1
1
mirror of https://github.com/systemd/systemd-stable.git synced 2024-12-22 13:33:56 +03:00
Commit Graph

1327 Commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek
32c3a623ce
Merge pull request #17467 from keszybz/unconditionally-pull-in-cryptsetup-remote
Unconditionally pull in cryptsetup-remote.target in the initramfs
2020-10-28 18:00:04 +01:00
Lennart Poettering
02229dff2b units: turn on timestamping for journald sockets
To make things simple and robust when debugging journald, we'll leave
the SO_TIMESTAMP invocations in the C code in place, even if they are
now typically redundant, given that the sockets are already passed into
the process with SO_TIMESTAMP turned on now.
2020-10-27 14:13:03 +01:00
Jonathan Lebon
e921ebb57e units: unconditionally pull in remote-cryptsetup.target in the initramfs
[zjs: Replaces #17149.

I took half of the patch in
https://github.com/systemd/systemd/pull/17149#issuecomment-698399194,
hence I'm keeping Jonathan's authorship.

The original reasoning for 6c5496c492 was that we
enable remote-cryptsetup.target via presets, and since presets are not used for
the initrd, we need a different target. But since parts of the unit and target
tree are shared between the initramfs and the main system, we can't just create
a separate target for the initramfs. All the targets that depend on this one
would need to be split also. That condition is true for initrd-fs.target, but
not for sysinit.target.

So let's instead just uncoditionally pull in remote-cryptsetup.target in the
initramfs. It should normally be empty, so there should be no impact on boots
that don't have units in the target.

Jonathan's patch used initrd-root-fs.target, this version instead uses
initrd-root-device.target. initrd-root-device.target is ordered before
sysroot.mount, which means that the decrypted devices will be available earlier
too.]
2020-10-27 13:49:01 +01:00
Zbigniew Jędrzejewski-Szmek
6bdcb72086 Revert "units: add initrd-cryptsetup.target"
This reverts commit 6c5496c492.

sysinit.target is shared between the initrd and the host system. Pulling in
initrd-cryptsetup.target into sysinit.target causes the following warning at
boot:
Oct 27 10:42:30 workstation-uefi systemd[1]: initrd-cryptsetup.target: Starting requested but asserts failed.
Oct 27 10:42:30 workstation-uefi systemd[1]: Assertion failed for initrd-cryptsetup.target.
2020-10-27 13:36:22 +01:00
Zbigniew Jędrzejewski-Szmek
d5816b6138 meson: simplify with_runlevels ternany op usage 2020-10-27 13:36:22 +01:00
Benjamin Berg
1c2fd33d84 units: Move user tmpfiles clean service into background.slice 2020-10-23 10:32:02 +02:00
Benjamin Berg
a3081a7a89 units: Add special Desktop Environment user related units
This adds app.slice, session.slice and background.slice.
2020-10-23 09:58:41 +02:00
Jonathan Lebon
6c5496c492 units: add initrd-cryptsetup.target
For encrypted block devices that we need to unlock from the initramfs,
we currently rely on dracut shipping `cryptsetup.target`. This works,
but doesn't cover the case where the encrypted block device requires
networking (i.e. the `remote-cryptsetup.target` version). That target
however is traditionally dynamically enabled.

Instead, let's rework things here by adding a `initrd-cryptsetup.target`
specifically for initramfs encrypted block device setup. This plays the
role of both `cryptsetup.target` and `remote-cryptsetup.target` in the
initramfs.

