1
0
mirror of https://github.com/systemd/systemd.git synced 2024-10-30 06:25:37 +03:00
Commit Graph

955 Commits

Author SHA1 Message Date
Mike Yuan
f129d0e77c vconsole: allow setting default keymap through build option
Allow defining the default keymap to be used by
vconsole-setup through a build option. A template
vconsole.conf also gets populated by tmpfiles if
it doesn't exist.
2023-02-15 20:00:51 +00:00
Zbigniew Jędrzejewski-Szmek
3156024532 meson: enable -Wzero-length-bounds
This will warn if fake flexible arrays are re-introduced. I'm not using
-Werror=… because we may still get warnings when compiling against old kernel
headers. We can crank this up to error later.
2023-02-06 12:09:55 +01:00
Zbigniew Jędrzejewski-Szmek
fc5688375c meson: enable -Warray-bounds and -fstrict-flex-arrays
-fstrict-flex-arrays means that the compiler doesn't have to assume that any
trailing array is a flex array. I.e. unless the array is declared without a
specified size, only indices in the declared range are valid.

-Warray-bounds turns on the warnings about out-of-bounds array accesses.
-Warray-bounds=2 does some more warnings, with higher false positive rate. But
it doesn't seem to yield any false positives in our codebase, so enable it.

clang supports -Warray-bounds, but not -Warray-bounds=2.
gcc supports both.
gcc-13 supports -fstrict-flex-arrays.

See https://people.kernel.org/kees/bounded-flexible-arrays-in-c for a long
discussion of use in the kernel.
2023-02-06 12:09:55 +01:00
Zbigniew Jędrzejewski-Szmek
e4c7b5f517 core: split system/user job timeouts and make them configurable
Config options are -Ddefault-timeout-sec= and -Ddefault-user-timeout-sec=.
Existing -Dupdate-helper-user-timeout= is renamed to -Dupdate-helper-user-timeout-sec=
for consistency. All three options take an integer value in seconds. The
renaming and type-change of the option is a small compat break, but it's just
at compile time and result in a clear error message. I also doubt that anyone was
actually using the option.

This commit separates the user manager timeouts, but keeps them unchanged at 90 s.
The timeout for the user manager is set to 4/3*user-timeout, which means that it
is still 120 s.

Fedora wants to experiment with lower timeouts, but doing this via a patch would
be annoying and more work than necessary. Let's make this easy to configure.
2023-02-01 11:52:29 +00:00
Zbigniew Jędrzejewski-Szmek
2584e16cb7
Merge pull request #26236 from medhefgo/meson-fixes
meson: Fixes
2023-02-01 10:05:36 +01:00
Zbigniew Jędrzejewski-Szmek
a0d613ec43 meson: fail build on implicit int warnings 2023-02-01 00:01:03 +00:00
Frantisek Sumsal
9c45bfb2ac ukify: don't install ukify man page if ukify is not enabled
Checking for gnu-efi is not enough, since ukify can be explicitly
disabled.

Resolves: #26274
2023-01-31 23:57:28 +00:00
Jan Janssen
6249face77 meson: Remove unused variables 2023-01-27 17:47:09 +01:00
Luca Boccassi
a1429c645b meson: bump numbers for v253-rc1 2023-01-24 12:32:15 +00:00
Jan Janssen
a6cabc90c8 meson: Use python module for detection 2023-01-23 14:54:28 +01:00
Jan Janssen
cd4300f30f meson: Move bootctl sources defintion to its own file
The root meson.build file is already large enough.
2023-01-23 14:41:26 +01:00
Daan De Meyer
09595fd5f2 ukify: Downgrade required python version to 3.9 2023-01-20 13:55:11 +01:00
Ludwig Nussel
8702496bfb bootctl: unlink and cleanup functions
The unlink command removes an entry from the ESP including
referenced files that are not referenced in other entries. That is
useful eg to have multiple entries that use the same kernel with
different options.

