Commit graph

43 commits

Author SHA1 Message Date
Christian Brauner 3228995c53 cgroup: detect cgroup namespaces
- define CLONE_NEWCGROUP
- add fun to detect whether cgroup namespaces are supported
2016-07-09 05:49:04 +02:00
Andreas Rammhold 20897a0d6e networkd: added support for vrf interfaces (#3316) 2016-06-16 00:25:06 +02:00
Andrew Jeddeloh f4f5e50a0a build: fix missing symbol for old kernel headers (#3530)
Fix issue where IN6_ADDR_GEN_MODE_STABLE_PRIVACY is undefined but
IFLA_INET6_ADDR_GEN_MODE is defined and thus the former does not get
fixed in missing.h. This occurs with kernel headers new enough to have
the IFLA_INET6_ADDR_GEN_MODE but old enough to not yet have
IN6_ADDR_GEN_MODE_STABLE_PRIVACY (e.g. 3.18).
2016-06-14 11:09:06 +02:00
Tobias Jungel 13b498f967 networkd: add support to configure VLAN on bridge ports 2016-06-10 09:10:41 +02:00
Zbigniew Jędrzejewski-Szmek 662c7e5073 Merge pull request #3326 from tomty89/update-2
networkd: IPv6 fixes
2016-05-28 15:28:51 -04:00
Djalal Harouni 87c05f365d nspawn: a bench of special fileystems that should not be shifted
Add some special filesystems that should not be shifted, most of them
relate to the host and not to containers.
2016-05-26 22:38:25 +02:00
Tom Yan fbc38f230b networkd: set IFLA_INET6_ADDR_GEN_MODE as per stable_secret
Although networkd has option (LinkLocalAddressing=) to toggle IPv6LL autoconfiguration, when it is enabled, the address is autoconfigured by the kernel, but not networkd.

Therefore, we do not statically set IFLA_INET6_ADDR_GEN_MODE to IN6_ADDR_GEN_MODE_EUI64, but dynamically depending on whether stable_secret is set, just as what the kernel does by default.

Note that this does NOT affect the global addresses configured by networkd.
2016-05-25 20:04:01 +08:00
Stefan Saraev 306578e518 missing.h: add BTRFS_IOC_QUOTA_RESCAN_WAIT (#3266) 2016-05-16 10:58:46 -04:00
Lennart Poettering 3282493ad0 build-sys: improve compat with older kernel headers
In 4.2 kernel headers, some netlink defines are missing that we need. missing.h
already can add them in, but currently makes this dependent on a definition
that these kernels already have. Change the check hence to check for the newest
definition in the table, so that the whole bunch of definitions as added in on
all kernels lacking this.
2016-04-29 16:27:48 +02:00
Lennart Poettering 88cd066e11 nspawn: don't try to patch UIDs/GIDs of procfs and suchlike 2016-04-25 12:50:06 +02:00
Susant Sahani 439689c6ec networkd: bump MTU to 1280 for interfaces which have IPv6 enabled (#3077)
IPv6 protocol requires a minimum MTU of 1280 bytes on the interface.
This fixes #3046.

Introduce helper link_ipv6_enabled() to figure out whether IPV6 is enabled.
Introduce network_has_static_ipv6_addresses() to find out if any static
ipv6 address configured.
If IPv6 is not configured on any interface that is SLAAC, DHCPv6 and static
IPv6 addresses not configured, then IPv6 will be automatically disabled for that
interface, that is we write "1" to /proc/sys/net/ipv6/conf//disable_ipv6.
2016-04-20 20:34:13 -04:00
Susant Sahani 3fef7a3fcd networkd: allow setting of multicast querier for linux bridge (#3051) 2016-04-18 13:45:52 +02:00
Alban Crequy 099619957a cgroup2: use new fstype for unified hierarchy
Since Linux v4.4-rc1, __DEVEL__sane_behavior does not exist anymore and
is replaced by a new fstype "cgroup2".

With this patch, systemd no longer supports the old (unstable) way of
doing unified hierarchy with __DEVEL__sane_behavior and systemd now
requires Linux v4.4 for unified hierarchy.

Non-unified hierarchy is still the default and is unchanged by this
patch.

