shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2024-12-23 17:34:00 +03:00
Code
44,680 Commits 36 Branches 651 Tags 227 MiB
45c5fa253a
Commit Graph

2171 Commits

Author SHA1 Message Date
Lennart Poettering
f54353406a update TODO 2018-11-16 14:54:13 +01:00
Lennart Poettering
899feb7225 man: let's deprecate PermissionsStartOnly= 
The concept is redundant and predates the special chars that do the same
in ExecStar=. Let's settle on advertising just the latter, and hide
PermissionsStartOnly= from the docs (even if we continue supporting it).
 2018-11-16 14:31:37 +01:00
Lennart Poettering
8a7cf15733 update TODO 2018-11-14 17:01:55 +01:00
Lennart Poettering
06bd149a71 update TODO 2018-11-13 23:48:53 +01:00
Lennart Poettering
d49881a06a update TODO 2018-11-12 18:57:52 +01:00
Lennart Poettering
cd0504a395 update TODO 2018-11-12 17:44:46 +01:00
Lennart Poettering
bc137cf45d update TODO 2018-11-12 11:44:02 +01:00
Lennart Poettering
7685329311 TODO 2018-11-09 17:15:34 +01:00
Lennart Poettering
a57e48a133
Merge pull request #10415 from poettering/boot-loader-spec-tweaks 
docs: tweaks to the boot loader spec
 2018-10-22 15:15:45 +02:00
Lennart Poettering
d3584ec472 update TODO 2018-10-19 22:49:42 +02:00
Lennart Poettering
42e1808890 update TODO 2018-10-19 22:34:50 +02:00
Lennart Poettering
c0815ca93d
Merge pull request #10407 from yuwata/netlink-slot 
sd-netlink: introduce sd_netlink_slot object and relevant functions
 2018-10-18 18:05:58 +02:00
Lennart Poettering
a42984dbc7
Merge pull request #10428 from keszybz/failure-actions 
Implement manager status changes using SuccessAction=
 2018-10-17 21:29:10 +02:00
Zbigniew Jędrzejewski-Szmek
d85515edcf units: use SuccessAction=reboot-force in systemd-reboot.service 2018-10-17 19:31:50 +02:00
Zbigniew Jędrzejewski-Szmek
54fcb6192c core: define "exit" and "exit-force" actions for user units and only accept that 
We would accept e.g. FailureAction=reboot-force in user units and then do an
exit in the user manager. Let's be stricter, and define "exit"/"exit-force" as
the only supported actions in user units.

v2:
- rename 'exit' to 'exit-force' and add new 'exit'
- add test for the parsing function
 2018-10-17 19:31:49 +02:00
Lennart Poettering
d3aeddb8d1 update TODO 2018-10-16 16:33:55 +02:00
Yu Watanabe
7a223c2e38 update TODO 2018-10-16 19:21:15 +09:00
Lennart Poettering
0689812331 update TODO 2018-10-13 13:01:08 +02:00
Lennart Poettering
0f78c4dbe4 update TODO 2018-10-12 12:26:29 +02:00
Zbigniew Jędrzejewski-Szmek
dd76367d3b
Merge pull request #10307 from poettering/portable-path 
finishing touches to portable services, and let's move portablectl to /usr/bin to make it official
 2018-10-09 14:58:22 +02:00
Lennart Poettering
1634ebb54a
Merge pull request #10262 from keszybz/hibres-disable 
Switches to disable hibernation and/or resuming
 2018-10-08 21:39:54 +02:00
Lennart Poettering
42d0958195 update TODO 2018-10-08 18:49:45 +02:00
Zbigniew Jędrzejewski-Szmek
9259d0e23e TODO: remove entry 
Swap on luks works great. Nothing to do here.
 2018-10-08 18:21:00 +02:00
Zbigniew Jędrzejewski-Szmek
e8f1d00d69 shared/sleep-config: add switches to kill specific sleep modes 
/etc/systemd/sleep.conf gains four new switches:
AllowSuspend=, AllowHibernation=, AllowSuspendThenHibernate=, AllowHybridSleep=.

