1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-22 17:35:35 +03:00
Commit Graph

4687 Commits

Author SHA1 Message Date
Jakub Sitnicki
d1813ba436 test: integration test for PassFileDescriptorsToExec= option
Check if socket file descriptors are passed to ExecXYZ= commands from the
socket unit depending on whether PassFileDescriptorsToExec= option is set.
2024-03-27 01:41:26 +08:00
Jakub Sitnicki
97df75d7bd socket: pass socket FDs to all ExecXYZ= commands but ExecStartPre=
Today listen file descriptors created by socket unit don't get passed to
commands in Exec{Start,Stop}{Pre,Post}= socket options.

This prevents ExecXYZ= commands from accessing the created socket FDs to do
any kind of system setup which involves the socket but is not covered by
existing socket unit options.

One concrete example is to insert a socket FD into a BPF map capable of
holding socket references, such as BPF sockmap/sockhash [1] or
reuseport_sockarray [2]. Or, similarly, send the file descriptor with
SCM_RIGHTS to another process, which has access to a BPF map for storing
sockets.

To unblock this use case, pass ListenXYZ= file descriptors to ExecXYZ=
commands as listen FDs [4]. As an exception, ExecStartPre= command does not
inherit any file descriptors because it gets invoked before the listen FDs
are created.

This new behavior can potentially break existing configurations. Commands
invoked from ExecXYZ= might not expect to inherit file descriptors through
sd_listen_fds protocol.

To prevent breakage, add a new socket unit parameter,
PassFileDescriptorsToExec=, to control whether ExecXYZ= programs inherit
listen FDs.

[1] https://docs.kernel.org/bpf/map_sockmap.html
[2] https://lore.kernel.org/r/20180808075917.3009181-1-kafai@fb.com
[3] https://man.archlinux.org/man/socket.7#SO_INCOMING_CPU
[4] https://www.freedesktop.org/software/systemd/man/latest/sd_listen_fds.html
2024-03-27 01:41:26 +08:00
Luca Boccassi
14a5217679 resolved: support reloading configuration at runtime
Drop connections and caches and reload config from files, to allow
for low-interruptions updates, and hook up to the usual SIGHUP and
ExecReload=. Mark servers and services configured directly via D-Bus
so that they can be kept around, and only the configuration file
settings are dropped and reloaded.

Fixes https://github.com/systemd/systemd/issues/17503
Fixes https://github.com/systemd/systemd/issues/20604
2024-03-26 13:36:42 +00:00
Luca Boccassi
9065908483 test: use /run/ instead of /etc/ in TEST-75-RESOLVE 2024-03-26 12:52:42 +00:00
Zbigniew Jędrzejewski-Szmek
c38e4e2fda
Merge pull request #29721 from poettering/systemd-project
New capsule@.service feature
2024-03-26 13:19:33 +01:00
Luca Boccassi
b1d18b96c4
Merge pull request #31801 from flatcar-hub/krnowak/sysext-config
systemd-sysext: Add support for env vars, ephemeral layers and some fixes
2024-03-26 09:23:19 +00:00
Yu Watanabe
857f29a772 test: add test cases for journalctl --facility=/--output=help
Follow-up for d44233503f.
2024-03-26 04:18:23 +09:00
Yu Watanabe
cbe884f13a test: add test cases for systemd-analyze --global
Follow-up for ac97053618.
2024-03-26 04:10:04 +09:00
Luca Boccassi
650421fb8e
Merge pull request #31730 from yuwata/network-dhcp-server-lease-file-follow-ups
network: several follow-ups for DHCP server lease file
2024-03-25 14:32:05 +00:00
Krzesimir Nowak
18c1ea41c1 test: Add cases for failures to import the hierarchy 2024-03-25 08:33:31 +01:00
Krzesimir Nowak
baaa167926 test, sysext: Actually fail the whole operation if sd-merge worker failed
This also fixes a wrong merge failure check.
2024-03-25 08:33:22 +01:00
Krzesimir Nowak
e2bdece284 test: Add test cases for sysext ephemeral-import mode 2024-03-25 08:30:09 +01:00
Krzesimir Nowak
153e7f7b24 test: Extend sysext tests with cases using ephemeral mode 2024-03-25 08:19:48 +01:00
Krzesimir Nowak
9245b547cc test: Extend sysext tests with cases using env var for mutable mode 2024-03-25 08:14:36 +01:00
Krzesimir Nowak
73cfa16d16 test: Fail sysext test if reusing a root directory 2024-03-25 08:14:36 +01:00
Luca Boccassi
22a36720bf test: explain how Ubuntu CI log URLs are created
Not trivially obvious, so add a couple of paragraph to explain it
2024-03-24 16:53:01 +01:00
networkException
f2cb9d17da bpf-socket-bind: fix unexpected behavior with either 0 allow or deny rules
This patch fixes an issue where, when not specifiying either at least one
`SocketBindAllow` or `SocketBindDeny` rule, behavior for the bind syscall
filtering would be unexpected.

