1
0
mirror of https://github.com/systemd/systemd.git synced 2024-10-31 07:51:21 +03:00
Commit Graph

212 Commits

Author SHA1 Message Date
Oleander Reis
2d06ddb7b4 man:systemd.service(5): fix description of specifiers in command lines (#8146)
Command lines now accept specifiers within the first argument.

see issues #3061, #679 and pr #4835
2018-02-09 17:03:09 +01:00
Faalagorn
ed10715af2 man: .service <filename> to <literal> (#8126)
Changed <filename>.service</filename> to <literal>.service</literal> to match style in other manual pages: man 5 systemd.socket, device, mount, automount, swap, target path, timer, slice and scope.
2018-02-08 09:14:55 +01:00
Lennart Poettering
db256aab13 core: be stricter when handling PID files and MAINPID sd_notify() messages
Let's be more restrictive when validating PID files and MAINPID=
messages: don't accept PIDs that make no sense, and if the configuration
source is not trusted, don't accept out-of-cgroup PIDs. A configuratin
source is considered trusted when the PID file is owned by root, or the
message was received from root.

This should lock things down a bit, in case service authors write out
PID files from unprivileged code or use NotifyAccess=all with
unprivileged code. Note that doing so was always problematic, just now
it's a bit less problematic.

When we open the PID file we'll now use the CHASE_SAFE chase_symlinks()
logic, to ensure that we won't follow an unpriviled-owned symlink to a
privileged-owned file thinking this was a valid privileged PID file,
even though it really isn't.

Fixes: #6632
2018-01-11 15:12:16 +01:00
Alan Jenkins
3f2d136505 man: generalize "binary" to "program" (#7668)
Systemd services are permitted to be scripts, as well as binary
executables.

The same also applies to the underlying /sbin/mount and /sbin/swapon.
It is not necessary for the user to consider what type of program file
these are.  Nor is it necessary with systemd-nspawn, to distinguish between
init as a "binary" v.s. a user-specified "program".

Also fix a couple of grammar nits in the modified sentences.
2017-12-16 11:48:12 +01:00
Ken (Bitsko) MacLeod
bd2538b50b man: Clarify when OnFailure= activates after restarts (#7646) 2017-12-15 11:10:41 +01:00
Daniel Black
a327431bd1 core: add EXTEND_TIMEOUT_USEC={usec} - prevent timeouts in startup/runtime/shutdown (#7214)
With Type=notify services, EXTEND_TIMEOUT_USEC= messages will delay any startup/
runtime/shutdown timeouts.

A service that hasn't timed out, i.e, start time < TimeStartSec,
runtime < RuntimeMaxSec and stop time < TimeoutStopSec, may by sending
EXTEND_TIMEOUT_USEC=, allow the service to continue beyond the limit for
the execution phase (i.e TimeStartSec, RunTimeMaxSec and TimeoutStopSec).

EXTEND_TIMEOUT_USEC= must continue to be sent (in the same way as
WATCHDOG=1) within the time interval specified to continue to reprevent
the timeout from occuring.

Watchdog timeouts are also extended if a EXTEND_TIMEOUT_USEC is greater
than the remaining time on the watchdog counter.

Fixes #5868.
2017-12-14 12:17:43 +01:00
Lennart Poettering
53c35a766f core: generalize FailureAction= move it from service to unit
All kinds of units can fail, hence it makes sense to offer this as
generic concept for all unit types.
2017-11-20 16:37:22 +01:00
Zbigniew Jędrzejewski-Szmek
572eb058cf Add SPDX license identifiers to man pages 2017-11-19 19:08:15 +01:00
Lennart Poettering
8adf53582c man: document that ExecStop= is executed during restarts
Fixes: #7126
2017-11-17 11:25:02 +01:00
Lennart Poettering
78a263f432 man: add missing suffixing "=" for setting name 2017-11-17 11:25:02 +01:00
bleep_blop
132523e7f7 man: fix typo for !! in systemd.service (#7031)
!! must be very similar to !, not itself.
2017-10-08 22:01:08 +02:00
Zbigniew Jędrzejewski-Szmek
1245e4132b man: use "filename" not "file name" by default
We settled on "filename" and "file system", so change a couple of places for
consistency. The exception is when there's an adjective before "file" that
binds more strongly then "name": "password file name", "output file name", etc.
Those cases are left intact.
2017-09-15 17:18:29 +02:00
Zbigniew Jędrzejewski-Szmek
6e2f5000c7 man: delete note about propagating signal termination
That advice is generally apropriate for "user" programs, i.e. programs which
are run interactively and used pipelines and such. But it makes less sense for
daemons to propagate the exit signal. For example, if a process receives a SIGTERM,
it is apropriate for it to exit with 0 code. So let's just delete the whole
paragraph, since this page doesn't seem to be the right place for the longer
discussion which would be required to mention all the caveats and considerations.