67e9c74b8a
2016-03-26 12:05:29 -04:00
Zbigniew Jędrzejewski-Szmek 2f368e4a11 basic/missing: move syscall definitions to basic/missing_syscall.h
We have a bunch of syscall wrapper definitions and it's easier to
see that they follow the same pattern if they are not interspersed
with other defines.

Change the wrappers to be uniform:
- if __NR_XXX is not defined, do not bother to call the syscall,
  and return -1/ENOSYS immediately.
- do not check __NR_XXX defines if we detect the symbol as defined,
  since we don't need them anyway
- reindent stuff for readability

New file basic/missing_syscall.h is included at the end of missing.h
because it might make use of some of the definitions in missing.h.
2016-03-17 13:34:34 -04:00
Zbigniew Jędrzejewski-Szmek 1d4b557d1b basic/missing: add copy_file_range
syscall numbers based on:
https://fedora.juszkiewicz.com.pl/syscalls.html
2016-03-17 13:02:18 -04:00
Tom Gundersen 7c7c0cbe64 Merge pull request #2685 from poettering/lldp-fixes2
lldp fixes, second iteration
2016-02-22 17:38:34 +01:00
Daniel Mack 26c34ab4ee missing.h: Explicitly check for IFLA_BRPORT_PROXYARP
RHEL explicitly disables IFLA_BRPORT_PROXYARP by renaming the enum value.

In order to support unpatched builds, we have two options:

a) redefine the enum value through missing.h and ignore the fact that it
   is really unsupported, or

b) omit that enum value on rtnl_prot_info_bridge_port_types[]

As we are not actually using this netlink type anywhere, and because it
is only hooked up for the sake of completeness, this patch opts for the
former.
2016-02-22 13:22:30 +01:00
Lennart Poettering 43a6a52efe sd-lldp: move ETHERTYPE_LLDP to missing.h
After all, most ETHERTYPE variables are defined in the system headers, hence
define these where we defined all other fill-ins for system headers.
2016-02-20 22:42:29 +01:00
Lennart Poettering de08570050 build-sys: fix type detection
Before this patch existence of char16_t, char32_t, key_serial_t was checked
with AC_CHECK_DECLS() which doesn't actually work for types. Correct this to
use AC_CHECK_TYPES() instead.

Also, while we are at it, change the check for memfd_create() to use
AC_CHECK_DECLS() instead of AC_CHECK_FUNCS(). This is a better choice, since a
couple of syscalls are defined by glibc but not exported in the header files
(pivot_root() for example), and we hence should probably be more picky with
memfd_create() too, which glibc might decide to expose one day, but not
necessarily in the headers too.
2016-02-16 15:22:06 +01:00
Rabin Vincent bacef2a229 missing.h: define IFLA_EXT_MASK
We already define IFLA_PROMISCUITY and some other of these masks in
order to allow building with older headers.  Define IFLA_EXT_MASK too,
which was added in the same kernel version as IFLA_PROMISCUITY (v3.10).
2016-02-15 07:39:23 +01:00
Daniel Mack b26fa1a2fb tree-wide: remove Emacs lines from all files
This should be handled fine now by .dir-locals.el, so need to carry that
stuff in every file.
2016-02-10 13:41:57 +01:00
Shawn Landden c932fb71cc utf8.[ch] et al: use char32_t and char16_t instead of int, int32_t, int16_t
rework C11 utf8.[ch] to use char32_t instead of uint32_t when referring
to unicode chars, to make things more expressive.

[
 @zonque:
  * rebased to current master
  * use AC_CHECK_DECLS to detect availibility of char{16,32}_t
  * make utf8_encoded_to_unichar() return int
]
2016-01-27 14:10:02 +01:00
Lennart Poettering 6955a3ba9d resolved: when checking whether a link is relevant, check kernel operstate
This mimics what networkd is doing to detect a carrier.
2016-01-25 15:59:40 +01:00
Dominik Hannen f217be196e Fix IPv6PrivacyExtension (networkd-ndisc.c)
This small addition fixes the issues #1982 and #2242.
IPv6PrivacyExtension now works as expected even when a RA is received.
2016-01-16 00:44:46 +01:00
Ismo Puustinen 755d4b67a4 capabilities: added support for ambient capabilities.
This patch adds support for ambient capabilities in service files. The
idea with ambient capabilities is that the execed processes can run with
non-root user and get some inherited capabilities, without having any
need to add the capabilities to the executable file.

