1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-26 03:22:00 +03:00
Commit Graph

67882 Commits

Author SHA1 Message Date
Luca Boccassi
3b3abf80f1
Merge pull request #29450 from YHNdnzj/run-mandatory
man/systemd.exec: document that API fs are required to setup namespacing
2023-10-04 23:30:46 +01:00
Yu Watanabe
b93bf1bf9f network: introduce [DHCPv4] RequestAddress= setting
This may be useful when requesting a specific address.

Closes #29437.
2023-10-05 06:58:08 +09:00
Yu Watanabe
5d896defeb network: skip to set request address when anonymized
In sd-dhcp-client.c, we do not set the option in the DHCPDISCOVER
message when anonymized, and the specified address is ignored
anyway. So, this does not change the behavior, but suppress
misleading debugging log in dhcp4_set_request_address().
2023-10-05 06:56:51 +09:00
Mike Yuan
723c3cd03c
man/systemd.exec: document that API fs are required to setup namespacing
Closes #27997
2023-10-05 05:31:05 +08:00
Mike Yuan
6460a89a1b
man/systemd.exec: suffix one more directory with / 2023-10-05 05:31:05 +08:00
Luca Boccassi
723ce80602
Merge pull request #29391 from lf-/jade/analyze-plot-tooltips
analyze: add tooltips with dependency information to "plot"
2023-10-04 21:15:52 +01:00
Lucas Adriano Salles
2de72ade08
Fix Positivo N14EP6 key toggle touchpad and programmable keys (#29448) 2023-10-05 05:06:34 +09:00
Lennart Poettering
3820f69713 stub: drop empty line 2023-10-04 17:59:57 +02:00
Lennart Poettering
4c376e58da markdown: add document listing TPM2 PCR measurements we make comprehensively
This is useful to write TPM event log decoders.
2023-10-04 15:38:48 +02:00
Yu Watanabe
0073f6c623 mmap-cache: each Window is owned by MMapFileDescriptor
And MMapFileDescriptor always references MMapCache, hence it is not
necessary Window to have a reference to MMapCache.

This also renames the list fields 'by_fd' -> 'windows', to make them
consistent with the name of the head.

No functional change, just refactoring.
2023-10-04 19:53:27 +09:00
Yu Watanabe
40f5e6a941 mmap-cache: merge mmap_cache_fd_get() with try_context() and find_mmap()
The post operations (attach the found or new window to a context, update
the keep_always flag, and calculate the address) in three steps are
equivalent, and the two searching logics are quite simple.
Let's merge them to decrease the total lines.

No functional change, just refactoring.
2023-10-04 19:53:27 +09:00
Yu Watanabe
81598f5ead mmap-cache: merge window_matches() and window_matches_fd()
Let's drop meaningless optimization, and always check if the window is
owned by the expected fd.
2023-10-04 19:53:27 +09:00
Yu Watanabe
1ed867d309 mmap-cache: merge mmap_try_harder() with make_room()
The function make_room() is short and only used by mmap_try_harder().
Let's merge them with short comments.

No functional change, just refactoring.
2023-10-04 19:53:27 +09:00
Luca Boccassi
714cb48a4f docs: fix typo in UEFI_SECURITY.md 2023-10-04 19:12:26 +09:00
Yu Watanabe
0096914023 sd-journal: drop unused argument for generic_array_bisect_plus_one() 2023-10-04 17:36:14 +09:00
Daan De Meyer
9c56d79e1c
Merge pull request #29386 from yuwata/mmap-cache-cleanups-part1
mmap-cache: several cleanups (part1)
2023-10-04 08:49:24 +02:00
Yu Watanabe
b5c8f47102 test-network: test SIP servers obtained by DHCP
For issue #29145.
2023-10-04 08:41:26 +02:00
Daan De Meyer
180d5aeaa7
Merge pull request #29403 from yuwata/journal-decouple-journald-and-journal-remote
journal: drop ManagedJournalFile and decouple journald and journal-remote
2023-10-04 07:55:52 +02:00
Jade Lovelace
6f39211f41 NEWS: systemd-analyze plot tooltips 2023-10-03 22:50:25 -07:00
Jade Lovelace
ebaf55499f analyze: add tooltips with dependency information to "plot"
This helps a lot with figuring out why units were started when they
were, rather than guessing there is a dependency relation. We could
perhaps also do fun JavaScript things in the future to highlight
dependencies on mouse-over.
2023-10-03 22:50:25 -07:00
Yu Watanabe
0558c86c78 sd-netlink: use secure_getenv()
Follow-up for 52afaee74b.