Fixes #6415.
2017-09-15 09:33:25 +02:00
John Lin
45f09f939b man: explicitly distinguish "implicit dependencies" and "default dependencies"
Fixes: #6793
2017-09-13 11:39:09 +08:00
Jakub Wilk
ee905de0d6 man: fix typos (#6739) 2017-09-04 22:25:59 +09:00
Lennart Poettering
165a31c0db core: add two new special ExecStart= character prefixes
This patch adds two new special character prefixes to ExecStart= and
friends, in addition to the existing "-", "@" and "+":

"!"  → much like "+", except with a much reduced effect as it only
       disables the actual setresuid()/setresgid()/setgroups() calls, but
       leaves all other security features on, including namespace
       options. This is very useful in combination with
       RuntimeDirectory= or DynamicUser= and similar option, as a user
       is still allocated and used for the runtime directory, but the
       actual UID/GID dropping is left to the daemon process itself.
       This should make RuntimeDirectory= a lot more useful for daemons
       which insist on doing their own privilege dropping.

"!!" → Similar to "!", but on systems supporting ambient caps this
       becomes a NOP. This makes it relatively straightforward to write
       unit files that make use of ambient capabilities to let systemd
       drop all privs while retaining compatibility with systems that
       lack ambient caps, where priv dropping is the left to the daemon
       codes themselves.

This is an alternative approach to #6564 and related PRs.
2017-08-10 15:04:32 +02:00
Zbigniew Jędrzejewski-Szmek
fa0c9e6315 man: add more detail about quoting in ExecStart lines
Fixes #624.
2017-06-30 10:00:13 -04:00
Lennart Poettering
80af263b6c man: improve documentation of ExecStartPost= a bit
Let's make clear what start-up really means in this case.

See: #6097
2017-06-27 21:30:48 +02:00
Lennart Poettering
3ceb72e558 core: permit FDSTORE=1 messages with non-pollable fds
This also alters the documentation to recommend memfds rather than /run
for serializing state across reboots. That's because /run doesn't
actually have the same lifecycle as the fd store, as it is cleared out
on restarts.

Fixes: #5606
2017-06-26 15:14:41 +02:00
Zbigniew Jędrzejewski-Szmek
7e867138f5 Merge pull request #5600 from fbuihuu/make-logind-restartable
Make logind restartable.
2017-06-24 18:58:36 -04:00
Franck Bui
9b1419111a core: only apply NonBlocking= to fds passed via socket activation
Make sure to only apply the O_NONBLOCK flag to the fds passed via socket
activation.

Previously the flag was also applied to the fds which came from the fd store
but this was incorrect since services, after being restarted, expect that these
passed fds have their flags unchanged and can be reused as before.

