1
0
mirror of https://github.com/systemd/systemd.git synced 2024-11-05 06:52:22 +03:00
Commit Graph

53 Commits

Author SHA1 Message Date
Kay Sievers
94a15ffa14 factory: install minimal PAM and nsswitch config 2014-07-29 16:58:18 +02:00
Zbigniew Jędrzejewski-Szmek
ad95fd1d2b journal-remote: add units and read certs from default locations 2014-07-15 22:23:49 -04:00
Lennart Poettering
13ba92e046 tmpfiles: explicitly set mode for /run/log 2014-06-30 19:53:10 +02:00
Lennart Poettering
6fc2766795 tmpfiles: don't do automatic cleanup in $XDG_RUNTIME_DIR
Now that logind will clean up all IPC resources of a user we should
really consider $XDG_RUNTIME_DIR as just another kind of IPC with the
same life-cycle logic as the other IPC resources. This should be safe
now to do since every user gets his own $XDG_RUNTIME_DIR tmpfs instance
with a fixed size limit, so that flooding of it will more effectively be
averted.
2014-06-30 19:06:18 +02:00
Lennart Poettering
a45e6ef38f tmpfiles: automatically clean up /var/lib/systemd/coredump after 3d 2014-06-19 00:00:24 +02:00
Lennart Poettering
7613d0aec9 tmpfiles: remove line for automatic clean-ups for /var/cache/man/
Management of /var/cache/man should move to the distribution package
owning the directory (for example, man-db). As man pages are a
non-essential part of the system and unnecessary for minimal setups,
there's no point in having systemd ship these lines.

Distribution packages should make sure the appropriate package for their
distribution adopts this line. Ideally, the line is adopted by the
upstream package.

For Fedora I have filed this bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1110274
2014-06-17 13:00:39 +02:00
Lennart Poettering
2e78fa79bb tmpfiles: add new "L+" command as stronger version of "L", that removes the destination before creating a symlink
Also, make use of this for mtab as long as mount insists on creating it
even if we invoke it with "-n".
2014-06-16 13:21:07 +02:00
Lennart Poettering
d4c6d50a2a tmpfiles: create /etc/resolv.conf as link to networkd's version, if it doesn't exist
If /etc/resolv.conf doesn't exist it's better than nothing to make it
point to networkd's version.
2014-06-15 23:39:49 +02:00
Lennart Poettering
6d1d50f081 tmpfiles: always use relative symlinks from tmpfiles snippets 2014-06-13 20:11:59 +02:00
Lennart Poettering
55745f2054 tmpfiles: add minimal tmpfiles snippet to rebuild the most essential stuff from /etc 2014-06-13 13:29:25 +02:00
Lennart Poettering
176f2acf8d tmpfiles: don't allow read access to journal files to users not in systemd-journal
Also, don't apply access mode recursively to /var/log/journal/*/, since
that might be quite large, and should be correct anyway.
2014-06-11 10:29:01 +02:00
Lennart Poettering
1b77b581eb tmpfiles: don't apply sgid and executable bit to journal files, only the directories they are contained in 2014-06-11 10:15:07 +02:00
Lennart Poettering
1ebab2103d tmpfiles: if /var is mounted from tmpfs, we should adjust its access mode 2014-06-11 09:20:17 +02:00
Lennart Poettering
9339db7187 tmpfiles: always recreate the most basic directory structure in /var
Let's allow booting up with /var empty. Only create the most basic
directories to get to a working directory structure and symlink set in
/var.
2014-06-11 00:12:21 +02:00
Lennart Poettering
e73a03e059 tmpfiles: get rid of "m" lines, make them redundant by "z"
"m" so far has been a non-globbing version of "z". Since this makes it
quite redundant, let's get rid of it. Remove "m" from the man pages,
beef up "z" docs instead, and make "m" nothing more than a compatibility
alias for "z".
2014-06-10 23:42:16 +02:00
Tom Gundersen
85b5673b33 networkd: split runtime config dir from state dir
Configuration will be in

root:root /run/systemd/network

and state will be in

systemd-network:systemd-network /run/systemd/netif

This matches what we do for logind's seat/session state.
2014-06-03 18:58:00 +02:00
Tom Gundersen
01501939d5 tmpfiles: systemd.conf - fix ownership of network directories 2014-06-02 15:06:32 +02:00
Kay Sievers
52ffb444cb timesyncd: order after tmpfiles to get a working network monitor 2014-05-22 07:57:33 +09:00
Lennart Poettering
c5abff7304 network: always create /run/systemd/network/links
This ways the networkd client library should work even if networkd is
not running.

http://lists.freedesktop.org/archives/systemd-devel/2014-May/019242.html
2014-05-16 15:58:06 +02:00
Greg KH
a606871da5 tmpfiles: fix permissions on new journal files
When starting up journald on a new system, set the proper permissions on
the system.journal files, not only on the journal directory.
2014-04-17 23:58:12 -04:00
Zbigniew Jędrzejewski-Szmek
c4708f1323 tmpfiles: introduce the concept of unsafe operations
Various operations done by systemd-tmpfiles may only be safely done at
boot (e.g. removal of X lockfiles in /tmp, creation of /run/nologin).
Other operations may be done at any point in time (e.g. setting the
ownership on /{run,var}/log/journal). This distinction is largely
orthogonal to the type of operation.