The cleanup command removes all files that are not referenced by any
entry.
2023-01-19 14:24:43 +01:00
Ludwig Nussel
d7efb17068 meson: ukify depends on GNU_EFI
ukify is rather efi specific and the manpage is already conditional on
HAVE_GNU_EFI so make the program also depend on HAVE_GNU_EFI
2023-01-19 11:42:18 +00:00
Lennart Poettering
a56182ddac
Merge pull request #26082 from kraxel/uki
bootctl: add is-uki command
2023-01-18 18:10:30 +01:00
Gerd Hoffmann
53c368d71b bootctl: add kernel-identity command
The command takes a kernel as argument and checks what kind of kernel
the image is.  Returns one of uki, pe or unknown.
2023-01-18 14:32:14 +01:00
Lennart Poettering
17984c5551 pcrphase: make tool more generic, reuse for measuring machine id/fs uuids
See: #24503
2023-01-17 09:42:16 +01:00
Lennart Poettering
94c0c85e30 cryptsetup: add tpm2-measure-pcr= and tpm2-measure-bank= crypttab options
These options allow measuring the volume key used for unlocking the
volume to a TPM2 PCR. This is ideally used for the volume key of the
root file system and can then be used to bind other resources to the
root file system volume in a secure way.

See: #24503
2023-01-17 09:42:16 +01:00
Zbigniew Jędrzejewski-Szmek
493cd5034c meson: use 0|1 for SD_BOOT
We converted to not using #ifdef for most of our defines because the syntax is
nicer and we are protected against typos and can set -Werror=undef. Let's do
the same for SD_BOOT. The define is nicely hidden in build.h for normal builds,
and for EFI builds we were already setting SD_BOOT on the commandline.
2023-01-10 14:25:57 +01:00
Jan Janssen
d84bdadb43 boot: Remove option TPM PCR compat option
It says remove in 2023; happy to oblige.
2023-01-09 09:52:55 +01:00
Luca Boccassi
da035a3a24 p11kit: switch to dlopen() 2022-12-19 14:49:01 +01:00
Lennart Poettering
baafb202f8 bootctl: split out "install" verb too 2022-12-19 12:08:02 +01:00
Lennart Poettering
da36788f65 bootctl: split out "status" verb too 2022-12-19 12:08:02 +01:00
Lennart Poettering
6d8ca25766 bootctl: split out "set-efivar" verbs, too 2022-12-19 12:06:33 +01:00
Lennart Poettering
6e975890a6 bootctl: also split out 'systemd-efi-options' verb 2022-12-19 11:52:09 +01:00
Lennart Poettering
85f875357b bootctl: split out random seed verb, too 2022-12-19 11:43:19 +01:00
Lennart Poettering
34ea7e0232 bootctl: let's start splitting up bootctl like we did for systemctl and others 2022-12-19 11:43:19 +01:00
asavah
2736a0c64e meson: fix cross-compilation of LONG_MAX
https://github.com/systemd/systemd/pull/25618#issuecomment-1355019553
2022-12-18 10:24:14 +01:00
Lennart Poettering
a579990277
Merge pull request #25180 from keszybz/ukify
ukify: add helper to create UKIs
2022-12-08 15:11:18 +01:00
Zbigniew Jędrzejewski-Szmek
a1d6dbb1c9 tests: add pytest tests for ukify
Some gymnastics were needed to import ukify as a module. Before the file
was templated, this was trivial: insert the directory in sys.path, call import.
But it's a real pain to import the unsuffixed file after processing. Instead,
the untemplated file is imported, which works well enough for tests and is
very simple.

The tests can be called via pytest:
  PATH=build/:$PATH pytest -v src/ukify/test/test_ukify.py
or directly:
  PATH=build/:$PATH src/ukify/test/test_ukify.py
or via the meson test machinery output:
  meson test -C build test-ukify -v
or without verbose output:
  meson test -C build test-ukify

Zekret files are obfuscated using base64.
2022-12-07 15:52:37 +01:00
Zbigniew Jędrzejewski-Szmek
30ec2eaef5 meson,ukify: hook up ukify, add --version option
The option is added because we have a similar one for kernel-install. This
program requires python, and some people might want to skip it because of this.

The tool is installed in /usr/lib/systemd for now, since the interface might
change.

A template file is used, but there is no .in suffix.
The problem is that we'll later want to import the file as a module
for tests, but recent Python versions make it annoyingly hard to import
a module from a file without a .py suffix. imp.load_sources() works, but it
is deprecated and throws warnings.
importlib.machinery.SourceFileLoader().load_module() works, but is also
deprecated. And the documented replacements are a maze of twisted little
callbacks that result in an empty module.
So let's take the easy way out, and skip the suffix which makes it easy
to import the template as a module after adding the directory to sys.path.
2022-12-07 15:32:13 +01:00
Zbigniew Jędrzejewski-Szmek
6ed3aca5c3 meson: build a standalone version of systemd-shutdown
I'd like to use this as a basis for an exitrd:

