1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-23 21:35:11 +03:00
Commit Graph

589 Commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek
6635f57d3e sysctl: enable coredump for suid binaries
Right now the kernel will not dump anything that went through setuid or
setgid. But it is routine for daemons to do that, and it makes things hard to
debug.

systemd-coredump saves the coredump readable by the users the process was
running as. This should be enough to avoid information leakage. So let's also
tell the kernel to do the coredump.

For https://bugzilla.redhat.com/show_bug.cgi?id=1790972.

Both patterns are stored in the same file, so they are enabled or disabled
together. (Though suid_dumpable=2 is supposed to be safe even when writing to
plain files.)
2020-04-07 15:28:46 +02:00
Mike Kazantsev
0e4daba173 NEWS: fix use of tabs instead of spaces for one item 2020-03-16 12:33:43 +09:00
Zbigniew Jędrzejewski-Szmek
2ca17c7801 NEWS: add late note about job trimming issue
Closes #15091.
2020-03-12 15:26:47 +01:00
Zbigniew Jędrzejewski-Szmek
03985d069b NEWS: final contributor update for v245 2020-03-06 13:38:28 +01:00
Paul Menzel
a100fe3c27 NEWS: Use correct tense in v245 entry 2020-03-03 12:24:40 +01:00
Zbigniew Jędrzejewski-Szmek
d54bb63875 NEWS: two minor entries 2020-03-03 08:41:27 +01:00
Zbigniew Jędrzejewski-Szmek
9c4d3d7968 NEWS: update contributors list 2020-03-03 08:31:06 +01:00
Zbigniew Jędrzejewski-Szmek
901d1ce8ef NEWS: add contributors for v245 2020-02-05 10:20:56 +01:00
Zbigniew Jędrzejewski-Szmek
573e58f62f NEWS: mention the operational state changes 2020-02-05 10:20:56 +01:00
Yu Watanabe
f05c0615f4 NEWS: mention SuppressPrefixLength= 2020-02-05 10:13:27 +01:00
Zbigniew Jędrzejewski-Szmek
f2394ddb08 Merge pull request #14779 from keszybz/news-v245 2020-02-05 09:35:58 +01:00
Zbigniew Jędrzejewski-Szmek
69f173477b NEWS: mention the TrafficControlQueueingDiscipline rename 2020-02-05 09:32:16 +01:00
Zbigniew Jędrzejewski-Szmek
823b035271 NEWS: mention empty .link and .network files 2020-02-05 09:32:16 +01:00
Zbigniew Jędrzejewski-Szmek
2ad988896c NEWS: reword and shorten a bunch of stuff 2020-02-05 09:32:16 +01:00
Zbigniew Jędrzejewski-Szmek
427928caa4
network: change "Gateway=dhcp" to "Gateway=_dhcp" (#14774)
This way we avoid confusion with a DNS name. Fixes #14773.
2020-02-05 13:41:30 +09:00
Yu Watanabe
f2f1b52c6f
Merge pull request #14767 from yuwata/network-split-qdisc-section
network: split TrafficControlQueueingDiscipline section into small pieces
2020-02-05 13:35:25 +09:00
Zbigniew Jędrzejewski-Szmek
ca58d00c68 network: FairQueueTrafficPolicing→FairQueueing
This never made into a release, so we can change the name with impunity.
Suggested by Davide Pesavento.