Then, adapt `systemd-cryptsetup-generator` to hook all generated
services to this new unit when running from the initrd. This is
analogous to `systemd-fstab-generator` hooking all mounts to
`initrd-fs.target`, regardless of whether they're network-backed or not.
2020-10-21 22:08:19 +02:00
Yu Watanabe
0ce8a9d6e5
Merge pull request #16939 from Rahix/robust-first-boot-machine-id
Make ConditionFirstBoot safe against power failures
2020-10-20 14:01:41 +09:00
Yu Watanabe
4b28e50f9e
Merge pull request #17390 from keszybz/logind-notifications-and-links
Fix sd_notify() usage in various daemons and update some documentation links
2020-10-20 13:44:52 +09:00
Harald Seiler
3af54f9bbe units: order systemd-random-seed.service before first-boot-complete.target
Ensure that systemd-random-seed.service has completed before marking
a first boot as completed to guarantee that a saved seed will only be
used after it has been initialized at least once.
2020-10-19 16:28:22 +02:00
Harald Seiler
a1e3787148 units: order systemd-firstboot.service before first-boot-complete.target
Make sure systemd-firstboot completes before reaching first-boot-complete.target
and thus marking the first boot as completed.  This way, it is
guaranteed that systemd-firstboot has a chance to complete provisioning
at least once, even in cases of the first boot getting aborted early.
2020-10-19 16:28:22 +02:00
Harald Seiler
f4466bdbf9 units: add first-boot-complete.target for first boot ordering
Add a new target for synchronizing units that wish to run once during
the first boot of the system.  The machine-id will be committed to disk
only after the target has been reached, thus ensuring that all units
ordered before it had a chance to complete.
2020-10-19 16:28:22 +02:00
Zbigniew Jędrzejewski-Szmek
515736d0f3 tree-wide: update web link to logind description
https://www.freedesktop.org/wiki/Software/systemd/multiseat/ says that it
is obsoleted by sd-login(3), so it doesn't make much sense to link to the former.
2020-10-19 15:23:37 +02:00
Anita Zhang
32ae9b1400 units: drop ConditionCapability from systemd-oomd.service
Another suggestion from #15206
2020-10-19 02:46:07 -07:00
Zbigniew Jędrzejewski-Szmek
69c0807432
Merge pull request #15206 from anitazha/systoomd-v0
systemd-oomd
2020-10-15 14:16:52 +02:00
Bjørn Mork
7fe7547ba3 units: update serial-getty@.service to support 57600 baud rate
Fixes: #17306
2020-10-13 21:00:11 +02:00
Anita Zhang
87e2bafff9 systemd-oomd: service files 2020-10-07 17:12:24 -07:00
Lennart Poettering
d1f6e01e47 homed: explicitly deactivate all home directories on shutdown
Let's explicitly deactivate all home dirs on shutdown, in order to
properly synchronizing unmounting and avoiding blocking devices.

Previously, we'd rely on automatic deactivation when home directories
become unused. However, that scheme is asynchronous, and ongoing
deactviations might conflicts with attempts to unmount /home. Let's fix
that by providing an explicit service systemd-homed-activate.service
whose only job is to have a ExecStop= line that explicitly deactivates
all home directories on shutdown. This service can the be ordered after
home.mount and similar, ensuring that we'll first deactivate all homes
before deactivating /home itself during shutdown.

This is kept separate from systemd-homed.service so that it is possible
to restart systemd-homed.service without deactivating all home
directories.

Fixes: #16842
2020-09-30 14:37:52 +02:00
Zbigniew Jędrzejewski-Szmek
21006e0e3e man,units: link to the new dbus-api man pages 2020-09-30 10:30:03 +02:00
Lennart Poettering
c9ef77ec5f units: pass CAP_SYS_RESOURCE to homed
The ext4 fs resize ioctl needs CAP_SYS_RESOURCE, irritatingly. Let's
grant it to homed hence.

Fixes: #15115
2020-09-18 22:35:36 +02:00
Zbigniew Jędrzejewski-Szmek
452d2dfd52 meson: RC_LOCAL_SCRIPT_PATH_START to RC_LOCAL_PATH
RC_LOCAL_SCRIPT_PATH_START and RC_LOCAL_SCRIPT_PATH_STOP were was originally
added in the conversion to meson based on the autotools name. In
4450894653 RC_LOCAL_SCRIPT_PATH_STOP was dropped.
We don't need to use such a long name.
2020-09-15 17:44:26 +02:00
Lennart Poettering
e67b818c2f unit: declare BusName= in all our units that are on the bus, event if they don't use Type=dbus
This information is always useful, so let's always declare it,
particular in the light of #16976.
2020-09-11 16:01:22 +02:00
Michael Biebl
9654645b62
Merge pull request #16850 from mbiebl/networkd-socket-activation
networkd: use socket activation when starting networkd
2020-08-29 16:12:46 +02:00
Kyle Russell
dd05042039 units: add missing usb-gadget.target 2020-08-28 18:57:58 +02:00
Michael Biebl
2c0dffe82d networkd: use socket activation when starting networkd
Add After=systemd-networkd.socket to avoid a race condition and networkd
falling back to the non-socket activation code.

