1
1
mirror of https://github.com/systemd/systemd-stable.git synced 2024-10-28 20:25:25 +03:00
Commit Graph

14100 Commits

Author SHA1 Message Date
Lennart Poettering
b88eb17a7a nspawn: no need to subscribe to netlink messages if we just want to execute one operation 2014-02-13 14:08:16 +01:00
Lennart Poettering
a42c8b54b1 nspawn: --private-network should imply CAP_NET_ADMIN 2014-02-13 14:07:59 +01:00
Lennart Poettering
d595c5cc9e rtnl: rename constructors from the form sd_rtnl_xxx_yyy_new() to sd_rtnl_xxx_new_yyy()
So far we followed the rule to always indicate the "flavour" of
constructors after the "_new_" or "_open_" in the function name, so
let's keep things in sync here for rtnl and do the same.
2014-02-13 13:53:25 +01:00
Lennart Poettering
cf6a891173 rtnl: drop "sd_" prefix from cleanup macros
The "sd_" prefix is supposed to be used on exported symbols only, and
not in the middle of names. Let's drop it from the cleanup macros hence,
to make things simpler.

The bus cleanup macros don't carry the "sd_" either, so this brings the
APIs a bit nearer.
2014-02-13 03:44:14 +01:00
Lennart Poettering
aa28aefe61 nspawn: add new --network-interface= switch to move an existing interface into the container 2014-02-13 03:27:39 +01:00
Lennart Poettering
39ed67d146 nspawn: introduce --capability=all for retaining all capabilities 2014-02-13 02:45:11 +01:00
Lennart Poettering
89fffa2735 seccomp: fix build again if libseccomp is missing 2014-02-13 02:25:45 +01:00
Lennart Poettering
513a78c1aa update TODO 2014-02-13 02:13:50 +01:00
Lennart Poettering
b33918c210 core: make StopWhenUnneeded work in conjunction with units that fail
during their start job

https://bugzilla.redhat.com/show_bug.cgi?id=997031
2014-02-13 02:13:14 +01:00
Lennart Poettering
bcd02123e1 update TODO 2014-02-13 01:41:24 +01:00
Lennart Poettering
d3b1c50833 core: add a system-wide SystemCallArchitectures= setting
This is useful to prohibit execution of non-native processes on systems,
for example 32bit binaries on 64bit systems, this lowering the attack
service on incorrect syscall and ioctl 32→64bit mappings.
2014-02-13 01:40:50 +01:00
Tom Gundersen
624b5a636f networkd: correctly handle manager_free(NULL) 2014-02-13 01:41:32 +01:00
Lennart Poettering
57183d117a core: add SystemCallArchitectures= unit setting to allow disabling of non-native
architecture support for system calls

Also, turn system call filter bus properties into complex types instead
of concatenated strings.
2014-02-13 00:24:00 +01:00
Lennart Poettering
351a19b17d core: fix build without libseccomp 2014-02-12 18:44:40 +01:00
Lennart Poettering
17df7223be core: rework syscall filter
- Allow configuration of an errno error to return from blacklisted
  syscalls, instead of immediately terminating a process.

- Fix parsing logic when libseccomp support is turned off

- Only keep the actual syscall set in the ExecContext, and generate the
  string version only on demand.
2014-02-12 18:30:36 +01:00
Ronny Chevalier
c0467cf387 syscallfilter: port to libseccomp 2014-02-12 18:30:36 +01:00
Tom Gundersen
c6f7b693fe sd-dhcp: make sure client->secs > 0
Some DHCP servers will not work correctly if secs == 0, so round up
to at least 1.
2014-02-12 17:07:31 +01:00
Tom Gundersen
60ad0c85e5 networkd: work inside containers
Udev does not run in containers, so instead of relying on it to tell us when a
network device is ready to be used by networkd, we simply assume that any
device was fully initialized before being added to the container.
2014-02-12 17:04:35 +01:00
Lennart Poettering
86d0d51942 update TODO (add section for things to fix before 209) 2014-02-12 12:59:56 +01:00
Zbigniew Jędrzejewski-Szmek
32dcef3ab1 build-sys: make lxml required when generating indices
Since the manpage indices generated without lxml would be missing some
parts, it doesn't make sense to keep lxml optional anymore.
2014-02-12 03:04:57 -05:00
Zbigniew Jędrzejewski-Szmek
feef0842cf build-sys: add less-variables.xml to EXTRA_DIST 2014-02-12 03:01:59 -05:00
Zbigniew Jędrzejewski-Szmek
21ac6ff143 man: use xinclude to de-deduplicate common text
I only tested with python-lxml. I'm not sure if xml.etree should be
deprecated.
2014-02-12 01:10:31 -05:00
Jason A. Donenfeld
f366d58dc1 pager: support SYSTEMD_LESS environment variable
This allows customization of the arguments used by less. The main
motivation is that some folks might not like having --no-init on every
invocation of less.
2014-02-12 01:10:31 -05:00
Lennart Poettering
db999e0f92 nspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use of this 2014-02-12 03:02:09 +01:00
Lennart Poettering
dd513a5dbf test: fix "make check"
Let's remove the tests for cg_path_get_machine_name(), since they no
longer operate solely on the cgroup path, but actually look up data in
/run. Since we have a test for cg_pid_get_machine_name() this shouldn't
be too much of a loss.
2014-02-12 02:11:00 +01:00
Lennart Poettering
923d8fd381 machinectl: add new "machinectl reboot" call 2014-02-12 02:11:00 +01:00
Zbigniew Jędrzejewski-Szmek
a87105a386 logind: ignore PropertiesChanged signals for jobs
Otherwise we get a (harmless) message like:
systemd-logind[30845]: Failed to process message [type=signal sender=:1.36 path=/org/freedesktop/systemd1/job/4674 interface=org.freedesktop.DBus.Properties member=PropertiesChanged signature=sa{sv}as]: Invalid argument
2014-02-11 19:14:47 -05:00
Zbigniew Jędrzejewski-Szmek
9bb69af4f2 logind: always kill session when termination is requested
KillUserProcesses=yes/no should be ignored when termination is
explicitly requested.
2014-02-11 19:14:47 -05:00
Zbigniew Jędrzejewski-Szmek
4daf54a851 journald: log provenience of signals 2014-02-11 19:14:47 -05:00
Lennart Poettering
c480d2f8bc units: make use of nspawn's --keep-unit switch in systemd-nspawn@.service 2014-02-11 21:13:51 +01:00
Lennart Poettering
b87633c4b2 machined: fix enumeration of existing machines on restart 2014-02-11 21:06:51 +01:00
Lennart Poettering
2fcb3af6a2 update TODO 2014-02-11 20:31:37 +01:00
Djalal Harouni
00555a2ee1 logind: use session_get_state() to get sessions state of the user
In function user_get_state() remove the session_is_active() check, just
count on the session_get_state() function to get the correct session
state.

