Commit graph

3919 commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek f9761a89a8 shared/conf-parser: turn CONFIG_PARSE_REFUSE_BOM flag into a local variable
This is an internal implementation detail.
2019-11-22 13:11:35 +01:00
Lennart Poettering a2e361dc27 cgls: visually separate processes from cgroups
Let's show them in grey, since we generally want to focus on showing the
cgroups much less than the processes in them.
2019-11-20 17:51:28 +01:00
Lennart Poettering 74d8ccd451 cgls: show delegation boundaries by underlining the cgroup in the output
This should help visualize where one manager's territory begins and
another's starts. Do this by underlining (since it's a "cut" point an
underline made most sense to me). Since underlining is not visible on
the console let's also show an ellipses for all lines that are
delegation boundaries.

Unfortunately this all is not as useful as it appears. The
"trusted.delegate" xattr is only visible to roo, which means
"systemd-cgls" has be called as root to show the boundaries.
Unfortunately cgroupfs doesn't support unprivileged xattrs on cgroups.
2019-11-20 17:50:12 +01:00
Lennart Poettering 09a6b4f34f ask-password: skip kernel keyring logic if we see EPERM
Let's improve compat with container managers that block the keyring
logic and return EPERM for them.
2019-11-19 19:12:09 +01:00
Lennart Poettering b26c0b68a4 format-table: add UID/GID output support to format-table.h 2019-11-19 12:10:44 +01:00
Lennart Poettering 394fda4caf id128: drop "MESSAGE_" prefix of pretty output
Using these IDs for message identication is one use case, but there are
others, hence let's drop the prefix, it only made sense to have while
the tool was part of journalctl.
2019-11-15 19:07:05 +01:00
Lennart Poettering a19fdd66c2 id128: add new "-u" switch for outputting Ids in UUID format
For some unrelated stuff I wanted the machine ID in UUID format, and it
was annoying doing that manually. So let's add a switch for this, so
that this works:

    systemd-id128 machine-id -u
2019-11-15 19:07:05 +01:00
Lennart Poettering f0bfae7265
Merge pull request #14037 from poettering/machinectl-pw-agent
spawn ask pw tty agent from "machinectl start"
2019-11-15 16:59:49 +01:00
Lennart Poettering 8af381679d
Merge pull request #13940 from keur/protect_kernel_logs
Add ProtectKernelLogs to systemd.exec
2019-11-15 16:26:10 +01:00
Lennart Poettering c59e2ec696 ask-password-agent: introduce ask_password_agent_open_if_enabled()
This makes the ask-password agent handling more alike the polkit agent
handling again, and introduces ask_password_agent_open_if_enabled() that
works just like the already existing polkit_agent_open_if_enabled().
2019-11-15 11:11:52 +01:00
Lennart Poettering 385d581b74 polkit-agent: don't use an inline function
This is long enough to just be a regular function, and is never called
in inner loops, let's hence just make this a plain function.
2019-11-15 11:11:14 +01:00
Zbigniew Jędrzejewski-Szmek 7edd8fb198 core: do not propagate polkit error to caller
If we fail to start polkit, we get a message like
"org.freedesktop.DBus.Error.NameHasNoOwner: Could not activate remote peer.",
which has no meaning for the caller of our StartUnit method. Let's just
return -EACCES.

$ systemctl start apache
Failed to start apache.service: Could not activate remote peer. (before)
Failed to start apache.service: Access denied                   (after)