Disabling specific modes was already possible by masking suspend.target,
hibernate.target, suspend-then-hibernate.target, or hybrid-sleep.target.
But this is not convenient for distributions, which want to set some defaults
based on what they want to support. Having those available as configuration
makes it easy to put a config file in /usr/lib/systemd/sleep.conf.d/ that
overrides the defaults and gives instructions how to undo that override.
 2018-10-08 18:21:00 +02:00
Zbigniew Jędrzejewski-Szmek
e83419d043 hib-res-generator: add "noresume" 
This is an override parameter, to totally skip dehiberanation.
 2018-10-08 16:06:16 +02:00
Lennart Poettering
1384653e71 update TODO 2018-10-02 18:00:10 +02:00
Zbigniew Jędrzejewski-Szmek
0f0159e313
Merge pull request #10252 from poettering/recv-log-msg-bump 
tiny sd-ravd/sd-ndisc logging fixes
 2018-10-02 17:56:31 +02:00
Lennart Poettering
876449bb47 update TODO 2018-10-02 16:28:06 +02:00
Zbigniew Jędrzejewski-Szmek
65d410c7ca sd-id128: add sd_id128_get_boot_app_specific() 2018-10-02 15:15:10 +02:00
Lennart Poettering
328756170e update TODO 2018-09-27 17:11:40 +02:00
Lennart Poettering
7c428bb5d5
Merge pull request #10059 from yuwata/env-exec-directory 
core: introduce $RUNTIME_DIRECTORY= or friends
 2018-09-25 12:34:30 +02:00
Lennart Poettering
bd1b3f75e8 update TODO 2018-09-24 19:25:49 +02:00
Zbigniew Jędrzejewski-Szmek
32397af3d4
Merge pull request #9928 from yuwata/libudev-cleanups 
libudev: coding style updates
 2018-09-15 22:36:38 +02:00
Zbigniew Jędrzejewski-Szmek
1327f272d3
Merge pull request #9920 from yuwata/udev-cleanup-4 
udev: drop unused udev structs and use verbs in udevadm
 2018-09-14 10:05:59 +02:00
Yu Watanabe
fb2042dd55 core: add new environment variable $RUNTIME_DIRECTORY= or friends 
The variable is generated from RuntimeDirectory= or friends.
If multiple directories are set, then they are concatenated with
the separator ':'.
 2018-09-13 17:02:58 +09:00
Lennart Poettering
c633b0a642 update TODO 2018-09-12 21:39:14 +02:00
Yu Watanabe
8aae9a66fa sd-device,libudev: make an argument for *_set_sysattr_value() const 2018-09-11 12:45:21 +09:00
Yu Watanabe
a168792c2d udev: drop collect 2018-09-10 18:27:36 +09:00
Yu Watanabe
0de4876496 core/socket: fix memleak in the error paths in usbffs_dispatch_eps() 2018-09-03 14:25:08 +09:00
Yu Watanabe
f069ebfadd TODO: drop duplicated entry 2018-09-03 14:21:13 +09:00
Lennart Poettering
20d4b10116 update TODO 2018-08-10 16:20:48 +02:00
Lennart Poettering
af560fc1da update TODO 2018-08-03 16:41:42 +02:00
Lennart Poettering
126708fa02 update TODO 2018-07-26 16:55:27 +02:00
Lennart Poettering
7bd4bcf740 update TODO 2018-07-25 22:48:11 +02:00
Lennart Poettering
65617ad82b update TODO 2018-07-25 12:31:50 +02:00
Lennart Poettering
a33ffd1505 update TODO 2018-07-20 16:38:53 +02:00
Lennart Poettering
4e8113bbbe update TODO 2018-06-20 23:59:29 +02:00
Zbigniew Jędrzejewski-Szmek
36ee2ececc
Merge pull request #9199 from poettering/copy-file-atomic 
make copy_file_atomic() use O_TMPFILE to create the destination file
 2018-06-14 11:19:22 +02:00
Lennart Poettering
6ca4803e5f update TODO 2018-06-07 18:20:42 +02:00
Lennart Poettering
ec6bdf7259 copy: rework copy_file_atomic() to copy the specified file via O_TMPFILE if possible 2018-06-07 17:40:14 +02:00
Lennart Poettering
c640710883 update TODO 
The three ancient entries marked "bugfixes" are already fixed (in two
cases), or are not really bugs (in the other case). Let's clean this up
a bit.
 2018-06-07 17:36:01 +02:00
Lennart Poettering
bb527e1137 update TODO 2018-06-07 15:29:17 +02:00
Zbigniew Jędrzejewski-Szmek
