1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-23 21:35:11 +03:00
Commit Graph

128 Commits

Author SHA1 Message Date
Krzesimir Nowak
33cb10f68d docs: Document SYSTEMD_SYSEXT_MUTABLE_MODE env var 2024-03-25 08:14:36 +01:00
Luca Boccassi
15d4bedf3d
Merge pull request #31778 from yuwata/kbd-util
kbd-util: allow to override the default keymap directories
2024-03-18 12:20:36 +00:00
Yu Watanabe
013359ac65 network: pin file descriptor of persistent storage
This also drop the support of /run/systemd/netif/persistent-storage-ready,
as the file is anyway removed when networkd is stopped.
Let's use $SYSTEMD_NETWORK_PERSISTENT_STORAGE_READY=1 instead on testing.
2024-03-16 01:12:05 +09:00
Yu Watanabe
e852f10cb4 kbd-util: allow to override the default keymap directories
This introduces $SYSTEMD_KEYMAP_DIRECTORIES environment variable to
override the hardcoded keymap directories.

I think it is not necessary to provide the first class configuration
option for controlling the keymap directories, but it is not good to
hardcode the paths. So, let's introduce an environment variable to
override that.

Prompted by #31759.

Closes #31759.
2024-03-15 03:19:45 +09:00
Lennart Poettering
74d142ff3a
Merge pull request #30612 from AdrianVovk/sleep-freeze-user-seesions
Freeze user sessions for all types of sleep
2024-03-06 18:52:57 +01:00
Adrian Vovk
a5b009d935
homework: Lock/Unlock: Freeze/Thaw user session
Whenever a home directory is in a locked state, accessing the files of
the home directory is extremely likely to cause the thread to hang. This
will put the session in a strange state, where some threads are hanging
due to file access and others are not hanging because they are not
trying to access any of the user's files.

This can lead to a whole slew of consequences. For example, imagine a
likely situation where the Wayland compositor is not hanging, but the
user's open apps are. Eventually, the compositor will detect that none
of the apps are responding to its pings, assume that they're frozen
(which they are), and kill them. The systemd user instance can end up in
a similarly confused state and start killing user services. In the worst
case, killing an app at an unexpected moment can lead to data loss.

The solution is to suspend execution of the whole user session by
freezing the user's slice.
2024-03-05 12:12:36 -05:00
Adrian Vovk
0b958bb3ee
sleep: Always freeze user.slice
Previously, we'd only freeze user.slice in the case of s2h, because we
didn't want the user session to resume while systemd was transitioning
from suspend to hibernate.

This commit extends this freezing behavior to all sleep modes.

We also have an environment variable to disable the freezing behavior
outright. This is a necessary workaround for someone that has hooks
in /usr/lib/systemd/system-sleep/ which communicate with some
process running under user.slice, or if someone is using the proprietary
NVIDIA driver which breaks when user.slice is frozen (issue #27559)

Fixes #27559
2024-03-05 12:12:35 -05:00
Lennart Poettering
6399be223b resolved: make resolved authoritative in resolveing our local host name
This is a kinda a follow-up for ce266330fc: it
makes resolved authoritative on our local hostname, and never contacts
DNS anymore for it.

We effectively already were authoritative for it, except if the user
queried for other RR types than just A/AAAA. This closes the gap and
refuses routing other RR type queries to DNS.

Fixes: #23662
2024-03-05 15:31:32 +01:00
Luca Boccassi
a73144bbdf repart: add --private-key-source and drop --private-key-uri
It turns out it's mostly PKCS11 that supports the URI format,
and other engines just take files. For example the tpm2-tss-openssl
engine just takes a sealed private key file path as the key input,
and the engine needs to be specified separately.

Add --private-key-source=file|engine:foo|provider:bar to
manually specify how to use the private key parameter.

Follow-up for 0a8264080a
2024-03-01 17:32:19 +00:00
Lennart Poettering
5b97957376
Merge pull request #31531 from poettering/verity-userspace-optional
dissect: make use of userspace verity keyring optional
2024-02-28 22:04:58 +01:00
Lennart Poettering
f0ecff8506 dissect: condition usespace verity keyring via kernel cmdline option + env var 2024-02-28 16:18:22 +01:00
Lennart Poettering
78266a54f1 tree-wide: use "_" rather than "-" as separator in kernel cmdline options
Most of our kernel cmdline options use underscores as word separators in
kernel cmdline options, but there were some exceptions. Let's fix those,
and also use underscores.

