1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-25 01:34:28 +03:00
Commit Graph

8773 Commits

Author SHA1 Message Date
Frantisek Sumsal
ad444dd8e8 man: slightly reword LogFilterPatterns= description
As there was something missing in the existing sentence.
2024-04-15 17:16:18 +02:00
Sam Leonard
9bfabe14e5 man: fix incorrect XML in man page 2024-04-15 10:40:11 +02:00
Yu Watanabe
14f3bdaa73
Merge pull request #32271 from YHNdnzj/arch-man
Fixes for links to man projects
2024-04-15 14:35:04 +09:00
Kristian Klausen
254e1aa707 vmspawn: Fix incorrect/broken links in the man page 2024-04-15 14:33:33 +09:00
Mike Yuan
e561037517
man/sd-journal: correct project name for man7
Follow-up for 5aa8180392
2024-04-14 23:46:54 +08:00
Mike Yuan
311f4b8f6a
man: switch wireguard man project to man7 2024-04-14 23:41:34 +08:00
Mike Yuan
41fead40e6
man/custom-html: update link to Arch manual 2024-04-14 23:38:38 +08:00
Yu Watanabe
ae9fd433d6
Merge pull request #32194 from henryli001/lihl/add-defaultUseDomains-config
network: add mechanism to configure default UseDomains= setting
2024-04-14 13:40:06 +09:00
Henry Li
fb57300743 network: add mechanism to configure default UseDomains= setting, update man page and add test 2024-04-13 16:54:31 -07:00
Ole Peder Brandtzæg
712514416e man: remove PrivateMounts= from list of other settings in its own description
The diff looks bigger, but that's only because it seemed fitting to
reformat the paragraph now that the list is shorter.
2024-04-14 08:04:12 +09:00
Sam Leonard
edd85c8414 vmspawn: add --discard-disk= to control handling of disk discard requests
Fixes issue #32024, using --discard-disk=yes will enable handling of disk
discarding requests, saving space for long running VMs as desired.
2024-04-12 20:32:38 +02:00
Ludwig Nussel
aadbe55925 creds: allow null when decrypting
pcrlock writes a credential file using null key. Make sure systemd-creds
can show the file
2024-04-11 12:15:32 +01:00
Pablo Méndez Hernández
ffd0cca34a man/journald: Add missing configuration files
The man page was missing:

-  `/run/systemd/journald.conf`
-  `/usr/lib/systemd/journald.conf`

as valid configuration files.

Fixes: https://github.com/systemd/systemd/issues/32199
2024-04-10 20:15:17 +08:00
Luca Boccassi
0f0d001254
Merge pull request #32104 from yuwata/network-ndisc-redirect
network/ndisc: add support for Redirect message
2024-04-08 20:03:32 +01:00
Luca Boccassi
b1b5d7e4bf
Merge pull request #32140 from YHNdnzj/socket-per-peer-source
Minor tweaks to socket manual & shorten the code a bit
2024-04-08 10:38:07 +01:00
Mike Yuan
6b014a2ac4
man/systemd.socket: be explicit that MaxConnectionsPerSource=0 means disabled 2024-04-08 01:49:49 +08:00
Lennart Poettering
0af7e29434 nspawn: make nspawn work without privileges 2024-04-06 16:08:24 +02:00
Lennart Poettering
702a52f4b5 mountfsd: add new systemd-mountfsd component 2024-04-06 16:08:24 +02:00
Lennart Poettering
8aee931e7a nsresourced: add new daemon for granting clients user namespaces and assigning resources to them
This adds a small, socket-activated Varlink daemon that can delegate UID
ranges for user namespaces to clients asking for it.

The primary call is AllocateUserRange() where the user passes in an
uninitialized userns fd, which is then set up.

There are other calls that allow assigning a mount fd to a userns
allocated that way, to set up permissions for a cgroup subtree, and to
allocate a veth for such a user namespace.

Since the UID assignments are supposed to be transitive, i.e. not
permanent, care is taken to ensure that users cannot create inodes owned
by these UIDs, so that persistancy cannot be acquired. This is
implemented via a BPF-LSM module that ensures that any member of a
userns allocated that way cannot create files unless the mount it
operates on is owned by the userns itself, or is explicitly
allowelisted.