6585f72c08
Merge pull request #9121 from poettering/sd-event-inotify 
add "sd_event_add_inotify()" and use it for making PID 1 rescheduler .timer units properly on timezone change
 2018-06-06 12:38:55 +02:00
Lennart Poettering
1627069766 update TODO 2018-06-06 11:44:58 +02:00
Lennart Poettering
cd710e6ab9 update TODO 2018-06-06 10:55:45 +02:00
Yu Watanabe
b613b01920 doc: update TODO 2018-05-31 17:39:13 +09:00
Lennart Poettering
499488071c update TODO 2018-05-29 11:40:49 +02:00
Lennart Poettering
8c4c2dfca9 update TODO 2018-05-24 17:02:23 +02:00
Zbigniew Jędrzejewski-Szmek
17c1b9a93f
Merge pull request #9024 from poettering/nspawn-attrs-more 
make even more nspawn concepts configurable
 2018-05-24 16:27:27 +02:00
Lennart Poettering
72d711efa3 update TODO 2018-05-22 16:21:26 +02:00
Yu Watanabe
c9f620bfec core: support unit specifiers in IODeviceWeight= and friends 2018-05-20 23:08:50 +09:00
Lennart Poettering
c7db2a9de4 update TODO 2018-05-03 17:46:31 +02:00
Lennart Poettering
4db688e0cc update TODO 2018-05-03 15:13:42 +02:00
Lennart Poettering
c46d15e398 update TODO 2018-04-27 21:52:45 +02:00
Lennart Poettering
8a97ff0e64 update TODO 2018-04-27 14:29:06 +02:00
Lennart Poettering
e44924f5c1 update TODO 2018-04-24 15:58:31 +02:00
Lennart Poettering
070d0ac9cf update TODO 2018-04-20 20:01:08 +02:00
Lennart Poettering
5da19043f1 update TODO 2018-04-18 12:52:20 +02:00
Lennart Poettering
7bc756ff00 update TODO 2018-04-12 11:02:47 +02:00
Lennart Poettering
0bb8dfaa53 update TODO 2018-04-05 13:07:31 +02:00
Lennart Poettering
53c70a2706 update TODO 2018-04-03 15:22:25 +02:00
Lennart Poettering
d9b50610e4 update TODO 2018-03-28 22:03:34 +02:00
Lennart Poettering
0ba6791f46
Merge pull request #8368 from yuwata/nss-systemd-getpwent 
nss-systemd: make dynamic users enumerable by `getent`
 2018-03-21 12:36:47 +01:00
Lennart Poettering
4526113f57 dissect: add dissect_image_and_warn() that unifies error message generation for dissect_image() (#8517) 2018-03-21 12:10:01 +01:00
Yu Watanabe
23e6c10bbe doc: update TODO 2018-03-21 13:39:16 +09:00
Yu Watanabe
3b85dace6d doc: update TODO 2018-03-20 00:44:41 +09:00
Zbigniew Jędrzejewski-Szmek
20d52ab60e shared/conf-parser: fix crash when specifiers cannot be resolved in config_parse_device_allow() 
oss-fuzz #6885.
 2018-03-14 16:50:08 +01:00
Zbigniew Jędrzejewski-Szmek
0d032da993 TODO: trim obsolete entries 
set -e is now used in test/TEST-*/test.sh, BUILD_DIR may be specified,
and symlinks are created as of ba7f4ae617.
 2018-03-14 16:37:09 +01:00
Lennart Poettering
cb77e12288 update TODO 2018-03-02 16:26:03 +01:00
Lennart Poettering
9711b1adc7 update TODO 2018-03-01 15:30:24 +01:00
Lennart Poettering
902c8502ad
Merge pull request #8149 from poettering/fake-root-cgroup 
Properly synthesize CPU+memory accounting data for the root cgroup
 2018-03-01 11:10:24 +01:00
Zbigniew Jędrzejewski-Szmek
8f7cbe730a TODO: drop one item 
C.f. 7cb609115c.
 2018-02-20 17:25:05 +01:00
Zbigniew Jędrzejewski-Szmek
730f40eb57 Merge pull request #8184 from poettering/color-ask-pw 
Trivial merge conflict resolved locally.
 2018-02-15 17:14:59 +01:00
Lennart Poettering
6b7b0f3947 update TODO 2018-02-14 14:28:00 +01:00
Lennart Poettering
1e78432157 update TODO 2018-02-12 11:34:00 +01:00
Lennart Poettering
972d4398bd update TODO 2018-02-09 19:43:35 +01:00
Lennart Poettering
0d5456556f update TODO 2018-01-31 19:54:25 +01:00
Lennart Poettering
aa79f93268 update TODO 2018-01-25 14:14:35 +01:00
Zbigniew Jędrzejewski-Szmek
f26f5b60d0 Merge pull request #7915 from poettering/pids-max-tweak 2018-01-25 10:24:35 +01:00
Lennart Poettering