Also add Wants=systemd-networkd.socket, so the socket is started when
networkd is started via `systemctl start systemd-networkd.service`.
A Requires is not strictly necessary, as networkd still ships the
non-socket activation code. Should this code be removed one day, the
Wants should be bumped to Requires accordingly.

See also 5544ee8516.

Fixes: #16809
2020-08-26 16:54:45 +02:00
Lennart Poettering
24da96a1bd units: turn on ProtectProc= wherever suitable 2020-08-24 20:11:14 +02:00
Lennart Poettering
7e31e90e58 units: order volatile-root after repart
Let's make sure systemd-repart can still see the real device before we
replace its mount with an overlay mount, and thus order repart before
volatile-root.

See: https://lists.freedesktop.org/archives/systemd-devel/2020-July/044896.html
2020-08-11 09:12:56 +02:00
Lennart Poettering
bbac7da2b3 units: order systemd-user-sessions.service after home.mount
This should make /home as automount work reasonably well.

If /home is an automount this has little effect at boot, because if the
automount is not triggered it doesn't matter how the associated mount is
ordered.

It does matter at shutdown however, where home.mount is likely active
now. There the ordering means we'll end sessions first, and only then
deactivate home.mount.

Fixes: #16291
2020-08-07 10:02:05 +02:00
Lennart Poettering
b89f5f7b03 units: downgrade Requires= to Wants=
Combining Requires= with Before= doesn't really make sense, since this
means we are requiring something that runs after us, which logically
cannot be fulfilled.

Let's hence downgrade Requires= to Wants= so that the ordering is kept
but no failure propagation implied.
2020-07-29 16:32:45 +02:00
Lennart Poettering
78490efca3 units: upgrade initrd check Conditions to Asserts
It's a bug if an initrd unit is run on the host. Hence let's upgrade the
conditions to asserts.
2020-07-29 16:32:03 +02:00
Zbigniew Jędrzejewski-Szmek
362a55fc14 Bump /tmp size back to 50% of RAM
This should be enough to fix https://bugzilla.redhat.com/show_bug.cgi?id=1856514.
But the limit should be significantly higher than 10% anyway. By setting a
limit on /tmp at 10% we'll break many reasonable use cases, even though the
machine would deal fine with a much larger fraction devoted to /tmp.
(In the first version of this patch I made it 25% with the comment that
"Even 25% might be too low.". The kernel default is 50%, and we have been using
that seemingly without trouble since https://fedoraproject.org/wiki/Features/tmp-on-tmpfs.
So let's just make it 50% again.)

See 7d85383edb.

(Another consideration is that we learned from from the whole initiative with
zram in Fedora that a reasonable size for zram is 0.5-1.5 of RAM, and that pretty
much all systems benefit from having zram or zswap enabled. Thus it is reasonable
to assume that it'll become widely used. Taking the usual compression effectiveness
of 0.2 into account, machines have effective memory available of between
1.0 - 0.2*0.5 + 0.5 = 1.4 (for zram sized to 0.5 of RAM) and
1.0 - 0.2*1.5 + 1.5 = 2.2 (for zram 1.5 sized to 1.5 of RAM) times RAM size.
This means that the 10% was really like 7-4% of effective memory.)

A comment is added to mount-util.h to clarify that tmp.mount is separate.
2020-07-29 11:07:04 +02:00
Zbigniew Jędrzejewski-Szmek
74c8e3c4e0 Revert "units: drop OnFailure= from .target units"
This reverts commit c7220ca802.

The removal was done as a reaction to the messages from systemd:
initrd-root-fs.target: Requested dependency OnFailure=emergency.target ignored (target units cannot fail).
initrd.target: Requested dependency OnFailure=emergency.target ignored (target units cannot fail).
initrd-root-device.target: Requested dependency OnFailure=emergency.target ignored (target units cannot fail).
initrd-fs.target: Requested dependency OnFailure=emergency.target ignored (target units cannot fail).
local-fs.target: Requested dependency OnFailure=emergency.target ignored (target units cannot fail).
...
But it seems that the messages themselves are wrong, and the units were OK.
2020-07-22 17:58:12 +02:00
Norbert Lange
55678b9eae build: skip installation of 2 files if feature is disabled
dont install systemd-update-utmp if utmp is disabled.
dont install systemd-initctl.service if sysv is disabled.
2020-07-18 13:50:39 +09:00
Lennart Poettering
048b4dc2e1 units: tweak udev unit descriptions 2020-06-08 16:53:37 +02:00
Zbigniew Jędrzejewski-Szmek
41a7c3bf5d units: uppercase the description
https://github.com/systemd/systemd/pull/15982#pullrequestreview-422536495
2020-06-02 14:14:20 +02:00
Zbigniew Jędrzejewski-Szmek
d1109e12c0 udevd: update snippet string
Repeating the unit name in the description is not useful, and "manages devices"
is too cryptic.
2020-05-30 17:15:20 +02:00
Yu Watanabe
27cd09442f
Merge pull request #15942 from poettering/pass-pktinfo
disable PassCredentials= on networkd netlink socket, enable NETLINK_PKTINFO instead
2020-05-29 15:23:15 +09:00
Lennart Poettering
871dc8d644 homed: enable userdb too if homed is requested
Strictly speaking you can run homed without userdb. But it doesn't
really make much sense: they go hand in hand and implement the same
concepts, just for different sets of users. Let's hence disable both
automatically by default if homed is requested.