Fixes #13865.
2019-11-15 08:17:01 +01:00
Lennart Poettering e013e10d0e ask-password: don't hit assert() when we query pw which the user C-d and caching is enabled 2019-11-14 10:04:11 +01:00
Zbigniew Jędrzejewski-Szmek a079077340
Merge pull request #14013 from keszybz/cryptsetup-keyfile-with-colons
Support cryptsetup keyfiles with colons agains
2019-11-14 10:02:20 +01:00
Zbigniew Jędrzejewski-Szmek ed4ad48897 Allow overriding /etc/fstab with $SYSTEMD_FSTAB 2019-11-13 22:04:51 +01:00
Lennart Poettering c214e210c9
Merge pull request #13994 from keszybz/bpf-refactor
Refactor the bpf devices code and fix some bugs
2019-11-13 16:36:39 +01:00
Lennart Poettering 437f48a471 tree-wide: fix how we set $TZ
According to tzset(3) we need to prefix timezone names with ":". Let's
do so hence, to avoid any ambiguities and follow documented behaviour.
2019-11-13 12:30:22 +01:00
Lennart Poettering 462255c65b meson: order list of dependencies of libshared alphabetically
Let's make merging patches against this more stable.
2019-11-12 15:30:18 +01:00
Kevin Kuehler 620dbdd248 shared: Add ProtectKernelLogs property
Add seccomp_protect_syslog, which adds a filter rule for the syslog
system call.
2019-11-11 12:11:56 -08:00
Zbigniew Jędrzejewski-Szmek 64ad9e088d tests: modify enter_cgroup_subroot() to return the new path 2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek 48e98ba5c3 tests: get rid of test-helper.[ch] completely
I don't think there's any particular reason to keep those functions in a separate
file.
2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek 5eecb1030f tests: make manager_skip_test() not a macro and move to tests.h
There is nothing magic in it.
2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek 77abd02985 tests: move memlock helper to shared code 2019-11-10 23:22:15 +01:00
Yu Watanabe e64664cefe
Merge pull request #13975 from keszybz/more-seccomp-syscalls
Add more syscalls to the seccomp lists
2019-11-09 23:27:34 +09:00
Zbigniew Jędrzejewski-Szmek 5021735fad shared/sleep-config: fix potential SEGV
We were looking at the wrong variable, and would always crash if this
comparison was reached. Fixes #13965.

Also, fix crash (_cleanup_ called on uninitialized variable) if we failed in
error path.

While at it, let's shorten some messages.
2019-11-09 09:19:36 +00:00
Zbigniew Jędrzejewski-Szmek 9493b16871 Add @pkey syscall group
Inspired by https://bugzilla.redhat.com/show_bug.cgi?id=1769299.
This change doesn't solve the issue, but makes it easier to whitelist the
syscall group.
2019-11-08 14:41:22 +01:00
Zbigniew Jędrzejewski-Szmek 6ca6771069 seccomp: add all *time64 syscalls
From https://bugzilla.redhat.com/show_bug.cgi?id=1770154:
> utime is an obsolete system call. The current kernel interface is
> utimensat_time64. New 32-bit architectures do not even provide the utime
> system call.

Also add all other *time64 syscalls listed in
https://fedora.juszkiewicz.com.pl/syscalls.html.
2019-11-08 14:40:49 +01:00
Anita Zhang 3e1db806b0 core: change top-level drop-in from -.service.d to service.d
Discussed in #13743, the -.service semantic conflicts with the
existing root mount and slice names, making this feature not
uniformly extensible to all types. Change the name to be
<type>.d instead.

Updating to this format also extends the top-level dropin to
unit types.
2019-11-07 08:34:53 +01:00
Anita Zhang f03378805f
Merge pull request #13936 from keszybz/format-table-uninhibited
Output tables at full width if piped
2019-11-05 15:03:15 -08:00
Zbigniew Jędrzejewski-Szmek 0db41a8f1f shared/format-table: disable ellipsization when piped
Fixes #13461.

Before:
$ systemd-inhibit --no-pager
WHO            UID  USER    PID   COMM           WHAT                                  WHY          MODE
ModemManager   0    root    1093  ModemManager   sleep                                 ModemManage… delay
NetworkManager 0    root    1400  NetworkManager sleep                                 NetworkMana… delay
UPower         0    root    5141  upowerd        sleep                                 Pause devic… delay
zbyszek        1000 zbyszek 10036 gsd-power      handle-lid-switch                     External mo… block
zbyszek        1000 zbyszek 10035 gsd-media-keys handle-power-key:handle-suspend-key:… GNOME handl… block
zbyszek        1000 zbyszek 10035 gsd-media-keys sleep                                 GNOME handl… delay
zbyszek        1000 zbyszek 10036 gsd-power      sleep                                 GNOME needs… delay

