1
0
mirror of https://github.com/systemd/systemd.git synced 2024-10-31 07:51:21 +03:00
Commit Graph

53983 Commits

Author SHA1 Message Date
Lennart Poettering
55166094ae homework: add new helper home_setup_undo_mount() 2021-10-27 22:05:20 +02:00
Lennart Poettering
655807f572 homework: make sure fscrypt backend takes a HomeSetup object for all calls
Similar to the same chage we did for the directory backend. Let's always
path the setup context object, i.e. HomeSetup, and store whatever we set
up in there.

No actual change in behaviour.
2021-10-27 22:05:02 +02:00
Lennart Poettering
d5bb2b0375
Merge pull request #20344 from poettering/revert-close-all
Alternative to #20288 – close_all_fds() reworking
2021-10-27 22:02:38 +02:00
Yu Watanabe
3dea470121 test: update comment
Follow-up for 8524db5021.
2021-10-27 19:52:39 +00:00
Yu Watanabe
593524af5d
Merge pull request #21153 from yuwata/network-lifetime-fix
network: fix lifetime handling
2021-10-28 04:52:25 +09:00
Yu Watanabe
ab5d52b79d systemctl: drop redundant "else" 2021-10-28 04:52:06 +09:00
Yu Watanabe
266305484c
Merge pull request #21150 from yuwata/sd-radv-shorten-default-lifetime-2
sd-radv: shorten default lifetime
2021-10-28 04:51:45 +09:00
Yu Watanabe
1462a941fb
Merge pull request #21136 from poettering/homed-uidmap-dir-only
homed uidmapping (just for the directory backend)
2021-10-28 04:51:31 +09:00
Yu Watanabe
4df5799f9b doc: fix typo in command
Follow-up for #21147.
2021-10-28 03:57:24 +09:00
Luca Boccassi
69e0830994 run: do not validate exe early if MountImages/ExtensionImages are used
Same as with RootImage&friends, the executable might be in the
image, so it's not visible in the host before the unit is set up.
2021-10-28 03:56:24 +09:00
Yu Watanabe
99987084f6
Merge pull request #21138 from bluca/show_extensions
systemctl: pretty-print ExtensionImages property
2021-10-28 03:56:04 +09:00
Yu Watanabe
4150584e63 test: do not use alloca() in function call 2021-10-28 03:55:22 +09:00
Lennart Poettering
b689197241 test-fd-util: extend close_all_fds() test to trigger all fallback codepaths
This extends the close_all_fds() logic to overmount /proc with an empty
tmpfs, and/or to block close_range() via seccomp, so that we run the
test case for the function with the fallback paths.

This should make sure that we don't regress in limited environments or
older kernels.
2021-10-27 18:02:49 +02:00
Lennart Poettering
73fc0cbc87 fd-util: export get_max_fd() so that we can use it in tests 2021-10-27 17:56:36 +02:00
Lennart Poettering
ab27b2fe56 exec-util: use close_all_fds_without_malloc() from freeze() 2021-10-27 17:56:36 +02:00
Lennart Poettering
5cfa0798ba fd-util: split out close_all_fds() special case handling and call it from close_all_fds_without_malloc(), too
The optimization is useful there too.
2021-10-27 17:56:36 +02:00
Lennart Poettering
1f6639eac7 fd-util: close_all() check d_type
Tiny optimization: check dirent's d_type before trying to parse
/proc/self/fd/ filenames, given we have that anyway.
2021-10-27 17:56:36 +02:00
Lennart Poettering
c844f0a924 fd-util: always return 0 on success in close_all_fds()
We never make use of the return value, and in case of close_range() we
don't even know how many fds got closed, hence don't pretend we knew.
2021-10-27 17:56:36 +02:00
Lennart Poettering
f498720a34 fd-util: special case invocation of close_all_fds() with single exception fd
Add special case optimization for a single exception fd. It's a
pretty common case in our codebase, and the optimization is simple
and means we don't need to copy/sort the exception array, so do it.
2021-10-27 17:56:36 +02:00
Lennart Poettering
11966552a8 fd-util: split out inner fallback loop of close_all_fds() as close_all_fds_without_malloc() 2021-10-27 17:56:36 +02:00
Lennart Poettering
c85cb3bc7f Revert "basic/fd-util: sort the 'except' array in place"
This reverts commit 9c46228b7d.
2021-10-27 17:56:36 +02:00
Lennart Poettering
e7e7c07c50 Revert "Add variant of close_all_fds() that does not allocate and use it in freeze()"
This reverts commit cbcf371abc.
2021-10-27 17:56:36 +02:00
Lennart Poettering
cf5115f6e5 homework: support uidmapping in the "directory" backend 2021-10-27 17:37:14 +02:00
Lennart Poettering
c7bf079bbc homework: add new helper call that can shift home dir UID/GID ranges
This new helper is not used yet, but it's useful for apply UID/GID
shifts so that the underlying home dir can use an arbitrary UID (for
example "nobody") and we'll still make it appear as owned by the target
UID.