The documentation was a bit unclear about this so clarify it.
2017-06-06 22:42:50 +02:00
Zbigniew Jędrzejewski-Szmek
0e3f51cf8d man: don't say that ExecStart syntax is "very shell"
Fixes #6035.
2017-05-30 16:33:42 -04:00
Ted W
09b69d68fa man: Clarify Restart= exception for systemctl stop (#5891) 2017-05-09 20:22:04 +02:00
Amir Yalon
23656d2b95 docs: clarify ExecStop= implications for remaining processes (#5793) 2017-04-25 09:31:29 +02:00
AlexanderKurtz
bda99fab31 man: Fix a simple grammar error in systemd.service.xml (#5594) 2017-03-15 20:33:56 -04:00
AsciiWolf
28a0ad81ee man: use https:// in URLs 2017-02-21 16:28:04 +01:00
Lucas Werkmeister
aa9f9e587d man: add cross-reference
The third paragraph of the Description already linked to
systemd.resource-control(5), but it was missing from the list of
additional options for the [Service] section.
2017-02-07 16:20:25 +01:00
Lennart Poettering
b3bb64767a man: document that sd_notify() is racy in some cases 2017-02-06 18:21:27 +01:00
Zbigniew Jędrzejewski-Szmek
6b3d378331 Merge pull request #4879 from poettering/systemd 2017-01-14 21:29:27 -05:00
Felipe Sateler
99479986ea man: Align ExecStop= documentation with actual kill behavior (#4974)
The manpage claimed that ExecStop would be followed immediately by
SIGKILL, whereas the actual behavior is to go through KillMode= and
KillSignal= first.

Fixes #4490
2016-12-24 11:34:26 +01:00
Lennart Poettering
e4b45b32e5 man: document that services need at least one of ExecStart= or ExecStop=
Fixes: #4521
2016-12-21 19:09:32 +01:00
Zbigniew Jędrzejewski-Szmek
1eecafb8c1 man: use unicode ellipsis in more places
As requested in
https://github.com/systemd/systemd/pull/4864#pullrequestreview-12372557.

docbook will substitute triple dots for the ellipsis in man output, so this has
no effect on the troff output, only on HTML, making it infinitesimally nicer.

In some places we show output from programs, which use dots, and those places
should not be changed. In some tables, the alignment would change if dots were
changed to the ellipsis which is only one character. Since docbook replaces the
ellipsis automatically, we should leave those be. This patch changes all other
places.
2016-12-11 17:13:19 -05:00
Zbigniew Jędrzejewski-Szmek
330785f5ca basic/extract-word,man: clarify "correction" of invalid escapes
Our warning message was misleading, because we wouldn't "correct" anything,
we'd just ignore unkown escapes. Update the message.

Also, print just the extracted word (which contains the offending sequences) in
the message, instead of the whole line.

Fixes #4697.
2016-12-11 00:21:36 -05:00
Jouke Witteveen
6375bd2007 service: new NotifyAccess= value for control processes (#4212)
Setting NotifyAccess=exec allows notifications coming directly from any
control process.
2016-11-29 23:20:04 +01:00
Lucas Werkmeister
6d24947638 man: mention start rate limiting in Restart= doc (#4637) 2016-11-10 18:20:44 -05:00
Zbigniew Jędrzejewski-Szmek
99bdcdc7fc man: add a note that FDSTORE=1 requires epoll-compatible fds
Let's say that this was not obvious from our man page.
2016-10-28 22:45:05 -04:00
Lucas Werkmeister
4cf13011fe man: document dependencies implied by Sockets= (#4412)
Fixes #4410. Also includes two minor improvements to the previous
sentence.
2016-10-19 23:21:26 +02:00
Lennart Poettering
6dcda09cbf man: document that Type=idle is subject to a 5s time-out
Fixes: #4116
2016-10-11 18:01:54 +02:00
Zbigniew Jędrzejewski-Szmek
29df65f913 man: add "timeout" to status table (#3919) 2016-08-11 10:51:49 +02:00
Lennart Poettering
136dc4c435 core: set $SERVICE_RESULT, $EXIT_CODE and $EXIT_STATUS in ExecStop=/ExecStopPost= commands
This should simplify monitoring tools for services, by passing the most basic
information about service result/exit information via environment variables,
thus making it unnecessary to retrieve them explicitly via the bus.
2016-08-04 23:08:05 +02:00
Lennart Poettering
43eb109aa9 core: change ExecStart=! syntax to ExecStart=+ (#3797)
As suggested by @mbiebl we already use the "!" special char in unit file
assignments for negation, hence we should not use it in a different context for
privileged execution. Let's use "+" instead.
2016-07-25 16:53:33 +02:00
Luca Bruno
aa4f6cf12c man: clarify NotifyAccess overriding (#3620)
Type=notify has a magic overriding case where a NotifyAccess=none
is turned into a NotifyAccess=main for sanity purposes.
This makes docs more clear about such behavior:
2787d83c28/src/core/service.c (L650):L651
2016-06-28 20:14:08 +02:00
Alessandro Puccetti
cf677fe686 core/execute: add the magic character '!' to allow privileged execution (#3493)
This patch implements the new magic character '!'. By putting '!' in front
of a command, systemd executes it with full privileges ignoring paramters
such as User, Group, SupplementaryGroups, CapabilityBoundingSet,
AmbientCapabilities, SecureBits, SystemCallFilter, SELinuxContext,
AppArmorProfile, SmackProcessLabel, and RestrictAddressFamilies.