You need at least Linux 4.3 to use ambient capabilities. SecureBit
keep-caps is automatically added when you use ambient capabilities and
wish to change the user.

An example system service file might look like this:

[Unit]
Description=Service for testing caps

[Service]
ExecStart=/usr/bin/sleep 10000
User=nobody
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW

After starting the service it has these capabilities:

CapInh: 0000000000003000
CapPrm: 0000000000003000
CapEff: 0000000000003000
CapBnd: 0000003fffffffff
CapAmb: 0000000000003000
2016-01-12 12:14:50 +02:00
Susant Sahani 62bc4efc7a core: socket options fix SCTP_NODELAY
SCTP_NODELAY is diffrent to TCP_NODELAY.
Apply proper options in case of SCTP.
2015-12-31 12:05:57 +05:30
Tom Gundersen b69015efd2 sd-netlink: add support for RTA_PREF 2015-11-11 15:42:38 +01:00
Tom Gundersen 8ae4b6d12c sd-netlink: types - let tables be sized implicitly
This way we do not rely on the size MAX* constants from the kernel headers, as these will
be out-of-sync in case we have old headers and new defines in missing.h.
2015-11-11 15:42:38 +01:00
Lennart Poettering 5bcd08db28 btrfs: beef-up btrfs support with a limited understanding of quota
With this change we understand more than just leaf quota groups for
btrfs file systems. Specifically:

- When we create a subvolume we can now optionally add the new subvolume
  to all qgroups its parent subvolume was member of too. Alternatively
  it is also possible to insert an intermediary quota group between the
  parent's qgroups and the subvolume's leaf qgroup, which is useful for
  a concept of "subtree" qgroups, that contain a subvolume and all its
  children.

- The remove logic for subvolumes has been updated to optionally remove
  any leaf qgroups or "subtree" qgroups, following the logic above.

- The snapshot logic for subvolumes has been updated to replicate the
  original qgroup setup of the source, if it follows the "subtree"
  design described above. It will not cover qgroup setups that introduce
  arbitrary qgroups, especially those orthogonal to the subvolume
  hierarchy.

This also tries to be more graceful when setting up /var/lib/machines as
btrfs. For example, if mkfs.btrfs is missing we don't even try to set it
up as loopback device.

Fixes #1559
Fixes #1129
2015-10-22 01:59:25 +02:00
David Herrmann 606601ddca Merge pull request #1595 from poettering/proxy-fixes
bus proxy fixes, and more
2015-10-18 12:15:10 +02:00
Tom Gundersen 9c5a882b7f sd-netlink: refcount multicast groups
Track the number of matches installed for a given multicast group, and leave the
group once no matches depend on it.

In order to handle passed-in sockets that are already members of multicast groups
we initialize the refcount based on the membership once we take over the socket.
This way we will leave the socket in the state we found it once we finish with
it.

On kernels that do not fully support reading out the multicast group membership
we fall back to never leaving any groups (as before).
2015-10-15 18:59:08 +02:00
Lennart Poettering 3f952f92b9 btrfs: always remove the per-subvol qgroup when removing a subvol
btrfs doesn't do that automatically, hence let's do that explicitly each
time.
2015-10-15 18:37:03 +02:00
Lennart Poettering e287086b8a ask-password: add support for caching passwords in the kernel keyring
This adds support for caching harddisk passwords in the kernel keyring
if it is available, thus supporting caching without Plymouth being
around.

This is also useful for hooking up "gdm-auto-login" with the collected
boot-time harddisk password, in order to support gnome keyring
passphrase unlocking via the HDD password, if it is the same.