I opted to add the "ing" ending. "Fair queuing" is the name of the general
concept and algorithm, and "Fair queue" is mostly used for the implementation
name.
2020-02-04 17:37:16 +01:00
Zbigniew Jędrzejewski-Szmek
60ed2dcfc7 network: TokenBufferFilter→TokenBucketFilter
This never made into a release, so we can change the name with impunity.
Noticed by Davide Pesavento.
2020-02-04 17:28:15 +01:00
Ansgar Burchardt
eb1322744d NEWS: correct indenting for two entries 2020-02-04 23:57:20 +09:00
Lennart Poettering
9a4940bf92 update NEWS 2020-02-02 18:17:24 +01:00
Lennart Poettering
6841019567 NEWS: more v245 preparation 2020-01-29 14:12:22 +01:00
Lennart Poettering
723822f00a NEWS: start preparing v245 2020-01-29 11:44:32 +01:00
Slava Kardakov
1e904320aa Fixup typo in NEWS 2019-12-03 08:02:24 +09:00
Lennart Poettering
8bf2a311f3 NEWS: update for final 244 2019-11-29 14:29:03 +01:00
Zbigniew Jędrzejewski-Szmek
bdf2357c12 NEWS: add contributors for v244 2019-11-22 09:33:59 +01:00
Lennart Poettering
168e131b8b update NEWS 2019-11-20 16:16:46 +01:00
Zbigniew Jędrzejewski-Szmek
2d8898f564
Merge pull request #14074 from keszybz/rename-system-options
Rename system-options
2019-11-20 16:13:46 +01:00
Yu Watanabe
88b860034e NEWS: SendRawOption= -> SendOption= 2019-11-19 11:52:36 +01:00
Zbigniew Jędrzejewski-Szmek
2536752dda Rename "system-options" to "systemd-efi-options"
This makes the naming more consistent: we now have
bootctl systemd-efi-options,
$SYSTEMD_EFI_OPTIONS
and the SystemdOptions EFI variable.

(SystemdEFIOptions would be redundant, because it is only used in the context
of efivars, and users don't interact with that name directly.)

bootctl is adjusted to use 2sp indentation, similarly to systemctl and other
programs.

Remove the prefix with the old name from 'bootctl systemd-efi-options' output,
since it's redundant and we don't want the old name anyway.
2019-11-18 20:20:58 +01:00
Zbigniew Jędrzejewski-Szmek
cc560ac064 NEWS: fix antique typo 2019-11-18 20:20:58 +01:00
Zbigniew Jędrzejewski-Szmek
852b72727a NEWS: more items
Also reorder some entries to restore the grouping by subject.
2019-11-16 13:48:41 +01:00
Zbigniew Jędrzejewski-Szmek
7b631898ef
Merge pull request #13961 from mwilck/udev-no-exit-timeout
udevd: wait for workers to finish when exiting
2019-11-13 08:56:49 +01:00
Martin Wilck
bfde9421af udevd: wait for workers to finish when exiting
On some systems with lots of devices, device probing for certain drivers can
take a very long time. If systemd-udevd detects a timeout and kills the worker
running modprobe using SIGKILL, some devices will not be probed, or end up in
unusable state. The --event-timeout option can be used to modify the maximum
time spent in an uevent handler. But if systemd-udevd exits, it uses a
different timeout, hard-coded to 30s, and exits when this timeout expires,
causing all workers to be KILLed by systemd afterwards. In practice, this may
lead to workers being killed after significantly less time than specified with
the event-timeout. This is particularly significant during initrd processing:
systemd-udevd will be stopped by systemd when initrd-switch-root.target is
about to be isolated, which usually happens quickly after finding and mounting
the root FS.

If systemd-udevd is started by PID 1 (i.e. basically always), systemd will
kill both udevd and the workers after expiry of TimeoutStopSec. This is
actually better than the built-in udevd timeout, because it's more transparent
and configurable for users. This way users can avoid the mentioned boot problem
by simply increasing StopTimeoutSec= in systemd-udevd.service.

If udevd is not started by systemd (standalone), this is still an
improvement. udevd will kill hanging workers when the event timeout is
reached, which is configurable via the udev.event_timeout= kernel
command line parameter. Before this patch, udevd would simply exit with
workers still running, which would then become zombie processes.

With the timeout removed, the sd_event_now() assertion in manager_exit() can be
dropped.
2019-11-12 12:20:20 +01:00
Anita Zhang
3e1db806b0 core: change top-level drop-in from -.service.d to service.d
Discussed in #13743, the -.service semantic conflicts with the
existing root mount and slice names, making this feature not
uniformly extensible to all types. Change the name to be
<type>.d instead.

