IF YOU WOULD LIKE TO GET AN ACCOUNT, please write an
email to Administrator. User accounts are meant only to access repo
and report issues and/or generate pull requests.
This is a purpose-specific Git hosting for
BaseALT
projects. Thank you for your understanding!
Только зарегистрированные пользователи имеют доступ к сервису!
Для получения аккаунта, обратитесь к администратору.
We finally got the OK from all contributors with non-trivial commits to
relicense systemd from GPL2+ to LGPL2.1+.
Some udev bits continue to be GPL2+ for now, but we are looking into
relicensing them too, to allow free copy/paste of all code within
systemd.
The bits that used to be MIT continue to be MIT.
The big benefit of the relicensing is that closed source code may now
link against libsystemd-login.so and friends.
This is an S/MIME signed message
The new function ima_setup() loads an IMA custom policy from a file in the
default location '/etc/ima/ima-policy', if present, and writes it to the
path 'ima/policy' in the security filesystem. This function is executed
at early stage in order to avoid that some file operations are not measured
by IMA and it is placed after the initialization of SELinux because IMA
needs the latter (or other security modules) to understand LSM-specific
rules. This feature is enabled by default and can be disabled by providing
the option '--disable-ima' to the configure script.
Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Acked-by: Gianluca Ramunno <ramunno@polito.it>
The text mode welcome message will only show the distro name stored
in /etc/os-release and no longer read any distro-specific files. If
/etc/os-release does not exist, 'Linux' will be printed.
When the source tree is is ./configure'd, only /etc-os-release is read
to guess the distro to build for. If /etc/os-release does not exist,
--with-distro= needs to be specified.
The way the various properties[] arrays are initialized is inefficient:
- only the .data members change at runtime, yet the whole arrays of
properties with all the fields are constructed on the stack one by
one by the code.
- there's duplication, eg. the properties of "org.freedesktop.systemd1.Unit"
are repeated in several unit types.
Fix it by moving the information about properties into static const
sections. Instead of storing the .data directly in the property, store
a constant offset from a run-time base.
The small arrays of struct BusBoundProperties bind together the constant
information with the right runtime information (the base pointer).
On my system the code shrinks by 60 KB, data increases by 10 KB.
This patch adds support for the Mageia Linux distribution:
http://www.mageia.org/
Mageia is a fork of Mandriva although some divergence has already occured
and thus inclusion of these changes upstream allow us to (hopefully)
migrate more rapidly to the new standard approaches systemd offers.
Indeed, we already use the preferred mechanism of OS identification via
the /etc/os-release file rather than a distro specific variation.
This patch mostly mirrors the patch added previously for Mandriva
support. In addition to those original authors, this patch was mostly
written by Dexter Morgan with help from Colin Guthrie and Eugeni Dodonov.
<mbiebl> kay, mezcalero: https://bugzilla.gnome.org/show_bug.cgi?id=627789
<mezcalero> so we can drop that entirely?
<mezcalero> kay: if you drop those two lines, does it improve things for you?
<mbiebl> kay: but ./configure should work now
<mbiebl> resp. autogen.sh
<kay> mezcalero, mbiebl: autogen.sh seems a lot better without the two lines
<kay> mezcalero: works without the 'touch' thing
<mezcalero> kay: ok, commit please
As in the bug[1] it would be nice to configure plymouth support
independently of the distro. This patch adds a "--enable-plymouth" and
"--disable-plymouth" option to the configure script to overwrite the
distro specific default.
[1] https://bugs.freedesktop.org/show_bug.cgi?id=38460
This commit consists of the initial work to include Angstrom as a ported
distribution for systemd.
Angstrom tries to follow the debian way as much as possible, but deviates
where it doesn't make sense for 'embedded'.
This commit consists of the initial work to include MeeGo as a ported
distribution for systemd.
The majority of the changes are small configuration additions to auto
tools, so that MeeGo is identified as a valid distribution option.
Some small deviations will be noticed between the configuration of MeeGo
and other distributions. As MeeGo is a distribution striving for
compliancy to support its near embedded attributes and target users,
there is less user configuration options available by default. Most
services will be enabled by systemd as part of the distribution
requirements, and as such most links and service files will be pre-setup
for the MeeGo distribution. As much of this is going to be done within
the MeeGo distribution packaging this is still noteworthy to mention, as
it explains why in systemd you will observe configuration differences
where the MeeGo distribution removes all links in the pkgsysconfdir for
instance. MeeGo will be user configurable if there is desire, but most
services will be enabled by the distribution as designated by the MeeGo
compliancy standards.
Other changes are in source to add such areas as meego-release defined
in utils, and hostname in hostname-setup, defining vconsole-setup,
localizations and rescue additions as needed.
As this is all ground work, MeeGo will continue to strive for complete
compatibility.
This merges several separate patches that I carry as part of
Mandriva systemd RPM. They touch those parts that are very
unlikely to be changed in near future and do not impose any
functionality change for systemd core. I also think it is
useful for troubleshooting to have real distribution name in
system logs, espicially when someone reports problem upstream.