Fixes CID#1522326.
2023-10-04 07:48:30 +02:00
Yu Watanabe
12696a7dba po: fix invalid printf format specifier 2023-10-04 09:16:11 +09:00
Yu Watanabe
fcdd21ec6a tree-wide: fix typo 2023-10-04 08:58:10 +09:00
Yu Watanabe
31438511e0 sd-journal: drop unnecessary re-read of object
This reverts the following commits.
- a1640191b4
- 231741d355

These were done by my misunderstanding of the mmap cache behavior.

Also, this updates the comments added by
df04b9ed86.
2023-10-03 22:17:34 +01:00
Luca Boccassi
fdae874cfe
Merge pull request #29426 from ddstreet/tpm2_minor_changes
Minor commits for tpm2
2023-10-03 22:16:57 +01:00
Luca Boccassi
c4e0f0f301
Merge pull request #29428 from mrc0mmand/soft-reboot
test: spawn the to-be-killed-on-soft-reboot units with --collect
2023-10-03 22:13:32 +01:00
NRK
be1666886b macro: use __builtin_unreachable on NDEBUG
note that this slightly changes the semantic of assert when NDEBUG is
defined. if there's an extern function call (without attribute pure or
similar) then the compiler has to assume it has side effects and still
emit the function call.

whereas the old assert guaranteed that nothing will be evaluated on
NDEBUG.

Closes: https://github.com/systemd/systemd/issues/29408
2023-10-03 21:34:38 +02:00
Dan Streetman
639dca030b tpm2: cache TPM's supported ECC curves
This brings the tpm2_supports_ecc_curve() api in line with the other
tpm2_supports_*() functions, of returning a boolean.
2023-10-03 12:56:55 -04:00
Dan Streetman
db7fdf152b tpm2: change tpm2_unseal() to accept Tpm2Context instead of device string
This matches the change to tpm2_seal(), which now accepts a Tpm2Context instead
of a device string.

This also allows using the same TPM context for sealing and unsealing, which
will be required by (future) test code when sealing/unsealing using a transient
key.
2023-10-03 12:56:55 -04:00
Dan Streetman
7014006906 tpm2: use GREEDY_REALLOC_APPEND() in tpm2_get_capability_handles(), cap max value
Simplify the function with GREEDY_REALLOC_APPEND(). Also limit the size_t-sized
max value to UINT32_MAX since that's the maximum of the range this searches,
and the max parameter for tpm2_get_capability() is uint32_t.
2023-10-03 12:56:55 -04:00
Dan Streetman
171d5b69c0 tpm2: update tpm2 test for supported commands
The test expects TPM2_CC_FIRST - 1 and TPM2_CC_LAST + 1 to be unsupported, but
those are not necessarily invalid commands. Instead test known-invalid
commands. Also add some more valid commands.
2023-10-03 12:56:55 -04:00
Dan Streetman
73592a7cca tpm2: allow tpm2_make_encryption_session() without bind key
Allow providing no bind key, and use ESYS_TR_NONE instead.
2023-10-03 12:56:55 -04:00
Zbigniew Jędrzejewski-Szmek
db5d86f5b9 test-loopback: suppress warning about ignored unused result 2023-10-03 17:19:07 +01:00
Dan Streetman
f9a0ee7554 tpm2: downgrade most log functions from error to debug
Because most TPM2 functions here are 'library-like' functions, they should be
at debug level, not error level.

The only functions not reduced to logging at debug are tpm2_list_devices(),
since it is expected to print output, and the tpm2_parse_pcr_argument_*()
functions, since the system-wide parse_*_argument() functions generally log at
error level.
2023-10-03 17:13:50 +01:00
Frantisek Sumsal
2f397514ad test: spawn the to-be-killed-on-soft-reboot units with --collect
Otherwise they might leave stuff behind if they don't respond fast
enough to the first SIGTERM and get SIGKILLEd, which then breaks reusing
the unit name further in the test:

[ 2993.620849] H testsuite-82.sh[43]: + systemd-run -p Type=exec -p DefaultDependencies=no -p IgnoreOnIsolate=yes --unit=testsuite-82-nosurvive.service sleep infinity
[ 2993.628686] H systemd[1]: testsuite-82-nosurvive.service: About to execute: /usr/bin/sleep infinity
[ 2993.628886] H systemd[1]: testsuite-82-nosurvive.service: Forked /usr/bin/sleep as 65
[ 2993.629328] H systemd[1]: testsuite-82-nosurvive.service: Changed dead -> start
...
[ 2993.699892] H testsuite-82.sh[43]: + systemctl --no-block --check-inhibitors=yes soft-reboot
[ 2993.704326] H systemd-logind[41]: The system will soft-reboot now!
...
[ 3001.249302] H systemd[1]: Sending SIGKILL to PID 65 (sleep).
...
[ 3001.303158] H testsuite-82.sh[136]: + systemd-notify '--status=Second Boot'
...
[ 3001.409504] H testsuite-82.sh[136]: + systemd-run -p Type=exec --unit=testsuite-82-nosurvive.service sleep infinity
[ 3001.414061] H testsuite-82.sh[165]: Failed to start transient service unit: Unit testsuite-82-nosurvive.service was already loaded or has a fragment file.