Any passwords added to the kernel keyring this way have a timeout of
2.5min at which time they are purged from the kernel.
2015-10-07 12:26:14 +02:00
Susant Sahani c3eae485bb missing.h : add bridge params 2015-10-05 09:43:29 +05:30
Lennart Poettering 97f709186b Merge pull request #1365 from floppym/kcmp
Add fallback for kcmp() in case __NR_kcmp is undefined
2015-09-23 21:09:38 +02:00
Mike Gilbert 75b554579b Add fallback for kcmp() in case __NR_kcmp is undefined
IA64 is missing this syscall as of linux-4.2.
This works around it until the necessary kernel patch gets merged.
2015-09-23 14:41:28 -04:00
Hendrik Brueckner 7bcff8daba mising: add __NR_memfd_create syscall number for s390 2015-09-23 15:46:30 +02:00
Lennart Poettering efdb02375b core: unified cgroup hierarchy support
This patch set adds full support the new unified cgroup hierarchy logic
of modern kernels.

A new kernel command line option "systemd.unified_cgroup_hierarchy=1" is
added. If specified the unified hierarchy is mounted to /sys/fs/cgroup
instead of a tmpfs. No further hierarchies are mounted. The kernel
command line option defaults to off. We can turn it on by default as
soon as the kernel's APIs regarding this are stabilized (but even then
downstream distros might want to turn this off, as this will break any
tools that access cgroupfs directly).

It is possibly to choose for each boot individually whether the unified
or the legacy hierarchy is used. nspawn will by default provide the
legacy hierarchy to containers if the host is using it, and the unified
otherwise. However it is possible to run containers with the unified
hierarchy on a legacy host and vice versa, by setting the
$UNIFIED_CGROUP_HIERARCHY environment variable for nspawn to 1 or 0,
respectively.

The unified hierarchy provides reliable cgroup empty notifications for
the first time, via inotify. To make use of this we maintain one
manager-wide inotify fd, and each cgroup to it.

This patch also removes cg_delete() which is unused now.

On kernel 4.2 only the "memory" controller is compatible with the
unified hierarchy, hence that's the only controller systemd exposes when
booted in unified heirarchy mode.

This introduces a new enum for enumerating supported controllers, plus a
related enum for the mask bits mapping to it. The core is changed to
make use of this everywhere.

This moves PID 1 into a new "init.scope" implicit scope unit in the root
slice. This is necessary since on the unified hierarchy cgroups may
either contain subgroups or processes but not both. PID 1 hence has to
move out of the root cgroup (strictly speaking the root cgroup is the
only one where processes and subgroups are still allowed, but in order
to support containers nicey, we move PID 1 into the new scope in all
cases.) This new unit is also used on legacy hierarchy setups. It's
actually pretty useful on all systems, as it can then be used to filter
journal messages coming from PID 1, and so on.

The root slice ("-.slice") is now implicitly created and started (and
does not require a unit file on disk anymore), since
that's where "init.scope" is located and the slice needs to be started
before the scope can.

To check whether we are in unified or legacy hierarchy mode we use
statfs() on /sys/fs/cgroup. If the .f_type field reports tmpfs we are in
legacy mode, if it reports cgroupfs we are in unified mode.

This patch set carefuly makes sure that cgls and cgtop continue to work
as desired.

When invoking nspawn as a service it will implicitly create two
subcgroups in the cgroup it is using, one to move the nspawn process
into, the other to move the actual container processes into. This is
done because of the requirement that cgroups may either contain
processes or other subgroups.
2015-09-01 23:52:27 +02:00
Matt Turner a242a99d42 Use getxpid syscall on alpha for raw_getpid()
Alpha does not have a getpid syscall, but rather has getxpid to match
OSF/1.
2015-08-04 14:47:52 -07:00
Susant Sahani 38a0245fb2 Add bridge NL params to missing.h 2015-07-23 15:06:03 +05:30
Susant Sahani 66f4bc7795 Tunnel NL params: Add to missing.h 2015-07-22 15:01:58 +05:30
Susant Sahani 56bf3853b4 add NL parameters to missing.h 2015-07-20 10:17:50 +05:30
Kay Sievers a095315b3c build-sys: split internal basic/ library from shared/
basic/      can be used by everything
            cannot use anything outside of basic/

libsystemd/ can use basic/
            cannot use shared/

shared/     can use libsystemd/
2015-06-11 10:52:46 +02:00
Renamed from src/shared/missing.h (Browse further)