Since our /proc/cmdline parsers don't distinguish between the two
characters anyway this should not break anything, but makes sure our own
codebase (and in particular docs and log messages) are internally
consistent.
2024-02-28 15:33:51 +01:00
Zbigniew Jędrzejewski-Szmek
8e3fee33af Revert "docs: use collections to structure the data"
This reverts commit 5e8ff010a1.

This broke all the URLs, we can't have that. (And actually, we probably don't
_want_ to make the change either. It's nicer to have all the pages in one
directory, so one doesn't have to figure out to which collection the page
belongs.)
2024-02-23 09:48:47 +01:00
hulkoba
5e8ff010a1
docs: use collections to structure the data 2024-02-22 10:11:54 +01:00
Lennart Poettering
0691d0e5a1 pcrlock: document the env vars we honour to find measurement logs
This env vars have been supported for a while, let's document them where
we usually document them.
2024-02-21 14:45:19 +01:00
Luca Boccassi
dba0afa14e openssl: add helper to load key from provider/engine
It's not the literal private key, but EVP_PKEY becomes a reference
to the engine/provider that OpenSSL knows how to use later
2024-02-09 14:36:10 +00:00
Luca Boccassi
343e35b36d core: add SYSTEMD_VERITY_SHARING env var for local development
When running an image that cannot be mounted (e.g.: key missing intentionally
for development purposes), there's a retry loop that takes some time
and slows development down. Add an env var to disable it.
2024-01-26 10:14:15 +00:00
Lennart Poettering
4a6fe5f05e varlink: also honour new env var $SYSTEMD_VARLINK_LISTEN in varlink_server_listen_auto()
varlink_server_listen_auto() is supposed to be the one-stop solution for
turning simple command line tools into IPC services. They aren't easy to
test/debug however, since you have to invoke them through a service
manager.

Let's make this easier: if the SYSTEMD_VARLINK_LISTEN env var is set,
let's listen on the socket specified therein. This makes things easier
to gdb: just run the service from the cmdline.
2024-01-16 13:45:35 +01:00
Lennart Poettering
bcb1bb379e sd-bus: also intrepret $SYSTEMD_SSH env var
To make things symmetric to the $SYSTEMD_SSH logic that the varlink
transport supports, let's also honour such a variable in sd-bus when
picking ssh transport.
2024-01-08 23:24:51 +01:00
Lennart Poettering
a1bb30de7f varlink: add "ssh:" transport
This uses openssh 9.4's -W support for AF_UNIX. Unfortunately older versions
don't work with this, and I couldn#t figure a way that would work for
older versions too, would not be racy and where we'd still could keep
track of the forked off ssh process.

Unfortunately, on older versions -W will just hang (because it tries to
resolve the AF_UNIX path as regular host name), which sucks, but hopefully this
issue will go away sooner or later on its own, as distributions update.

Fedora is still stuck at 9.3 at the time of posting this (even on
Fedora), even though 9.4, 9.5, 9.6 have all already been released by
now.

Example:
        varlinkctl call -j ssh:root@somehost:/run/systemd/io.systemd.Credentials io.systemd.Credentials.Encrypt '{"text":"foobar"}'
2024-01-08 23:24:45 +01:00
Luca Boccassi
5af0f171f9 udev: add upper bound of 5 hours to SYSTEMD_UDEV_EXTRA_TIMEOUT_SEC=
Follow-up for b16c6076cb

CID#1533111
2024-01-04 14:30:20 +01:00
Yu Watanabe
b16c6076cb udev: wait for an extra time before the manager kills workers
Otherwise, udev workers cannot detect slow programs invoked by
IMPORT{program}=, PROGRAM=, or RUN=, and whole worker process may be
killed.

Fixes #30436.

Co-authored-by: sushmbha <sushmita.bhattacharya@oracle.com>
2024-01-03 04:23:22 +09:00
Daan De Meyer
3d11b46bf7
Add $SYSTEMD_HWDB_UPDATE_BYPASS (#30463)
Same as $KERNEL_INSTALL_BYPASS, but for hwdb. This will speed up
cross architecture image builds in mkosi as I can disable package
managers from running the costly hwdb update stuff in qemu user
mode and run it myself with a native systemd-hwdb with --root=.
2023-12-14 18:57:05 +09:00
Zbigniew Jędrzejewski-Szmek
25757715fe shared/cryptsetup-util: build problematic code only in developer mode
This code doesn't link when gcc+lld is used:

$ LDFLAGS=-fuse-ld=lld meson setup build-lld && ninja -C build-lld udevadm
...
ld.lld: error: src/shared/libsystemd-shared-255.a(libsystemd-shared-255.a.p/cryptsetup-util.c.o):
  symbol crypt_token_external_path@@ has undefined version
collect2: error: ld returned 1 exit status

As a work-around, restrict it to developer mode.