The patch looks bigger than sum of replaced patches because
- previous patches were applied on top of distro=fedora, now
I need to add all those bits for distro=mandriva as well
- part of patch was done as spec file magic, but it seems more
logical to ship all these bits together
There's already a condition that gives a warning if user is
cross-compiling an relying on files from the build system. AC_CHECK_FILE
macro only tests for file in the build system. Hence use a simple
'test -f' that does the same job, without the warning.
When cross-compiling systemd, the introspection XML files fail to be
generated because the systemd host binary is not executable. This patch
works around this by putting the introspection XML data into separate
ELF sections and extracting them from the binary when generating the XML
files.
The extracted XML data is passed through the strings utility in order to
strip the trailing NUL character. A small AWK script is used to prepend
the doctype and add the opening and closing node tags respectively.
Finally, the C preprocessor is used to substitute the correct doctype
information from the D-Bus header files.
Previously Ubuntu was treated as being equivalent to Debian, but the two
distributions require different behaviour in certain places. This commit does
not change the behaviour of systemd on either distro but it creates a
framework for changes to be introduced by later commits.
The following previously meant "Target is Debian or Ubuntu".
* configure option "--with-distro=debian"
* C preprocessor symbol "TARGET_DEBIAN"
* Automake conditional "TARGET_DEBIAN"
After this commit, all of the above are redefined to mean "Target is Debian"
The following are introduced to mean "Target is Ubuntu".
* configure option "--with-distro=ubuntu"
* C preprocessor symbol "TARGET_UBUNTU"
* Automake conditional "TARGET_UBUNTU"
Most code written for Debian will also be applicable to Ubuntu. An extra
Automake conditional "TARGET_DEBIAN_OR_UBUNTU" is introduced to avoid
duplication of code that would otherwise occur.
This commit updates configure.ac, Makefile.am and distro-specific source files
in line with the above definitions.
Reduce number of exported symbols with -fvisibility=hidden by default,
this is safe as we're not generating and loadable library and our
binaries should have no exported symbol other than main(). This alone
reduces around 4kb per binary.
It will also request GCC to emit every function and data variable in
its own section, then request the linker to remove unused
sections. This reduces the size of utility tools
(/lib/systemd/systemd-*) by half or even more (in my system some
binaries went from 84kb to 32kb).
This patch adds a cpp definition HAVE_SYSV_COMPAT that is used to
isolate code dealing with /etc/init.d and /etc/rcN.d for systems where
it does not make sense (one that does not use sysv or one that is fully
systemd native).
The patch tries to be as little intrusive as possible, however in
order to minimize the number of #ifdef'ed regions I've reordered some
code in path-lookup.c:lookup_paths_init() where all code dealing with
sysv is now isolated under running_as == MANAGER_SYSTEM as well.
Moreover, In struct Service, some fields were rearranged to reduce
the number of ifdefs.
Lennart's suggestions were fixed and squashed with the original patch,
that was sent by Gustavo Sverzut Barbieri (barbieri@profusion.mobi).
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/28/2010 05:57 AM, Kay Sievers wrote:
> On Wed, Jul 28, 2010 at 11:43, Lennart Poettering
> <lennart@poettering.net> wrote:
>> On Mon, 26.07.10 16:42, Daniel J Walsh (dwalsh@redhat.com) wrote:
>>> tcontext=system_u:object_r:device_t:s0 tclass=chr_file
>>> type=1400 audit(1280174589.476:7): avc: denied { read } for pid=1
>>> comm="systemd" name="autofs" dev=devtmpfs ino=9482
>>> scontext=system_u:system_r:init_t:s0
>>> tcontext=system_u:object_r:device_t:s0 tclass=chr_file
>>> type=1400 audit(1280174589.476:8): avc: denied { read } for pid=1
>>> comm="systemd" name="autofs" dev=devtmpfs ino=9482
>>> scontext=system_u:system_r:init_t:s0
>>> tcontext=system_u:object_r:device_t:s0 tclass=chr_file
>>>
>>> Lennart, we talked about this earlier. I think this is caused by the
>>> modprobe calls to create /dev/autofs. Since udev is not created at the
>>> point that init loads the kernel modules, the devices get created with
>>> the wrong label. Once udev starts the labels get fixed.
>>>
>>> I can allow init_t to read device_t chr_files.
>>
>> Hmm, I think a cleaner fix would be to make systemd relabel this device
>> properly before accessing it? Given that this is only one device this
>> should not be a problem for us to maintain, I think? How would the
>> fixing of the label work? Would we have to spawn restorecon for this, or
>> can we actually do this in C without too much work?
>
> I guess we can just do what udev is doing, and call setfilecon(), with
> a context of an earlier matchpathcon().
>
> Kay
> _______________________________________________
> systemd-devel mailing list
> systemd-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/systemd-devel
Here is the updated patch with a fix for the labeling of /dev/autofs
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxQMyoACgkQrlYvE4MpobNviACfWgxsjW2xzz1qznFex8RVAQHf
gIEAmwRmRcLvGqYtwQaZ3WKIg8wmrwNk
=pC2e
It seems to work on my machine.
/proc/1/fd/20 system_u:system_r:system_dbusd_t:s0
/proc/1/fd/21 system_u:system_r:avahi_t:s0
And the AVC's seem to have dissapeared when a confined app trys to
connect to dbus or avahi.
If you run with this patch and selinux-policy-3.8.8-3.fc14.noarch
You should be able to boot in enforcing mode.
