured.

The system server list is supposed to be populated from a foreign tool's
/etc/resolv.conf (not implemented yet).

Also adds a configuration switch for LLMNR, that allows configuring
whether LLMNR shall be used simply for resolving or also for responding.
2014-08-01 16:06:39 +02:00
Lennart Poettering bdf10b5b4d resolved: handle IDNA domains
Make sure we format UTF-8 labels as IDNA when writing them to DNS
packets, and as native UTF-8 when writing them to mDNS or LLMNR packets.

When comparing or processing labels always consider native UTF-8 and
IDNA formats equivalent.
2014-08-01 00:58:12 +02:00
Lennart Poettering ec2c5e4398 resolved: implement LLMNR uniqueness verification 2014-07-31 17:47:19 +02:00
Zbigniew Jędrzejewski-Szmek 0dae31d468 resolved: LOC records
LOC records have a version field. So far only version 0 has been
published, but if a record with a different version was encountered,
our only recourse is to treat it as an unknown type. This is
implemented with the 'unparseable' flag, which causes the
serialization/deserialization and printing function to cause the
record as a blob. The flag can be used if other packet types cannot be
parsed for whatever reason.
2014-07-31 08:56:03 -04:00
Zbigniew Jędrzejewski-Szmek a489205405 sysusers: split users for remote into separate file
This mirrors the setup for tmpfiles.d done in ad95fd1d2b.
2014-07-31 08:56:03 -04:00
Lennart Poettering 2d4c5cbc0e resolved: add API for resolving specific RRs 2014-07-30 19:24:13 +02:00
Zbigniew Jędrzejewski-Szmek bdef7319e4 resolved: add tool to query resolved 2014-07-30 16:47:21 +02:00
Lennart Poettering 623a4c97b9 resolve: add llmnr responder side for UDP and TCP
Name defending is still missing.
2014-07-29 20:57:58 +02:00
Kay Sievers f22bbd11db build-sys: add missing files for distcheck 2014-07-29 17:54:57 +02:00
Kay Sievers ab6efe71f3 test: test_tables - fix missing symbols when --gc-sections are not available 2014-07-29 17:10:16 +02:00
Kay Sievers 94a15ffa14 factory: install minimal PAM and nsswitch config 2014-07-29 16:58:18 +02:00
Kay Sievers 51f1ec3bbe build-sys: remove systemd-coredumpctl symlink 2014-07-29 15:20:42 +02:00
Lennart Poettering faa133f3aa resolved: rework logic so that we can share transactions between queries of different clients 2014-07-23 02:00:40 +02:00
Zbigniew Jędrzejewski-Szmek 2c12a402cb shell-completion: systemd-analyze verify, systemctl link
Some zsh completion helpers were not installed, so completion
was broken.

Add systemd-analyze verify. Make systemctl link complete only
unit names.
2014-07-21 22:33:51 -04:00
Zbigniew Jędrzejewski-Szmek 1d3bc0177a Merge systemd-verify with systemd-analyze 2014-07-21 21:42:28 -04:00
Zbigniew Jędrzejewski-Szmek 7dbb1d08f6 update-done: set proper selinux context for .updated
https://bugzilla.redhat.com/show_bug.cgi?id=1121806
2014-07-21 20:57:39 -04:00
Zbigniew Jędrzejewski-Szmek 8b835fccda systemd-verify: a simple tool for offline unit verification
This tool will warn about misspelt directives, unknown sections, and
non-executable commands. It will also catch the common mistake of
using Accept=yes with a non-template unit and vice versa.

https://bugs.freedesktop.org/show_bug.cgi?id=56607
2014-07-20 19:48:16 -04:00
Zbigniew Jędrzejewski-Szmek 8328d8c633 test-cgroup-mask: fix masks in test and enable by default
Commit 637f421e5c ("cgroups: always propagate controller membership
to siblings") changed the mask propagation logic, but the test wasn't
updated.

Move to normal tests from manual tests, it should not touch the system
anymore.
2014-07-20 19:48:16 -04:00
Zbigniew Jędrzejewski-Szmek 0d8c31ff72 test-engine: fix access to unit load path
Also add a bit of debugging output to help diagnose problems,
add missing units, and simplify cppflags.

Move test-engine to normal tests from manual tests, it should now
work without destroying the system.
2014-07-20 19:48:16 -04:00
Michael Olbrich e9b11a8457 install: systemd-timesyncd.service is enabled by sysinit.target
systemd-timesyncd.service has a "WantedBy=sysinit.target" so the
initially generated link should match that.
2014-07-19 17:32:28 -04:00
Zbigniew Jędrzejewski-Szmek 3fb97a58fa Nuke update-kbd-map
Our version has evolved independently of the original table
in systemd-config-keyboard, so it cannot be ever regenerated from
original upstream. Remove script to avoid confusion.
2014-07-18 21:44:59 -04:00
Zbigniew Jędrzejewski-Szmek e091457e82 Makefile.am: tweaks to python commands 2014-07-18 21:44:58 -04:00
David Herrmann 86db5dfb6d terminal: add unifont font-handling
The unifont layer of libsystemd-terminal provides a fallback font for
situations where no system-fonts are available, or if you don't want to
deal with traditional font-formats for some reasons.

The unifont API mmaps a pre-compiled bitmap font that was generated out of
GNU-Unifont font-data. This guarantees, that all users of the font will
share the pages in memory. Furthermore, the layout of the binary file
allows accessing glyph data in O(1) without pre-rendering glyphs etc. That
is, the OS can skip loading pages for glyphs that we never access.

Note that this is currently a test-run and we want to include the binary
file in the GNU-Unifont package. However, until it was considered stable
and accepted by the maintainers, we will ship it as part of systemd. So
far it's only enabled with the experimental --enable-terminal, anyway.
2014-07-18 17:45:33 +02:00
David Herrmann 545149a2fc terminal: only build if --enable-terminal was specified
Whoopsy, I totally forgot adding the "if ENABLE_TERMINAL" markers. Do that
now that we know it builds fine everywhere.
2014-07-18 17:45:33 +02:00
David Herrmann 5ab887e98d terminal: add systemd-subterm example
The systemd-subterm example is a stacked terminal that shows how to
use sd-term. Instead of rendering images and displaying it via X11/etc.,
it uses its parent terminal to display the page (terminal-emulator inside
a terminal-emulator) (like GNU-screen and friends do).