Closes https://github.com/systemd/systemd/issues/30218.
2023-11-28 20:23:45 +00:00
Lennart Poettering
abc19a6ffa storagetm: expose more useful metadata for nvme block devices
don't let the devices to be announced just as model "Linux". Let's instead
propagate the underlying block device's model. Also do something
reasonably smart for the serial and firmware version fields.
2023-11-13 19:32:34 +00:00
Frantisek Sumsal
d4317fe172 nspawn: allow disabling os-release check
Introduce a new env variable $SYSTEMD_NSPAWN_CHECK_OS_RELEASE, that can
be used to disable the os-release check for bootable OS trees. Useful
when trying to boot a container with empty /etc/ and bind-mounted /usr/.

Resolves: #29185
2023-11-03 16:05:14 +00:00
Lennart Poettering
d54c747f7e firewall: allow selecting firewall backend via env var 2023-11-03 09:34:02 +01:00
Lennart Poettering
0631eac96d crytsetup: allow overriding the token .so library path via an env var
I tried to get something similar upstream:

https://gitlab.com/cryptsetup/cryptsetup/-/issues/846

But no luck, it was suggested I use ELF interposition instead. Hence,
let's do so (but not via ugly LD_PRELOAD, but simply by overriding the
relevant symbol natively in our own code).

This makes debugging tokens a ton easier.
2023-11-02 18:18:00 +00:00
Raul Cheleguini
813dbff4d5 nspawn: allow user-specified MAC address on container side
Introduce the environment variable SYSTEMD_NSPAWN_NETWORK_MAC to allow
user-specified MAC address on container side.
2023-10-25 13:59:46 +01:00
Mike Yuan
5d4072d0ed
man,docs: suffix directories with / 2023-10-21 06:25:35 +08:00
Luca Boccassi
665a3d6d15 systemctl: automatically softreboot/kexec if set up on reboot
Automatically softreboot if the nextroot has been set up with an OS
tree, or automatically kexec if a kernel has been loaded with kexec
--load.

Add SYSTEMCTL_SKIP_AUTO_KEXEC and SYSTEMCTL_SKIP_AUTO_SOFT_REBOOT to
skip the automated switchover.
2023-10-20 11:45:37 +01:00
Lennart Poettering
e59049d7a9 repart: add simple mechanism to override fstype choices
This is very useful for quickly testing things when building DDIs, in
particular in the CI, and trivial to add.
2023-10-05 19:18:36 +02:00
Yu Watanabe
52afaee74b sd-netlink: make the default timeout configurable by environment variable
On normal systems, triggering a timeout should be a bug in code or
configuration error, so I do not think we should extend the default
timeout. Also, we should not introduce a 'first class' configuration
option about that. But, making it configurable may be useful for cases
such that "an extremely highly utilized system (lots of OOM kills,
very high CPU utilization, etc)".

Closes #25441.
2023-10-01 12:41:10 +09:00
Lennart Poettering
32295fa08f pcrphase: rename binary to pcrextend
The tool initially just measured the boot phase, but was subsequently
extended to measure file system and machine IDs, too. At AllSystemsGo
there were request to add more, and make the tool generically
accessible.

Hence, let's rename the binary (but not the pcrphase services), to make
clear the tool is not just measureing the boot phase, but a lot of other
things too.

The tool is located in /usr/lib/ and still relatively new, hence let's
just rename the binary and be done with it, while keeping the unit names
stable.

While we are at it, also move the tool out of src/boot/ and into its own
src/pcrextend/ dir, since it's not really doing boot related stuff
anymore.
2023-09-25 17:17:20 +02:00
Lennart Poettering
fba84e121b journalctl: read env vars that override compiled catalog database and source files
This makes it a bit easier to test catalog files without installing
systemd.
2023-06-27 23:20:15 +02:00
Lennart Poettering
7e81ce6bb8 docs: describe $TESTFUNCS briefly
Follow-up for f1a83e41ae
2023-06-22 15:14:47 +01:00
Zbigniew Jędrzejewski-Szmek
bd3beda283 shared/condition: add envvar override for the check for first-boot
Before 7cd43e34c5, it was possible to use
SYSTEMD_PROC_CMDLINE=systemd.condition-first-boot to override autodetection.
But now this doesn't work anymore, and it's useful to be able to do that for
testing.
2023-05-23 15:09:39 +02:00
Frantisek Sumsal
e24c6676c7 docs: add a missing $ sign
Addresses https://github.com/systemd/systemd/pull/27283#pullrequestreview-1386816102.
Follow-up to 1a127aa02b.
2023-04-16 20:31:33 +02:00
Frantisek Sumsal
1a127aa02b docs: a couple of typo fixes & formatting tweaks 2023-04-15 13:12:43 +02:00
Yu Watanabe
5cf69e709e os-util: make $SYSTEMD_OS_RELEASE prefixed with the root directory
To make it consistent with other env vars, e.g. $SYSTEMD_ESP_PATH or
$SYSTEMD_XBOOTLDR_PATH.