BPF LSM program with contributions from Alexei Starovoitov.
2024-04-06 16:08:24 +02:00
Vito Caputo
a7d8cacce0 man: fix typo s/veno/reno/ 2024-04-06 07:12:33 +02:00
Mike Yuan
36b21fac8f
sleep: rename SleepMemMode= to MemorySleepMode=
Addresses https://github.com/systemd/systemd/pull/31986#discussion_r1554053623
2024-04-06 02:16:54 +08:00
Zbigniew Jędrzejewski-Szmek
f1a090b136 man: sd_notify() does not fail if var is unset 2024-04-05 13:56:17 +02:00
Yu Watanabe
6df0059441 network/ndisc: add basic support for Redirect message
Closes #31438.
2024-04-05 05:57:54 +09:00
Mike Yuan
05d2a63139
man/kernel-command-line: document resume_offset= too 2024-04-05 03:03:09 +08:00
Luca Boccassi
2aef0ac819
Merge pull request #32097 from keszybz/sd-notify-cleanups
Small cleanups to sd_notify docs
2024-04-04 17:44:12 +01:00
Daan De Meyer
7b62a246a6
Merge pull request #32033 from DaanDeMeyer/unit-creds
debug-generator: Add unit and drop-in credentials
2024-04-04 18:27:20 +02:00
Daan De Meyer
8595f578fe debug-generator: Add unit and drop-in credentials
These allow adding extra units and drop-ins via credentials.
2024-04-04 16:17:38 +02:00
Zbigniew Jędrzejewski-Szmek
3a9259d93c man: align strings in sd_notify() examples
I think this way it's easier to see that they are part of the same argument.
2024-04-04 14:41:56 +02:00
Zbigniew Jędrzejewski-Szmek
4cbf560edf man/notify-selfcontained-example: check argument first
This is just good style. In this particular case, if the argument is incorrect and
the function is not tested with $NOTIFY_SOCKET set, the user could not get the
proper error until running for real.

Also, remove mention of systemd. The protocol is fully generic on purpose.
2024-04-04 12:18:30 +02:00
Zbigniew Jędrzejewski-Szmek
a1887f8b48 man: regenerate rules
Fixup for dfad86b838.
2024-04-04 12:18:30 +02:00
Zbigniew Jędrzejewski-Szmek
19e980eb92 man: update fedora example to F40
F40 will be out soon, so we can update the man page already. The example should
already work.

The cloud link was dropped in fd571c9df0, so
drop the unused variable too.
2024-04-04 09:19:24 +01:00
Yu Watanabe
94ad70989f man/example: also build example code with C90
Unfortunately, sd-bus-vtable.h, sd-journal.h, and sd-id128.h
have variadic macro and inline initialization of sub-object, these are
not supported in C90. So, we need to silence some errors.
2024-04-04 03:23:20 +09:00
Yu Watanabe
3a6bee0510
Merge pull request #32043 from YHNdnzj/resume-clear-efi
units: introduce systemd-hibernate-clear.service that clears stale HibernateLocation EFI variable
2024-04-04 02:43:00 +09:00
Yu Watanabe
040cb66458 man/examples: set _GNU_SOURCE in source, rather than by compile option
Addresses https://github.com/systemd/systemd/pull/32057#issuecomment-2034408569.
2024-04-04 02:30:29 +09:00
Lennart Poettering
47fba8f925 notify-example: also send STOPPING=1 at exit
I think the example should reflect the full set of lifecycle messages,
including STOPPING=1, which tells the service manager that the service
is already terminating. This is useful for reporting this information
back to the user and to suppress repeated shutdown requests.

It's not as important as the READY=1 and RELOADING=1 messages, since we
actively wait for those from the service message if the right Type= is
set. But it's still very valuable information, easy to do, and completes
the state engine.
2024-04-03 15:52:07 +01:00
Mike Yuan
5f0cd5717f
man/kernel-command-line: be clear that resumeflags= is about timeout opts only 2024-04-03 22:08:11 +08:00
Mike Yuan
dfad86b838
units: introduce systemd-hibernate-clear.service that clears
stale HibernateLocation EFI variable

Currently, if the HibernateLocation EFI variable exists,
but we failed to resume from it, the boot carries on
without clearing the stale variable. Therefore, the subsequent
boots would still be waiting for the device timeout,
unless the variable is purged manually.

There's no point to keep trying to resume after a successful
switch-root, because the hibernation image state
would have been invalidated by then. OTOH, we don't
want to clear the variable prematurely either,
i.e. in initrd, since if the resume device is the same
as root one, the boot won't succeed and the user might
be able to try resuming again. So, let's introduce a
unit that only runs after switch-root and clears the var.