(We don't do the reverse: opting into userdbd shouldn't mean that you
are OK with homed.)

And of course, users can always deviate from our defaults easily, and
turn off userbd again right-away if they don't like it, and things will
generally work.
2020-05-28 23:38:29 +02:00
Lennart Poettering
43007b302e networkd: clean up NETLINK_PKTINFO vs. SO_PASSCRED confusion
We actually care for NETLINK_PKTINFO, not for SO_PASSCRED, hence when
allocating the netlink socket, configure things accordingly.

Tracked down by Benjamin Robin, see:

https://github.com/systemd/systemd/pull/15571#issuecomment-633213747
2020-05-27 22:40:56 +02:00
Lennart Poettering
6bce17455e
Merge pull request #15226 from benzea/benzea/xdg-autostart-generator
xdg-autostart-generator: a generator for XDG autostart files
2020-05-27 18:41:01 +02:00
Benjamin Berg
8feca2472c xdg-autostart-generator: Add a generator for XDG autostart files
This generator can be used by desktop environments to launch autostart
applications and services. The feature is an opt-in, triggered by
xdg-desktop-autostart.target being activated.

Also included is the new binary xdg-autostart-condition. This binary is
used as an ExecCondition to test the OnlyShowIn and NotShowIn XDG
desktop file keys. These need to be evaluated against the
XDG_CURRENT_DESKTOP environment variable which may not be known at
generation time.

Co-authored-by: Henri Chain <henri.chain@enioka.com>
2020-05-27 09:02:10 +02:00
Lennart Poettering
021acbc188 units: remove KillMode=process in our regular gettys
In our regular gettys the actual shell commands live the the session
scope anyway (as long as logind is used). Hence, let's avoid
KillMode=process, it serves no purpose and is simply unsafe since it
disables systemd's own process lifecycle management.
2020-05-26 23:52:09 +02:00
Lennart Poettering
48432791ac units: don't set PrivateNetwork= in systemd-homed.service
We want to watch USB sticks being plugged in, and that requires
AF_NETLINK to work correctly and get the host's events. But if we live
in a network namespace AF_NETLINK is disconnected too and we'll not get
the host udev events.

Fixes: #15287
2020-05-26 23:37:44 +02:00
Lennart Poettering
7257f717c1
Merge pull request #15920 from keszybz/userwork-proc-title
Avoid log noise when setting proc titles and some doc updates
2020-05-26 18:29:06 +02:00
Norbert Lange
6589a56972 dont install systemd-initctl, runlevel, telinit if no SYSV compat
systemd-initctl executable is still built.
2020-05-26 15:04:36 +02:00
Zbigniew Jędrzejewski-Szmek
201632e314 tree-wide: s/time-out/timeout/g
See 3f9a0a522f for justification.
2020-05-26 10:28:59 +02:00
Norbert Lange
cdf7ad38b6 allow removal of initrd services 2020-05-19 10:19:18 +02:00
Topi Miettinen
7d85383edb tree-wide: add size limits for tmpfs mounts
Limit size of various tmpfs mounts to 10% of RAM, except volatile root and /var
to 25%. Another exception is made for /dev (also /devs for PrivateDevices) and
/sys/fs/cgroup since no (or very few) regular files are expected to be used.

In addition, since directories, symbolic links, device specials and xattrs are
not counted towards the size= limit, number of inodes is also limited
correspondingly: 4MB size translates to 1k of inodes (assuming 4k each), 10% of
RAM (using 16GB of RAM as baseline) translates to 400k and 25% to 1M inodes.

