1
1
mirror of https://github.com/systemd/systemd-stable.git synced 2024-12-22 13:33:56 +03:00
Commit Graph

2362 Commits

Author SHA1 Message Date
Luca Boccassi
211a3d87fb core: add [State|Runtime|Cache|Logs]Directory symlink as second parameter
When combined with a tmpfs on /run or /var/lib, allows to create
arbitrary and ephemeral symlinks for StateDirectory or RuntimeDirectory.
This is especially useful when sharing these directories between
different services, to make the same state/runtime directory 'backend'
appear as different names to each service, so that they can be added/removed
to a sharing agreement transparently, without code changes.

An example (simplified, but real) use case:

foo.service:
StateDirectory=foo

bar.service:
StateDirectory=bar

foo.service.d/shared.conf:
StateDirectory=
StateDirectory=shared:foo

bar.service.d/shared.conf:
StateDirectory=
StateDirectory=shared:bar

foo and bar use respectively /var/lib/foo and /var/lib/bar. Then
the orchestration layer decides to stop this sharing, the drop-in
can be removed. The services won't need any update and will keep
working and being able to store state, transparently.

To keep backward compatibility, new DBUS messages are added.
2021-10-28 10:47:46 +01:00
Luca Boccassi
df61e79a5d core: make DynamicUser=1 and StateDirectory= work with TemporaryFileSystem=/var/lib
The /var/lib/private/foo -> /var/lib/foo symlink for StateDirectory and
DynamicUser is set up on the host filesystem, before the mount namespacing
is brought up. If an empty /var/lib is used, to ensure the service does not
see other services data, the symlink is then not available despite
/var/lib/private being set up as expected.

Make a list of symlinks that need to be set up, and create them after all
the namespaced filesystems have been created, but before any eventual
read-only switch is flipped.
2021-10-27 22:45:26 +01:00
Frantisek Sumsal
cd37793d28 test: add a missing udevadm settle to the multipath test case
8a088877ab uncovered a missing `udevadm
settle` in the multipath test case, causing the test to occasionally
fail with:

```
[   41.718617] testsuite-64.sh[806]: + for i in {0..63}
[   41.727917] systemd-udevd[1120]: sdhf: /usr/lib/udev/rules.d/60-persistent-storage.rules:66 Importing properties from results of 'scsi_id --export --whitelisted -d /dev/sdhf'
[   41.728668] testsuite-64.sh[2341]: ++ printf %.4d 1
[   41.733851] systemd-udevd[1415]: sdhc: Adding watch on '/dev/sdhc'
[   41.734477] testsuite-64.sh[806]: + wwid=deaddeadbeef0001
[   41.734477] testsuite-64.sh[806]: + path=/dev/disk/by-id/wwn-0xdeaddeadbeef0001
[   41.746174] systemd-udevd[1409]: sdhb: 'scsi_id --export --whitelisted -d /dev/sdhb'(out) 'ID_MODEL_ENC=QEMU\x20HARDDISK\x20\x20\x20'
[   41.747058] testsuite-64.sh[2342]: ++ readlink -f /dev/disk/by-id/wwn-0xdeaddeadbeef0001
[   41.755512] testsuite-64.sh[806]: + dmpath=/dev/sdi
[   41.755512] testsuite-64.sh[806]: + lsblk /dev/disk/by-id/wwn-0xdeaddeadbeef0001
[   41.766884] systemd-udevd[1402]: sdhd: 'scsi_id --export --whitelisted -d /dev/sdhd'(out) 'ID_VENDOR=QEMU'
[   41.767532] testsuite-64.sh[2343]: NAME MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
[   41.767532] testsuite-64.sh[2343]: sdi    8:128  0  512B  0 disk
[   41.779219] systemd-udevd[1400]: dm-33: 'kpartx_id 254 33 mpath-3deaddeadbeef0051'(out) 'DM_WWN=0xdeaddeadbeef0051'
[   41.779902] testsuite-64.sh[806]: + multipath -C /dev/sdi
[   41.785296] systemd-udevd[1414]: dm-31: Device processed (SEQNUM=4839, ACTION=change)
[   41.785925] testsuite-64.sh[2344]: 37.658168 | /dev/sdi is not a dm device
```
2021-10-27 02:23:55 +09:00
Yu Watanabe
caad88a22b test-network: add test cases for DHCPv6 prefix delegation 2021-10-26 20:43:10 +09:00
Yu Watanabe
dc5cae6c9d network: dhcp6: introduce UplinkInterface= for DHCP6 prefix delegation 2021-10-26 20:43:10 +09:00
Yu Watanabe
0f5ef9b62a network: dhcp6: introduce UseDelegatedPrefix= setting and enable by default
Previously, the prefix delegation is enabled when at least one
downstream interfaces request it. But, when the DHCPv6 client on the
upstream interface is configured, some downstream interfaces may not
exist yet, nor have .network file assigned.