7 inhibitors listed.
$ systemd-inhibit --no-pager|grep suspend
$ systemd-inhibit --no-pager|cat
WHO            UID  USER    PID   COMM           WHAT                WHY   MODE
ModemManager   0    root    1093  ModemManager   sleep               Mode… delay
NetworkManager 0    root    1400  NetworkManager sleep               Netw… delay
UPower         0    root    5141  upowerd        sleep               Paus… delay
zbyszek        1000 zbyszek 10036 gsd-power      handle-lid-switch   Exte… block
zbyszek        1000 zbyszek 10035 gsd-media-keys handle-power-key:h… GNOM… block
zbyszek        1000 zbyszek 10035 gsd-media-keys sleep               GNOM… delay
zbyszek        1000 zbyszek 10036 gsd-power      sleep               GNOM… delay

After:
$ build/systemd-inhibit --no-pager
(same as above)

$ build/systemd-inhibit --no-pager|grep suspend
zbyszek        1000 zbyszek 10035 gsd-media-keys handle-power-key:handle-suspend-key:handle-hibernate-key GNOME handling keypresses                                   block
$ build/systemd-inhibit --no-pager|cat
WHO            UID  USER    PID   COMM           WHAT                                                     WHY                                                         MODE
ModemManager   0    root    1093  ModemManager   sleep                                                    ModemManager needs to reset devices                         delay
NetworkManager 0    root    1400  NetworkManager sleep                                                    NetworkManager needs to turn off networks                   delay
UPower         0    root    5141  upowerd        sleep                                                    Pause device polling                                        delay
zbyszek        1000 zbyszek 10036 gsd-power      handle-lid-switch                                        External monitor attached or configuration changed recently block
zbyszek        1000 zbyszek 10035 gsd-media-keys handle-power-key:handle-suspend-key:handle-hibernate-key GNOME handling keypresses                                   block
zbyszek        1000 zbyszek 10035 gsd-media-keys sleep                                                    GNOME handling keypresses                                   delay
zbyszek        1000 zbyszek 10036 gsd-power      sleep                                                    GNOME needs to lock the screen                              delay

7 inhibitors listed.

Note that this affect all tools that use format-table.c: machinectl, busctl,
loginctl, systemd-analyze, networkctl, portablectl.
2019-11-05 17:50:09 +01:00
Zbigniew Jędrzejewski-Szmek a859abf062
Merge pull request #13906 from yuwata/drop-missing-take2
tree-wide: drop xxx.h when xxx-util.h is included
2019-11-04 13:41:37 +01:00
Jérémy Rosen b5395600a0 allow an empty DefaultInstance= in configuration files
It is currently possible to override the DefaultInstance via drop-ins but
not remove it completely. Allow to do that by specifying an empty
DefaultInstance=
2019-11-04 13:33:08 +01:00
Yu Watanabe 8e1e87a5de tree-wide: drop double newline 2019-11-04 00:30:32 +09:00
Yu Watanabe 1405cb653a tree-wide: drop stdio.h when stdio-util.h is included 2019-11-04 00:30:32 +09:00
Yu Watanabe 021cdf8330 tree-wide: drop signal.h when signal-util.h is included 2019-11-04 00:30:32 +09:00
Yu Watanabe d8704e6914 tree-wide: drop mman.h when missing_mman.h is included 2019-11-04 00:30:32 +09:00
Yu Watanabe e30e8b5073 tree-wide: drop stat.h or statfs.h when stat-util.h is included 2019-11-04 00:30:32 +09:00
Yu Watanabe 92133d2878 tree-wide: drop socket.h when socket-util.h is included 2019-11-04 00:30:32 +09:00
Yu Watanabe af760d85c3 tree-wide: drop mntent.h when fstab-util.h is included 2019-11-04 00:30:32 +09:00
Yu Watanabe f21e58b47d tree-wide: drop time.h when time-util.h is included 2019-11-04 00:30:32 +09:00
Yu Watanabe 996f7e1cd0 tree-wide: drop dirent.h when dirent-util.h is included 2019-11-04 00:30:32 +09:00
Yu Watanabe 1c1da38afc tree-wide: drop alloca.h when alloc-util.h is included 2019-11-04 00:30:32 +09:00
Yu Watanabe 455fa9610c tree-wide: drop string.h when string-util.h or friends are included 2019-11-04 00:30:32 +09:00
Yu Watanabe f5947a5e92 tree-wide: drop missing.h 2019-10-31 17:57:03 +09:00
Zbigniew Jędrzejewski-Szmek be75c86dc6 calendarspec: fix calculation of timespec iterations that fall onto a DST change
If we tested a candidate time that would fall onto the DST change, and we
realized that it is now a valid time ('cause the given "hour" is missing),
we would jump to to beginning of the next bigger time period, i.e. the next
day.

