1
1
mirror of https://github.com/systemd/systemd-stable.git synced 2024-12-23 17:34:00 +03:00
Commit Graph

22065 Commits

Author SHA1 Message Date
Tom Gundersen
54683f0f9b udev: net_id - support predictable ifnames on virtio buses
Virtio buses are undeterministically enumerated, so we cannot use them as a basis
for deterministic naming (see bf81e792f3). However, we are guaranteed that there
is only ever one virtio bus for every parent device, so we can simply skip over
the virtio buses when naming the devices.
2015-09-02 14:24:17 +02:00
Lennart Poettering
28bc259c01 Merge pull request #1118 from jsynacek/man-dot-d-v2
man: *.d conf directories: add note about initrd regeneration
2015-09-02 11:30:08 +02:00
Lennart Poettering
a8c0f36714 Merge pull request #1116 from poettering/unified-rebased
core: unified cgroup hierarchy support
2015-09-02 11:21:24 +02:00
David Herrmann
d18ec0491e Merge pull request #1112 from poettering/sd-bus-container-fixes
machined and sd-bus container fixes
2015-09-02 11:14:41 +02:00
Jan Synacek
2ef555d69a man: *.d conf directories: add note about initrd regeneration 2015-09-02 10:01:34 +02:00
Daniel Mack
f22572452b Merge pull request #1117 from evverx/detect-parallels-virt
virt: detect parallels virtualization
2015-09-02 08:00:38 +02:00
Evgeny Vereshchagin
d84248ebec virt: detect parallels virtualization
inspired by http://people.redhat.com/~rjones/virt-what/

see:
* http://git.annexia.org/?p=virt-what.git;a=blob;f=virt-what.in;h=a5ed33ef3e4bfa3281c9589eccac4d92dff1babe;hb=HEAD#l200
* http://git.annexia.org/?p=virt-what.git;a=blob;f=virt-what.in;h=a5ed33ef3e4bfa3281c9589eccac4d92dff1babe;hb=HEAD#l253
2015-09-02 01:49:47 +00:00
Lennart Poettering
efdb02375b core: unified cgroup hierarchy support
This patch set adds full support the new unified cgroup hierarchy logic
of modern kernels.

A new kernel command line option "systemd.unified_cgroup_hierarchy=1" is
added. If specified the unified hierarchy is mounted to /sys/fs/cgroup
instead of a tmpfs. No further hierarchies are mounted. The kernel
command line option defaults to off. We can turn it on by default as
soon as the kernel's APIs regarding this are stabilized (but even then
downstream distros might want to turn this off, as this will break any
tools that access cgroupfs directly).

It is possibly to choose for each boot individually whether the unified
or the legacy hierarchy is used. nspawn will by default provide the
legacy hierarchy to containers if the host is using it, and the unified
otherwise. However it is possible to run containers with the unified
hierarchy on a legacy host and vice versa, by setting the
$UNIFIED_CGROUP_HIERARCHY environment variable for nspawn to 1 or 0,
respectively.

The unified hierarchy provides reliable cgroup empty notifications for
the first time, via inotify. To make use of this we maintain one
manager-wide inotify fd, and each cgroup to it.

This patch also removes cg_delete() which is unused now.

On kernel 4.2 only the "memory" controller is compatible with the
unified hierarchy, hence that's the only controller systemd exposes when
booted in unified heirarchy mode.

This introduces a new enum for enumerating supported controllers, plus a
related enum for the mask bits mapping to it. The core is changed to
make use of this everywhere.

This moves PID 1 into a new "init.scope" implicit scope unit in the root
slice. This is necessary since on the unified hierarchy cgroups may
either contain subgroups or processes but not both. PID 1 hence has to
move out of the root cgroup (strictly speaking the root cgroup is the
only one where processes and subgroups are still allowed, but in order
to support containers nicey, we move PID 1 into the new scope in all
cases.) This new unit is also used on legacy hierarchy setups. It's
actually pretty useful on all systems, as it can then be used to filter
journal messages coming from PID 1, and so on.

The root slice ("-.slice") is now implicitly created and started (and
does not require a unit file on disk anymore), since
that's where "init.scope" is located and the slice needs to be started
before the scope can.

To check whether we are in unified or legacy hierarchy mode we use
statfs() on /sys/fs/cgroup. If the .f_type field reports tmpfs we are in
legacy mode, if it reports cgroupfs we are in unified mode.

This patch set carefuly makes sure that cgls and cgtop continue to work
as desired.