Also, if a system has thousands of interfaces, then the previous logic
introduce O(n^2) search.

This makes the prefix delegation is always enabled, except when it is
explicitly disabled. Hopefully, that should not break anything, as the
DHCPv6 server should ignore the prefix delegation request if the server
do not have any prefix to delegate.
2021-10-26 20:29:08 +09:00
Yu Watanabe
adef6d089b
Merge pull request #21122 from yuwata/network-optimize-reload
network: slightly optimize "networkctl reload"
2021-10-26 15:55:01 +09:00
Yu Watanabe
5b47f35d0e test-network: reconfigure interface instead of restarting networkd 2021-10-26 08:20:29 +09:00
Yu Watanabe
8a088877ab test: enable debug logging of systemd-udevd
Otherwise, it is hard to debug when the test fails.
2021-10-26 08:12:10 +09:00
Frantisek Sumsal
35382a9da3 test: merge coverage reports from previous test runs
Relevant mainly for tests which utilize both QEMU and nspawn.
2021-10-25 11:35:47 +02:00
Frantisek Sumsal
e70103e2d4 test: tweak TriggerLimitIntervalSec= when built with coverage
Collecting coverage causes a significant slowdown in general, but since
this test requires certain timing, we need to tweak the defaults to make
it reliably pass.
2021-10-25 11:02:22 +02:00
Frantisek Sumsal
d2a39812fd test: rename the global service override file for coverage runs
Otherwise we break TEST-15-DROPIN, since it uses
/usr/lib/systemd/system/service.d/override.conf in some of its
sub-tests.
2021-10-23 22:10:24 +02:00
Frantisek Sumsal
035af7adfe test: disable ProtectHome= when collecting coverage as well
Depending on the location of the original build dir, either ProtectHome=
or ProtectSystem= may get in the way when creating the gcov metadata
files.

Follow-up to:
    * 02d7e73013
    * 6c9efba677
2021-10-23 21:27:20 +02:00
Frantisek Sumsal
7a6c5b6ab5 test: make the coverage check safer for non-compiled builds 2021-10-21 18:34:21 +02:00
Frantisek Sumsal
9bc10d3109 test: collect the coverage _before_ unmounting the rootfs
d'oh!
2021-10-21 18:12:06 +02:00
Frantisek Sumsal
02d7e73013 test: loosen sandbox restrictions for integration tests as well
Otherwise we miss quite a lot of coverage (mainly from logind,
hostnamed, networkd, and possibly others), since they can't write their
reports with `ProtectSystem=strict`.
2021-10-21 18:06:36 +02:00
Frantisek Sumsal
6c9efba677 test: loosen certain sandbox restrictions when collecting coverage
With `ProtectSystem=strict` gcov is unable to write the *.gcda files
with collected coverage. Let's add a yet another switch to make such
restriction less strict to make gcov happy.

This addresses following errors:
```
...
systemd-networkd[272469]: profiling:/systemd-meson-build/src/shared/libsystemd-shared-249.a.p/binfmt-util.c.gcda:Cannot open
systemd-networkd[272469]: profiling:/systemd-meson-build/src/shared/libsystemd-shared-249.a.p/base-filesystem.c.gcda:Cannot open
systemd-networkd[272469]: profiling:/systemd-meson-build/src/shared/libsystemd-shared-249.a.p/barrier.c.gcda:Cannot open
systemd-networkd[272469]: profiling:/systemd-meson-build/src/shared/libsystemd-shared-249.a.p/ask-password-api.c.gcda:Cannot open
systemd-networkd[272469]: profiling:/systemd-meson-build/src/shared/libsystemd-shared-249.a.p/apparmor-util.c.gcda:Cannot open
systemd-networkd[272469]: profiling:/systemd-meson-build/src/shared/libsystemd-shared-249.a.p/acpi-fpdt.c.gcda:Cannot open
...
```
2021-10-21 17:36:45 +02:00
Frantisek Sumsal
dded88acb9 test: wait a bit for the given PID to die if it's still alive
When playing around with the coverage-enabled build I kept hitting
an issue where dnsmasq failed to start because the previous instance was
still shutting down. This should, hopefully, help to mitigate that.
2021-10-21 15:59:57 +02:00
Frantisek Sumsal
140557021a test: don't install test-network-generator-conversion.sh w/o networkd
otherwise TEST-02 will fail:

```
=== Failed test log ===
--- test-network-generator-conversion.sh begin ---
+ [[ -n '' ]]
+ [[ -x /usr/lib/systemd/systemd-network-generator ]]
+ [[ -x /lib/systemd/systemd-network-generator ]]
+ exit 1
--- test-network-generator-conversion.sh end ---
```