Fixes #32021
2024-04-03 22:07:43 +08:00
Yu Watanabe
e98d4c3599 man/meson: add simple build test for example code 2024-04-03 17:58:39 +09:00
Yu Watanabe
2548ce6a30 man/examples: fix sd- header path 2024-04-03 17:58:39 +09:00
Yu Watanabe
e84f70e16d man/examples: use strerror() instead of %m 2024-04-03 17:58:35 +09:00
Yu Watanabe
06d0dcc009 man/example: fix build failure of hwdb-usb-device.c
STRLEN() and xsprintf() is our internal macros.
2024-04-03 17:44:41 +09:00
Luca Boccassi
f98e2b33ea
Merge pull request #32030 from bluca/dlopen_document
man: document that using sd_journal APIs might cause dlopen to happen and add self-contained notify protocol example
2024-04-02 17:18:02 +01:00
Luca Boccassi
383917ac67 man: add self-contained example of notify protocol
We are saying in public that the protocl is stable and can be easily
reimplemented, so provide an example doing so in the documentation,
license as MIT-0 so that it can be copied and pasted at will.
2024-04-02 14:53:31 +01:00
Luca Boccassi
5aa8180392 man: document that using sd_journal APIs might cause dlopen to happen 2024-04-02 14:53:31 +01:00
Mike Yuan
9c96ffe003
man/tmpfiles.d: drop doubled space 2024-04-02 17:12:55 +08:00
Eisuke Kawashima
86f36e87ff doc(tmpfiles.d): remove deprecated F type
close #32044
2024-04-02 02:46:19 +01:00
Daan De Meyer
3799fa803e repart: Add DefaultSubvolume= setting
We already have Subvolumes= to create subvolumes, let's add
DefaultSubvolume= as well to set the default subvolume.
2024-03-30 00:08:12 +00:00
Luca Boccassi
8312b17a29 core: apply ReloadLimit to reexec too
Same reason as the reload, reexec is disruptive and it requires the
same privileges, so if somebody wants to limit reloads, they'll also
want to limit reexecs, so use the same setting.
2024-03-29 12:03:32 +00:00
Luca Boccassi
55c1a411c6 portable: the 'flags' parameter is now used in DetachImageWithExtensions() and ReattachImageWithExtensions() 2024-03-29 09:35:45 +09:00
Mike Yuan
a2124b35e9
sleep: add SleepMemMode= setting for configuring /sys/power/mem_sleep
The setting is used when /sys/power/state is set to 'mem'
(common for suspend) or /sys/power/disk is set to 'suspend'
(hybrid-sleep). We default to kernel choice here, i.e.
respect what's set through 'mem_sleep_default=' kernel
cmdline option.
2024-03-28 17:19:35 +08:00
Mike Yuan
0a3fd5ce43
man/systemd-sleep: reorder options 2024-03-28 17:16:24 +08:00
Yu Watanabe
a3ed665a29 network/dhcp-server: introduce PersistLeases= setting
Requested at https://github.com/systemd/systemd/pull/31772#issuecomment-2000053357.
2024-03-27 13:21:15 +00:00
Luca Boccassi
66f35161f6 core: add counter for soft-reboot iterations
Allow to query via D-Bus how many times the current booted system has
been soft rebooted
2024-03-27 01:27:35 +00:00
Luca Boccassi
54f86b86ba core: add SoftRebootStartTimestamp
Will be useful to calculate how long it took to shut down the system before starting
in the new root
2024-03-27 01:25:49 +00:00
Jakub Sitnicki
97df75d7bd socket: pass socket FDs to all ExecXYZ= commands but ExecStartPre=
Today listen file descriptors created by socket unit don't get passed to
commands in Exec{Start,Stop}{Pre,Post}= socket options.

This prevents ExecXYZ= commands from accessing the created socket FDs to do
any kind of system setup which involves the socket but is not covered by
existing socket unit options.

One concrete example is to insert a socket FD into a BPF map capable of
holding socket references, such as BPF sockmap/sockhash [1] or
reuseport_sockarray [2]. Or, similarly, send the file descriptor with
SCM_RIGHTS to another process, which has access to a BPF map for storing
sockets.

To unblock this use case, pass ListenXYZ= file descriptors to ExecXYZ=
commands as listen FDs [4]. As an exception, ExecStartPre= command does not
inherit any file descriptors because it gets invoked before the listen FDs
are created.

This new behavior can potentially break existing configurations. Commands
invoked from ExecXYZ= might not expect to inherit file descriptors through
sd_listen_fds protocol.

To prevent breakage, add a new socket unit parameter,
PassFileDescriptorsToExec=, to control whether ExecXYZ= programs inherit
listen FDs.

[1] https://docs.kernel.org/bpf/map_sockmap.html
[2] https://lore.kernel.org/r/20180808075917.3009181-1-kafai@fb.com
[3] https://man.archlinux.org/man/socket.7#SO_INCOMING_CPU
[4] https://www.freedesktop.org/software/systemd/man/latest/sd_listen_fds.html
2024-03-27 01:41:26 +08:00
Luca Boccassi
14a5217679 resolved: support reloading configuration at runtime
Drop connections and caches and reload config from files, to allow
for low-interruptions updates, and hook up to the usual SIGHUP and
ExecReload=. Mark servers and services configured directly via D-Bus
so that they can be kept around, and only the configuration file
settings are dropped and reloaded.

Fixes https://github.com/systemd/systemd/issues/17503
Fixes https://github.com/systemd/systemd/issues/20604
2024-03-26 13:36:42 +00:00
Zbigniew Jędrzejewski-Szmek
c38e4e2fda
Merge pull request #29721 from poettering/systemd-project
New capsule@.service feature
2024-03-26 13:19:33 +01:00
Luca Boccassi
b1d18b96c4
Merge pull request #31801 from flatcar-hub/krnowak/sysext-config
systemd-sysext: Add support for env vars, ephemeral layers and some fixes
2024-03-26 09:23:19 +00:00
Gaël Donval
7b123f8186 Document SYSTEMD_REPART_MKFS_* in repart.d manual 2024-03-26 03:08:38 +09:00
Krzesimir Nowak
5ae2f83b3e man: Document sysext ephemeral-import mode 2024-03-25 08:30:09 +01:00
Krzesimir Nowak
504bdf08b5 man: Document sysext ephemeral mode 2024-03-25 08:19:48 +01:00
Krzesimir Nowak
ca49d4c33d man: Install sysext man pages when ENABLE_SYSEXT is true 2024-03-25 08:14:36 +01:00
Luca Boccassi
a2369b8be4
Merge pull request #31919 from YHNdnzj/analyze-verify
Some fixes/improvements for analyze
2024-03-24 11:50:44 +00:00
Mike Yuan
147e7b4446
analyze-dot: also show BindsTo= in --require 2024-03-24 01:28:28 +08:00
Adrian Vovk
d94c7eef12 homework: Implement offline updates
This makes it possible to update a home record (and blob directory) of a
home area that's either completely absent (i.e. on a USB stick that's
unplugged) or just inaccessible due to lack of authentication
2024-03-23 01:05:13 +00:00
Adrian Vovk
5ec87d577f homework: Accept volume key from keyring
This bypasses authentication (i.e. user_record_authenticate) if the
volume key was loaded from the keyring and no secret section is
provided.