1a58b91079 update TODO 2018-01-23 21:29:31 +01:00
Lennart Poettering
8dba4c60e2
Merge pull request #7952 from poettering/tmpfiles-tweaks 
Some tmpfiles tweaks
 2018-01-22 20:33:40 +01:00
Lennart Poettering
3420075adf update TODO 2018-01-22 16:26:55 +01:00
Reverend Homer
8ac8c411d7 remove canonicalize_file_name() mention from TODO 
canonicalize_file_name() invocations were replaced by chase_symlinks() in
Decemeber 2016 with PR #4694, so we don't need this mention in the TODO anymore
 2018-01-22 15:49:45 +01:00
Lennart Poettering
586a8e93a0 update TODO 2018-01-22 15:33:26 +01:00
Lennart Poettering
d93f4df40a update TODO 2018-01-11 15:10:29 +01:00
Lennart Poettering
c3cd7cc929 update TODO 2018-01-05 13:59:12 +01:00
Lennart Poettering
46099c9e36 update TODO 2018-01-04 13:28:24 +01:00
Yu Watanabe
5543b2b2c9
Merge pull request #7745 from poettering/sockaddr-size 
mostly systemd-analyze fixes
 2017-12-29 23:13:53 +09:00
Lennart Poettering
6c6d285fbe update TODO 2017-12-26 16:04:10 +01:00
Lennart Poettering
bce40de9d7 update TODO 2017-12-25 11:48:21 +01:00
Yu Watanabe
69ec5decf0 TODO: update 2017-12-15 09:11:54 +09:00
Zbigniew Jędrzejewski-Szmek
590171d1c9 Update TODO 2017-12-14 22:14:39 +01:00
Lennart Poettering
38edd43d48 update TODO 2017-12-07 12:34:46 +01:00
Lennart Poettering
fa75683700 update TODO 2017-12-06 13:40:50 +01:00
Michael Biebl
35ccaf9332
Merge pull request #7481 from poettering/bpf-test-fix 
bpf-firewall: actually invoke BPF_PROG_ATTACH to check whether cgroup/bpf is available
 2017-12-01 13:52:32 +01:00
Lennart Poettering
0634585890 update TODO 2017-11-29 20:15:23 +01:00
Lennart Poettering
c6009ff029 update TODO 2017-11-29 20:12:26 +01:00
Lennart Poettering
67ca6412ab update TODO 2017-11-27 17:04:04 +01:00
Lennart Poettering
48f1b5e51d update TODO 2017-11-25 17:08:21 +01:00
Zbigniew Jędrzejewski-Szmek
ffb70e4424
Merge pull request #7381 from poettering/cgroup-unified-delegate-rework 
Fix delegation in the unified hierarchy + more cgroup work
 2017-11-22 07:42:08 +01:00
Lennart Poettering
5962e9db5e update TODO 2017-11-21 11:54:08 +01:00
Lennart Poettering
9a92a97a94 update TODO 2017-11-20 16:37:22 +01:00
Lennart Poettering
4154ce8a85 update TODO 2017-11-20 10:57:41 +01:00
Lennart Poettering
0133d5553a
Merge pull request #7198 from poettering/stdin-stdout 
Add StandardInput=data, StandardInput=file:... and more
 2017-11-19 19:49:11 +01:00
Lennart Poettering
3d80d4541b update TODO 2017-11-17 11:25:02 +01:00
Lennart Poettering
370f9c21b9 update TODO 2017-11-17 11:13:44 +01:00
Lennart Poettering
2368e9748a update TODO 2017-11-16 14:38:36 +01:00
Zbigniew Jędrzejewski-Szmek
5427b6afdb Update TODO 2017-11-15 22:58:24 +01:00
Lucas Werkmeister
3e6b74e885 Remove TODO entry (#7326) 
This was documented in b0e8cec2dd (#7317).
 2017-11-14 10:57:54 +01:00
Lennart Poettering
e7e4a2584f update TODO 2017-11-13 10:24:03 +01:00
Lennart Poettering
17b6f896b4 update TODO 2017-11-12 14:27:25 +01:00
Zbigniew Jędrzejewski-Szmek
ecd9ded89b
Merge pull request #6996 from poettering/discover-block-device 
add nspawn image discovery on block devices
 2017-10-30 16:05:20 +01:00
Lennart Poettering
1c8ac41c65 update TODO 2017-10-26 18:01:28 +02:00
Lennart Poettering
3992bce17f update TODO 2017-10-26 17:54:56 +02:00
Zbigniew Jędrzejewski-Szmek
0c2826c60c core: in --user mode, report READY=1 as soon as basic.target is reached (#7102) 
When a user logs in, systemd-pam will wait for the user manager instance to
report readiness. We don't need to wait for all the jobs to finish, it
is enough if the basic startup is done and the user manager is responsive.