When invoking nspawn as a service it will implicitly create two
subcgroups in the cgroup it is using, one to move the nspawn process
into, the other to move the actual container processes into. This is
done because of the requirement that cgroups may either contain
processes or other subgroups.
2015-09-01 23:52:27 +02:00
Lennart Poettering
b92340af68 Merge pull request #1115 from phomes/hwdb-mice
hwdb: more mice
2015-09-01 22:07:58 +02:00
Thomas Hindoe Paaboel Andersen
ea24343247 hwdb: more mice 2015-09-01 22:02:05 +02:00
Lennart Poettering
b85ec419cb Merge pull request #1098 from filbranden/cpuaffinity2
Getting rid of FOREACH_WORD_QUOTED and some more cleanup in config_parse_cpu_affinity2
2015-09-01 20:52:52 +02:00
Lennart Poettering
92dcf85e11 Merge pull request #1107 from msekletar/selinux-get-raw-context
selinux: always use *_raw API from libselinux
2015-09-01 20:46:27 +02:00
Lennart Poettering
751090cc8a sd-bus: when connecting to a container, don't fall back to host bus
We should never connect to the host bus as fallback if connecting to a
container failed via one method. Otherwise connecting to a dbus1
container will always result in a connection to the host.
2015-09-01 20:40:24 +02:00
Lennart Poettering
80b0d3e311 sd-bus: when connecting to a kdbus container bus pass error up
We rely on the correct error used when opening the kdbus device node,
hence let's make sure we pass it up from the namespaced child process to
the process which actually wants to connect.
2015-09-01 20:40:24 +02:00
Lennart Poettering
a07c35c3e6 machined: introduce a ptsname_namespace() call and make use of it
The call is like ptsname() but does not assume the pty path was
accessible in the local namespace. It uses the same internal ioctl
though.
2015-09-01 20:40:24 +02:00
Lennart Poettering
395745ba53 machined: call unlockpt() in container, not host
It makes assumptions about the pty path, hence better call it in the
container namespace rather than the host.
2015-09-01 20:40:24 +02:00
Filipe Brandenburger
5cc623e644 core: Log parse errors in config_parse_cpu_affinity2 2015-09-01 11:10:09 -07:00
Tom Gundersen
fc94c32605 Merge pull request #1111 from poettering/more-cgroup-fixes
More cgroup fixes
2015-09-01 19:48:04 +02:00
Lennart Poettering
332929623a Merge pull request #1099 from filbranden/joincontrollers2
Getting rid of FOREACH_WORD_QUOTED in config_parse_join_controllers
2015-09-01 19:10:45 +02:00
Lennart Poettering
aa3e5246ba Merge pull request #1102 from heftig/master
build-sys: Look for gcc-* binutils wrappers only if we're using GCC
2015-09-01 19:09:42 +02:00
Lennart Poettering
d6d8075a86 Merge pull request #1109 from phomes/man-typos
man: fix typos in systemd-path.xml
2015-09-01 19:08:55 +02:00
Lennart Poettering
a9326c4046 Merge pull request #1110 from evverx/run-interactive-auth
run: enable interactive authorization
2015-09-01 19:08:17 +02:00
Lennart Poettering
d06673212e core: rework when we kill with which signal
When the user wants to explicitly send our own PID a signal, then do so.

Don't follow up SIGABRT with a SIGHUP if send_sighup is enabled. At that
point the process should have segfaulted, hence there's no point in
following up with a SIGHUP.

Send only termination signals to ourselves, never KILL or ABRT signals.
2015-09-01 18:54:08 +02:00
Lennart Poettering
102ef9829e core: don't allow changing the slice of a unit while it is active 2015-09-01 18:53:29 +02:00
Lennart Poettering
b821a397c0 unit: small clean-ups
Always say when we ignore errors. Cast calls whose return value we
knowingly ingore to (void). Use "bool" where we actually mean a boolean,
even if we return it as an int later on.
2015-09-01 18:52:15 +02:00
Lennart Poettering
5fe8876b32 core: when looking for the unit for a process, look at the PID hashmaps first
It's cheaper that going to cgroupfs, and also usually the better choice
since it's not racy and can map PIDs even if they were moved to a
different unit.
2015-09-01 18:47:46 +02:00
Evgeny Vereshchagin
8c7db2fb21 run: enable interactive authorization 2015-09-01 16:43:08 +00:00
Lennart Poettering
6fd6650737 cgroup: the root cgroup is always populated 2015-09-01 18:37:01 +02:00
Lennart Poettering
6f883237f1 cgroup: drop "ignore_self" argument from cg_is_empty()
In all cases where the function (or cg_is_empty_recursive()) ignoring
the calling process is actually wrong, as a process keeps a cgroup busy
regardless if its the current one or another. Hence, let's simplify
things and drop the "ignore_self" parameter.
2015-09-01 18:37:01 +02:00
Lennart Poettering
e155a0aa04 cgroup: small cleanups and coding style fixes
A number of simplications and adjustments to brings things closer to our
coding style.
2015-09-01 18:37:01 +02:00
Lennart Poettering
f01327adb7 cgroup: don't allow hidden cgroups
We really should care for all cgroups, and not allow hidden ones.
2015-09-01 18:37:01 +02:00
Lennart Poettering
9b84c7f959 cgroup: never migrate kernel threads out of the root cgroup
It won't work anyway.
2015-09-01 18:37:01 +02:00
David Herrmann
3a487d41d7 Merge pull request #1108 from phomes/dont-shadow-globals
tree-wide: do not shadow the global var timezone
2015-09-01 18:33:54 +02:00
Thomas Hindoe Paaboel Andersen
5575c4e603 man: fix typos in systemd-path.xml 2015-09-01 18:31:04 +02:00
Thomas Hindoe Paaboel Andersen
64d6c22905 tree-wide: do not shadow the global var timezone 2015-09-01 18:20:13 +02:00
Lennart Poettering
e9db43d591 units: enable waiting for unit termination in certain cases
The legacy cgroup hierarchy does not support reliable empty
notifications in containers and if there are left-over subgroups in a
cgroup. This makes it hard to correctly wait for them running empty, and
thus we previously disabled this logic entirely.