This also changes Update() and Resize() to always try and load the
volume key from the keyring. This makes the secret section optional for
these methods while still letting them function (as long as the home
area is active)
2024-03-23 01:05:13 +00:00
Luca Boccassi
1b5f3f5662
Merge pull request #31670 from CodethinkLabs/vmspawn/generate_ssh_keys
vmspawn: generate ssh keys
2024-03-22 16:28:03 +00:00
Daan De Meyer
16f182e59a
Merge pull request #31839 from DaanDeMeyer/log
log: Add per target log levels
2024-03-22 15:11:11 +01:00
Daan De Meyer
e8815abff6 log: Add per target log levels
For CI in mkosi, I want to configure systemd to log at debug level
to the journal, but not to the console. While we already have max
level settings for journald's forwarding settings, not every log line
goes to the journal, specifically during early boot and when units
are connected directly to the console (think systemd-firstboot), so
let's extend the log level options we already have to allow specifying
a comma separated list of values and lets allow prefixing values with
the log target they apply to to make this possible.
2024-03-22 12:46:32 +01:00
Gerd Hoffmann
57ea8012d6 sd-boot: add support for support enrolling dbx
usage:
  (1) get latest revocation list for your architecture
      from https://uefi.org/revocationlistfile
  (2) copy the file to $ESP/loader/keys/$name/dbx.auth
2024-03-21 23:03:42 +00:00
Matthias Lisin
245bd4af99 man: fix minor issues 2024-03-21 02:49:38 +01:00
cunshunxia
cc59d1014f man: fix a few issues in manpage
fix: #31482

Signed-off-by: cunshunxia <cunshunxia@tencent.com>
2024-03-20 15:24:11 +01:00
Zbigniew Jędrzejewski-Szmek
7aed434371 Rename uid0 to run0
Naming is always a matter of preference, and the old name would certainly work,
but I think the new one has the following advantages:
- A verb is better than a noun.
- The name more similar to "the competition", i.e. 'sudo', 'pkexec', 'runas',
  'doas', which generally include an action verb.
- The connection between 'systemd-run' and 'run0' is more obvious.

There has been no release yet with the old name, so we can rename without
caring for backwards compatibility.
2024-03-19 16:37:22 +01:00
Daan De Meyer
db7374e156 Document new vsock literals
Fixes #31849
2024-03-19 12:31:36 +00:00
Adrian Vovk
1f8aa8456e
homed: Minor man page improvements 2024-03-18 15:31:18 -04:00
Adrian Vovk
5d490208a8
Revert "homed: Add InhibitSuspend() method"
I'm moving this functionality into logind instead.

This reverts commit 691b99160d.
2024-03-18 15:31:16 -04:00
Ronan Pigott
88123aa21c dnssd: support service subtypes
A service subtype is used for selective enumeration of services.
2024-03-18 13:16:48 +00:00
Jörg Behrmann
80e748155e man: add missing "and" to importctl description 2024-03-16 12:52:48 +01:00
Max Gautier
ba53d4eb9a documentation: fix inconsistency
Since this sentence is in the same section it refers to, it does not
make much sense to mention the "section below".
2024-03-15 14:09:52 +00:00
Lennart Poettering
f63c1ada25
Merge pull request #31739 from poettering/pid1-sd-notify-tweaks
pid1: send various notifications via sd_notify() reporting boot progress
2024-03-14 18:43:57 +01:00
Adrian Wannenmacher
c6d0c6688e man: fix efi var vendor uuid for systemd-bless-boot.service
The specified vendor UUID is not actually a UUID. This changes it to an actual UUID.

The new value matches the ones from the systemd-boot man page and [The Boot Loader Interface](https://systemd.io/BOOT_LOADER_INTERFACE/).
2024-03-14 16:54:49 +00:00
Lennart Poettering
1e785c50c9 docs: document new sd_notify() extensions 2024-03-14 17:24:24 +01:00
Lennart Poettering
95be59f907 ssh-generator: introduce ssh-access.target
This new passive target is supposed to be pulled in by SSH
implementations and should be reached when remote SSH access is
possible. The idea is that this target can be used as indicator for
other components to determine if and when SSH access is possible.