This is only for testing and not installed system-wide!
2014-07-18 12:53:41 +02:00
David Herrmann e432f9e8f9 terminal: add screen-handling
The screen-layer represents the terminal-side (compared to the host-side).
It connects term_parser with term_page and implements all the required
control sequences.

We do not implement all available control sequences. Even though our
parser recognizes them, there is no need to handle them. Most of them are
legacy or unused. We try to be as compatible to xterm, so if we missed
something, we can implement it later. However, all the VT510 / VT440 stuff
can safely be skipped (who needs terminal macros? WTF?).

The keyboard-handling is still missing. It will be added once
systemd-console is available and we pulled in the key-definitions.
2014-07-18 12:53:41 +02:00
David Herrmann 1c9633d669 terminal: add parser state-machine
The term-parser is used to parse any input from TTY-clients. It reads CSI,
DCS, OSC and ST control sequences and normal escape sequences. It doesn't
do anything with the parsed data besides detecting the sequence and
returning it. The caller has to react to them.

The parser also comes with its own UTF-8 helpers. The reason for that is
that we don't want to assert() or hard-fail on parsing errors. Instead,
we treat any invalid UTF-8 sequences as ISO-8859-1. This allows pasting
invalid data into a terminal (which cannot be controlled through the TTY,
anyway) and we still deal with it in a proper manner.
This is _required_ for 8-bit and 7-bit DEC modes (including the g0-g3
mappings), so it's not just an ugly fallback because we can (it's still
horribly ugly but at least we have an excuse).
2014-07-18 12:53:41 +02:00
Thomas Hindoe Paaboel Andersen 0204152684 test-tables: fix build-scan 2014-07-17 23:54:12 +02:00
Tom Gundersen 7de12ae764 networkd-wait-online: track links
Rather than refetching the link information on ever event, we liston to
rtnl to track them. Much code stolen from resolved.

This will allow us to simplify the sd-network api and don't expose
information available over rtnl.
2014-07-17 22:53:35 +02:00
Lennart Poettering 322345fdb9 resolved: add DNS cache 2014-07-17 19:39:50 +02:00
David Herrmann 84da4a3022 ui/term: add line/cell/char handling for terminal pages
This commit introduces libsystemd-ui, a systemd-internal helper library
that will contain all the UI related functionality. It is going to be used
by systemd-welcomed, systemd-consoled, systemd-greeter and systemd-er.
Further use-cases may follow.

For now, this commit only adds terminal-page handling based on lines only.
Follow-up commits will add more functionality.
2014-07-17 11:48:40 +02:00
David Herrmann a47d1dfd08 shared: add PTY helper
This Pty API wraps the ugliness that is POSIX PTY. It takes care of:
  - edge-triggered HUP handling (avoid heavy CPU-usage on vhangup)
  - HUP vs. input-queue draining (handle HUP _after_ draining the whole
    input queue)
  - SIGCHLD vs. HUP (HUP is no reliable way to catch PTY deaths, always
    use SIGCHLD. Otherwise, vhangup() and friends will break.)
  - Output queue buffering (async EPOLLOUT handling)
  - synchronous setup (via Barrier API)

At the same time, the PTY API does not execve(). It simply fork()s and
leaves everything else to the caller. Usually, they execve() but we
support other setups, too.

This will be needed by multiple UI binaries (systemd-console, systemd-er,
...) so it's placed in src/shared/. It's not strictly related to
libsystemd-terminal, so it's not included there.
2014-07-17 11:39:48 +02:00
David Herrmann a2da110b78 nspawn: use Barrier API instead of eventfd-util
The Barrier-API simplifies cross-fork() synchronization a lot. Replace the
hard-coded eventfd-util implementation and drop it.

Compared to the old API, Barriers also handle exit() of the remote side as
abortion. This way, segfaults will not cause the parent to deadlock.

EINTR handling is currently ignored for any barrier-waits. This can easily
be added, but it isn't needed so far so I dropped it. EINTR handling in
general is ugly, anyway. You need to deal with pselect/ppoll/... variants
and make sure not to unblock signals at the wrong times. So genrally,
there's little use in adding it.
2014-07-17 11:34:25 +02:00
David Herrmann 279da1e3f9 shared: add generic IPC barrier
The "Barrier" object is a simple inter-process barrier implementation. It
allows placing synchronization points and waiting for the other side to
reach it. Additionally, it has an abortion-mechanism as second-layer
synchronization to send abortion-events asynchronously to the other side.

The API is usually used to synchronize processes during fork(). However,
it can be extended to pass state through execve() so you could synchronize
beyond execve().

Usually, it's used like this (error-handling replaced by assert() for
simplicity):

    Barrier b;

    r = barrier_init(&b);
    assert_se(r >= 0);

    pid = fork();
    assert_se(pid >= 0);
    if (pid == 0) {
            barrier_set_role(&b, BARRIER_CHILD);

            ...do child post-setup...
            if (CHILD_SETUP_FAILED)
                       exit(1);
            ...child setup done...

            barrier_place(&b);
            if (!barrier_sync(&b)) {
                    /* parent setup failed */
                    exit(1);
            }

            barrier_destroy(&b); /* redundant as execve() and exit() imply this */

            /* parent & child setup successful */
            execve(...);
    }

    barrier_set_role(&b, BARRIER_PARENT);

    ...do parent post-setup...
    if (PARENT_SETUP_FAILED) {
            barrier_abort(&b);          /* send abortion event */
            barrier_wait_abortion(&b);  /* wait for child to abort (exit() implies abortion) */
            barrier_destroy(&b);
           ...bail out...
    }
    ...parent setup done...

    barrier_place(&b);
    if (!barrier_sync(&b)) {
            ...child setup failed... ;
            barrier_destroy(&b);
            ...bail out...
    }

    barrier_destroy(&b);

    ...child setup successfull...