Because nr_inodes option can't use ratios like size option, there's an
unfortunate side effect that with small memory systems the limit may be on the
too large side. Also, on an extremely small device with only 256MB of RAM, 10%
of RAM for /run may not be enough for re-exec of PID1 because 16MB of free
space is required.
2020-05-13 00:37:18 +02:00
Zbigniew Jędrzejewski-Szmek
cd7e1e1a7f units: change description of systemd-logind.service
"Login Service" doesn''t explain much, esp. considering that logind is actually is
for logins. I think "User Login Management" is better, but not that great either.
Suggestions welcome.
2020-05-05 22:34:17 +02:00
Lennart Poettering
846acb6798 binfmt: also unregister binfmt entries from unit
We unregister binfmt_misc twice during shutdown with this change:

1. A previous commit added support for doing that in the final shutdown
   phase, i.e. when we do the aggressive umount loop. This is the robust
   thing to do, in case the earlier ("clean") shutdown phase didn't work
   for some reason.

2. This commit adds support for doing that when systemd-binfmt.service
   is stopped. This is a good idea so that people can order mounts
   before the service if they want to register binaries from such
   mounts, as in that case we'll undo the registration on shutdown
   again, before unmounting those mounts.

And all that, just because of that weird "F" flag the kernel introduced
that can pin files...

Fixes: #14981
2020-04-23 17:14:45 +02:00
Lennart Poettering
e46736fbb6 units: use correct path to refer to plymouth
This doesn't really matter, since in non-/usr-merged systems plymouth
needs to be in /bin and on merged ones it doesn't matter, but it is
still prettier to insert the right path, and avoid /bin on merged
systems, since it's just a compat symlink.

Replaces: #15351
2020-04-16 16:33:01 +02:00
Lennart Poettering
b0c1a07654 units: make sure systemd-pstore stops at shutdown
This doesn't matter too much given that the service doesn't do anything
on shutdown, but let's still stop it to make things cleaner.
2020-04-08 16:29:58 +02:00
Lennart Poettering
e0f968ad96 units: drop systemd-remount-fs.service dependency from more services
All services using StateDirectory= don't need the explicit dep anymore,
let's hence drop it everywhere.
2020-04-08 16:29:41 +02:00
Lennart Poettering
0c978faa16 units: drop dependency on systemd-remount-fs.service from systemd-pstore.service
This dependency is now generated automatically given we use
StateDirectory=. Moreover the combination of Wants= and After= was too
strong anway, as whether remount-fs is pulled in or not should not be up
to systemd-pstore.service, and in fact is part of the initial
transaction anyway.
2020-04-08 16:29:40 +02:00
Lennart Poettering
167241912f units: pull in systemd-pstore.service from sysinit.target
sysinit.target is the target our early boot services are generally
pulled in from, make systemd-pstore.service not an exception of that.

Effectively this doesn't mean much, either way our unit is part of the
initial transaction.
2020-04-08 16:29:24 +02:00
Topi Miettinen
cabc1c6d7a units: add ProtectClock=yes
Add `ProtectClock=yes` to systemd units. Since it implies certain
`DeviceAllow=` rules, make sure that the units have `DeviceAllow=` rules so
they are still able to access other devices. Exclude timesyncd and timedated.
2020-04-07 15:37:14 +02:00
Lennart Poettering
fdfe909123 units: run systemd-repart only if there's configuration for it 2020-04-02 17:07:48 +02:00
Lennart Poettering
aade0c3b6e Revert "units: make systemd-repart.service installable"
This reverts commit 7e1ed1f3b2.

systemd-repart is not a user service that should be something people
enable/disable, instead it should just work if there's configuration for
it. It's like systemd-tmpfiles, systemd-sysusers, systemd-load-modules,
systemd-binfmt, systemd-systemd-sysctl which are NOPs if they have no
configuration, and thus don't hurt, but cannot be disabled since they
are too deep part of the OS.

This doesn't mean people couldn't disable the service if they really
want to, there's after all "systemctl mask" and build-time disabling,
but those are OS developer facing instead of admin facing, that's how it
should be.