For example, when trying to bind to a port with only "SocketBindDeny=any"
given, the syscall would succeed:

> systemd-run -t -p "SocketBindDeny=any" nc -l 8080

Expected with this set of rules (also in accordance with the documentation)
would be an Operation not permitted error.

This behavior occurs because a default initialized socket_bind_rule struct
matches what "any" represents. When creating the bpf list all elements get
default initialized, as such represeting "any". Seemingly it is necressarry
to set the size of the map to at least one, as such if no allow rule is
given default initialization and minimal map size cause one any allow rule
to be in the map, causing the behavior observed above.

This patch solves this by introducing a new "match nothing" magic stored in
the rule's address family and setting such a rule as the first one if no
rule is given, making sure that default initialized rule structs are never
used.

Resolves #30556
2024-03-24 11:08:58 +00:00
Adrian Vovk
269a3fe245 TEST-46-HOMED: Disable auth rate-limiting
Rate limiting authentication attempts in the test can cause somewhat
sporadic test failures: adding a test case might suddenly cause future
test cases to fail because of too many authentication attempts too
quickly

We're not trying to test the rate-limiting, we're trying to test the
functionality of homed. So we effectively disable rate-limiting on all
the home areas we create
2024-03-23 01:05:13 +00:00
Adrian Vovk
d94c7eef12 homework: Implement offline updates
This makes it possible to update a home record (and blob directory) of a
home area that's either completely absent (i.e. on a USB stick that's
unplugged) or just inaccessible due to lack of authentication
2024-03-23 01:05:13 +00:00
Adrian Vovk
5ec87d577f homework: Accept volume key from keyring
This bypasses authentication (i.e. user_record_authenticate) if the
volume key was loaded from the keyring and no secret section is
provided.

This also changes Update() and Resize() to always try and load the
volume key from the keyring. This makes the secret section optional for
these methods while still letting them function (as long as the home
area is active)
2024-03-23 01:05:13 +00:00
Daan De Meyer
27add528d7 test: Install test journals
Let's package these just like we package other test data.
2024-03-22 15:11:39 +01:00
Luca Boccassi
437eddcb41 test: run clean-again between tests, not at the end
So that we free up space for the next run, as we are seeing disk space
issues on Ubuntu CI due to the many images built and left around
2024-03-21 11:11:01 +00:00
Luca Boccassi
a82cf4902d test: delete private images on clean-again
Private images are not reused, they are unique to tests, so delete them
as they take a lot of disk space, and we are starting to run in /var/tmp
space issues on the Ubuntu CI
2024-03-21 11:08:18 +00:00
Yu Watanabe
bf995423fd test: add test case for issue #31776 2024-03-21 04:44:39 +09:00
Yu Watanabe
1c8e8ec0ff Revert "test: temporarily adjust the default mount rate limit"
This reverts commit 3f4b00a34a.