This is the most basic API. Using barrier_place() to place barriers and
barrier_sync() to perform a full synchronization between both processes.
barrier_abort() places an abortion barrier which superceeds any other
barriers, exit() (or barrier_destroy()) places an abortion-barrier that
queues behind existing barriers (thus *not* replacing existing barriers
unlike barrier_abort()).

This example uses hard-synchronization with wait_abortion(), sync() and
friends. These are all optional. Barriers are highly dynamic and can be
used for one-way synchronization or even no synchronization at all
(postponing it for later). The sync() call performs a full two-way
synchronization.

The API is documented and should be fairly self-explanatory. A test-suite
shows some special semantics regarding abortion, wait_next() and exit().

Internally, barriers use two eventfds and a pipe. The pipe is used to
detect exit()s of the remote side as eventfds do not allow that. The
eventfds are used to place barriers, one for each side. Barriers itself
are numbered, but the numbers are reused once both sides reached the same
barrier, thus you cannot address barriers by the index. Moreover, the
numbering is implicit and we only store a counter. This makes the
implementation itself very lightweight, which is probably negligible
considering that we need 3 FDs for a barrier..

Last but not least: This barrier implementation is quite heavy. It's
definitely not meant for fast IPC synchronization. However, it's very easy
to use. And given the *HUGE* overhead of fork(), the barrier-overhead
should be negligible.
2014-07-17 11:34:00 +02:00
Zbigniew Jędrzejewski-Szmek 86bbe5bfbc test-tables: add new entries
One missing string found.

A few things had to be moved around to make it possible to test them.
2014-07-16 19:00:03 -04:00
Michael Biebl 5c059d2ead build-sys: don't move libgudev to /lib
It depends on libgobject and libgmodule which are installed in /usr/lib.
2014-07-16 12:53:46 +02:00
Zbigniew Jędrzejewski-Szmek 29fc0ddcd7 journal-upload: add config file 2014-07-15 22:34:41 -04:00
Zbigniew Jędrzejewski-Szmek 9ff48d0982 journal-remote: rework fd and writer reference handling 2014-07-15 22:34:41 -04:00
Zbigniew Jędrzejewski-Szmek ad95fd1d2b journal-remote: add units and read certs from default locations 2014-07-15 22:23:49 -04:00
Zbigniew Jędrzejewski-Szmek eacbb4d33e journal-upload: use journal as the source 2014-07-15 22:23:48 -04:00
Zbigniew Jędrzejewski-Szmek 3d090cc6f3 journal-upload: a tool to push messages to systemd-journal-remote 2014-07-15 22:23:48 -04:00
Zbigniew Jędrzejewski-Szmek 1e4e7b71e1 Move network-related journal programs to src/journal-remote/
Directory src/journal has become one of the largest directories,
and since systemd-journal-gatewayd, systemd-journal-remote, and
forthcoming systemd-journal-upload are all closely related, create
a separate directory for them.
2014-07-15 22:23:47 -04:00
Kay Sievers b7e6c03d3b resolved: add busname unit file 2014-07-16 04:12:03 +02:00
Kay Sievers 18641cb17e resolved: add legacy dbus service and policy files 2014-07-16 03:41:39 +02:00
Lennart Poettering 4d1cf1e229 resolved: add small NSS module that uses resolved to resolve DNS names 2014-07-16 03:31:30 +02:00
Lennart Poettering 74b2466e14 resolved: add a DNS client stub resolver
Let's turn resolved into a something truly useful: a fully asynchronous
DNS stub resolver that subscribes to network changes.

(More to come: caching, LLMNR, mDNS/DNS-SD, DNSSEC, IDN, NSS module)
2014-07-16 00:31:38 +02:00
Zbigniew Jędrzejewski-Szmek c0a67aef31 shell-completion: restore completion for -p
It was broken since systemd was moved out of /bin.

For zsh it was never there.
2014-07-15 10:06:12 -04:00
Tom Gundersen 3be1d7e0c5 networkd: netdev - introduce vtable for netdev kinds
Split each netdev kind into its own .h/.c.
2014-07-14 16:49:41 +02:00
Tom Gundersen 6235b3def8 networkd: netdev - split out bridge creation 2014-07-14 16:47:04 +02:00
Jon Severinsson 3864c28549 build-sys: Do not distribute generated emergency.service
It is already in nodist_systemunit_DATA and if it is
shipped, it contains the hardcoded path to systemctl
which will cause it to fail to start when
rootprefix != prefix and rootbindir != bindir.
2014-07-11 16:10:53 -04:00
Mike Gilbert 3ce1424909 Revert "build-sys: include PolicyKit files as part of distribution"
This reverts commit 0c26bfc3d2.

src/core/org.freedesktop.systemd1.policy.in.in depends on values which
are specified at configure time, so we cannot ship the corresponding
policy file in the tarball.

Since we need to regenerate one policy file, we might as well generate
them all.
2014-07-11 16:10:53 -04:00
Zbigniew Jędrzejewski-Szmek 3b1a55e110 Fix build without any compression enabled 2014-07-11 10:42:27 -04:00
Lennart Poettering cabb0bc6b1 nss-mymachines: add new NSS module for automatically resolving addresses of all local containers 2014-07-11 03:15:21 +02:00
Lennart Poettering 2de30868ed build-sys: export sd_path APIs 2014-07-11 03:13:24 +02:00
Lennart Poettering c9fdc26e96 nss-myhostname: move NSS boilerplate to nss-util.h 2014-07-10 23:33:55 +02:00
Lennart Poettering 3b653205cf shared: split out in_addr related calls from socket-util.[ch] into its private in-addr-util.[ch]
These are enough calls for a new file, and they are sufficiently
different from the sockaddr-related calls, hence let's split this out.
2014-07-10 21:15:26 +02:00
Lennart Poettering e80af1bddd nss-myhostname: move local address listing logic into shared, so that we can make use of it from machined 2014-07-10 21:01:25 +02:00
Lennart Poettering 947127ff62 nss-myhostname: only export the NSS entry point symbols, nothing else 2014-07-10 20:38:07 +02:00
Lennart Poettering 47efffc22b nss-myhostname: following the usual naming scheme for .c/.h files 2014-07-10 20:25:21 +02:00
Kay Sievers b72ddf0f4f timedated: manage systemd-timesyncd directly instead of lists of alternatives
Alternative NTP implementations should add a:
  Conflicts=systemd-timesyncd.service
to take over the built-in NTP functionality of systemd.
2014-07-09 17:04:11 +02:00
Michael Biebl 2945a452b0 escape: move to rootbindir
The systemd-escape utility might be used during early boot (e.g. when
being triggered from udev rules), so move it to rootbindir to support
systems with a split /usr setup.
2014-07-08 21:06:07 +02:00
Michael Biebl b1a5a9989a add new systemd-escape tool 2014-07-07 22:23:42 +02:00
Susant Sahani fe8ac65b68 networkd: add support for mode
This patch adds supports networkd to configure bond mode
during creation via persistent conf. Mode can be configured
with conf param 'Mode'. A new section Bond is added to the
conf to support bond mode.