Note that systemd-repart is in particular an initrd service, and so far
enable/disable state of those is not managed anyway via "systemctl
enable/disable" but more what dracut decides to package up and what not.
2020-04-02 17:04:59 +02:00
Zbigniew Jędrzejewski-Szmek
4e561c6200
Merge pull request #15109 from keszybz/units-make-installable
Make homed/userdbd/repart services installable (to allow uninstalling)
2020-04-02 10:21:29 +02:00
Lennart Poettering
286fe8ee21 units: do not pull in home.mount from systemd-homed.service
/home is posibly a remote file system. it makes sense to order homed
after it, so that we can properly enumerate users in it, but we probably
shouldn't pull it in ourselves, and leave that to users to configure
otherwise.

Fixes: #15102
2020-03-31 15:22:48 +02:00
Zbigniew Jędrzejewski-Szmek
ead7af3093 units: make systemd-userdbd.{socket,service} installable
It's lightweight and generally useful, so it should be enabled by default. But
users might want to disable it for whatever reason, and things should be fine
without it, so let's make it installable so it can be disabled if wanted.

Fixes #15175.
2020-03-31 14:55:16 +02:00
Zbigniew Jędrzejewski-Szmek
5ef9eda17f units: make systemd-homed.service installable
Fixes #15083. Users might want to disable homed if not used to save resources.
2020-03-31 14:55:14 +02:00
Zbigniew Jędrzejewski-Szmek
7e1ed1f3b2 units: make systemd-repart.service installable
This essentially adds another layer of configurability:
build disable, this, presence of configuration. The default is
set to enabled, because the service does nothing w/o config.
2020-03-31 14:51:04 +02:00
Franck Bui
e730db6c90 systemd-network-generator.service: network-pre.target is a passive target unit 2020-03-27 18:30:57 +01:00
Balint Reczey
cdc6c95737 units: Don't mount tracefs in LXC
Mounting tracefs fails in unprivileged LXC containers and latest LXD
(3.23) bind mounts tracefs already.

Fixes https://github.com/lxc/lxd/issues/7059
2020-03-23 08:34:48 +01:00
Zbigniew Jędrzejewski-Szmek
b5947b5b10 homed: replace "home directory" with "home area" in a few places 2020-03-11 13:43:19 +01:00
Yu Watanabe
5197b41fac
Merge pull request #15022 from keszybz/make-units-remain-after-exit
Make units remain after exit
2020-03-06 21:14:36 +09:00
Zbigniew Jędrzejewski-Szmek
9cbf1e58f9 units: skip modprobe@.service if the unit appears to be already loaded
Possible alternative to #14819.

For me, setting RemainAfterExit=yes would be OK, but if people think that it
might cause issues, then this could be a reasonable alternative that still
let's us skip the invocation of the separate binary.
2020-03-05 18:43:50 +00:00
Zbigniew Jędrzejewski-Szmek
d48eea583f units: make systemd-network-generator.service stay around
Once done, its done, and shouldn't be run again.
2020-03-05 15:15:08 +01:00
Yu Watanabe
c1817e2528
Merge pull request #15023 from keszybz/network-generator-man
Man page for systemd-network-generator
2020-03-05 20:54:32 +09:00
Zbigniew Jędrzejewski-Szmek
4a29c185b7 man: add systemd-network-generator.service(8)
It's a bit bare-bones, but it should be enough to point the reader in the right
direction.
2020-03-05 08:20:06 +01:00
Zbigniew Jędrzejewski-Szmek
9fd32ff7d3 units: restore RemainAfterExit=yes in systemd-vconsole-setup.service
This reverts the second part of 8125e8d38e.
The first part was reverted in 750e550eba.
The problem starts when s-v-s.s is pulled in by something that is then pulled
in by sysinit.target. Every time a unit is started, systemd recursively checks
all dependencies, and since sysinit.target is pull in by almost anything, we'll
start s-v-s.s over and over. In particular, plymouth-start.service currently
has Wants=s-v-s.s and After=s-v-s.s.
2020-03-05 08:13:49 +01:00
Zbigniew Jędrzejewski-Szmek
a3558e7952 units: do not ignore return value from systemd --user
This minus has been there since the unit was added in
d42d27ead9. I think the idea was not cause things
to fail if the user instance doesn't work. But ignoring the return value
doesn't seem to be the right way to approach the problem. In particular, if
the program fails to run, we'll get a bogus fail state, see
https://bugzilla.redhat.com/show_bug.cgi?id=1727895#c1:

with the minus:
$ systemctl start user@1002
Job for user@1002.service failed because the service did not take the steps required by its unit configuration.
See "systemctl status user@1002.service" and "journalctl -xe" for details.

without the minus:
$ systemctl start user@1002
Job for user@1002.service failed because the control process exited with error code.
See "systemctl status user@1002.service" and "journalctl -xe" for details.
2020-03-05 04:49:37 +09:00
Kevin P. Fleming
3b355677b8 RequireMountsFor in systemd-nspawn should wait for machine mount
This patch modifies the RequireMountsFor setting in systemd-nspawn@.service to wait for the machine instance directory to be mounted, not just /var/lib/machines.

