1
0
mirror of https://github.com/systemd/systemd.git synced 2024-10-28 03:25:31 +03:00
Commit Graph

39565 Commits

Author SHA1 Message Date
Lennart Poettering
afcfaa695c core: implement OOMPolicy= and watch cgroups for OOM killings
This adds a new per-service OOMPolicy= (along with a global
DefaultOOMPolicy=) that controls what to do if a process of the service
is killed by the kernel's OOM killer. It has three different values:
"continue" (old behaviour), "stop" (terminate the service), "kill" (let
the kernel kill all the service's processes).

On top of that, track OOM killer events per unit: generate a per-unit
structured, recognizable log message when we see an OOM killer event,
and put the service in a failure state if an OOM killer event was seen
and the selected policy was not "continue". A new "result" is defined
for this case: "oom-kill".

All of this relies on new cgroupv2 kernel functionality: the
"memory.events" notification interface and the "memory.oom.group"
attribute (which makes the kernel kill all cgroup processes
automatically).
2019-04-09 11:17:58 +02:00
Lennart Poettering
a5b5aece01 service: beautify debug log message a bit 2019-04-09 11:17:58 +02:00
Lennart Poettering
0bb814c2c2 core: rename cgroup_inotify_wd → cgroup_control_inotify_wd
Let's rename the .cgroup_inotify_wd field of the Unit object to
.cgroup_control_inotify_wd. Let's similarly rename the hashmap
.cgroup_inotify_wd_unit of the Manager object to
.cgroup_control_inotify_wd_unit.

Why? As preparation for a later commit that allows us to watch the
"memory.events" cgroup attribute file in addition to the "cgroup.events"
file we already watch with the fields above. In that later commit we'll
add new fields "cgroup_memory_inotify_wd" to Unit and
"cgroup_memory_inotify_wd_unit" to Manager, that are used to watch these
other events file.

No change in behaviour. Just some renaming.
2019-04-09 11:17:57 +02:00
Lennart Poettering
5210387ea6 core: check for redundant operation before doing allocation 2019-04-09 11:17:57 +02:00
Lennart Poettering
cbe83389d5 core: rearrange cgroup empty events a bit
So far the priorities for cgroup empty event handling were pretty weird.
The raw events (on cgroupsv2 from inotify, on cgroupsv1 from the agent
dgram socket) where scheduled at a lower priority than the cgroup empty
queue dispatcher. Let's swap that and ensure that we can coalesce events
more agressively: let's process the raw events at higher priority than
the cgroup empty event (which remains at the same prio).
2019-04-09 11:17:57 +02:00
Zbigniew Jędrzejewski-Szmek
52efbd8f0e
Merge pull request #12223 from yuwata/network-wireguard-preshared-key-file
network: add PresharedKeyFile= setting and make reading key file failure fatal
2019-04-09 10:52:52 +02:00
Zbigniew Jędrzejewski-Szmek
9d1b2b2252 pid1,shutdown: do not cunescape paths from libmount
The test added in previous commit shows that libmount does the unescaping
internally.
2019-04-09 09:07:40 +02:00
Zbigniew Jędrzejewski-Szmek
b57adc94cd test-libmount: let's see how libmount parses stuff
With libmount-2.33.1-3.fc30.x86_64 I get:
/* test_libmount_unescaping_one escaped space + utf8 */
from '729 38 0:59 / /tmp/\342\200\236zupa\\040z\304\231bowa\342\200\235 rw,relatime shared:395 - tmpfs die\\040Br\303\274he rw,seclabel'
source: 'die Brühe'
source: 'die Br\303\274he'
source: 'die Brühe'
expected: 'die Brühe'
target: '/tmp/„zupa zębowa”'
target: '/tmp/\342\200\236zupa z\304\231bowa\342\200\235'
target: '/tmp/„zupa zębowa”'
expected: '/tmp/„zupa zębowa”'
/* test_libmount_unescaping_one escaped newline */
from '729 38 0:59 / /tmp/x\\012y rw,relatime shared:395 - tmpfs newline rw,seclabel'
source: 'newline'
source: 'newline'
source: 'newline'
expected: 'newline'
target: '/tmp/x
y'
target: '/tmp/x\ny'
target: '/tmp/x
y'
expected: '/tmp/x
y'
/* test_libmount_unescaping_one empty source */
from '760 38 0:60 / /tmp/emptysource rw,relatime shared:410 - tmpfs  rw,seclabel'
source: ''
source: ''
source: ''
expected: ''
target: '/tmp/emptysource'
target: '/tmp/emptysource'
target: '/tmp/emptysource'
expected: '/tmp/emptysource'
/* test_libmount_unescaping_one foo\rbar */
from '790 38 0:61 / /tmp/foo\rbar rw,relatime shared:425 - tmpfs tmpfs rw,seclabel'
source: 'tmpfs'
source: 'tmpfs'
source: 'tmpfs'
expected: 'tmpfs'
target: '/tmp/foo'
target: '/tmp/foo'
target: '/tmp/foo'
expected: 'n/a'