These modes can be configured now.

balance-rr
active-backup
balance-xor
broadcast
802.3ad
balance-tlb
balance-alb

Example conf file: test-bond.conf
[NetDev]
Name=bond1
Kind=bond

[Bond]
Mode=balance-xor

Test case:
1. start networkd service:

12: bond1: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc
noqueue state UNKNOWN mode DEFAULT group default
link/ether 22:89:6c:47:23:d2 brd ff:ff:ff:ff:ff:ff

2. find bond mode:

cat /proc/net/bonding/bond1
    Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
    Bonding Mode: load balancing (xor)
    Transmit Hash Policy: layer2 (0)
    MII Status: up
    MII Polling Interval (ms): 0
    Up Delay (ms): 0
    Down Delay (ms): 0

Changes:
       1. Added file networkd-bond.c
       2. Bond mode enum BondMode
       3. conf section [Bond]

[tomegun: whitespace]
2014-07-07 21:52:01 +02:00
Lennart Poettering e26807239b firstboot: get rid of firstboot generator again, introduce ConditionFirstBoot= instead
As Zbigniew pointed out a new ConditionFirstBoot= appears like the nicer
way to hook in systemd-firstboot.service on first boots (those with /etc
unpopulated), so let's do this, and get rid of the generator again.
2014-07-07 21:05:09 +02:00
Lennart Poettering 418b9be500 firstboot: add new component to query basic system settings on first boot, or when creating OS images offline
A new tool "systemd-firstboot" can be used either interactively on boot,
where it will query basic locale, timezone, hostname, root password
information and set it. Or it can be used non-interactively from the
command line when prepareing disk images for booting. When used
non-inertactively the tool can either copy settings from the host, or
take settings on the command line.

$ systemd-firstboot --root=/path/to/my/new/root --copy-locale --copy-root-password --hostname=waldi

The tool will be automatically invoked (interactively) now on first boot
if /etc is found unpopulated.

This also creates the infrastructure for generators to be notified via
an environment variable whether they are running on the first boot, or
not.
2014-07-07 15:25:55 +02:00
Lennart Poettering 7568345034 shared: make timezone and locale enumeration and validation generic
This way we can reuse it other code thatn just localectl/localed +
timedatectl/timedated.
2014-07-07 15:25:55 +02:00
Zbigniew Jędrzejewski-Szmek fd53fee04b compress: add benchmark-style test
This is useful to test the behaviour of the compressor for various buffer
sizes.

Time is limited to a minute per compression, since otherwise, when LZ4
takes more than a second which is necessary to reduce the noise, XZ
takes more than 10 minutes.

% build/test-compress-benchmark (without time limit)
XZ: compressed & decompressed 2535300963 bytes in 794.57s (3.04MiB/s), mean compresion 99.95%, skipped 3570 bytes
LZ4: compressed & decompressed 2535303543 bytes in 1.56s (1550.07MiB/s), mean compresion 99.60%, skipped 990 bytes

% build/test-compress-benchmark (with time limit)
XZ: compressed & decompressed 174321481 bytes in 60.02s (2.77MiB/s), mean compresion 99.76%, skipped 3570 bytes
LZ4: compressed & decompressed 2535303543 bytes in 1.63s (1480.83MiB/s), mean compresion 99.60%, skipped 990 bytes

 It appears that there's a bug in lzma_end where it leaks 32 bytes.
2014-07-06 19:06:03 -04:00
Zbigniew Jędrzejewski-Szmek d89c8fdf48 journal: add LZ4 as optional compressor
Add liblz4 as an optional dependency when requested with --enable-lz4,
and use it in preference to liblzma for journal blob and coredump
compression. To retain backwards compatibility, XZ is used to
decompress old blobs.

Things will function correctly only with lz4-119.

Based on the benchmarks found on the web, lz4 seems to be the best
choice for "quick" compressors atm.

For pkg-config status, see http://code.google.com/p/lz4/issues/detail?id=135.
2014-07-06 19:06:03 -04:00
Lennart Poettering 252ff40a38 build-sys: bump package and library versions 2014-07-03 20:48:40 +02:00
Susant Sahani 30ae9dfda3 networkd: Introduce tun/tap device
This patch introduces TUN/TAP device creation support
to networkd.

Example conf to create a tap device:

file: tap.netdev
------------------
[NetDev]
Name=tap-test
Kind=tap

[Tap]
OneQueue=true
MultiQueue=true
PacketInfo=true
User=sus
Group=sus
------------------

Test:
1. output of ip link
tap-test: tap pi one_queue UNKNOWN_FLAGS:900 user 1000 group 1000

id:
uid=1000(sus) gid=10(wheel) groups=10(wheel),1000(sus)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Modifications:

Added:
1. file networkd-tuntap.c
3. netdev kind NETDEV_KIND_TUN and NETDEV_KIND_TAP
2. Tun and Tap Sections and config params to parse
   conf and gperf conf parameters

[tomegun: tweak the 'kind' checking for received ifindex]
2014-07-03 11:00:02 +02:00
Tom Gundersen 0372cb2bd2 networkd: split out vlan and macvlan handling 2014-07-03 11:00:01 +02:00
Lennart Poettering 9a00f57a5b path: add new "systemd-path" utility for querying paths described in file-hierarchy(7)
This new tool is based on "sd-path", a new (so far unexported) API for
libsystemd, that can hopefully grow into a workable API covering /opt
and more one day.
2014-07-02 12:23:36 +02:00
Tom Gundersen 9e358851b4 networkd: netdev - add dummy support 2014-07-01 22:10:07 +02:00
Zbigniew Jędrzejewski-Szmek 2968644080 Move x-systemd-device.timeout handling from core to fstab-generator
Instead of adjusting job timeouts in the core, let fstab-generator
write out a dropin snippet with the appropriate JobTimeout.
x-systemd-device.timeout option is removed from Options= line
in the generated unit.