The issue #30573 seems to be fixed somehow. Let's revert the workaround.
2024-03-20 15:36:05 +01:00
Zbigniew Jędrzejewski-Szmek
7aed434371 Rename uid0 to run0
Naming is always a matter of preference, and the old name would certainly work,
but I think the new one has the following advantages:
- A verb is better than a noun.
- The name more similar to "the competition", i.e. 'sudo', 'pkexec', 'runas',
  'doas', which generally include an action verb.
- The connection between 'systemd-run' and 'run0' is more obvious.

There has been no release yet with the old name, so we can rename without
caring for backwards compatibility.
2024-03-19 16:37:22 +01:00
Yu Watanabe
93126bb0fa test-network: extend test case for DHCP server with null server address 2024-03-18 22:33:14 +09:00
Nick Rosbrook
6fec0fed10 shared/install: correctly install alias for units outside search path
Currently, if a unit file is enabled from outside of the search path,
and that unit has an alias, then the symlink ends up pointing outside of
the search path too. For example:

 $ cat /tmp/a.service
 [Service]
 ExecStart=sleep infinity

 [Install]
 Alias=b.service
 WantedBy=multi-user.target

 $ systemctl enable /tmp/a.service
 Created symlink /etc/systemd/system/a.service → /tmp/a.service.
 Created symlink /etc/systemd/system/b.service → /tmp/a.service.
 Created symlink /etc/systemd/system/multi-user.target.wants/a.service → /tmp/a.service.

This then means the alias is treated as a separate unit:

 $ systemctl start a.service
 $ sudo systemctl status a
 ● a.service
  Loaded: loaded (/etc/systemd/system/a.service; enabled; preset: enabled)
  Active: active (running) since Fri 2024-03-15 15:17:49 EDT; 9s ago
 Main PID: 769593 (sleep)
   Tasks: 1 (limit: 18898)
  Memory: 220.0K
     CPU: 5ms
  CGroup: /system.slice/a.service
          └─769593 sleep infinity

 Mar 15 15:17:49 six systemd[1]: Started a.service.
 $ sudo systemctl status b
 ○ b.service
  Loaded: loaded (/etc/systemd/system/b.service; alias)
  Active: inactive (dead)

To fix this, make sure the alias uses a target that is inside the search
path. Since the unit file itself is outside of the search path, a
symlink inside the search path will have been created already. Hence,
just point the alias symlink to that recently created symlink.
2024-03-18 11:58:07 +00:00
Luca Boccassi
48570c9273
Merge pull request #31811 from yuwata/network-pin-persistent-storage
network: pin file descriptor of persistent storage
2024-03-18 11:08:21 +00:00
Yu Watanabe
013359ac65 network: pin file descriptor of persistent storage
This also drop the support of /run/systemd/netif/persistent-storage-ready,
as the file is anyway removed when networkd is stopped.
Let's use $SYSTEMD_NETWORK_PERSISTENT_STORAGE_READY=1 instead on testing.
2024-03-16 01:12:05 +09:00
Zbigniew Jędrzejewski-Szmek
3df28dd9b6 test/TEST-46: drop whitespace after redirection operators 2024-03-15 16:07:58 +01:00
Lennart Poettering
a037f2eb9b test: add integration test for capsules 2024-03-14 11:34:04 +01:00
Mike Yuan
45bcab66a9
journal/cat: allow connecting output to specific journal namespace 2024-03-14 14:25:53 +08:00
Frantisek Sumsal
beffcd62f8 test: split logs from each test into separate files if requested
If both $ARTIFACT_DIRECTORY and $SPLIT_TEST_LOGS are set, split the
output from each test into a separate log file, so we don't have to load
one ginormous log file when checking the results.
2024-03-12 17:34:55 +01:00
Frantisek Sumsal
aec72d7901 test: clean up the integration test runner a bit 2024-03-12 17:34:55 +01:00
Yu Watanabe
06baee4ea3
Merge pull request #30021 from yuwata/dhcp-client-id-cleanups
dhcp-server: save bound leases to persistent storage, and load it on start
2024-03-12 13:40:09 +09:00
Ross Burton
59e33acc8e tests/run-unit-tests: add option to skip tests
In automated QA environments there may be tests that are known to fail,
and being able to skip them is useful to remove known failures from the
test log.