With https://github.com/karelzak/util-linux/issues/780 fixed, we get

/* test_libmount_unescaping_one foo\rbar */
from '790 38 0:61 / /tmp/foo\rbar rw,relatime shared:425 - tmpfs tmpfs rw,seclabel'
source: 'tmpfs'
source: 'tmpfs'
source: 'tmpfs'
expected: 'tmpfs'
target: '/tmp/foo
bar'
target: '/tmp/foo\rbar'
target: '/tmp/foo
bar'
expected: '/tmp/foo
bar'
2019-04-09 09:07:40 +02:00
welaq
56d939e044 l10n: Updated Lithuanian translation 2019-04-09 09:00:16 +02:00
Yu Watanabe
78bb2866fd NEWS: mention PresharedKeyFile= 2019-04-09 15:50:23 +09:00
Yu Watanabe
9e5d79e7a1 test-network: add tests for WireGuardPeer.PresharedKey= and PresharedKeyFile= 2019-04-09 15:50:23 +09:00
Yu Watanabe
2b942a926c network: make wireguard_decode_key_and_warn() take uint8_t buf[static WG_KEY_LEN] 2019-04-09 15:50:23 +09:00
Yu Watanabe
26f86d500e network: warn when wireguard keys are stored in world readable files 2019-04-09 15:50:22 +09:00
Yu Watanabe
a3945c6361 network: add WireGuardPeer.PresharedKeyFile= setting 2019-04-09 15:50:22 +09:00
Yu Watanabe
6ef5c881dd network: clear wireguard keys on failure or on exit 2019-04-09 15:50:22 +09:00
Yu Watanabe
cb31e7c861 network: make reading PrivateKeyFile= failure always fatal
This also refactor wireguard_read_key_file().
2019-04-09 15:50:22 +09:00
Yu Watanabe
07d8c0eb1e fileio: add READ_FULL_FILE_UNBASE64 flag for read_full_file_full() 2019-04-09 15:50:22 +09:00
Yu Watanabe
50caae7b92 fileio: read_full_file_full() also warns when file is world readable and secure flag is set 2019-04-09 15:50:22 +09:00
Yu Watanabe
7a309a8c63 fileio: introduce warn_file_is_world_accessible() 2019-04-09 15:50:22 +09:00
Yu Watanabe
15f8f026cf util: introduce READ_FULL_FILE_SECURE flag for reading secure data 2019-04-09 15:50:16 +09:00
Zbigniew Jędrzejewski-Szmek
2c9e7540e0
Merge pull request #12241 from keszybz/two-man-link-additions
Two man link additions
2019-04-08 21:58:11 +02:00
Benjamin Robin
a012f9f7cf core/killall: Propagate errors and return the number of process left 2019-04-08 19:41:16 +02:00
Lennart Poettering
b473691d41 inhibit: fix argv[] usage
Another fix in style of ed179fd710 and
bd169c2be0fbdaf6eb2ea7951e650d5e5983fbf6..

I hope we are soon complete with these.

Fixes: #12246
2019-04-08 16:57:39 +02:00
Zbigniew Jędrzejewski-Szmek
ab80eca144 NEWS: add mention of time-set.target 2019-04-08 16:57:23 +02:00
Zbigniew Jędrzejewski-Szmek
7a447d2107 man: add a lengthy example for NamePolicy= debugging
This is still rather opaque, and test-builtin is quite useful in this
case, let's advertise it a bit more.
2019-04-08 15:36:02 +02:00
Zbigniew Jędrzejewski-Szmek
58576937bc man: say that .link NamePolicy= should be empty for Name= to take effect
The description of NamePolicy= implied this, but didn't spell it out. It's a
very common use case, so let's add a bit of explanation and ehance the example
a bit.

Inspired by https://bugzilla.redhat.com/show_bug.cgi?id=1695894.
2019-04-08 15:34:40 +02:00
Lennart Poettering
3fca6ec03c
Merge pull request #12244 from poettering/242-news-final
final 242 NEWS tweaks + another hwdb update
2019-04-08 15:31:31 +02:00
Lennart Poettering
438e6a48be man: add references from the .mount and .service man pages to systemd-{mount,run} pages
Fixes: #12235
2019-04-08 15:25:36 +02:00
Zbigniew Jędrzejewski-Szmek
afae22ca41
Merge pull request #12245 from poettering/empty-or-dash
introduce empty_or_dash() helper
2019-04-08 15:22:44 +02:00
Lennart Poettering
30ab7a519e man: elaborate on fd ownership in sd_event_add_io(3)
Replaces: #12239
2019-04-08 15:09:30 +02:00
Peter A. Bigot
4ea0f675ae units: add time-set.target
time-sync.target is supposed to indicate system clock is synchronized
with a remote clock, but as used through 241 it only provided a system
clock that was updated based on a locally-maintained timestamp.  Systems
that are powered off for extended periods would not come up with
accurate time.