The functions to write dropins are moved from core/unit.c to
shared/dropin.c, to make them available outside of core.

generator.c is moved to libsystemd-label, because it now uses
functions defined in dropin.c, which are in libsystemd-label.
2014-06-30 18:39:45 -04:00
Lennart Poettering d4e85aac0b pc: expose more drop-in dirs in the .pc file 2014-06-30 23:19:00 +02:00
Lennart Poettering 94655a1670 sysusers: split up default sysusers snippet
This ways, distributions have an easier way to replace the OS specific
generic groups/users while keeping systemd's own.
2014-06-29 22:27:07 +02:00
Lennart Poettering 0dc5d23c85 coredump: add simple coredump vacuuming
When disk space taken up by coredumps grows beyond a configured limit
start removing the oldest coredump of the user with the most coredumps,
until we get below the limit again.
2014-06-27 19:35:57 +02:00
Filipe Brandenburger 0c26bfc3d2 build-sys: include PolicyKit files as part of distribution
So that building from an archive works even if intltool is not present.
The README file already mentioned that intltool should only be required
when building from git.

Tested: Built it from the distribution archive on a host without intltool.
  $ ./configure --enable-polkit
  $ make
2014-06-26 01:41:05 -04:00
Michael Olbrich 3210412576 install: enable timesyncd by default
This treats it similarly to networkd, resolved and others and it matches
what 90-systemd.preset does.
2014-06-26 01:41:05 -04:00
Ronny Chevalier 843fecc076 tests: add test-compress 2014-06-25 02:04:42 +02:00
Kay Sievers 3577de7ac3 nspawn: create essential base directories at system bootup
This allows us to bootup a rootfs with a /usr directory only.
2014-06-24 15:41:03 +02:00
Ronny Chevalier 5549f483d0 build-sys: do not run coverage if build failed 2014-06-24 02:40:51 +02:00
Ronny Chevalier e80cde5e96 tests: add test-ratelimit 2014-06-24 02:40:50 +02:00
Zbigniew Jędrzejewski-Szmek dfdd0e0730 Add systemd-coredumpctl as an alias for coredumpctl
Should make the transition easier for exisiting users.
2014-06-22 15:30:19 -04:00
Ronny Chevalier e6b5c5d03c tests: add test-async 2014-06-22 00:36:19 +02:00
Ronny Chevalier 6160e473fc tests: add test-capability 2014-06-22 00:36:19 +02:00
Ronny Chevalier 8e75477abd build-sys: add -pthread flag for libsystemd-shared
src/shared/async.c uses pthread so it will fail at link time if we link
only to libsystemd-shared and use async
2014-06-22 00:36:19 +02:00
Kay Sievers aac5ad0d25 build-sys: replace nm with $(NM) 2014-06-21 16:50:11 +02:00
Kay Sievers 706b7936d0 gudev: replace regex with sym file 2014-06-21 16:25:15 +02:00
Kay Sievers e09c69d9fd pam_systemd: replace regex with sym file 2014-06-21 15:45:49 +02:00
Kay Sievers dfb0c6cc3b pam_systemd: rename source file to match the module 2014-06-21 15:44:14 +02:00
Filipe Brandenburger 65adc982db build-sys: check that compat-libs are enabled for "make dist"
Running "make dist" requires --enable-compat-libs since DIST_SOURCES will list
generated files such as libsystemd-daemon.c.

Tested:
  $ ./configure && make && make dist
  *** compat-libs must be enabled in order to make dist
  make: *** [dist-check-compat-libs] Error 1
2014-06-20 18:44:40 -04:00
Filipe Brandenburger 279419b379 build-sys: check that python is enabled for "make dist"
Running "make dist" requires Python support since some of the man page sources
(such as man/systemd.index.xml and man/systemd.directives.xml) are generated by
Python scripts, so break "make dist" and give an useful error message when
Python or the Python lxml module is not available.

Tested:
  $ ./configure --without-python && make && make dist
  *** python and python-lxml module must be installed and enabled in order to make dist
  make: *** [dist-check-python] Error 1
2014-06-20 18:44:40 -04:00
Filipe Brandenburger b9d5b4c30d build-sys: configure --with-python when running distcheck
Python support is pretty much essential to create man pages, so we should make
sure that distcheck will request it during configure.

Tested: Successfully ran "make distcheck" and confirmed --with-python was
present in the ./configure run inside the unpacked distribution directory.
2014-06-20 18:44:40 -04:00
Filipe Brandenburger 49100d2abd build-sys: do not include id128-constants.h in the dist archive
File src/python-systemd/id128-constants.h is auto generated and its generation
does not require special tools, only sed.  There is no point in bundling it in
the distribution archive, so let's mark it as nodist_ to have it excluded.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=80006

Tested: Successfully ran "make dist" after ./configure --without-python.
2014-06-20 18:44:40 -04:00
Filipe Brandenburger 61b5c82d91 build-sys: add sysusers.d/systemd.conf to CLEANFILES
The sysusers.d/systemd.conf configuration file was originally introduced in
commit 1b99214789, but it was not marked for cleanup.  This caused distcheck
to complain about the file not being removed by distcleam.

Tested: Successfully ran "make distcheck" with this patchset.
2014-06-20 14:27:25 +02:00
Michael Marineau 09e00c524f test: ensure conf_files_list returns absolute paths 2014-06-20 00:10:47 -04:00
Filipe Brandenburger 228b2a1277 sd-dhcp6-client: include dhcp6-protocol.h in the list of sources
If the file is not listed, then "make dist" will not include it.