session_is_active() may return true before starting the session scope
and user service, this means it will return true even before the creation
of the session fifo_fd which will produce incorrect states.

So be consistent and just use session_get_state().
2014-02-11 20:31:16 +01:00
Cristian Rodríguez
70d9b9fc0a efi: fix Undefined reference efi_loader_get_boot_usec when EFI support is disabled 2014-02-11 17:28:13 +01:00
Lennart Poettering
89f7c8465c machined: optionally, allow registration of pre-existing units (scopes
or services) as machine with machined
2014-02-11 17:16:08 +01:00
Lennart Poettering
2d2ebd6b8f util: modernize readlink_malloc() a bit 2014-02-11 17:16:08 +01:00
Lennart Poettering
c50e4f95d8 util: drop parse_user_at_host() since its unused now 2014-02-11 17:16:07 +01:00
Lennart Poettering
eb91eb187b nspawn: add --register=yes|no switch to optionally disable registration of the container with machined 2014-02-11 17:16:07 +01:00
Tom Gundersen
cf597f650a sd-dhcp: split out packet handling from client 2014-02-11 16:24:23 +01:00
David Herrmann
a020c2a013 sd-bus: export sd_bus_call{,_async,_async_cancel}
The .sym file somehow lacks these declarations, so add these. You have to
run "make clean" to make sure the sym-test runs fine afterwards.
2014-02-10 23:25:10 +01:00
Tom Gundersen
63ffa72022 networkd: link - correctly skip state ENSLAVING when no vlans configured
This fixes a regression introduced in 672682a6b
2014-02-10 23:01:47 +01:00
Tom Gundersen
672682a6b9 networkd: VLAN - allow multiple vlans to be created on a link
Also limit the range of vlan ids. Other implementations and
documentation use the ranges {0,1}-{4094,4095}, but we use
the one accepted by the kernel: 0-4094.

Reported-by: Oleksii Shevchuk <alxchk@gmail.com>
2014-02-10 19:00:17 +01:00
Michal Sekletar
3831838ae7 pam: use correct log level 2014-02-10 16:38:28 +01:00
Susant Sahani
108e131ece sd-rtnl: added support for a few more attributes 2014-02-10 14:53:19 +01:00
Tom Gundersen
11fc2e833e sd-rtnl: test - improve test of MTU a bit
We are more likely to catch errors if we don't use '0' as test value.
2014-02-10 14:53:19 +01:00
Susant Sahani
eedee64522 sd-rtnl: add test cases for link 2014-02-10 14:53:19 +01:00
Lennart Poettering
8a96d94e4c nspawn: add new --share-system switch to run a container without PID/UTS/IPC namespacing 2014-02-10 13:18:16 +01:00
Lennart Poettering
deb678f15a update TODO 2014-02-10 13:18:16 +01:00
Lennart Poettering
82adf6af7c nspawn,man: use a common vocabulary when referring to selinux security contexts
Let's always call the security labels the same way:

  SMACK: "Smack Label"
  SELINUX: "SELinux Security Context"

And the low-level encapsulation is called "seclabel". Now let's hope we
stick to this vocabulary in future, too, and don't mix "label"s and
"security contexts" and so on wildly.
2014-02-10 13:18:16 +01:00
Michael Scherer
0d3f7bb3a5 exec: Add support for ignoring errors on SELinuxContext by prefixing it with -, like for others settings.
Also remove call to security_check_context, as this doesn't serve anything, since
setexeccon will fail anyway.
2014-02-10 13:18:16 +01:00