One specific usecase for this is the new sd_notify() logic in PID 1 that
sends its own supervisor notifications whenever target units are
reached. This can be used to precisely schedule SSH connections from
host to VM/container, or just to identify systems where SSH is even
available.
2024-03-14 17:23:28 +01:00
Sam Leonard
2042aebb55
vmspawn: generate ephemeral SSH keys for the VM 2024-03-14 11:55:54 +00:00
Yu Watanabe
cdafb51ab4
Merge pull request #31754 from YHNdnzj/journal-fd-namespace
journal/cat: allow connecting output to specific journal namespace
2024-03-14 19:59:19 +09:00
Lennart Poettering
e8fd555471 man: document the new concepts 2024-03-14 11:34:04 +01:00
Lennart Poettering
7b14f85cd8 man: shorten unnecessarily long example 2024-03-14 11:05:04 +01:00
Mike Yuan
45bcab66a9
journal/cat: allow connecting output to specific journal namespace 2024-03-14 14:25:53 +08:00
Mike Yuan
32104d3251
sd-journal: introduce sd_journal_stream_fd_with_namespace 2024-03-14 14:25:52 +08:00
Mike Yuan
1ea275f119 core/cgroup: introduce MemoryZSwapWriteback setting
Added in
501a06fe8e
2024-03-13 23:36:25 +00:00
Luca Boccassi
121c4eba0a ukify: really add default .sbat for UKIs
This was lost on refactor, and only addons had a default uki
line in the .sbat. Add it back, and differentiate between the
default for UKIs vs the default for addons, so that they can
be revoked separately. These are only defaults and users are
encouraged to provide their own.

Follow-up for a8b645dec8
2024-03-12 11:36:08 +01:00
Yu Watanabe
5582b36c38 network/dhcp-server: save leases in state directory
Then, we can read the lease file on restart, and the DHCP server will be
able to manage previously assigned addresses.

To save leases in the state directory /var/lib/systemd/network/, this
adds systemd-networkd-dhcp-server.service, and by default
systemd-networkd does not start the DHCP server without the heler
service started.

Closes #29991.
2024-03-12 01:57:17 +09:00
Yu Watanabe
91676b6458 networkctl: introduce "persistent-storage" command
Then, this introduces systemd-networkd-persistent-storage.service.

systemd-networkd.service is an early starting service. So, at the time
it is started, the persistent storage for the service may not be ready,
and we cannot use StateDirectory=systemd/network in
systemd-networkd.service.

The newly added systemd-networkd-persistent-storage.service creates the
state directory for networkd, and notify systemd-networkd that the
directory is usable.
2024-03-12 01:57:16 +09:00
Luca Boccassi
03292f9663
Merge pull request #31706 from DaanDeMeyer/smbios
systemd-boot: Add support for reading extra kernel cmdline from SMBIOS
2024-03-11 10:44:11 +00:00
Daan De Meyer
f710037984 man: Mention that SMBIOS type 11 strings are ignored inside CVM 2024-03-10 21:24:52 +01:00
Luca Boccassi
3cf1e7d678 man: fix systemd-measure manpage conditional
Follow-up for ec3cf73f30
2024-03-10 17:50:54 +00:00
Mike Yuan
edec55ea61 man/systemd-hibernate-resume: generator now enables rather than creates the service
Follow-up for a628d933cc
2024-03-10 16:13:19 +00:00
Daan De Meyer
365e90b946 systemd-boot: Add support for reading extra kernel cmdline from SMBIOS
Same as io.systemd.stub.kernel-cmdline-extra, but for type 1 entries
booted by systemd-boot.
2024-03-10 16:30:34 +01:00
Antonio Alvarez Feijoo
6be9f641ce man/kernel-install: add add-all command to synopsis 2024-03-08 21:26:48 +00:00
Zbigniew Jędrzejewski-Szmek
ec596fe34e
Merge pull request #30480 from keszybz/kernel-install-more-paths
Read kernel-install config from /run/kernel too
2024-03-08 08:25:07 +01:00
Zbigniew Jędrzejewski-Szmek
db26d8025e kernel-install: support full set of config files and drop-ins
This brings the handling of config for kernel-install in line with most of
systemd, i.e. we search the set of paths for the main config file, and the full
set of drop-in paths for drop-ins.

This mirrors what 07f5e35fe7 did for udev.conf.
That change worked out fine, so I hope this one will too.

The update in the man page is minimal. I think we should split out a separate
page for the config file later on.

One motivating use case is to allow a drop-in to be created for temporary
config overrides and then removed after the operation is done.
2024-03-07 19:14:36 +01:00
Zbigniew Jędrzejewski-Szmek
b83a59f8a7 man: document all the new paths 2024-03-07 19:14:36 +01:00
Ronan Pigott
4e17de7fee man/resolve: update DNSSEC description
This behavior was changed.

Fixes: 9c47b33444 ("resolved: enable DNS proxy mode if client wants DNSSEC")
2024-03-07 11:29:48 +00:00
Michael Biebl
73d8990930 man: fix systemd-timedated man page wrt ntp-units.d
The service parsing/using this directory is systemd-timedated, not
systemd-timesyncd.
2024-03-06 21:44:12 +00:00
Lennart Poettering
74d142ff3a
Merge pull request #30612 from AdrianVovk/sleep-freeze-user-seesions
Freeze user sessions for all types of sleep
2024-03-06 18:52:57 +01:00
Luca Boccassi
ba6ec879bb
Merge pull request #31621 from poettering/resolved-proxy-do
resolved: proxy upstream local requests to our stub with DO bit set
2024-03-06 13:55:14 +00:00
Zbigniew Jędrzejewski-Szmek
ec3cf73f30 meson/man: allow man pages to use multiple conditions
This way the man pages are installed only when the corresponding binary is
installed. The conditions in man pages and man/rules/meson.build are adjusted to
match the conditions for units in units/meson.build.
2024-03-06 09:55:01 +00:00
Adrian Vovk
0b958bb3ee
sleep: Always freeze user.slice
Previously, we'd only freeze user.slice in the case of s2h, because we
didn't want the user session to resume while systemd was transitioning
from suspend to hibernate.