This operates roughly like this:

1. The relevant underlying UID is mapped to the target UID
2. Everything in the homed UID range except for the target UID is left
   unmapped (and thus will appear as "nobody")
3. Everything in the 16bit UID range outside of the homed UID
   range/target UID/nobody user is mapped to itself
4. Everything else is left unmapped (in particular everything outside of
   the 16 bit range).

Why do it like this?

The 2nd rule done to ensure that any files from homed's managed UID
range that do not match the user's own UID will be shown as "unmapped"
basically. Of course, IRL this should never happen, except if people
managed to manipulate the underlying fs directly.

The 3rd rule is to allow that if devs untar an OS image it more or
less just works as before: 16bit UIDs outside of the homed range will
be mapped onto themselves: you can untar things and tar it back up and
things will just work.
2021-10-27 17:37:14 +02:00
Lennart Poettering
2ba38f78c3 homework: rework directory backend to set up mounts in /run/systemd/user-home-mount before moving them to /home
This does what we already do for the LUKS backend: instead of mounting
the source directory directly to the final home dir, we instead bind
mount it to /run/systemd/user-home-mount (where /run/ is unshared and
specific to our own mount namespace), then adjust its mount flags and
then bind mount it in a single atomic operation into the final
destination, fully set up.

This doesn't improve much on its own, but it makes things a tiny bit
more correct: this way MS_NODEV/MS_NOEXEC/MS_NOSUID will already be
applied when the bind mount appears in the host mount namespace, instead
of being adjusted after the fact.

Doing things this way also makes things work more like the LUKS backend,
reducing surprises. Most importantly it's preparation for doing
uidmapping for directory homes, added in a later commit.
2021-10-27 17:37:14 +02:00
Lennart Poettering
cfef46f5fe homework: when activating a directory, include info about it in resulting record
For the other backends we synthesize a "binding" section in the json
record of the user that stores meta info how a user record is "bound" to
the local host. It declares storage info and such. Let's do the same for
the directory/subvolume backends.
2021-10-27 17:37:14 +02:00
Lennart Poettering
e1aeaf27f5 homework: port home_create_directory_or_subvolume() to use HomeSetup
Let's migrate home_create_directory_or_subvolume() to also use HomeSetup
for storing its runtime objects we'd like to destroy in case of failure.

In the beginning this is just the root_fd, but later on we can add more.