systemd --user will now send out a READY=1 notification when either of two
conditions becomes true:
- basic.target/start job is gone,
- the initial transaction is done.

Also fixes #2863.
 2017-10-24 14:48:54 +02:00
Michal Sekletar
6e2d7c4f13 namespace: fall back gracefully when kernel doesn't support network namespaces (#7024) 2017-10-10 09:46:13 +02:00
Lennart Poettering
6fc373ee43 update TODO 2017-10-09 15:22:45 +02:00
Zbigniew Jędrzejewski-Szmek
83fefc8888 man: explain precedence for options which take a list (#7010) 
Hopefully finally fixes #6639.
 2017-10-06 10:04:49 +02:00
Lennart Poettering
195c2c7fac update TODO 2017-10-02 17:41:44 +02:00
Lennart Poettering
fa991fb72b add some more things to TODO 2017-09-28 11:26:11 +02:00
Lennart Poettering
81f84b33da update TODO 2017-09-26 18:00:38 +02:00
Jan Synacek
0cde65e263 test-cpu-set-util.c: fix typo in comment (#6916) 2017-09-26 16:07:34 +02:00
Lennart Poettering
620218fbd9 update TODO 2017-09-23 11:08:57 +02:00
Lennart Poettering
22c8321b09 update TODO 2017-09-22 15:28:05 +02:00
Lennart Poettering
bff8f2543b units: set LockPersonality= for all our long-running services (#6819) 
Let's lock things down. Also, using it is the only way how to properly
test this to the fullest extent.
 2017-09-14 19:45:40 +02:00
Lennart Poettering
9492c16031 TODO: Drop even more redundant and implemented items 2017-09-14 11:21:24 +02:00
Lennart Poettering
09624cee53 TODO: remove some items that are implemented now or otherwise obsolete 2017-09-14 11:08:59 +02:00
Lennart Poettering
5dca7739e8 run: add new --pipe option for including "systemd-run" commands in shell pipelines 
In this mode, we'll directly connect stdin/stdout/stderr of the invoked
service with whatever systemd-run itself is invoked on. This allows
inclusion of "systemd-run" commands in shell pipelines, as unlike
"--pty" this means EOF of stdin/stdout/stderr are propagated
independently.