With this change we explicitly check for the container case, and whether
the unit is a "delegation" unit (i.e. one where programs may create
their own subgroups). If we are neither in a container, nor operating on
a delegation unit cgroup empty notifications become reliable and thus we
start waiting for the empty notifications again.

This doesn't really fix the general problem around cgroup notifications
but reduces the effect around it.

(This also reorders #include lines by their focus, as suggsted in
CODING_STYLE. We have to add "virt.h", so let's do that at the right
place.)

Also see #317.
2015-09-01 17:44:17 +02:00
Filipe Brandenburger
1592ec21b3 core: add OOM check in config_parse_join_controllers 2015-09-01 08:35:54 -07:00
Filipe Brandenburger
3875c85bae core: Log parse errors in config_parse_join_controllers 2015-09-01 08:35:54 -07:00
Lennart Poettering
957c3cf97c unit: suppress unnecessary cgroup empty check
Rework the "service is good" check, to only check the cgroup state if we
really need to instead of always.

This allows us to suppress going to the cgroupfs for an empty check for
the majority of services.

No functional change.
2015-09-01 17:20:56 +02:00
Lennart Poettering
ae2a2c53dd manager: don't write first-boot flag file all the time
Instead, remember that we have already written it.
2015-09-01 17:20:56 +02:00
Lennart Poettering
fc60d8153c sd-login: improve error handling
let's return ENXIO whenever we don't know something rather than ENOENT.

ENOENT suggests this was really about a file or directory, while ENXIO
is a more generic "not found" indicator.
2015-09-01 17:20:56 +02:00
Lennart Poettering
9660efb82f cgtop: properly show "/" instead of empty string in cgroup list 2015-09-01 17:20:56 +02:00
Lennart Poettering
bd9f2fc2d0 set: return NULL on destructors
Like we do it pretty much everywhere else.
2015-09-01 17:20:56 +02:00
Michal Sekletar
2415487984 selinux: always use *_raw API from libselinux
When mcstransd* is running non-raw functions will return translated SELinux
context. Problem is that libselinux will cache this information and in the
future it will return same context even though mcstransd maybe not running at
that time. If you then check with such context against SELinux policy then
selinux_check_access may fail depending on whether mcstransd is running or not.

To workaround this problem/bug in libselinux, we should always get raw context
instead. Most users will not notice because result of access check is logged
only in debug mode.

* SELinux context translation service, which will translates labels to human
  readable form
2015-09-01 17:09:56 +02:00
Jan Alexander Steffens (heftig)
0e3b0a95cc build-sys: Look for gcc-* binutils wrappers only if we're using GCC
If we don't look for them, LT_INIT will and default to the unprefixed
tools.

Apparently clang doesn't like the wrappers being used. Should fix #1077.
2015-09-01 13:27:42 +02:00
Lennart Poettering
3f010fe095 Merge pull request #1066 from ssahani/tunnel
networkd: add support for tunnel encap limit
2015-09-01 12:02:10 +02:00
Lennart Poettering
5c69031f9c Merge pull request #1100 from martinpitt/master
logind: Listen to WMI hotkeys to catch SW_DOCK state/events
2015-09-01 11:34:26 +02:00
Martin Pitt
7577e5181a logind: Listen to WMI hotkeys to catch SW_DOCK state/events
On Dell and HP laptops the dock state/events (SW_DOCK) come from the "{Dell,HP}
WMI hotkeys" input devices. Tag them as power-switch so that login actually
considers them. Use a general match in case this affects other vendors, too.

Thanks to Andreas Schultz for debugging this!

https://launchpad.net/bugs/1450009
2015-09-01 10:51:15 +02:00
Filipe Brandenburger
d4ebeb4fb3 core: Use extract_first_word in config_parse_join_controllers
Related to the TODO item to replace FOREACH_WORD_QUOTED with it.

Tested by setting `JoinControllers=cpu,cpuacct,memory net_cls,blkio' in
/etc/systemd/system.conf, rebooting the system with the patched binaries
and checking that the desired setup was created by inspecting the
entries under /sys/fs/cgroup.

No regressions observed in test cases.
2015-08-31 17:33:35 -07:00
Filipe Brandenburger
4b40bc38b4 util: Declare a cleanup routine for a cpu_set_t
Make use of it in config_parse_cpu_affinity2.

Tested by tweaking the `CPUAffinity' setting in /etc/systemd/system.conf
and reloading the daemon to confirm it is working as expected.

No regressions observed in test cases.
2015-08-31 17:15:56 -07:00