1
1
mirror of https://github.com/systemd/systemd-stable.git synced 2024-12-23 17:34:00 +03:00
Commit Graph

43534 Commits

Author SHA1 Message Date
Lennart Poettering
7f56982289 polkit: on async pk requests, re-validate action/details
When we do an async pk request, let's store which action/details we used
for the original request, and when we are called for the second time,
let's compare. If the action/details changed, let's not allow the access
to go through.
2020-02-04 18:45:22 +01:00
Lennart Poettering
95f82ae9d7 polkit: reuse some common bus message appending code 2020-02-04 18:45:22 +01:00
Lennart Poettering
773b1a7916 bus-polkit: rename return error parameter to ret_error 2020-02-04 18:45:22 +01:00
Christian Göttsche
f156e60c66 core: unit_label_path(): take const unit 2020-02-04 18:36:19 +01:00
Zbigniew Jędrzejewski-Szmek
6bdd90fbcd man: add "quick-help" to sysusers.d synopsis
We have that in tmpfiles.d and it is makes looking up the syntax
very easy.

While at it, add an example for "r" and use the underscrore as prefix
as described in the text.
2020-02-04 18:20:28 +01:00
Christian Göttsche
1648233dce selinux-access: log warning on context acquisition failure
Relevant when testing in permissive mode, where the function does not return a failure to the client.
This helps to configure a system in permissive mode, without getting surprising failures when switching to enforced mode.
2020-02-04 18:11:42 +01:00
Christian Göttsche
074b597dd9 selinux-util: increase log severity
`log_enforcing()` and `log_enforcing_errno()` are only used for important messages, which describe failures in enforced mode.
They are guarded either by `!mac_selinux_use()` or `!label_hnd` checks, where the latter is itself guarded by the former.
Only SELinux enabled systems print these logs.
This helps to configure a system in permissive mode, without getting surprising failures when switching to enforced mode.
2020-02-04 18:11:42 +01:00
Zbigniew Jędrzejewski-Szmek
2979f04b99
Merge pull request #14717 from yuwata/network-radv-dns-link-local
network: make DNS= in [IPv6PrefixDelegation] section take special value '_link_local'
2020-02-04 17:47:17 +01:00
Zbigniew Jędrzejewski-Szmek
ca58d00c68 network: FairQueueTrafficPolicing→FairQueueing
This never made into a release, so we can change the name with impunity.
Suggested by Davide Pesavento.

I opted to add the "ing" ending. "Fair queuing" is the name of the general
concept and algorithm, and "Fair queue" is mostly used for the implementation
name.
2020-02-04 17:37:16 +01:00
Zbigniew Jędrzejewski-Szmek
60ed2dcfc7 network: TokenBufferFilter→TokenBucketFilter
This never made into a release, so we can change the name with impunity.
Noticed by Davide Pesavento.
2020-02-04 17:28:15 +01:00
Zbigniew Jędrzejewski-Szmek
8e92d92fb8 man: tweak description of blockdev@.target
In particular, let's just say "is" and "must" instead of "may be" and
"should". The weaker forms are obviously correct, but the text is easier to
understand if non-conditional forms are used.
2020-02-04 16:40:52 +01:00
Zbigniew Jędrzejewski-Szmek
dc9fd22d3d Merge pull request #14398 from poettering/mount-prep 2020-02-04 16:28:51 +01:00
Ansgar Burchardt
eb1322744d NEWS: correct indenting for two entries 2020-02-04 23:57:20 +09:00
Zbigniew Jędrzejewski-Szmek
ce4121c6ff meson: update efi path detection to gnu-efi-3.0.11
Fixes systemd build in Fedora rawhide.

The old ldsdir option is not useful, because both the directory and the
file name changed. Let's remove the option and try to autodetect the file
name. If this turns out to be not enough, a new option to simply specify
the full path to the file can be added.