Before:
```
$ meson build -Dnetworkd=false -Dinstall-tests=true
$ ninja -C build
$ DESTDIR=$PWD/test-install ninja -C build install
$ find test-install/ -name test-network-generator-conversion.sh
test-install/usr/lib/systemd/tests/test-network-generator-conversion.sh
```

After:
```
$ find test-install/ -name test-network-generator-conversion.sh
<no output>
```
2021-10-20 22:04:45 +01:00
Frantisek Sumsal
0b5fe54ff5 test: collect coverage in a couple more codepaths
Otherwise we'd miss coverage from TEST-{02,24,61}, since they don't go
through the "standard" `check_result_common` hook.

Follow-up to 7bf20e48bd.
2021-10-20 16:46:58 +01:00
Dimitri Papadopoulos
ba669952b2 Typos found by codespell 2021-10-20 22:20:18 +09:00
Yu Watanabe
a4a1385e07 test-network: cleanup dnsmasq related file on setup
Just for safety.
2021-10-20 03:49:05 +09:00
Yu Watanabe
888f57c11c test-network: drop pid_file argument from stop_dnsmasq() 2021-10-20 03:49:05 +09:00
Yu Watanabe
ed08ed4a45 test-network: use constant variables in dnsmasq command 2021-10-20 03:49:05 +09:00
Zbigniew Jędrzejewski-Szmek
721700df3c TEST-06-SELINUX: add the usual spdx license header to policy files 2021-10-18 09:43:18 +02:00
Zbigniew Jędrzejewski-Szmek
1d9a1215e8 gitattributes: introduce and use "generated" attribute
I want to mark some files to be ignored for licensing purposes,
e.g. output from fuzzers and other samples. By using the gitattribute
machinery for this we don't need to design a custom protocol:

$ git check-attr generated test/test-sysusers/unhappy-*
test/test-sysusers/unhappy-1.expected-err: generated: set
test/test-sysusers/unhappy-1.input: generated: unspecified
test/test-sysusers/unhappy-2.expected-err: generated: set
test/test-sysusers/unhappy-2.input: generated: unspecified
test/test-sysusers/unhappy-3.expected-err: generated: set
test/test-sysusers/unhappy-3.input: generated: unspecified
2021-10-18 09:42:55 +02:00
Zbigniew Jędrzejewski-Szmek
546e57f51b gitattributes: mark more files as "binary"
This way we know that we shouldn't look for a spdx header in them.
2021-10-18 09:40:35 +02:00
Zbigniew Jędrzejewski-Szmek
d632e6fe3b tests: use !/usr/bin/env bash consistently
This adjustment was last done in f96bc66901,
but it seems some files were missed and some were added later.
2021-10-18 09:04:45 +02:00
Zbigniew Jędrzejewski-Szmek
7b3cec95db tests: add spdx headers to scripts and Makefiles 2021-10-18 09:04:45 +02:00
Zbigniew Jędrzejewski-Szmek
22d3cfe54c tests: add spdx license header to test unit/link/network/conf files
Those are all consumed by our parser, so they all support comments.
I was considering whether they should have a license header at all,
but in the end I decided to add it because those files are often created
by copying parts of real unit files. And if the real ones have a license,
then those might as well. It's easier to add it than to make an exception.
2021-10-18 09:04:45 +02:00
Zbigniew Jędrzejewski-Szmek
7b84e701a8 gitattributes: mark fuzz inputs that are pure binary as such
We also have a bunch of files that have some bytes and a lot
of text, like the journal export format. For those, it is still quite
useful when the tools try to diff them, so let's not mark those.
2021-10-18 09:04:45 +02:00
Zbigniew Jędrzejewski-Szmek
6b292fa17b
Merge pull request #20996 from yuwata/udevadm-trigger-debug
test: show debug and verbose message
2021-10-15 09:44:59 +02:00
Zbigniew Jędrzejewski-Szmek
df618f259a
Merge pull request #20987 from yuwata/sd-dhcp6-enum-cleanups
sd-dhcp6-client: enum cleanups
2021-10-13 08:25:37 +02:00
Yu Watanabe
6870cf0729 test: show debug and verbose message 2021-10-13 12:58:24 +09:00
Anita Zhang
0b4f8d9498 core: serialize device cgroup bpf progs across daemon-reload/reexec
Follows what was done in b57d752326 and
adds a test that verifies the device BPF program is not detached during
reload/reexec.
2021-10-13 11:13:56 +09:00
Yu Watanabe
308d01f3c4 network: do not request RAPID_COMMIT option
The option must not be included in OPTION_REQUEST option.
See the "Client ORO" field in
https://www.iana.org/assignments/dhcpv6-parameters/dhcpv6-parameters.xhtml#dhcpv6-parameters-2