Signed-off-by: Ross Burton <ross.burton@arm.com>
2024-03-11 23:27:01 +00:00
Ross Burton
4a052a718a test/run-unit-tests: sort the test cases we're executing
When reading test logs manually it is a lot easier when the tests are
sorted by name rather than by disk order.

Signed-off-by: Ross Burton <ross.burton@arm.com>
2024-03-11 18:11:30 +00:00
Yu Watanabe
1c4411b7ff test-network: add test case for DHCP server lease file 2024-03-12 01:57:17 +09:00
Yu Watanabe
c84a5f5eaf test-network: add support for systemd-networkd-persistent-storage.service 2024-03-12 01:57:16 +09:00
Yu Watanabe
83cc18257e test-network: copy system unit files from build or source directory
Addresses https://github.com/systemd/systemd/pull/30021#issuecomment-1971090682.
2024-03-12 01:17:40 +09:00
Yu Watanabe
f66045c7d4 test-network: drop unused options and variables
This also renames several variables, and replace RuntimeError with
assert.
2024-03-12 01:14:40 +09:00
Lennart Poettering
cf1c8cdb87 resolved: expose raw RR resolver via Varlink too
Now that we have an address, hostname, and service resolve, at the last
kind of resovler we expose over D-Bus also to Varlink.
2024-03-06 19:00:53 +01:00
Luca Boccassi
ba6ec879bb
Merge pull request #31621 from poettering/resolved-proxy-do
resolved: proxy upstream local requests to our stub with DO bit set
2024-03-06 13:55:14 +00:00
Frantisek Sumsal
4e5a7e1923 test: use 'ahost' instead of 'hosts' where applicable
As explained in [0] the 'hosts' database uses deprecated
gethostbyname2() which uses AF_INET6 instead of AF_UNSPEC for IPv6
lookups which is broken and makes the test fail with disabled IPv6.

[0] https://github.com/systemd/systemd/pull/28136#issuecomment-1974901039
2024-03-06 01:15:30 +00:00
Lennart Poettering
df81adba88 ci: disable test that is now answered by knot
dig question with DNSSEC on will now be proxied upstream, i.e. to the
test knot server. This leads to different results, but the result isn't
tha tinteresting since we don't want to test knot, but resolved. Hence
comment this test.

There seems to be something wrong with the test though, as the upstream
server refused recursion, but if so it is not suitable as an upstream
server really, as resolved can only be client to a recursive resolver.
2024-03-05 15:29:19 +01:00
Frantisek Sumsal
7a63c5e550 test: explicitly set TERM=linux for TEST-69-SHUTDOWN
sulogin from the latest util-linux started falling back to vt102 instead
of linux, which makes screen sad (because we install only the linux
terminfo into the test image) and expect trips over the unexpected
warning. Let's just explicitly set TERM=linux before invoking screen to
avoid this.

+ make -C TEST-69-SHUTDOWN setup run
...
INFO:test-shutdown:log in and start screen
root
root
Last login: Sun Mar  3 13:19:31 from 18.191.105.60
-bash-5.2# screen
screen
Cannot find terminfo entry for 'vt102'.
-bash-5.2# ERROR:test-shutdown:Timeout exceeded.
2024-03-03 21:12:43 +01:00
Luca Boccassi
e440426221
Merge pull request #31587 from yuwata/udev-rps-follow-ups
udev: follow-ups for RPS setting
2024-03-02 11:47:44 +00:00
Yu Watanabe
4b35dab86a test-network: wait for the interface being processed by udevd
Otherwise, even if the interface is available, the requested config may
not be applied to the interface yet.

This also merges multiple tests for RPS setting. Hopefully the
performance of the test is improved.
2024-03-02 14:50:40 +09:00
Yu Watanabe
a39a2a8121 test-network: introduce udevadm() and friends 2024-03-02 14:50:40 +09:00