This commit extends this freezing behavior to all sleep modes.

We also have an environment variable to disable the freezing behavior
outright. This is a necessary workaround for someone that has hooks
in /usr/lib/systemd/system-sleep/ which communicate with some
process running under user.slice, or if someone is using the proprietary
NVIDIA driver which breaks when user.slice is frozen (issue #27559)

Fixes #27559
2024-03-05 12:12:35 -05:00
Lennart Poettering
36418a4792 resolvectl: expose new SD_RESOLVED_RELAX_SINGLE_LABEL flag in resolvectl 2024-03-05 15:29:04 +01:00
Lennart Poettering
d0eae64c1f resolved: add new SD_RESOLVED_RELAX_SINGLE_LABEL resolver flag
This new flag allows resolving single label names via public DNS. By
default this is turned off, and this option allows excepting a lookup
for this.
2024-03-05 15:28:54 +01:00
Zbigniew Jędrzejewski-Szmek
27faf24a48
Merge pull request #31597 from keszybz/option-P-for-machinectl-and-timedatectl
Option -P for machinectl and timedatectl
2024-03-05 10:11:40 +04:00
Lennart Poettering
af8a03ccf8 resolved: mention the Varlink interface of resolved
This is ready from prime-time, hence mention it.
2024-03-04 19:50:01 +00:00
Mike Yuan
3d1759299f
man/systemd-debug-generator: be consistent on '=' for boolean options 2024-03-05 02:19:58 +08:00
Zbigniew Jędrzejewski-Szmek
c5c619502b machinectl: add -P 2024-03-04 16:12:23 +04:00
Zbigniew Jędrzejewski-Szmek
31e70e88cd timedatectl: add -P 2024-03-04 16:12:21 +04:00
Mike Yuan
6e890fe86f
man/sd_notify: be explicit that FDPOLL= is not a global setting
"submitted" is already used in the description of FDNAME=.
Let's use that instead of "stored" for FDPOLL= too, to make
it more clear that it's a per-submission/per-fdset setting.
2024-03-03 19:01:01 +08:00
Yu Watanabe
5bafe8d1e7 man: fix typo
Follow-up for 419b25ddca.
2024-03-02 11:57:39 +09:00
Lennart Poettering
0068131bf5
Merge pull request #31507 from poettering/import-modernize
importd: various modernizations
2024-03-01 23:42:32 +01:00
Lennart Poettering
5db99d6651
Merge pull request #31274 from bluca/measure_engine
repart/measure/ukify: add support for OpenSSL engines/providers
2024-03-01 23:41:25 +01:00
Lennart Poettering
fd571c9df0 man: document new importctl/importd functionality
This also replaces the Fedora download example with another one from
Ubuntu, since Fedora's images these days no longer qualify as DDIs, they
have no distinctive partition type UUIDs set for multiple of their
partitions, hence the images cannot be booted. A bit sad. Let's provide
a command that just works in its place.
2024-03-01 22:29:07 +01:00
Lennart Poettering
7253eaa0fb sd-event: make return code of sd_event_get_exit_code() optional 2024-03-01 22:25:42 +01:00
Lennart Poettering
3c1053ff27 machinectl: mention -V in --help text
Follow-up for f82dcc3fc3
2024-03-01 22:24:19 +01:00
Luca Boccassi
419b25ddca ukify: add support for engine signing of PCR signatures 2024-03-01 17:32:19 +00:00
Luca Boccassi
ed896a5b85 measure: add support for --certificate and --private-key-source for engine/provider signing
Allow signing with an OpenSSL engine/provider, such as PKCS11. A public key is
not enough, a full certificate is needed for PKCS11, so a new parameter is
added for that too.
2024-03-01 17:32:19 +00:00
Luca Boccassi
a73144bbdf repart: add --private-key-source and drop --private-key-uri
It turns out it's mostly PKCS11 that supports the URI format,
and other engines just take files. For example the tpm2-tss-openssl
engine just takes a sealed private key file path as the key input,
and the engine needs to be specified separately.

Add --private-key-source=file|engine:foo|provider:bar to
manually specify how to use the private key parameter.

Follow-up for 0a8264080a
2024-03-01 17:32:19 +00:00
Adrian Vovk
793ceda177 user-record: Add preferredSession{Type,Launcher}
These will be used by display managers to pre-select the user's
preferred desktop environment and display server type. On homed, the
display manager will also be able to set these fields to cache the
user's last selection.
2024-03-01 16:28:10 +00:00
Yu Watanabe
d5e6df24bd
Merge pull request #31498 from ssahani/bond
netdev: bond - add support for peer_notif_delay
2024-03-01 12:45:52 +09:00
Yu Watanabe
14a5c07afa networkctl: use varlink method to dump LLDP neighbors
`networkctl lldp` and `networkctl status INTERFACE` now use varlink
call to the networkd to query LLDP neighbors.