Retain the existing behavior using a new time-set.target leaving
time-sync.target for cases where accuracy is required.

Closes #8861
2019-04-08 14:34:05 +02:00
Lennart Poettering
ca7410fe43 coccinelle: add coccinelle script for empty_or_dash() use 2019-04-08 14:31:15 +02:00
Paul Menzel
82d0776da2 man/systemd-sysusers: Fix typo in *from* to *form* 2019-04-08 13:46:34 +02:00
Lennart Poettering
dc90e0faae basic: add new helper call empty_or_dash_to_null()
We have a function like this at two places already. Let's unify it in
one generic location and let's port a number of users over.
2019-04-08 12:11:11 +02:00
Lennart Poettering
e7b88b7bc1 tree-wide: introduce empty_or_dash() helper
At quite a few places we check isempty() || streq(…, "-"), let's add a
helper to simplify that, and replace that by a single function call.
2019-04-08 12:03:33 +02:00
Lennart Poettering
bf63365414 hwdb: update hwdb 2019-04-08 11:42:16 +02:00
Lennart Poettering
c3287a42ae update NEWS for 242 final 2019-04-08 11:35:45 +02:00
Lennart Poettering
ea505047c5
Merge pull request #12238 from keszybz/one-genuine-bugfix+lots-of-line-wrapping
One genuine bugfix and lots of line wrapping
2019-04-08 11:19:34 +02:00
Lennart Poettering
83d4ab5533 pam-systemd: use secure_getenv() rather than getenv()
And explain why in a comment.
2019-04-08 10:24:03 +02:00
Jonas DOREL
565026b49a man: correct units path usage according to FHS (#11388)
According to the Filesystem Hierarchy Standard, "The /usr/local hierarchy is for use by the system administrator when installing software locally. It needs to be safe from being overwritten when the system software is updated". So it should not be used by installed packages.
2019-04-08 08:19:58 +02:00
Zbigniew Jędrzejewski-Szmek
330d1defdb sysusers: use return_error_errno() where possible 2019-04-07 22:00:11 +02:00
Zbigniew Jędrzejewski-Szmek
71fb15888b sysusers: add missing initalizer
I assume that this is the error causing the invalid free in
https://bugzilla.redhat.com/show_bug.cgi?id=1670679.
2019-04-07 21:49:08 +02:00
Zbigniew Jędrzejewski-Szmek
124d7cb2a0 logind: linewrap some long lines and remove unnecessary conditional 2019-04-07 21:48:54 +02:00
Yu Watanabe
2432d09c7a util: extend unbase64mem() to accept secure flag
When the flag is set, buffer is cleared on failure.
2019-04-08 03:43:00 +09:00
Jussi Pakkanen
700805f6c5 meson: drop misplaced -Wl,--undefined argument
Ld's man page says the following:

  -u symbol
  --undefined=symbol

  Force symbol to be entered in the output file as an undefined symbol. Doing
  this may, for example, trigger linking of additional modules from standard
  libraries. -u may be repeated with different option arguments to enter
  additional undefined symbols. This option is equivalent to the "EXTERN"
  linker script command.

  If this option is being used to force additional modules to be pulled into
  the link, and if it is an error for the symbol to remain undefined, then the
  option --require-defined should be used instead.

This would imply that it always requires an argument, which this does not
pass. Thus it will grab the next argument on the command line as its
argument. Before it took one of the many -lrt args (presumably) and now it
grabs something other random linker argument and things break.

[zj: this line was added in the first version of the meson configuration back
in 5c23128dab. AFAICT, this was a mistake. No
such flag appeared in Makefile.am at the time.]

https://github.com/mesonbuild/meson/issues/5113
2019-04-07 19:37:08 +02:00
Lennart Poettering
d855b2ab36
Merge pull request #12234 from yuwata/calendarspec-fix-oss-fuzz-14108
Calendarspec cleanups and fixes integer overflow
2019-04-07 19:36:32 +02:00
Yu Watanabe
03fec54396 network: re-indent conf parsers in wireguard.c 2019-04-08 00:52:34 +09:00
Yu Watanabe
daa4aca1cb calendarspec: fix possible integer overflow
Fixes oss-fuzz#14108.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14108
2019-04-08 00:50:07 +09:00
Yu Watanabe
fb3ba5ec11 calendarspec: use _cleanup_ attributes for CalendarComponent 2019-04-08 00:50:02 +09:00
Yu Watanabe
9eef82e5a8 calendarspec: rename free_chain() to chain_free() 2019-04-08 00:21:37 +09:00