When compiled with -Dstandalone-binaries=true -Db_lto=true -Dbuildtype=release,
the new file is 800k. It's more than I'd like, but still quite a bit less
than libsystemd-shared.so, which is 3800k.
2022-12-06 10:15:54 +01:00
Zbigniew Jędrzejewski-Szmek
9702d82414 test: do the --help/--version checks for repart.standalone too 2022-12-06 10:15:54 +01:00
Zbigniew Jędrzejewski-Szmek
a5fac1df27 manager: define a string constant for LONG_MAX and use that for sysctl
This moves the formatting of the constant to compilation time and let's us
avoid asprintf() in the very hot path of initial boot.
2022-12-03 11:59:03 +01:00
Zbigniew Jędrzejewski-Szmek
50f2c32cd5 tests: add a simple test that bootctl output is valid json
python's json.tool module is used because it does validation. jq is more forgiving.
Also, json is in the stdlib, so it should be always available.
2022-12-01 18:01:00 +01:00
Lennart Poettering
f8cf3d19d2 fdisk: introduce common fdisk_new_context_fd() helper
We do the same thing over and over again and it's a bit ugly, hence
let's unify the code for it at one common place.
2022-11-26 11:28:05 +09:00
Zbigniew Jędrzejewski-Szmek
10783aef2e meson: resort imports 2022-11-25 18:33:52 +01:00
Yu Watanabe
8077dc9657
Merge pull request #25389 from fbuihuu/update-test-for-opensuse
Update test/ for openSUSE
2022-11-19 05:58:51 +09:00
Franck Bui
cc77a56532 meson: install test-kernel-install only when -Dkernel-install=true
This patch fixes the following build failure:

  meson.build:3853:8: ERROR: Unknown variable "test_kernel_install_sh".

Fixes #25432.
2022-11-18 11:09:35 +01:00
Vitaly Kuznetsov
155c51293d shared/tpm2-util: Fix "Error: Esys invalid ESAPI handle (40000001)" warning
systemd-cryptenroll complains (but succeeds!) upon binding to a signed PCR
policy:

$ systemd-cryptenroll --unlock-key-file=/tmp/passphrase --tpm2-device=auto
  --tpm2-public-key=... --tpm2-signature=..." /tmp/tmp.img

ERROR:esys:src/tss2-esys/esys_iutil.c:394:iesys_handle_to_tpm_handle() Error: Esys invalid ESAPI handle (40000001).
WARNING:esys:src/tss2-esys/esys_iutil.c:415:iesys_is_platform_handle() Convert handle from TPM2_RH to ESYS_TR, got: 0x40000001
ERROR:esys:src/tss2-esys/esys_iutil.c:394:iesys_handle_to_tpm_handle() Error: Esys invalid ESAPI handle (40000001).
WARNING:esys:src/tss2-esys/esys_iutil.c:415:iesys_is_platform_handle() Convert handle from TPM2_RH to ESYS_TR, got: 0x4000000
New TPM2 token enrolled as key slot 1.

The problem seems to be that Esys_LoadExternal() function from tpm2-tss
expects a 'ESYS_TR_RH*' constant specifying the requested hierarchy and not
a 'TPM2_RH_*' one (see Esys_LoadExternal() -> Esys_LoadExternal_Async() ->
iesys_handle_to_tpm_handle() call chain).

It all works because Esys_LoadExternal_Async() falls back to using the
supplied values when iesys_handle_to_tpm_handle() fails:

    r = iesys_handle_to_tpm_handle(hierarchy, &tpm_hierarchy);
    if (r != TSS2_RC_SUCCESS) {
        ...
        tpm_hierarchy = hierarchy;
    }

Note, TPM2_RH_OWNER was used on purpose to support older tpm2-tss versions
(pre https://github.com/tpm2-software/tpm2-tss/pull/1531), use meson magic
to preserve compatibility.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
2022-11-16 21:45:57 +01:00
Daan De Meyer
a54219532d missing_syscall: Add rt_tgsigqueueinfo() 2022-11-16 15:03:41 +01:00
Daan De Meyer
48a09a8fff repart: Do offline encryption instead of online
Offline encryption can be done without mounting the luks device. For
now we still use loop devices to split out the partition we want to
write to but in a later commit we'll replace this with a regular file.

For offline encryption, we need to keep 2x the luks header size space
free at the end of the partition, so this means our encrypted partitions
will be 16M larger than before.
2022-11-15 20:07:54 +01:00
Yu Watanabe
251dc2f14b meson: install systemd-ac-power under /usr/bin
And test the its help message.