Tested: "make distcheck" works after this fix is applied.

Fixes: 139b011ab8
2014-06-20 00:25:08 +02:00
Filipe Brandenburger ab2bc6feee sd-dhcp6-client: fix path of sd-icmp6-nd.h in Makefile.am
It was incorrectly looking for a file in src/libsystemd-network/ when the file was actually deployed to src/systemd/ instead.  This broke "make dist".

Tested: "make dist" works again after this patchset is applied.

Fixes: f20a35cc0d
2014-06-20 00:25:04 +02:00
Filipe Brandenburger 302c9d6c8b sd-dhcp6-client: remove bogus dependency on dhcp6-icmp6.h
Makefile.am had a reference to it but it none of the sources included it.

Tested: "make dist" works again after this patchset is applied.

Fixes: 2ea8857eff
2014-06-20 00:25:00 +02:00
Lennart Poettering 326bb68c40 debug-generator: add new generator
debug-generator can mask specific units if they are specified on the
kernel command line with systemd.mask=.

debug-generator can pull in debug-shell.service is systemd.debug-shell
is passed on the kernel command line.
2014-06-19 16:33:01 +02:00
Patrik Flykt 3fb2c57038 sd-dhcp6-lease: Add DHCPv6 lease handling
Create a structure describing a DHCPv6 lease. Add internal functions
for creating a new lease and accessing the server ID, preference and
IAID. Provide functions for clearing addresses and associated timers.

External users are initially given only the capabilities of
referencing and unreferencing the lease structure.
2014-06-19 15:44:44 +03:00
Patrik Flykt 2ea8857eff sd-dhcp6-client: Add DHCPv6 Solicit test case
Verify the Solicit message created by the DHCPv6 client code.

Provide local variants for detect_vm(), detect_container() and
detect_virtualization() defined in virt.h. This makes the DHCPv6
library believe it is run in a container and does not try to request
interface information from udev for the non-existing interface index
used by the test case code.
2014-06-19 15:44:44 +03:00
Patrik Flykt f12ed3bf0b sd-dhcp6-client: Add basic DHCPv6 option handling
Add option appending and parsing. DHCPv6 options are not aligned, thus
the option handling code must be able to handle options starting at
any byte boundary.

Add a test case for the basic option handling.
2014-06-19 15:44:43 +03:00
Patrik Flykt 813e3a6ffc sd-dhcp6-client: Add basic DHCPv6 test cases
Add test cases for basic DHCPv6 client handling, e.g. setting
interface index, mac address and attaching event loop.
2014-06-19 15:44:43 +03:00
Patrik Flykt f20a35cc0d sd-icmp6-nd: Add initial Router Advertisement test case
Feed a Router Advertisement to the code and expect proper events
each time. The sending part is ignored, as all of it is static code
in the real dhcp_network_icmp6_send_rs() function.
2014-06-19 15:44:43 +03:00
Patrik Flykt e316912679 sd-icmp6-nd: Add Router Solicitation and Advertisement support
Provide functions to bind the ICMPv6 socket to the approriate interface
and set multicast sending and receiving according to RFC 3493, section
5.2. and RFC 3542, sections 3. and 3.3. Filter out all ICMPv6 messages
except Router Advertisements for the socket in question according to
RFC 3542, section 3.2.

Send Router Solicitations to the all routers multicast group as
described in RFC 4861, section 6. and act on the received Router
Advertisments according to section 6.3.7.

Implement a similar API for ICMPv6 handling as is done for DHCPv4 and
DHCPv6.
2014-06-19 15:44:43 +03:00
Lennart Poettering f4bab1690e coredump: coredumpctl is so useful now, make it a first-class citizen
Drop the "systemd-" prefix, renaming it from "systemd-coredumpctl" to
"coredumpctl".
2014-06-19 13:46:01 +02:00
Lennart Poettering 8d4e028f18 coredump: include stacktrace of coredumps in the log message
elfutils' libdw is maintained, can read DWARF debug data and appears to
be the library of choice for generating backtraces today.
2014-06-19 12:38:45 +02:00
Lennart Poettering 34c10968cb coredump: optionally store coredumps on disk, not in the journal
Introduce a new configuration file /etc/systemd/coredump.conf to
configure when to place coredumps in the journal and when on disk.

Since the coredumps are quite large, default to storing them only on
disk.
2014-06-19 00:00:24 +02:00
Lennart Poettering 11bf3cced1 networkd: add address pool support
When an address is configured to be all zeroes, networkd will now
automatically find a locally unused network of the right size from a
list of pre-configured pools. Currently those pools are 10.0.0.0/8,
172.16.0.0/12, 192.168.0.0/16 and fc00::/7, i.e. the network ranges for
private networks. They are compiled in, but should be configurable
eventually.

This allows applying the same configuration to a large number of
interfaces with each time a different IP range block, and management of
these IP ranges is fully automatic.

When allocating an address range from the pool it is made sure the range
is not used otherwise.
2014-06-18 18:28:29 +02:00
Lennart Poettering 9542239eaf cryptsetup: introduce new cryptsetup-pre.traget unit so that services can make sure they are started before and stopped after any LUKS setup
https://bugzilla.redhat.com/show_bug.cgi?id=1097938
2014-06-18 00:09:46 +02:00
Ronny Chevalier fe582db94b build-sys: add missing backslash 2014-06-17 17:29:47 -04:00
Lennart Poettering a1259e0a14 build-sys: touch /usr on "make install"
this way, the "make install" will be detected as offline update on next
boot.
2014-06-17 03:09:27 +02:00
Lennart Poettering 1713703c96 preset: ship a minimal preset file upstream
This is useful so that distros have something to base their own policy
of. It also useful to make sure that minimal installs always get useful
configuration in place.
2014-06-17 02:43:44 +02:00
Ronny Chevalier 106ecd769d tests: add test-fdset 2014-06-16 20:38:22 +02:00
Ronny Chevalier c182135d3a tests: add test-socket-util 2014-06-16 20:38:22 +02:00
Susant Sahani 326cb4061a networkd: introduce vxlan
This patch enables netwokd to create vxlan

Changes:
Added:
	1. File networkd networkd-vxlan.c
	2. to netdev
	    bool learning
	    struct in_addr group
	    uint64_t vxlanid;
	3. VXLAN subsection and config
	   parameters
2014-06-16 20:38:22 +02:00
Lennart Poettering 137243fd13 units: add a service to invoke ldconfig on system updates at boot 2014-06-16 12:33:22 +02:00
Lennart Poettering b532bdeae9 rpm: add RPM macros to apply sysusers, sysctl, and binfmt drop-ins
With this in place RPMs can make sure that whatever they drop in is
immeidately applied, and not delayed until next reboot.