Updating to this format also extends the top-level dropin to
unit types.
2019-11-07 08:34:53 +01:00
Yu Watanabe
6878c02245 NEWS: mention NetworkEmulatorDuplicateRate= setting 2019-11-01 13:18:13 +09:00
Christian Rebischke
597f905c76 add other worthy news
I think we can mention that systemd-resolved is able to validate IP
address certificates and prefer TLS 1.3 before TLS 1.2 now.

Also the `machinectl reboot` command actually works now.

Signed-off-by: Christian Rebischke <chris@nullday.de>
2019-10-31 09:02:15 +09:00
Zbigniew Jędrzejewski-Szmek
b7db8b7b13 NEWS: fix two typos 2019-10-30 15:58:53 +01:00
Yu Watanabe
f36e6a4a96 NEWS: fix option name 2019-10-30 14:01:01 +01:00
Zbigniew Jędrzejewski-Szmek
ee50dada49 NEWS: start preparations for v244 2019-10-30 11:16:38 +01:00
Zbigniew Jędrzejewski-Szmek
e48a1e3423 mailmap: add entry to fix authorship of commit
471cffcfb0 was committed on a debug VM where I
didn't have git set up properly.
2019-10-21 15:10:58 +02:00
Zbigniew Jędrzejewski-Szmek
efb536d0cb Update NEWS for v243 2019-09-03 11:27:19 +02:00
Zbigniew Jędrzejewski-Szmek
a7d9b3557e NEWS: update contributors list 2019-09-03 11:27:19 +02:00
Zbigniew Jędrzejewski-Szmek
6d8cf86476 docs: new systemd-security mailing list
In the past, we asked people to open a security bug on one of the "big"
distros. This worked OK as far as getting bugs reported and notifying some
upstream developers went. But we always had trouble getting information to
all the appropriate parties, because each time a bug was reported, a big
thread was created, with a growing CC list. People who were not CCed early
enough were missing some information, etc.

To clean this up, we decided to create a private mailing list. The natural
place would be freedesktop.org, but unfortunately the request to create a
mailing list wasn't handled
(https://gitlab.freedesktop.org/freedesktop/freedesktop/issues/134). And even
if it was, at this point, if there was ever another administrative issue, it
seems likely it could take months to resolve. So instead, we asked for a list
to be created on the redhat mailservers.

Please consider the previous security issue reporting mechanisms rescinded, and
send any senstive bugs to systemd-security@redhat.com.
2019-08-30 09:12:27 +02:00
Zbigniew Jędrzejewski-Szmek
f21e2ecb8b NEWS: update contributors list 2019-08-22 13:47:11 +02:00
Kai Krakow
2dbc45aea7 cgroup: Also set io.bfq.weight
Current kernels with BFQ scheduler do not yet set their IO weight
through "io.weight" but through "io.bfq.weight" (using a slightly
different interface supporting only default weights, not per-device
weights). This commit enables "IOWeight=" to just to that.

This patch may be dropped at some time later.

Github-Link: https://github.com/systemd/systemd/issues/7057
Signed-off-by: Kai Krakow <kai@kaishome.de>
2019-08-20 11:50:59 +02:00
Chris Down
5c76ca6093 NEWS: Remove DisableControllers from v243
We already released this in v240 and had a NEWS entry then.
2019-07-31 12:12:46 +09:00
Zbigniew Jędrzejewski-Szmek
4860f5c2ae NEWS: more entries and some rewordings 2019-07-30 16:50:40 +02:00
Zbigniew Jędrzejewski-Szmek
e397eb50da
Merge pull request #13219 from poettering/named-exit-codes-tweaks
quick follow-up for the symbolic exit status PR #13207
2019-07-30 08:27:20 +02:00
Lennart Poettering
48fd50f749 update TODO 2019-07-30 08:23:18 +02:00
Lennart Poettering
5238d9a83a analyze: rename "exit-codes" to "exit-status"
waitid(2) and the libc function signature calls this "exit status", and
uses "exit code" for something different. Let's stick to the same
nomenclature hence.
2019-07-29 19:22:22 +02:00