F31:
         efi arch:                          x86_64
         EFI machine type:                  x64
         EFI CC                             ccache cc
         EFI lds:                           /usr/lib64/gnuefi/elf_x64_efi.lds
         EFI crt0:                          /usr/lib64/gnuefi/crt0-efi-x64.o
         EFI include directory:             /usr/include/efi
F32:
         efi arch:                          x86_64
         EFI machine type:                  x64
         EFI CC                             ccache cc
         EFI lds:                           /usr/lib/gnuefi/x64/efi.lds
         EFI crt0:                          /usr/lib/gnuefi/x64/crt0.o
         EFI include directory:             /usr/include/efi
2020-02-04 23:43:21 +09:00
Yu Watanabe
18de0969c5 network: split TrafficControlQueueingDiscipline section into small pieces
Closes #14763.
2020-02-04 21:45:39 +09:00
Yu Watanabe
91e50467f5
Merge pull request #14761 from keszybz/link-network-no-match
Refuse .network and .link files with no matches
2020-02-04 20:26:37 +09:00
Zbigniew Jędrzejewski-Szmek
dade734917 network,udev: refuse .link and .network settings with no matches
Two releases ago we started warning about this, and I think it is now to turn
this into a hard error. People get bitten by this every once in a while, and
there doesn't see to be any legitimate use case where the same .link or
.network files should be applied to _all_ interfaces, since in particular that
configuration would apply both to lo and any other interfaces. And if for
whatever reason that is actually desired, OriginalName=* or Name=* can be
easily added to silence the warning and achieve the effect.

(The case described in #12098 is particularly nasty: 'echo -n >foo.network'
creates a mask file, 'echo >foo.network' creates a "match all" file.)

Fixes #717, #12098 for realz now.
2020-02-04 08:45:52 +01:00
Zbigniew Jędrzejewski-Szmek
e519e20ae1 test-network: do not fail if lo has a .network file
Fixes #9895.
2020-02-04 08:30:40 +01:00
nabijaczleweli
90198bcbea Fix generator name in hibernate-resume-generator's drop-in
Introduced in ff757c9d29
2020-02-04 14:49:04 +09:00
Zbigniew Jędrzejewski-Szmek
61c3e2c8bf presets: "disable" all passive targets by default
Officially we default to a "enable *", even though pretty much everybody
overrides this with "disable *". We have a bunch of targets and services which
should not be enabled by default. In case the default policy is not overriden,
our passive units would be enabled by presets, which is generally not useful at
all. So let's explicitly mark them as disabled.

Note that this effectively changes very little. E.g. on Fedora, all the units
listed in this patch were "disabled" already.

Fixes #14648.
2020-02-04 13:59:31 +09:00
Yu Watanabe
41fd8fe716 test-network: add a test case for IPv6PrefixDelegation.DNS=linklocal 2020-02-04 13:57:12 +09:00
Yu Watanabe
fd3ef936ed network,radv: make DNS= in [IPv6PrefixDelegation] section take special value 'linklocal'
Closes #13639.
2020-02-04 13:56:30 +09:00
Zbigniew Jędrzejewski-Szmek
2f1fc899ce
Merge pull request #14589 from keszybz/sysctl-downgrade-messages
sysctl: add glob patterns to set network settings more flexibly
2020-02-04 00:04:28 +01:00
Zbigniew Jędrzejewski-Szmek
5d4fc0e665 sysctl: set ipv4 settings in a race-free way
Fixes #6282.

This solution is a bit busy, but we close the race without setting *.all.*, so
it is still possible to set a different setting for particular interfaces.
Setting just "default" is not very useful because any interfaces present before
systemd-sysctl is invoked are not affected. Setting "all" is too harsh, because
the kernel takes the stronger of the device-specific setting and the "all" value,
so effectively having a weaker setting for specific interfaces is not possible.
2020-02-04 00:01:50 +01:00
Zbigniew Jędrzejewski-Szmek
e0f424790d sysctl: add glob syntax to sysctl.d files
This is intended for net.*.conf.*.foo files. Setting just "default" is not very
useful because any interfaces present before systemd-sysctl is invoked are not
affected. Setting "all" is too harsh, because the kernel takes the stronger of
the device-specific setting and the "all" value, so effectively having a weaker
setting for specific interfaces is not possible. Let's add a way in which can
set "default" first and then all the others without "all".
2020-02-04 00:01:50 +01:00
AsciiWolf
5e9c08f377 l10n: update Czech Translation 2020-02-03 21:54:09 +01:00
Anita Zhang
d383613872
Merge pull request #14747 from yuwata/core-dynamic-user-14733
core: call dynamic_user_acquire() only when 'group' is non-null
2020-02-03 10:38:27 -08:00
Yu Watanabe
50152bb1c5 core: call dynamic_user_acquire() only when 'group' is non-null
When unit is reloaded, and the reloaded unit has bad-setting, then
unit_patch_contexts() is not called and exec_context::user and group
may not be configured.