This also moves systemd-sysusers back to /usr/bin, since hardcoding the
path to /usr/lib in the macros would mean compatibility breaks in
future, should we turn sysusers into a command that is actually OK for
people to call directly. And given that that is quite likely to happen
(since it is useful to prepare images with its --root= switch), let's
just prepare for it.
2014-06-13 20:11:59 +02:00
Tom Gundersen b44cd88210 sd-dhcp-server: add basic functionality for creating/destroying server instance 2014-06-13 16:53:13 +02:00
Lennart Poettering 55745f2054 tmpfiles: add minimal tmpfiles snippet to rebuild the most essential stuff from /etc 2014-06-13 13:29:25 +02:00
Lennart Poettering ecde7065f7 units: rebuild /etc/passwd, the udev hwdb and the journal catalog files on boot
Only when necessary of course, nicely guarded with the new
ConditionNeedsUpdate= condition we added.
2014-06-13 13:26:32 +02:00
Lennart Poettering 8ea48dfcd3 update-done: add minimal tool to manage system updates for /etc and /var, if /usr has changed
In order to support offline updates to /usr, we need to be able to run
certain tasks on next boot-up to bring /etc and /var in line with the
updated /usr. Hence, let's devise a mechanism how we can detect whether
/etc or /var are not up-to-date with /usr anymore: we keep "touch
files" in /etc/.updated and /var/.updated that are mtime-compared with
/usr. This means:

Whenever the vendor OS tree in /usr is updated, and any services that
shall be executed at next boot shall be triggered, it is sufficient to
update the mtime of /usr itself. At next boot, if /etc/.updated and/or
/var/.updated is older than than /usr (or missing), we know we have to
run the update tools once. After that is completed we need to update the
mtime of these files to the one of /usr, to keep track that we made the
necessary updates, and won't repeat them on next reboot.

A subsequent commit adds a new ConditionNeedsUpdate= condition that
allows checking on boot whether /etc or /var are outdated and need
updating.

This is an early step to allow booting up with an empty /etc, with
automatic rebuilding of the necessary cache files or user databases
therein, as well as supporting later updates of /usr that then propagate
to /etc and /var again.
2014-06-13 13:26:32 +02:00
Lennart Poettering 48e93f88ff sysusers: move systemd-sysusers to libexec for now 2014-06-13 13:26:32 +02:00
Lennart Poettering f8b5d99408 sysuser: generate default snippet incorporating TTY_GID properly
When the user specifies --with-tty-gid= then we should honour that and
write it to the snippet, too.
2014-06-12 23:22:27 +02:00
Lennart Poettering 1b99214789 sysusers: add minimal tool to reconstruct /etc/passwd and /etc/group from static files
systemd-sysusers is a tool to reconstruct /etc/passwd and /etc/group
from static definition files that take a lot of inspiration from
tmpfiles snippets. These snippets should carry information about system
users only. To make sure it is not misused for normal users these
snippets only allow configuring UID and gecos field for each user, but
do not allow configuration of the home directory or shell, which is
necessary for real login users.

The purpose of this tool is to enable state-less systems that can
populate /etc with the minimal files necessary, solely from static data
in /usr. systemd-sysuser is additive only, and will never override
existing users.

This tool will create these files directly, and not via some user
database abtsraction layer. This is appropriate as this tool is supposed
to run really early at boot, and is only useful for creating system
users, and system users cannot be stored in remote databases anyway.

The tool is also useful to be invoked from RPM scriptlets, instead of
useradd. This allows moving from imperative user descriptions in RPM to
declarative descriptions.

The UID/GID for a user/group to be created can either be chosen dynamic,
or fixed, or be read from the owner of a file in the file system, in
order to support reconstructing the correct IDs for files that shall be
owned by them.

This also adds a minimal user definition file, that should be
sufficient for most basic systems. Distributions are expected to patch
these files and augment the contents, for example with fixed UIDs for
the users where that's necessary.
2014-06-12 23:07:33 +02:00
Lennart Poettering 42a04ee69c build-sys: update library versions 2014-06-11 15:30:28 +02:00
Lennart Poettering a4a878d040 units: introduce network-pre.target as place to hook in firewalls
network-pre.target is a passive target that should be pulled in by
services that want to be executed before any network is configured (for
example: firewall scrips).

network-pre.target should be ordered before all network managemet
services (but not be pulled in by them).

network-pre.target should be order after all services that want to be
executed before any network is configured (and be pulled in by them).
2014-06-11 12:14:55 +02:00
Lennart Poettering 9339db7187 tmpfiles: always recreate the most basic directory structure in /var
Let's allow booting up with /var empty. Only create the most basic
directories to get to a working directory structure and symlink set in
/var.
2014-06-11 00:12:21 +02:00
Lennart Poettering 849958d1ba tmpfiles: add new "C" line for copying files or directories 2014-06-10 23:02:40 +02:00
Dave Reisner bfa501e150 build: fix copypaste error in networkd-wait-online symlink 2014-06-09 08:48:21 -04:00
Thomas Hindoe Paaboel Andersen 95ed3294c6 Move handling of sysv initscripts to a generator
Reuses logic from service.c and the rc-local generator.

Note that this drops reading of chkconfig entirely. It also drops reading
runlevels from the LSB headers. The runlevels were only used to check for
runlevels outside of the normal 1-5 range and then add special dependencies
and settings. Special runlevels were dropped in the past so it seemed to be
unused code.