Closes #14931
2020-03-02 19:37:51 +09:00
Guillaume Douézan-Grard
f4665664c4 units: disable ProtectKernelLogs for machined
machined needs access to the host mount namespace to propagate bind
mounts created with the "machinectl bind" command. However, the
"ProtectKernelLogs" directive relies on mount namespaces to make the
kernel ring buffer inaccessible. This commit removes the
"ProtectKernelLogs=yes" directive from machined service file introduced
in 6168ae5.

Closes #14559.
2020-03-02 14:49:14 +09:00
Balint Reczey
287f506c32 pstore: Don't start systemd-pstore.service in containers
Usually it is not useful and can also fail making
boot-and-services autopkgtest fail.
2020-02-27 14:26:34 +01:00
Norbert Lange
aaaf42cb44 units: add mount for tracefs
Kernel 4.1 separated the tracing system from the debugfs,
actual documentation already points to a different path
that needs this new mount to exist.

the old sysfs path will still be an automount in the debugfs,
created by the kernel (for now).

Signed-off-by: Norbert Lange <nolange79@gmail.com>
2020-02-26 23:40:44 +01:00
Zbigniew Jędrzejewski-Szmek
c7220ca802 units: drop OnFailure= from .target units
See c80a9a33d0, target units can't fail.
I guess we need to figure out some replacement functionality, but at least
let's avoid the warning from systemd for now.
2020-02-05 18:34:30 +01:00
Zbigniew Jędrzejewski-Szmek
dc9fd22d3d Merge pull request #14398 from poettering/mount-prep 2020-02-04 16:28:51 +01:00
Lennart Poettering
340cb115b3 units: define RuntimeDirectory= in systemd-journald.service
It doesn't get us much, but makes the differences between the templated
and non-templated versions a bit smaller.
2020-01-31 15:04:24 +01:00
Lennart Poettering
5591cd4e20 units: sort settings in systemd-journald.service again 2020-01-31 15:04:15 +01:00
Lennart Poettering
dc5437c78b journald: add ability to activate by varlink socket
If we have exit on idle, then operations such as "journalctl
--namespace=foo --rotate" should work even if the journal daemon is
currently not running.

(Note that we don't do activation by varlink for the main instance of
journald, I am not sure the deadlocks it might introduce are worth it)
2020-01-31 15:03:55 +01:00
Lennart Poettering
65c398c031 journald: add exit on idle 2020-01-31 15:03:44 +01:00
Lennart Poettering
1ee51fbd70 units: add unit files for instantiated journal daemons 2020-01-31 15:01:30 +01:00
Lennart Poettering
70a5db5822 home: add new systemd-homed service that can manage LUKS homes
Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2020-01-28 22:36:07 +01:00
Yu Watanabe
1b3cccfdac unit: add AF_ALG to systemd-networkd.service
networkd uses khash, and khash requires AF_ALG.
2020-01-28 15:34:04 +01:00
Lennart Poettering
a7e8855879 units: introduce blockdev@.target for properly ordering mounts/swaps against cryptsetup
Let's hook it into both cryptsetup-generator and gpt-auto-generator with
a shared implementation in generator.c

Fixes: #8472
2020-01-21 20:23:13 +01:00
Lennart Poettering
29ee6541a4 units: add unit file for systemd-repart to automatically run at boot 2020-01-20 17:42:03 +01:00
Zbigniew Jędrzejewski-Szmek
cdc6804b60 units: drop full paths for utilities in $PATH
This makes things a bit simpler and the build a bit faster, because we don't
have to rewrite files to do the trivial substitution. @rootbindir@ is always in
our internal $PATH that we use for non-absolute paths, so there should be no
functional change.
2020-01-20 16:50:16 +01:00
Lennart Poettering
d093b62c94 userdbd: add new service that can merge userdb queries from multiple clients 2020-01-15 15:28:17 +01:00
Lennart Poettering
d5016c21d7 units: tweaks to modprobe@.service
Let's use uppercase wording in the description string, like we usually
do.