Then, this allows to dump LLDP neighbors in JSON format.

Co-authored-by: Tomáš Pecka <tomas.pecka@cesnet.cz>
2024-03-01 09:40:26 +09:00
Luca Boccassi
9b61d422ff
Merge pull request #31430 from CodethinkLabs/vmspawn/machinectl_vmspawn_support
machinectl: initial vmspawn support
2024-02-29 11:27:02 +00:00
Lennart Poettering
5b97957376
Merge pull request #31531 from poettering/verity-userspace-optional
dissect: make use of userspace verity keyring optional
2024-02-28 22:04:58 +01:00
Sam Leonard
f82dcc3fc3
machinectl: support vmspawn as a backend 2024-02-28 17:49:00 +00:00
Sam Leonard
b0dc766852
vmspawn: support machined registration 2024-02-28 17:49:00 +00:00
Lennart Poettering
f0ecff8506 dissect: condition usespace verity keyring via kernel cmdline option + env var 2024-02-28 16:18:22 +01:00
Lennart Poettering
dc9a56d83e man: add a few missing entries to kernel-command-line man page 2024-02-28 15:33:51 +01:00
Lennart Poettering
78266a54f1 tree-wide: use "_" rather than "-" as separator in kernel cmdline options
Most of our kernel cmdline options use underscores as word separators in
kernel cmdline options, but there were some exceptions. Let's fix those,
and also use underscores.

Since our /proc/cmdline parsers don't distinguish between the two
characters anyway this should not break anything, but makes sure our own
codebase (and in particular docs and log messages) are internally
consistent.
2024-02-28 15:33:51 +01:00
Luca Boccassi
0cad991c4c
Merge pull request #31293 from ragazenta/netdev_rps
udevd: Add ReceivePacketSteeringCPUMask for systemd.link
2024-02-28 13:37:28 +00:00
Susant Sahani
00386d5b3f netdev: bond - add support for peer_notif_delay
Specify the delay, in milliseconds, between each peer
notification (gratuitous ARP and unsolicited IPv6
Neighbor Advertisement) when they are issued after
a failover event. This delay should be a multiple of
the MII link monitor interval (miimon).

 The valid range is 0 - 300s. The default value is 0,
which means to match the value of the MII link monitor interval.
2024-02-28 17:31:02 +05:30
Yu Watanabe
39af486a7f network/ndisc: drop redundant sd_ndisc_router_get_icmp6_ratelimit()
This effectively reverts 9175002864.

The retrans time field in RA message is for neighbor solicitation,
and the commit d4c8de21a0 makes the value
assigned to the correct sysctl property.

Let's deprecate the option, and drop the redundant functions.
2024-02-28 11:05:00 +00:00
Renjaya Raga Zenta
0f30bf5886 udevd: Add ReceivePacketSteeringCPUMask for systemd.link
Takes a list of CPU indices or ranges separated by either whitespace or commas. Alternatively,
takes the special value "all" in which will include all available CPUs in the mask.
CPU ranges are specified by the lower and upper CPU indices separated by a dash (e.g. "2-6").
This option may be specified more than once, in which case the specified CPU affinity masks are merged.
If an empty string is assigned, the mask is reset, all assignments prior to this will have no effect.
Defaults to unset and RPS CPU list is unchanged. To disable RPS when it was previously enabled, use the
special value "disable".

Currently, this will set CPU mask to all `rx` queue of matched device (if it has multiple queues).

The `/sys/class/net/<dev>/queues/rx-<n>/rps_cpus` only accept cpu bitmap mask in hexadecimal.

Fix: #30323
2024-02-28 11:35:36 +07:00
Luca Boccassi
47c2a6e958
Merge pull request #31515 from keszybz/small-cleanups-after-review-of-stable-batch
Small cleanups after review of stable batch
2024-02-27 20:07:18 +00:00
Zbigniew Jędrzejewski-Szmek
3e6b040bec man/sd_bus_service_reconnect.c: normalize whitespace
For man pages, we generally indent with 2 spaces and wrap to ~80 columns.
2024-02-27 18:15:51 +01:00
Štěpán Němec
c959e17823 man, shell-completion: fix a few typos/language issues 2024-02-27 16:57:33 +00:00
Luca Boccassi
e5191faf44
Merge pull request #31000 from flatcar-hub/krnowak/mutable-overlays
systemd-sysext: Implement optional mutability for extensions
2024-02-26 16:17:11 +00:00
Lennart Poettering
795ec90cda vmspawn: use our own ptyfwd code for the console of a VM
Let's make systemd-nspawn use our own ptyfwd logic to handle the TTY by
default.

This adds a new setting --console=, inspired by nspawn's setting of the
same name. If --console=interactive= is used, then we'll do the TTY
dance on our own via ptyfwd, and thus get tinting, our usual hotkey
handling and similar.

Since qemu's own console is useful too, let's keep it around via
--console=native.