No change in behaviour, just shifting things around.
2021-10-27 17:37:14 +02:00
Lennart Poettering
f509ed4b61 homed: move HOME_UID_{MIN,MAX} into a header we can reuse in homework.c 2021-10-27 17:37:14 +02:00
Yu Watanabe
c9e2c2dae3 network: radv: shorten default lifetime of prefix, route prefix, DNS, and domains
See draft-ietf-6man-slaac-renum-02 section 4.1.1.
2021-10-27 23:58:35 +09:00
Yu Watanabe
d951507d5d sd-radv: shorten the default lifetime for prefix/route prefix
See draft-ietf-6man-slaac-renum-02 section 4.1.1.
2021-10-27 23:58:35 +09:00
Yu Watanabe
95e104e049 sd-radv: make prefix/route prefix lifetime can be specified with independently with valid_until
Previously, valid_until (or preferred_until for preferred lifetime) was
calculated from lifetime. So, when an upstream interface acquire a
dynamic prefix (e.g. through DHCPv6-PD) with long lifetime, then sd-radv
advertise the same lifetime. It may not be desired for some situations.
2021-10-27 23:58:28 +09:00
Yu Watanabe
c1c655bb60 network: route: update lifetime of existing route
Otherwise, the route whose lifetime is managed by the sd-event's timer
event source will be removed when the initial lifetime expires.
2021-10-27 23:38:18 +09:00
Yu Watanabe
435910b3a6 network: address: use passed Address object if possible
Then, we can avoid unnecessary duplication.
2021-10-27 23:34:47 +09:00
Yu Watanabe
eef5ebec97
Merge pull request #21143 from yuwata/sd-radv-router-lifetime
sd-radv: several cleanups for router lifetime
2021-10-27 22:14:35 +09:00
Lennart Poettering
6663b509d8 bootctl: refuse parsing unknown special '@' entry ids
Let's make sure '@' is never written as entry ID into any EFI variable,
as we want the ability to add new ids like this later on, with them
resulting in a clear error on older implementations.
2021-10-27 22:12:07 +09:00
Zbigniew Jędrzejewski-Szmek
3c15860e9e
Merge pull request #21147 from DaanDeMeyer/hacking-docs
docs: Clean up HACKING.md
2021-10-27 14:09:46 +02:00
Daan De Meyer
b2c9da052a docs: Specify code block language for mkosi boot instructions 2021-10-27 12:27:16 +01:00
Daan De Meyer
4c71f971c1 docs: Make mkosi install instructions generic 2021-10-27 12:27:16 +01:00
Daan De Meyer
b43ed972e0 docs: Extend builddep instructions to include more distros 2021-10-27 12:27:14 +01:00
Luca Boccassi
8ec6108c0b systemctl: small fixes for MountImages pretty printing 2021-10-27 12:23:55 +01:00
Luca Boccassi
60c16c5cf3 systemctl: pretty-print ExtensionImages property
Complex type, so without explicit support 'systemctl show' just prints [unprintable]
2021-10-27 12:23:55 +01:00
Yu Watanabe
1ad83d9500
Merge pull request #21144 from yuwata/sd-radv-trivial-cleanups
sd-radv: trivial cleanups
2021-10-27 19:52:57 +09:00
Yu Watanabe
8524db5021 conf-parse: make config_parse_many() optionally save 'struct stat' for each file
Fixes #21113.
2021-10-27 19:49:55 +09:00
Luca Boccassi
f3f1172cf6 docs/COREDUMP_PACKAGE_METADATA: ELF section should be allocated and 0-padded 2021-10-27 12:29:31 +02:00
Yu Watanabe
4f1ac4a38d network: radv: refuse invalid router lifetime in conf parser 2021-10-27 19:29:05 +09:00
Yu Watanabe
804775577d sd-radv: update how to calculate interval of sending advertisements 2021-10-27 19:27:23 +09:00
Yu Watanabe
0945767012 sd-radv: router lifetime must be 0 or between 4 seconds and 9000 seconds
See RFC 4861 section 6.2.1.
2021-10-27 19:27:07 +09:00
Daan De Meyer
390a307665 docs: Remove mkosi symlink instruction from HACKING
mkosi automatically builds for the host distro which seems a much
better default to encourage since dnf won't be installed on any host
system that's not Fedora anyway.
2021-10-27 11:10:52 +01:00
Daan De Meyer
ff7c07fb08 docs: Simplify git instructions in HACKING slightly 2021-10-27 11:10:52 +01:00
Daan De Meyer
540804827a docs: Clean up links in HACKING.md 2021-10-27 11:10:50 +01:00