mktime_or_timegm() already tells us what the next valid time is, so let's reuse
this, and continue the calculations at this point. This should allow us to
correctly jump over DST changes, but also leap seconds and similar.  It should
be OK even multiple days were removed from calendar, similarly to the
Gregorian-Julian transition. By reusing the information from normalization, we
don't have to make assumptions what the next valid time is.

Fixes #13745.

$ TZ=Australia/Sydney faketime '2019-10-06 01:50' build/systemd-analyze calendar 0/1:0/1 --iterations 20 | grep Iter
       Iter. #2: Sun 2019-10-06 01:52:00 AEST
       Iter. #3: Sun 2019-10-06 01:53:00 AEST
       Iter. #4: Sun 2019-10-06 01:54:00 AEST
       Iter. #5: Sun 2019-10-06 01:55:00 AEST
       Iter. #6: Sun 2019-10-06 01:56:00 AEST
       Iter. #7: Sun 2019-10-06 01:57:00 AEST
       Iter. #8: Sun 2019-10-06 01:58:00 AEST
       Iter. #9: Sun 2019-10-06 01:59:00 AEST
      Iter. #10: Sun 2019-10-06 03:00:00 AEDT
      Iter. #11: Sun 2019-10-06 03:01:00 AEDT
      Iter. #12: Sun 2019-10-06 03:02:00 AEDT
      Iter. #13: Sun 2019-10-06 03:03:00 AEDT
      Iter. #14: Sun 2019-10-06 03:04:00 AEDT
      Iter. #15: Sun 2019-10-06 03:05:00 AEDT
      Iter. #16: Sun 2019-10-06 03:06:00 AEDT
      Iter. #17: Sun 2019-10-06 03:07:00 AEDT
      Iter. #18: Sun 2019-10-06 03:08:00 AEDT
      Iter. #19: Sun 2019-10-06 03:09:00 AEDT
      Iter. #20: Sun 2019-10-06 03:10:00 AEDT

$ TZ=Australia/Sydney faketime 2019-10-06 build/systemd-analyze calendar 2/4:30 --iterations=3
  Original form: 2/4:30
Normalized form: *-*-* 02/4:30:00
    Next elapse: Sun 2019-10-06 06:30:00 AEDT
       (in UTC): Sat 2019-10-05 19:30:00 UTC
       From now: 5h 29min left
       Iter. #2: Sun 2019-10-06 10:30:00 AEDT
       (in UTC): Sat 2019-10-05 23:30:00 UTC
       From now: 9h left
       Iter. #3: Sun 2019-10-06 14:30:00 AEDT
       (in UTC): Sun 2019-10-06 03:30:00 UTC
       From now: 13h left
2019-10-30 17:57:01 +01:00
Lennart Poettering 9e48626571 seccomp: add new Linux 5.3 syscalls to syscall filter lists
Many syscalls added and all fit nicely into existing groups, hence lets
add them there.
2019-10-30 15:42:49 +01:00
Yu Watanabe afa1a54eb5
Merge pull request #13867 from keszybz/man-condition
Refactor description of conditons
2019-10-30 09:40:00 +09:00
Zbigniew Jędrzejewski-Szmek c82a2b5b84 shared: small typo 2019-10-28 21:39:55 +01:00
Zbigniew Jędrzejewski-Szmek a5f6f346d3
Merge pull request #13423 from pwithnall/12035-session-time-limits
Add `RuntimeMaxSec=` support to scope units (time-limited login sessions)
2019-10-28 14:57:00 +01:00
Philip Withnall 9ed7de605d scope: Support RuntimeMaxSec= directive in scope units
Just as `RuntimeMaxSec=` is supported for service units, add support for
it to scope units. This will gracefully kill a scope after the timeout
expires from the moment the scope enters the running state.

This could be used for time-limited login sessions, for example.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Fixes: #12035
2019-10-28 09:44:31 +01:00