If --pty and --pipe are combined systemd-run will automatically pick the
right choice for the context it is invoked in, i.e. --pty when invoked
on a TTY, and --pipe otherwise.
 2017-09-12 16:28:12 +02:00
Lennart Poettering
e8deb9486f update TODO 2017-08-31 18:30:16 +02:00
Yu Watanabe
d7bdedae87 TODO: update 2017-08-31 18:37:22 +09:00
Lennart Poettering
f8d8c6bc90 update TODO 2017-08-30 12:21:46 +02:00
Lennart Poettering
1d9c3c7477 update TODO 2017-08-30 10:50:01 +02:00
Zbigniew Jędrzejewski-Szmek
a132bef023 Drop kdbus bits 
Some kdbus_flag and memfd related parts are left behind, because they
are entangled with the "legacy" dbus support.

test-bus-benchmark is switched to "manual". It was already broken before
(in the non-kdbus mode) but apparently nobody noticed. Hopefully it can
be fixed later.
 2017-07-23 12:01:54 -04:00
Lennart Poettering
d73b607d0f update TODO 2017-07-10 18:25:58 +02:00
Lennart Poettering
fd63f36c02 update TODO 2017-04-24 18:48:10 +02:00
Lennart Poettering
5e806f453d update TODO 2017-02-28 17:22:14 +01:00
Martin Pitt
f4ad4d658d Merge pull request #5491 from poettering/hwdb-update-v233 
hwbd: update once again for 233
 2017-02-28 16:52:46 +01:00
Lennart Poettering
fe6a023501 update TODO 2017-02-28 15:24:10 +01:00
Lennart Poettering
6fd1a2918d update TODO 2017-02-28 15:20:22 +01:00
Zbigniew Jędrzejewski-Szmek
fc6149a6ce Merge pull request #4962 from poettering/root-directory-2 
Add new MountAPIVFS= boolean unit file setting + RootImage=
 2017-02-08 23:05:05 -05:00
Lennart Poettering
b8076e3d06 update TODO 2017-02-08 22:21:27 +01:00
Lennart Poettering
08fe86d5be update TODO 2017-02-07 12:21:29 +01:00
Evgeny Vereshchagin
1fb8579749 Merge pull request #5239 from poettering/notify-access-all 
man: document that sd_notify() is racy in some cases
 2017-02-06 23:59:33 +03:00
Lennart Poettering
6a1da642b3 update TODO 2017-02-06 21:14:31 +01:00
Lennart Poettering
33bac67b48 update TODO 2017-02-06 20:26:33 +01:00
Lennart Poettering
d543b9f586 update TODO 2017-02-06 18:37:28 +01:00
Lennart Poettering
3576dddf27 update TODO 2017-02-06 13:49:40 +01:00
Lennart Poettering
1d0106996c update TODO 2017-02-01 20:02:17 +01:00
Zbigniew Jędrzejewski-Szmek
6b3d378331 Merge pull request #4879 from poettering/systemd 2017-01-14 21:29:27 -05:00
Lennart Poettering
08422e63b2 update TODO 2016-12-21 19:09:32 +01:00
Lennart Poettering
8eb7383ba8 update TODO 2016-12-14 18:30:05 +01:00
Lennart Poettering
f59d1da8cd update TODO 2016-12-14 00:55:12 +01:00
Lennart Poettering
280b29ac84 Merge pull request #4861 from keszybz/dissect-tweaks 
A prettification of the dissect code, mkosi and TODO updates
 2016-12-11 20:09:04 +01:00
Zbigniew Jędrzejewski-Szmek
347a17d553 TODO: add dissect section 2016-12-10 01:41:50 -05:00
Zbigniew Jędrzejewski-Szmek
1ac7a93574 Merge pull request #4835 from poettering/unit-name-printf 
Various specifier resolution fixes.
 2016-12-10 01:29:52 -05:00
Reverend Homer
8fb3f00997 tree-wide: replace all readdir cycles with FOREACH_DIRENT{,_ALL} (#4853) 2016-12-09 10:04:30 +01:00
Lennart Poettering
6a9cd374e0 update TODO 2016-12-07 18:47:32 +01:00
Susant Sahani
10452f7c93 core: introduce parse_ip_port (#4825) 
1. Listed in TODO.
2. Tree wide replace safe_atou16 with parse_ip_port incase
   it's used for ports.
 2016-12-06 12:21:45 +01:00
Douglas Christman
8ea803516e calendarspec: add support for scheduling timers at the end of the month 
"*-*~1"       => The last day of every month
"*-02~3..5"   => The third, fourth, and fifth last days in February
"Mon 05~07/1" => The last Monday in May