Spotted in Ubuntu CI.
2023-10-03 16:40:49 +02:00
Frantisek Sumsal
399a8a5eb1 test: use --service-type= instead of -p Type= 2023-10-03 16:38:35 +02:00
Luca Boccassi
d3dde190c1 docs: fix spelling in UEFI_SECURITY.md
that that -> that
2023-10-03 12:40:42 +02:00
Zbigniew Jędrzejewski-Szmek
1c287c9ac5
Merge pull request #29420 from bluca/uefi_doc
Fixups for UEFI_SECURITY.md
2023-10-03 11:57:59 +02:00
Luca Boccassi
7f9231f0d8 docs: rephrase sentence about UKIs in UEFI_SECURITY.md 2023-10-03 10:12:36 +01:00
Luca Boccassi
e2ae5f0224 docs: rephrase sentence about addons measuring in UEFI_SECURITY.md 2023-10-03 10:08:33 +01:00
Yu Watanabe
fcf17d693c man: update the list of ignored options by Anonymize=yes
Closes #29362.
2023-10-03 10:02:02 +01:00
Luca Boccassi
8867122783
Merge pull request #29390 from yuwata/sd-netlink-make-default-timeout-configurable
sd-netlink: make the default timeout configurable
2023-10-02 22:59:07 +01:00
NRK
6c7b1ea1be udevadm: avoid side-effect in assert()
this was found when trying to use __builtin_assume() with clang:
https://github.com/systemd/systemd/pull/29409#issuecomment-1743575402
2023-10-02 22:58:45 +01:00
Dan Streetman
3ed342562a tpm2: edit tpm2_get_or_create_srk() comment
Adjust the comment to correct the return value, i.e. 1 for SRK created, 0 for
SRK already exists, <0 on error.
2023-10-02 22:58:13 +01:00
Luca Boccassi
359d4b04e8 docs: rename src/boot/efi/SECURITY.md as UEFI_SECURITY.md 2023-10-02 19:02:30 +01:00
Luca Boccassi
1f75b649e7 doc: add compiler hardening details to UEFI SECURITY.md 2023-10-02 18:27:13 +01:00
dependabot[bot]
273aca8b62 build(deps): bump systemd/mkosi
Bumps [systemd/mkosi](https://github.com/systemd/mkosi) from adaa41512aa30c952daae5ba0abcf2622d66b93b to a8ecff0defa132d729dcdab38380dcae31138e7e.
- [Release notes](https://github.com/systemd/mkosi/releases)
- [Changelog](https://github.com/systemd/mkosi/blob/main/NEWS.md)
- [Commits](adaa41512a...a8ecff0def)

---
updated-dependencies:
- dependency-name: systemd/mkosi
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-10-02 16:54:01 +00:00
Luca Boccassi
fdb0b47bf7
Merge pull request #29407 from CM4all/test-kernel-acl-dummy
src/test: fixups for kernels without ACL and net-dummy
2023-10-02 16:30:39 +01:00
Luca Boccassi
df3e378a5d
Merge pull request #29339 from bluca/mount_namespace_new_api
Use new mount API for bind/image mount tunnel
2023-10-02 16:04:26 +01:00
Benjamin Peterson
8ec951e8d5 resolve: tolerate merging a zero-ttl RR and a nonzero-ttl RR if not mDNS
resolved rejected RRsets containing a RR with a zero TTL and a RR with a nonzero TTL. In practice—see the linked issues—, this case triggered when an AF_UNSPEC query to a CNAMEd domain returned a zero TTL for the CNAME on one address family and a nonzero TTL for the CNAME on the other address family.

The zero-nonzero TTL check cites RFC 2181 § 5.2 in a comment. That section says DNS clients should reject any RRset containing differing TTLs, which the check only implements a very special case of. That the old behavior caused real-world false NXDOMAIN results is reason enough to completely ignore the RFC's recommendation. However, mDNS treats zero TTLs specially, so the error case needs to be kept for mDNS.

Fixes https://github.com/systemd/systemd/issues/22177
Fixes https://github.com/systemd/systemd/issues/20617
Fixes https://github.com/systemd/systemd/issues/19118
2023-10-02 16:47:36 +02:00