A new switch --unsafe is added, and operations which should only be
executed during bootup are marked with an exclamation mark in the
configuration files. systemd-tmpfiles.service is modified to use this
switch, and guards are added so it is hard to re-start it by mistake.

If we install a new version of systemd, we actually want to enforce
some changes to tmpfiles configuration immediately. This should now be
possible to do safely, so distribution packages can be modified to
execute the "safe" subset at package installation time.

/run/nologin creation is split out into a separate service, to make it
easy to override.

https://bugzilla.redhat.com/show_bug.cgi?id=1043212
https://bugzilla.redhat.com/show_bug.cgi?id=1045849
2013-12-24 15:48:06 -05:00
Lennart Poettering
6b46ea73e3 namespace: include boot id in private tmp directories
This way it is easy to only exclude directories from the current boot
from automatic clean up in /var/tmp.

Also, pick a longer name for the directories so that are globs in
tmp.conf can be simpler yet equally accurate.
2013-12-13 04:06:43 +01:00
Zbigniew Jędrzejewski-Szmek
87267de89d tmpfiles: adjust excludes for the new per-service private dirs
In d8c9d3a (systemd: use unit name in PrivateTmp directories)
I forgot to update the tmpfiles config.
2013-11-16 17:30:58 -05:00
Dave Reisner
7074fecf67 tmpfiles.d: include setgid perms for /run/log/journal
4608af4333 set permissions for journal storage on persistent disk
but not the volatile storage.

ref: https://bugs.archlinux.org/task/37170
2013-10-02 15:35:16 -04:00
Michael Scherer
edcfd89ad0 Add a bit more explicit message, to help confused users
Seeing http://www.happyassassin.net/2013/09/27/further-sysadmin-adventures-wheres-my-freeipa-badge/
it seems that the default message is a bit confusing for people
who never encountered it before, so adding a link to the manpage could
help them.
2013-09-27 15:59:42 +02:00
Lennart Poettering
4608af4333 journald: avoid NSS in journald
In order to avoid a deadlock between journald looking up the
"systemd-journal" group name, and nscd (or anyother NSS backing daemon)
logging something back to the journal avoid all NSS in journald the same
way as we avoid it from PID 1.

With this change we rely on the kernel file system logic to adjust the
group of created journal files via the SETGID bit on the journal
directory. To ensure that it is always set, even after the user created
it with a simply "mkdir" on the shell we fix it up via tmpfiles on boot.
2013-09-17 16:55:37 -05:00
Lennart Poettering
1ee306e124 machined: split out machine registration stuff from logind
Embedded folks don't need the machine registration stuff, hence it's
nice to make this optional. Also, I'd expect that machinectl will grow
additional commands quickly, for example to join existing containers and
suchlike, hence it's better keeping that separate from loginctl.
2013-07-02 03:47:23 +02:00
Zbigniew Jędrzejewski-Szmek
d34cd37490 Make PrivateTmp dirs also inaccessible from the outside
Currently, PrivateTmp=yes means that the service cannot see the /tmp
shared by rest of the system and is isolated from other services using
PrivateTmp, but users can access and modify /tmp as seen by the
service.

Move the private /tmp and /var/tmp directories into a 0077-mode
directory. This way unpriviledged users on the system cannot see (or
modify) /tmp as seen by the service.
2013-03-20 14:08:41 -04:00
Zbigniew Jędrzejewski-Szmek
b08131ec17 tmpfiles: exclude /var/tmp/systemd-private-* too 2013-01-26 10:52:32 -05:00
Zbigniew Jędrzejewski-Szmek
e4ac004c12 tmpfiles: exclude /tmp/systemd-private-* from cleanup
See http://thread.gmane.org/gmane.comp.sysutils.systemd.devel/6874/focus=6891
Should fix https://bugzilla.redhat.com/show_bug.cgi?id=866693
2013-01-25 11:46:58 -05:00
Michał Bartoszkiewicz
610d99284f tmpfiles: do not make /run/nologin executable 2013-01-19 02:11:41 +01:00
Tom Gundersen
9261bb7c50 tmpfiles: move legacy flag-files handling to legacy.conf 2013-01-07 15:21:36 +01:00
Lennart Poettering
61beaf818b tmpfiles: write /run/nologin during early boot to disallow too early user logins
systemd-user-sessoins.service will later on remove the flag file, thus
permitting user logins when the time has come.
2012-06-25 17:35:13 +02:00
Lennart Poettering
24f3a374b9 tmpfiles: exclude the first level directories in /run/user from automatic clean up
It's logind's job to maintain those user dirs, so avoid automatic clean
up for them. However, we do cover everything within them.
2012-06-20 09:05:50 +02:00
Lennart Poettering
5430f7f2bc relicense to LGPLv2.1 (with exceptions)
We finally got the OK from all contributors with non-trivial commits to
relicense systemd from GPL2+ to LGPL2.1+.