Resolves #3861
 2016-11-23 12:37:43 -05:00
Lennart Poettering
0c426957d8 update TODO 2016-11-17 18:10:30 +01:00
Lennart Poettering
7d992a6ede update TODO 2016-11-16 17:01:46 +01:00
Zbigniew Jędrzejewski-Szmek
d85a0f8028 Merge pull request #4536 from poettering/seccomp-namespaces 
core: add new RestrictNamespaces= unit file setting

Merging, not rebasing, because this touches many files and there were tree-wide cleanups in the mean time.
 2016-11-08 19:54:21 -05:00
Zbigniew Jędrzejewski-Szmek
bc8ec170d2 Drop FOREACH_WORD_QUOTED 2016-11-05 18:54:27 -04:00
Lennart Poettering
add005357d core: add new RestrictNamespaces= unit file setting 
This new setting permits restricting whether namespaces may be created and
managed by processes started by a unit. It installs a seccomp filter blocking
certain invocations of unshare(), clone() and setns().

RestrictNamespaces=no is the default, and does not restrict namespaces in any
way. RestrictNamespaces=yes takes away the ability to create or manage any kind
of namspace. "RestrictNamespaces=mnt ipc" restricts the creation of namespaces
so that only mount and IPC namespaces may be created/managed, but no other
kind of namespaces.

This setting should be improve security quite a bit as in particular user
namespacing was a major source of CVEs in the kernel in the past, and is
accessible to unprivileged processes. With this setting the entire attack
surface may be removed for system services that do not make use of namespaces.
 2016-11-04 07:40:13 -06:00
Lennart Poettering
67234d218b update TODO 2016-11-02 08:49:59 -06:00
Lennart Poettering
b5bdbcd5ba update TODO 2016-10-20 14:22:43 -04:00
Lennart Poettering
da597d2b52 update TODO 2016-10-12 20:33:33 +02:00
Zbigniew Jędrzejewski-Szmek
b744e8937c Merge pull request #4067 from poettering/invocation-id 
Add an "invocation ID" concept to the service manager
 2016-10-11 13:40:50 -04:00
Lennart Poettering
642d6665f4 update TODO 2016-10-10 19:56:45 +02:00
Lennart Poettering
a46eac1bbd update TODO 2016-10-07 20:32:23 +02:00
Lennart Poettering
d21494ea25 update TODO 2016-10-06 17:27:23 +02:00
Zbigniew Jędrzejewski-Szmek
4a77c53d64 NEWS: add another batch of entries 2016-10-03 07:36:59 -04:00
Zbigniew Jędrzejewski-Szmek
dd5e7000cb core: complain if Before= dep on .device is declared 
[Unit]
Before=foobar.device