Let's allow using this service in early boot.

If it's pulled into the initial transaction it's better to finish
loading this before sysinit.target.

Don't bother with this in containers that lack CAP_SYS_MODULE
2020-01-07 18:54:24 +01:00
Iain Lane
625077264b units: Split modprobing out into a separate service unit
Devices referred to by `DeviceAllow=` sandboxing are resolved into their
corresponding major numbers when the unit is loaded by looking at
`/proc/devices`. If a reference is made to a device which is not yet
available, the `DeviceAllow` is ignored and the unit's processes cannot
access that device.

In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe`
in `ExecStartPre=` to load some kernel modules. Those kernel modules
cause device nodes to become available when they are loaded: the device
nodes may not exist when the unit itself is loaded. This means that the
unit's processes will not be able to access the device since the
`DeviceAllow=` will have been resolved earlier and denied it.

One way to fix this would be to re-evaluate the available devices and
re-apply the policy to the cgroup, but this cannot work atomically on
cgroupsv1. So we fall back to a second approach: instead of running
`modprobe` via `ExecStartPre`, we move this out to a separate unit and
order it before the units which want the module.

Closes #14322.
Fixes: #13943.
2020-01-07 18:37:30 +01:00
Yu Watanabe
48d0248e6d network: bump netlink receive buffer size to 128M
Prompted by #14417.
2020-01-02 10:29:41 +01:00
Lennart Poettering
b895fa08e6 Revert "Drop dbus activation stub service"
This reverts commit 07125d24ee.

In contrast to what is claimed in #13396 dbus-broker apparently does
care for the service file to be around, and otherwise will claim
"Service Not Activatable" in the time between systemd starting up the
broker and connecting to it, which the stub service file is supposed to
make go away.

Reverting this makes the integration test suite pass again on host with
dbus-broker (i.e. current Fedora desktop).

Tested with dbus-broker-21-6.fc31.x86_64.
2019-12-20 17:28:12 +01:00
Zbigniew Jędrzejewski-Szmek
4186441bbd Revert "cryptsetup: umount encrypted devices before detaching it during shutdown"
This reverts commit 362c378291.

This commit introduced an ordering loop: remote-cryptsetup.target was both
before and after remote-fs-pre.target. It also globally ordered all cryptsetup
volumes before all mounts. Such global ordering is problematic if people have
stacked storage. Let's look for a different solution.

See https://github.com/systemd/systemd/pull/14378#discussion_r359460109.
2019-12-19 10:42:14 +01:00
Dimitri John Ledkov
f27bb6abd3 initrd: make udev cleanup service confict trigger and settle too
Otherwise, systemd-udev-trigger|settle.service that ran in the initrd may
ramain active, and never re-run again from the system root.

This is observed by forexample examining ESP with udevadm info, which in the
initrd has all the ID_* variables, and none of them in fully booted system.
2019-12-17 21:38:11 +01:00
Franck Bui
362c378291 cryptsetup: umount encrypted devices before detaching it during shutdown
This is done by ordering local-fs-pre.target and remote-fs-pre.target after
cryptsetup.target and remote-cryptsetup.target respectively.

Fixes: #8472
2019-12-05 11:43:05 +01:00
Franck Bui
1dc85eff1d crypsetup: introduce x-initrd.attach option
This option is an indication for PID1 that the entry in crypttab is handled by
initrd only and therefore it shouldn't interfer during the usual start-up and
shutdown process.

It should be primarily used with the encrypted device containing the root FS as
we want to keep it (and thus its encrypted device) until the very end of the
shutdown process, i.e. when initrd takes over.

This option is the counterpart of "x-initrd.mount" used in fstab.

Note that the slice containing the cryptsetup services also needs to drop the
usual shutdown dependencies as it's required by the cryptsetup services.

Fixes: #14224
2019-12-05 11:43:02 +01:00
Pascal de Bruijn
b4e2236a72 systemd-tmpfiles: don't install timer when service isn't installed either
Fixes: systemd-tmpfiles-clean.timer: Refusing to start, unit
systemd-tmpfiles-clean.service to trigger not loaded.
2019-11-22 14:30:37 +01:00