This is useful when the root is specified by a file descriptor, instead
of a path.
2023-04-11 18:49:23 +09:00
Zbigniew Jędrzejewski-Szmek
1e094cb4ba
Merge pull request #27126 from yuwata/journal-compress
sd-journal: allow to specify compression algorithm through env
2023-04-07 09:28:27 +02:00
maanyagoenka
1f4f166690 confext: documentation and man page updates for confext 2023-04-05 21:50:04 +00:00
Yu Watanabe
1f06ea747b sd-journal: allow to specify compression algorithm through env
Fixes RHBZ#2183546 (https://bugzilla.redhat.com/show_bug.cgi?id=2183546).

Previously, journal file is always compressed with the default algorithm
set at compile time. So, if a newer algorithm is used, journal files
cannot be read by older version of journalctl that does not support the
algorithm.

Co-authored-by: Colin Walters <walters@verbum.org>
2023-04-04 18:32:12 +09:00
Daan De Meyer
4b8ce14f6c repart: Add support for reading mkfs options from environment 2023-03-10 09:33:39 +01:00
Zbigniew Jędrzejewski-Szmek
ba0e70673c
Merge pull request #26038 from lilyinstarlight/fix/fstab-generator-sysroot-without-cmdline
fstab-generator: use correct targets when /sysroot is specificied in fstab only
2023-03-09 08:51:31 +01:00
Lily Foster
905dd992f8
fstab-generator: add SYSTEMD_SYSFS_CHECK env var
This forces processing of /dev entries in fstab when running in a
container is detected (checked as the existence of read-only /sys).
2023-01-25 19:05:11 -05:00
Luca Boccassi
71c6f0ac52
Merge pull request #23309 from DaanDeMeyer/log-context
basic: Add log context
2023-01-20 15:01:03 +00:00
Lennart Poettering
6c51b49ce0 tpm2: add common helper for checking if we are running on UKI with TPM measurements
Let's introduce a common implementation of a function that checks
whether we are booted on a kernel with systemd-stub that has TPM PCR
measurements enabled. Do our own userspace measurements only if we
detect that.

PCRs are scarce and most likely there are projects which already make
use of them in other ways. Hence, instead of blindly stepping into their
territory let's conditionalize things so that people have to explicitly
buy into our PCR assignments before we start measuring things into them.
Specifically bind everything to an UKI that reported measurements.

This was previously already implemented in systemd-pcrphase, but with
this change we expand this to all tools that process PCR measurement
settings.

The env var to override the check is renamed to SYSTEMD_FORCE_MEASURE,
to make it more generic (since we'll use it at multiple places now).
This is not a compat break, since the original env var for that was not
included in any stable release yet.
2023-01-17 09:42:16 +01:00
Ludwig Nussel
2e76ca79b3 bootctl: honor $KERNEL_INSTALL_CONF_ROOT
Honor $KERNEL_INSTALL_CONF_ROOT for reading config files, as
kernel-install does.
2023-01-10 15:17:07 +01:00
Daan De Meyer
7c7a9138a2 basic: Add log context
This commit adds support for attaching extra metadata to log
messages written to the journal via log.h. We keep track of a
thread local log context in log.c onto which we can push extra
metadata fields that should be logged. Once a field is no longer
relevant, it can be popped again from the log context.

On top of this, we then add macros to allow pushing extra fields
onto the log context.

LOG_CONTEXT_PUSH() will push the provided field onto the log context
and pop the last field from the log context when the current block
ends. LOG_CONTEXT_PUSH_STRV() will do the same but for all fields in
the given strv.

Using the macros is as simple as putting them anywhere inside a block
to add a field to all following log messages logged from inside that
block.

void myfunction(...) {
	...

	LOG_CONTEXT_PUSH("MYMETADATA=abc");

	// Every journal message logged will now have the MYMETADATA=abc
        // field included.
}

For convenience, there's also LOG_CONTEXT_PUSHF() to allow constructing
the field to be logged using printf() syntax.

log_context_new()/log_context_free() can be used to attach a log context
to an async operation by storing it in the associated userdata struct.
2023-01-08 16:31:16 +01:00