[Service]
ExecStart=/bin/true
Type=oneshot

$ systemd-analyze verify before-device.service
before-device.service: Dependency Before=foobar.device ignored (.device units cannot be delayed)
 2016-10-01 22:53:17 +02:00
Zbigniew Jędrzejewski-Szmek
73a99163a7 coredump,catalog: give better notice when a core file is truncated 
coredump had code to check if copy_bytes() hit the max_bytes limit,
and refuse further processing in that case.
But in 84ee096044, the return convention for copy_bytes() was changed
from -EFBIG to 1 for the case when the limit is hit, so the condition
check in coredump couldn't ever trigger.
But it seems that *do* want to process such truncated cores [1].
So change the code to detect truncation properly, but instead of
returning an error, give a nice log entry.

[1] https://github.com/systemd/systemd/issues/3883#issuecomment-239106337

Should fix (or at least alleviate) #3883.
 2016-09-28 23:50:29 +02:00
Lennart Poettering
0439746492 Update TODO 2016-09-25 10:52:57 +02:00
Susant Sahani
1bc7460bf2 TODO: update networkd TODO 2016-09-15 10:18:22 +05:30
Zbigniew Jędrzejewski-Szmek
e031c227cb TODO: remove duplicated item 2016-09-13 20:10:57 -04:00
Zbigniew Jędrzejewski-Szmek
481a2b02a3 Always use unicode ellipsis when ellipsizing 
We were already unconditionally using the unicode character when the
input string was not pure ASCII, leading to different behaviour in
depending on the input string.

systemd[1]: Starting printit.service.
python3[19962]: foooooooooooooooooooooooooooooooooooo…oooo
python3[19964]: fooąęoooooooooooooooooooooooooooooooo…oooo
python3[19966]: fooąęoooooooooooooooooooooooooooooooo…ąęąę
python3[19968]: fooąęoooooooooooooooooąęąęąęąęąęąęąęą…ąęąę
systemd[1]: Started printit.service.
 2016-09-13 20:10:57 -04:00
Zbigniew Jędrzejewski-Szmek
432b5c8a4d TODO: remove strerror entry 
I believe the remaining call sites are legitimate uses which cannot be
easily replaced with %m.
 2016-09-13 20:10:57 -04:00
Seraphime Kirkovski
07b0b339d6 machinectl: split OS field in two; print ip addresses (#4058) 
This splits the OS field in two : one for the distribution name
and one for the the version id.
Dashes are written for missing fields.
This also prints ip addresses of known machines. The `--max-addresses`
option specifies how much ip addresses we want to see. The default is 1.
When more than one address is written for a machine, a `,` follows it.
If there are more ips than `--max-addresses`, `...` follows the last
address.
 2016-08-31 20:06:57 +02:00
Lennart Poettering
2c5f295823 update TODO 2016-08-22 17:31:41 +02:00
Zbigniew Jędrzejewski-Szmek
d87a2ef782 Merge pull request #3884 from poettering/private-users 2016-08-06 17:04:45 -04:00
Lennart Poettering
d47f681b28 update TODO 2016-08-04 23:08:05 +02:00
Lennart Poettering
8ce9b83a8f update TODO 2016-08-03 20:43:50 +02:00
Lennart Poettering
d82047bef5 update TODO 2016-07-22 15:53:45 +02:00
Lennart Poettering
36376e0b71 update TODO 2016-07-21 11:09:24 +02:00
Torstein Husebø
61233823aa treewide: fix typos and remove accidental repetition of words 2016-07-11 16:18:43 +02:00
Douglas Christman
32b5236916 calendarspec: allow ranges in date and time specifications 
Resolves #3042
 2016-07-01 23:13:58 -04:00
Lennart Poettering
563a69f480 update TODO 2016-07-01 18:39:26 -07:00
Lennart Poettering
3efb871a3c update 2016-06-24 11:45:06 +02:00