Fixes partially https://github.com/systemd/systemd/issues/3414
Related to https://github.com/coreos/rkt/issues/2482

Testing:
1. Create a user 'bob'
2. Create the unit file /etc/systemd/system/exec-perm.service
   (You can use the example below)
3. sudo systemctl start ext-perm.service
4. Verify that the commands starting with '!' were not executed as bob,
   4.1 Looking to the output of ls -l /tmp/exec-perm
   4.2 Each file contains the result of the id command.

`````````````````````````````````````````````````````````````````
[Unit]
Description=ext-perm

[Service]
Type=oneshot
TimeoutStartSec=0
User=bob
ExecStartPre=!/usr/bin/sh -c "/usr/bin/rm /tmp/exec-perm*" ;
    /usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-start-pre"
ExecStart=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-start" ;
    !/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-star-2"
ExecStartPost=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-start-post"
ExecReload=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-reload"
ExecStop=!/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-stop"
ExecStopPost=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-stop-post"

[Install]
WantedBy=multi-user.target]
`````````````````````````````````````````````````````````````````
2016-06-10 18:19:54 +02:00
Lennart Poettering
cc4e4df49f man: clarify that DefaultDependencies= is in the [Unit] section
This hopefully reduces confusion resulting in issues like #2992.
2016-04-12 13:43:33 +02:00
Zbigniew Jędrzejewski-Szmek
b266400c92 Merge pull request #2590 from zonque/bus-endpoint-removal
Remove kdbus custom endpoint support
2016-02-11 21:58:46 -05:00
Jakub Wilk
07ff561c26 man: fix typos 2016-02-12 00:01:16 +01:00
Daniel Mack
9ca6ff50ab Remove kdbus custom endpoint support
This feature will not be used anytime soon, so remove a bit of cruft.

The BusPolicy= config directive will stay around as compat noop.
2016-02-11 22:12:04 +01:00
Lennart Poettering
1917c8cab4 man: document that ExecStartPost= is only run if ExecStart= succeeded
Fixes: #846
2016-02-10 23:48:50 +01:00
Lennart Poettering
6bf0f408e4 core: make the StartLimitXYZ= settings generic and apply to any kind of unit, not just services
This moves the StartLimitBurst=, StartLimitInterval=, StartLimitAction=, RebootArgument= from the [Service] section
into the [Unit] section of unit files, and thus support it in all unit types, not just in services.

This way we can enforce the start limit much earlier, in particular before testing the unit conditions, so that
repeated start-up failure due to failed conditions is also considered for the start limit logic.

For compatibility the four options may also be configured in the [Service] section still, but we only document them in
their new section [Unit].

This also renamed the socket unit failure code "service-failed-permanent" into "service-start-limit-hit" to express
more clearly what it is about, after all it's only triggered through the start limit being hit.

Finally, the code in busname_trigger_notify() and socket_trigger_notify() is altered to become more alike.

Fixes: #2467
2016-02-10 13:26:56 +01:00
Lennart Poettering
ce359e98f8 core: when a service's ExecStartPre= times out, skip ExecStop=
This makes sure we never run two control processes at the same time, we cannot keep track off.

This introduces a slight change of behaviour but cleans up the definition of ExecStop= and ExecStopPost=. The former is
now invoked only if the service managed to start-up correctly. The latter is called even if start-up failed half-way.
Thus, ExecStopPost= may be used as clean-up step for both successful and failed start-up attempts, but ExecStop='s
purpose is clearly defined as being responsible for shutting down the service and nothing else.

The precise behaviour of this was not documented yet. This commit adds the necessary docs.

Fixes: #1254
2016-02-03 23:58:47 +01:00