A minimum reproducer for the case is:
- step 1.
$ sudo systemctl edit --full hoge.service
[Service]
oneshot
ExecStart=sleep 1h

- step 2.
$ sudo systemctl start hoge.service

- step 3.
$ sudo systemctl edit --full hoge.service
[Service]
Type=oneshot
ExecStart=@bindir@/sleep 1h
DynamicUser=yes

Then pid1 crashed.

Fixes #14733.
2020-02-03 21:51:07 +09:00
Yu Watanabe
4c1dea42b5 journal: drop unreachable path 2020-02-03 10:00:50 +01:00
splantefeve
e362d6eeba po: update French translation 2020-02-03 10:00:30 +01:00
Yu Watanabe
bf2334c054 udev: add {Receive,Transmit}ChecksumOffload= settings
Closes #14661.
2020-02-03 12:31:31 +09:00
Naïm Favier
53e1ba280f
network: add SuppressPrefixLength option to RoutingPolicyRule (#14736)
Closes #14724.
2020-02-03 08:25:48 +09:00
Yu Watanabe
e06d7d0fb0 po: update Japanese translation 2020-02-02 20:48:17 +01:00
Piotr Drąg
10f58ad015 po: update Polish translation 2020-02-02 20:46:57 +01:00
Lennart Poettering
9a4940bf92 update NEWS 2020-02-02 18:17:24 +01:00
Lennart Poettering
d58f31793a
Merge pull request #14645 from keszybz/sd-bus-message-dump
sd_bus_message_dump
2020-02-02 17:27:50 +01:00
Lennart Poettering
ddb10d8ccd
Merge pull request #14699 from yuwata/dhcp6-fix-t1-t2
dhcp6: do not use T1 and T2 longer than one provided by the lease
2020-02-02 17:16:31 +01:00
Yu Watanabe
60d0a5098b util: uid_t, gid_t, and pid_t must be 32bit
We already have assert_cc(sizeof(uid_t) == sizeof(uint32_t)) or friends
at various places.
2020-02-02 17:13:08 +01:00
Yu Watanabe
c757517d98 meson: fix feature list 2020-02-02 17:09:28 +01:00
Lennart Poettering
a754993d9c
Merge pull request #14719 from yuwata/sd-boot-fix-warnings
sd-boot: fix warnings
2020-02-02 16:57:17 +01:00
David Michael
649916d356 sysusers: support creating users with a specific primary group
This extends the "uid:gid" syntax for "u" lines so that a group
name can be given instead of a GID.  This requires that the group
is either queued for creation by sysusers, or it is already defined
on the system.

Closes #14340
2020-02-02 16:53:22 +01:00
Yu Watanabe
4e3132d6d6
Merge pull request #14672 from yuwata/network-routing-policy-uidrange
network: support UID based routing policy
2020-02-02 22:46:04 +09:00
Yu Watanabe
6be8e78e32 test-network: add test for UID based routing policy 2020-02-02 22:43:38 +09:00
Yu Watanabe
ea471a4695 network: support UID based routing policy
Closes #14666.
2020-02-02 22:43:38 +09:00
Yu Watanabe
03de302a31 util: add parse_uid_range() helper function 2020-02-02 22:43:38 +09:00
Yu Watanabe
af06ddf51a meson, man: do not install pam_systemd_home(8) when pam or homed is disabled
Fixes #14725.
2020-02-01 12:13:45 +01:00
Frantisek Sumsal
2273ecfeda test: don't install /etc/securetty
Having /etc/securetty in test containers prevents root from logging into
them:

```
Jan 31 10:15:11 systemd-testsuite login[69]: pam_securetty(login:auth): access denied: tty 'pts/0' is not secure !
Jan 31 10:15:11 systemd-testsuite login[69]: FAILED LOGIN 1 FROM pts/0 FOR root, Authentication failure
```
2020-02-01 11:55:17 +01:00
Lennart Poettering
5ee69e144e
Merge pull request #14178 from poettering/journal-namespace
journal: add concept of "journal namespaces"
2020-02-01 11:25:48 +01:00
Anita Zhang
279be556f8
Merge pull request #14721 from yuwata/home-tiny-fixes
homed,nspawn,userdb: trivial tiny fixes
2020-01-31 12:02:51 -08:00
Yu Watanabe
020313b213 test: also check the result of merge_gid_lists()
Fixes CID#1412354.
2020-01-31 23:31:23 +09:00