The generator does not know about non-generated units with a value set with
SysVStartPriority=. These are therefor not taken into account when converting
start priority to before/after.
2014-06-07 00:59:32 +02:00
Lennart Poettering bcf3295d2b bus: add basic dbus1 policy parser
Enforcement is still missing, but at least we can parse it now.
2014-06-06 19:41:24 +02:00
Lennart Poettering fb69d7096d socket-proxyd: port to asynchronous name resolution using sd-resolve 2014-06-05 16:12:48 +02:00
Lennart Poettering 03ee5c38cb journald: move /dev/log socket to /run
This way we can make the socket also available for sandboxed apps that
have their own private /dev. They can now simply symlink the socket from
/dev.
2014-06-04 16:53:58 +02:00
Lennart Poettering 6a010ac9e5 bus-proxy: drop priviliges if we can
Either become uid/gid of the client we have been forked for, or become
the "systemd-bus-proxy" user if the client was root. We retain
CAP_IPC_OWNER so that we can tell kdbus we are actually our own client.
2014-06-04 11:13:08 +02:00
Tom Gundersen 682265d5e2 resolved: run as unpriviliged "systemd-resolve" user
This service is not yet network facing, but let's prepare nonetheless.
Currently all caps are dropped, but some may need to be kept in the
future.
2014-06-03 10:40:28 +02:00
Tom Gundersen bddfc8afd3 networkd: drop CAP_SYS_MODULE
Rely on modules being built-in or autoloaded on-demand.

As networkd is a network facing service, we want to limits its capabilities,
as much as possible. Also, we may not have CAP_SYS_MODULE in a container,
and we want networkd to work the same there.

Module autoloading does not always work, but should be fixed by the kernel
patch f98f89a0104454f35a: 'net: tunnels - enable module autoloading', which
is currently in net-next and which people may consider backporting if they
want tunneling support without compiling in the modules.

Early adopters may also use a module-load.d snippet and order
systemd-modules-load.service before networkd to force the module
loading of tunneling modules.

This sholud fix the various build issues people have reported.
2014-06-03 00:40:23 +02:00
Susant Sahani 10142d75cc networkd: introduce veth device support
This patch adds veth device support to networkd.

Example conf:

File: veth.netdev

[NetDev]
Name=veth-test
Kind=veth

[Peer]
Name=veth-peer
2014-06-02 16:09:40 +02:00
Lennart Poettering d3cf48f4bd networkd: run as unpriviliged "systemd-network" user
This allows us to run networkd mostly unpriviliged with the exception of
CAP_NET_* and CAP_SYS_MODULE. I'd really like to get rid of the latter
though...
2014-06-01 09:12:00 +02:00
Lennart Poettering fdd2531170 virt: rework container detection logic
Instead of accessing /proc/1/environ directly, trying to read the
$container variable from it, let's make PID 1 save the contents of that
variable to /run/systemd/container. This allows us to detect containers
without the need for CAP_SYS_PTRACE, which allows us to drop it from a
number of daemons and from the file capabilities of systemd-detect-virt.

Also, don't consider chroot a container technology anymore. After all,
we don't consider file system namespaces container technology anymore,
and hence chroot() should be considered a container even less.
2014-05-28 18:53:44 +08:00
Lennart Poettering 76d4bef384 build-sys: bump package and library version 2014-05-27 19:02:22 +08:00
Djalal Harouni e866af3acc nspawn: make nspawn robust to container failure
nspawn and the container child use eventfd to wait and notify each other
that they are ready so the container setup can be completed.

However in its current form the wait/notify event ignore errors that
may especially affect the child (container).

On errors the child will jump to the "child_fail" label and terminate
with _exit(EXIT_FAILURE) without notifying the parent. Since the eventfd
is created without the "EFD_NONBLOCK" flag, this leaves the parent
blocking on the eventfd_read() call. The container can also be killed
at any moment before execv() and the parent will not receive
notifications.

We can fix this by using cheap mechanisms, the new high level eventfd
API and handle SIGCHLD signals:

* Keep the cheap eventfd and EFD_NONBLOCK flag.

* Introduce eventfd states for parent and child to sync.
Child notifies parent with EVENTFD_CHILD_SUCCEEDED on success or
EVENTFD_CHILD_FAILED on failure and before _exit(). This prevents the
parent from waiting on an event that will never come.

* If the child is killed before execv() or before notifying the parent,
we install a NOP handler for SIGCHLD which will interrupt blocking calls
with EINTR. This gives a chance to the parent to call wait() and
terminate in main().

* If there are no errors, parent will block SIGCHLD, restore default
handler and notify child which will do execv(), then parent will pass
control to process_pty() to do its magic.

This was exposed in part by:
https://bugs.freedesktop.org/show_bug.cgi?id=76193

Reported-by: Tobias Hunger tobias.hunger@gmail.com
2014-05-25 11:23:35 +08:00
Kay Sievers 24efb11245 shared: rename hwclock.[ch] to clock-util.[ch] 2014-05-24 07:56:20 +09:00
Kay Sievers 5052e3996d build-sys: let libsystemd_network pull in libudev-internal.la
On Thu, May 22, 2014 at 9:53 AM, Jan Engelhardt <jengelh@inai.de> wrote:
>
> If libsystemd-network.la is relying on that udev function, it ought
> to specify libudev(-internal).la in libsystemd_network_la_LIBADD.
2014-05-22 10:19:07 +09:00
Kay Sievers 2f14583f47 build-sys: do not run symbol list export test for compat-only libs
The verbose link-time deprecation warnings are annoying. These libs
will never change or be extended; there is no need to test the list
of exported symbols.
2014-05-22 09:46:09 +09:00
Kay Sievers ffcf82d250 build-sys: fix linking order
./.libs/libsystemd-network.a(libsystemd_network_la-network-internal.o):
  network-internal.c:function net_get_unique_predictable_data:
  error: undefined reference to 'udev_device_get_property_value'
collect2: error: ld returned 1 exit status
2014-05-22 09:46:09 +09:00
Kay Sievers 5590bbe529 Makefile.am: fix whitespace 2014-05-22 09:46:09 +09:00
Jan Engelhardt f884afb206 build: put missing KMOD_CFLAGS into Makefile
The build fails if kmod is not in a default location.
2014-05-22 09:27:26 +09:00