The program is useful for e.g. scripts that conditionalize their tasks
to be invoked only when running on AC power.
2022-11-10 23:04:23 +01:00
Cristian Rodríguez
afd8e1d945 build: Use -fstrict-flex-arrays=1 if supported
Due to "historical reasons" both gcc and clang treat *all* trailing
arrays members as flexible arrays, this has an evil side effect
of inhibiting bounds checks on such members as __builtin_object_size
cannot say for sure that:

struct {
...
type foo[3];
}

has a trailing foo member of fixed size rather than unspecified.

Ideally we should use -fstrict-flex-arrays as is, but we have to
tolerate kernel uapi headers that use [0] and third party libraries
written in c89 that may use [1] like curl.
2022-11-10 21:07:59 +09:00
Frantisek Sumsal
3a21c554a5 meson: add version.h dependency to more components
Follow-up to c47511da7e.

```
archlinux_systemd_ci: In file included from ../build/src/dissect/dissect.c:15:
archlinux_systemd_ci: ../build/src/basic/build.h:4:10: fatal error: version.h: No such file or directory
archlinux_systemd_ci:     4 | #include "version.h"
archlinux_systemd_ci:       |          ^~~~~~~~~~~
archlinux_systemd_ci: compilation terminated.
```

```
archlinux_systemd_ci: In file included from ../build/src/journal/cat.c:13:
archlinux_systemd_ci: ../build/src/basic/build.h:4:10: fatal error: 'version.h' file not found
archlinux_systemd_ci: #include "version.h"
archlinux_systemd_ci:          ^~~~~~~~~~~
archlinux_systemd_ci: 1 error generated.
```

```
archlinux_systemd_ci: In file included from ../build/src/sysext/sysext.c:10:
archlinux_systemd_ci: ../build/src/basic/build.h:4:10: fatal error: version.h: No such file or directory
archlinux_systemd_ci:     4 | #include "version.h"
archlinux_systemd_ci:       |          ^~~~~~~~~~~
archlinux_systemd_ci: compilation terminated.
archlinux_systemd_ci: FAILED: systemd-inhibit.p/src_login_inhibit.c.o
```

```
archlinux_systemd_ci: In file included from ../build/src/login/inhibit.c:12:
archlinux_systemd_ci: ../build/src/basic/build.h:4:10: fatal error: version.h: No such file or directory
archlinux_systemd_ci:     4 | #include "version.h"
archlinux_systemd_ci:       |          ^~~~~~~~~~~
archlinux_systemd_ci: compilation terminated.
```

...
2022-11-09 18:22:58 +00:00
Zbigniew Jędrzejewski-Szmek
c47511da7e meson: add version.h as dependency to more targets
version.h can be generated after compilation starts, creating a race condition
between compilation of various .c files and creation of version.h. Let's add it
as a dependency to more build targets that require version.h or build.h.

So far we played whack'a'mole by adding versiondep whenever compilation failed.
In principle any target which includes compilation (i.e. any that has .c
sources directly), could require this. I don't understand why we didn't see
more failures… But it seems reasonable to just add the dependency more widely.
2022-11-08 18:18:34 +01:00
Samuel Thibault
ede5a78f50 shutdown: Add Xen kexec support
In the Xen case, it's the hypervisor which manages kexec. We thus
have to ask it whether a kernel is loaded, instead of relying on
/sys/kernel/kexec_loaded.
2022-11-02 20:47:41 +01:00
Daan De Meyer
1c265fcd59 namespace: Add hidepid/subset support check
Using fsopen()/fsconfig(), we can check if hidepid/subset are supported to
avoid the noisy logs from the kernel if they aren't supported. This works
on centos/redhat 8 as well since they've backported fsopen()/fsconfig().
2022-11-01 16:12:58 +01:00
Zbigniew Jędrzejewski-Szmek
3c3e14a7d8 meson: systemd-repart.standalone
Repart is growing into an important tool on its own, and users might
want to install newer versions on systems that have older systemd. Let's
make this easier by providing a standalone binary.

Related to https://github.com/systemd/mkosi/issues/1228.
2022-10-31 21:12:55 +01:00
Luca Boccassi
034fe54cd5
Merge pull request #24958 from Werkov/meson-generated-directives
Generate dirrectives for fuzzer tests
2022-10-31 21:04:30 +01:00