Some udev bits continue to be GPL2+ for now, but we are looking into
relicensing them too, to allow free copy/paste of all code within
systemd.

The bits that used to be MIT continue to be MIT.

The big benefit of the relicensing is that closed source code may now
link against libsystemd-login.so and friends.
2012-04-12 00:24:39 +02:00
Lennart Poettering
04ebb59567 shutdownd: rework interface, allow subscribing to scheduled shutdowns
This extends the shutdownd interface to expose schedule shutdown
information in /run/systemd/shutdown/schedule.

This also cleans up the shutdownd protocol and documents it in a header
file sd-shutdown.h.

This is supposed to be used by client code that wants to control and
monitor scheduled shutdown.
2012-04-11 02:04:46 +02:00
Lennart Poettering
87d2c1ff6a journal: add preliminary incomplete implementation 2011-10-07 22:02:05 +02:00
Josh Triplett
f08fce8820 tmpfiles: Move /tmp and /var/tmp to a separate tmpfiles.d file to ease overrides via /etc
Many people prefer to avoid clearing /tmp and /var/tmp, and
distributions often have explicit settings for how often to clear them
if at all.  Overriding those with systemd currently requires overriding
all of /usr/lib/tmpfiles.d/systemd.conf via
/etc/tmpfiles.d/systemd.conf, copying across all the other entries, and
updating that override when systemd.conf changes.

Move the /tmp and /var/tmp entries from systemd.conf to a separate
tmp.conf, making them easier to override without affecting the rest of
systemd.conf.
2011-08-24 20:39:33 +02:00
Josh Triplett
3b09f343fe tmpfiles: Remove X11 lock files for displays :10 and higher too 2011-08-24 02:35:02 +02:00
Lennart Poettering
034a2a52ac sd-login: beef up login api, to add monitoring and enumerating 2011-07-22 21:01:15 +02:00
Lennart Poettering
0e456f9781 path: optionally, create watched directories in .path units 2011-04-10 01:30:14 +02:00
Kay Sievers
5b75435328 move /var/lock to HAVE_SYSV_COMPAT 2011-04-03 22:09:25 +02:00
Lennart Poettering
cca4aeeead tmpfiles: split off rules for legacy systems into legacy.conf 2011-04-02 01:08:31 +02:00
Lennart Poettering
e1ab991283 tmpfiles: enforce new /var/lock semantics
http://lists.freedesktop.org/archives/systemd-devel/2011-March/001823.html
2011-04-01 00:43:28 +02:00
Kay Sievers
6f4ed5203a tmpfiles fix /run/lock permissions
<mbiebl> kay: just wondering: d /run/lock 0755 root lock -
<mbiebl> shouldn't that rather be 0775?
<mbiebl> otherwise it doesn't make sense
2011-03-29 00:15:14 +02:00
Kay Sievers
2b583ce657 use /run instead of /dev/.run
Instead of the /dev/.run trick we have currently implemented, we decided
to move the early-boot runtime dir to /run.

An existing /var/run directory is bind-mounted to /run. If /var/run is
already a symlink, no action is taken.

An existing /var/lock directory is bind-mounted to /run/lock.
If /var/lock is already a symlink, no action is taken.

To implement the directory vs. symlink logic, we have a:
  ConditionPathIsDirectory=
now, which is used in the mount units.

Skipped mount unit in case of symlink:
  $ systemctl status var-run.mount
  var-run.mount - Runtime Directory
    Loaded: loaded (/lib/systemd/system/var-run.mount)
    Active: inactive (dead)
            start condition failed at Fri, 25 Mar 2011 04:51:41 +0100; 6min ago
     Where: /var/run
      What: /run
    CGroup: name=systemd:/system/var-run.mount

The systemd rpm needs to make sure to add something like:
  %pre
  mkdir -p -m0755 /run >/dev/null 2>&1 || :
or it needs to be added to filesystem.rpm.

Udev -git already uses /run if that exists, and is writable at bootup.
Otherwise it falls back to the current /dev/.udev.

Dracut and plymouth need to be adopted to switch from /dev/.run to run
too.

Cheers,
Kay
2011-03-28 23:00:00 +02:00
Lennart Poettering
a49728dc8c tmpfiles: simplify default tmpfiles configuration by using globs 2011-02-13 15:11:28 +01:00
Lennart Poettering
b0734b235f tmpfiles: include reference to man page in tmpfiles files 2010-11-10 23:58:01 +01:00
Bill Nottingham
4d91b19eb6 tmpfiles: Don't clean /var/lock/subsys; it is not aged content
It will get 'cleaned' on boot due to being tmpfs anyway.
2010-10-25 23:25:51 +02:00
Bill Nottingham
f448d9e7c4 tmpfiles: Make wtmp match utmp perms, and add btmp. 2010-10-25 22:21:56 +02:00