This deprecates RapidCommit= setting. Note that sd-dhcp6-client always
sets the RAPID_COMMIT option in the solicit message.
2021-10-13 02:46:24 +09:00
Dimitri John Ledkov
af7fb6831f test: set 5 minute timeout on TEST-11-ISSUE-3166 and TEST-50-DISSECT
When they work they finish quickly in under two minutes on slow machines, when
soft lock ups happen in the nested virt machine each test can run for like 5
hours clogging up CI infrastructure. It's best to fail quicker than that when
qemu or kernel are broken.
2021-10-09 18:31:27 +01:00
Yu Watanabe
6830c3a553
Merge pull request #20778 from yuwata/network-ipv6-token
network: rework IPv6 address generation mode
2021-10-07 23:24:00 +09:00
Luca Boccassi
c9d1c37c93 test: make OpenSSL checks optional in TEST-50-DISSECT
If the packages are built without libssl simply skip the signature
checks.

Oct 06 21:21:32 H systemd[1]: systemd 249.1249.gcc4df1f787.0 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS -OPENSSL
...
Oct 06 21:22:21 H systemd[459]: Activation of signed Verity volume worked neither via the kernel nor in userspace, can't activate.

Follow-up for #20691
2021-10-07 08:41:33 +02:00
Luca Boccassi
0cf250022c
Merge pull request #20926 from yuwata/udev-net-wol-sopass
udev/net: introduce WakeOnLanPassword=
2021-10-06 23:36:05 +01:00
Frantisek Sumsal
f415cdb372 test: test udev with a _very_ long device name
Let's attempt to provide some coverage for #16161, #6867, and similar.
2021-10-07 03:17:44 +09:00
Yu Watanabe
d489317f59
Merge pull request #20935 from unusual-thoughts/fix-empty-argv
Fix #20933
2021-10-07 01:53:51 +09:00
Yu Watanabe
d3867133f0 udev/net: introduce WakeOnLanPassword=
Closes #20913.
2021-10-07 01:50:37 +09:00
Yu Watanabe
fe2a8b3d3f test-network: add tests for Token= in [IPv6Prefix] 2021-10-07 01:24:50 +09:00
Yu Watanabe
b48b6bd3b9 test-network: replace deprecated settings 2021-10-07 01:24:50 +09:00
Yu Watanabe
e609cd0694 network: introduce Token= setting in [IPv6Prefix]
Closes #20149.
2021-10-07 01:24:50 +09:00
Yu Watanabe
a73628e647 network: rename IPv6Token= in [Network] -> Token= in [IPv6AcceptRA]
The token is only used by received prefixes through RA.
2021-10-07 01:16:36 +09:00
Iago López Galeiras
e59ccd035c core: add RestrictFileSystems= fragment parser
It takes an allow or deny list of filesystems services should have
access to.
2021-10-06 10:52:14 +02:00
Henri Chain
29500cf8c4 core: fix SIGABRT on empty exec command argv
This verifies that the argv part of any exec_command parameters that
are sent through dbus is not empty at deserialization time.

There is an additional check in service.c service_verify() that again
checks if all exec_commands are correctly populated, after the service
has been loaded, whether through dbus or otherwise.

Fixes #20933.
2021-10-06 00:16:47 +09:00
Anita Zhang
a2ae2ba2ff
Merge pull request #20892 from yuwata/test-network-preferred-lifetime-zero
network: drop and warn duplicated address settings
2021-10-04 18:40:59 -07:00