FInally, replace the --qemu-gui switch by --console=gui.
2024-02-26 11:54:37 +01:00
Thilo Fromm
ea29a87f23 man/systemd-sysext.xml: document mutable extensions
Signed-off-by: Thilo Fromm <thilofromm@microsoft.com>
2024-02-23 19:17:50 +01:00
Sam Leonard
5df0159ef2 ssh-generator: add mention of ssh.authorized_keys.root to man page 2024-02-23 12:52:28 +00:00
Yu Watanabe
3976c43092 network: introduce per-interface IP forwarding settings
This deprecates IPForward= setting, which unconditionally controled
the global setting, even though it is a setting in .network file.

Instead, this introduces new IPv4Forwarding= and IPv6Forwarding=
settings both in .network and networkd.conf.
If these settings are specified in a .network file, then the
per-interface forwarding setting will be configured.
If specified in networkd.conf, then the global IP forwarding setting will
be configured.

Closes #30648.
2024-02-22 19:24:12 +00:00
Luca Boccassi
909c4f8587
Merge pull request #31414 from poettering/bsod-tweaks
bsod: some small bsod tweaks
2024-02-22 12:48:38 +00:00
Luca Boccassi
a0d2c41ed6
Merge pull request #31432 from poettering/vmspawn-qemu-rename
vmspawn: drop "qemu" word from most switches
2024-02-22 11:04:45 +00:00
Susant Sahani
9adafeddac netdev/macvlan: allow to set the broadcast queueing threshold
Allow to set the broadcast queueing threshold
on macvlan devices. This controls which multicast packets will be
processed in a workqueue instead of inline.
2024-02-22 09:36:19 +09:00
Lennart Poettering
2c0061c784 vmspawn: rename "qemu" specific switches to not carry the "qemu" prefix
This renames a few of the switches vmspawn takes, such as --qemu-mem=
and --qemu-smp= to names without the "qemu" moniker and uses less
cryptic names (i.e. --ram= and --cpus=).

I think it's a bit unsystematic that so far we use the "qemu" prefix for
some options but not for others. At least I could not figure out a
system when we use it and when we don't. Hence let's clean it up and
just use simpler names without suffix.

After all we might want to plug other hypervisors behind vmspawn one
day, hence I think there's value in sticking to generic names for these
switches that allow us to switch out backends easily. In particular for
--ram= and --cpus= which are probably the most fundamental of VM settings
there are.

The old switches are support for compat, but not advertised in man page
or --help text anymore.

I left "--qemu-gui" under its current name, since it fundamentally is a
a qemu concept, exposing a qemu specific graphical UI.
2024-02-21 16:35:53 +01:00
Lennart Poettering
cf9de8ef21 vspawn: prefer "VSOCK" spelling over "vsock" and "VSock"
The vsock(7) man page appears to prefer "VSOCK" spelling for the
concept, let's also use it as much as we can.
2024-02-21 16:18:24 +01:00
Lennart Poettering
9655cd3c95 bsod: add new option --tty= to specify TTY to output on
If specified we'll not try to find a free V, but instead just output
directly to the specified TTY. This is particularly useful for
debugging, as it means "systemd-bsod --tty=/dev/tty" just works.
2024-02-21 15:11:27 +01:00
Luca Boccassi
14975aaef8
Merge pull request #31326 from CodethinkLabs/vmspawn/extra_drives
vmspawn: add --extra-drive= and correctly escape ',' in certain  qemu arguments
2024-02-21 13:52:22 +00:00
Martin Ivicic
ea932bd34d networkd: support setting dhcp server port 2024-02-21 19:33:27 +09:00
Sam Leonard
1ec3218e82
vmspawn: add --extra-drive= 2024-02-21 10:22:40 +00:00
Yu Watanabe
3c6d9d1c39
Merge pull request #31405 from yuwata/network-ndisc-reachable-time
network/ndisc: set neighbor reachable time
2024-02-21 14:29:01 +09:00
Luca Boccassi
5605b7d61a
Merge pull request #31400 from poettering/askpw-rework
Password Asking rework
2024-02-20 23:45:52 +00:00
Zbigniew Jędrzejewski-Szmek
0615abef62 analyze: always recommend saving the output to a file
The command will refuse to write to a TTY, so give a strong hint
that redirecting to a file is recommended. This makes the synopsis,
man page text, and --help output consistent.

Also drop the space after the redirection operator everywhere.
2024-02-20 19:35:58 +00:00
Lennart Poettering
732285eb8c man: tweak cryptsetup credentials docs a bit
Let's bring the credentials into a better order, in order of relevance.

Also, let's clarify what the generic LUKS PIN is about.

Finally, list the credentials in system-credentials(7) too, after all
people might want to unlock a disk with this via SMBIOS Type 11 or so.
2024-02-20 16:50:00 +01:00
Lennart Poettering
0fceb5539d man: now that the crdentials used by systemd-cryptenroll are in order, document them
Replaces: #31370
2024-02-20 16:50:00 +01:00
Yu Watanabe
1452d49741 network/ndisc: set IPv6 neighbor reachable time
Closes #31402.
2024-02-20 15:31:39 +09:00
runiq
793166aea5 udev: String substitutions can be done in ENV, too
Precedence for example in ac63c8df30/rules.d/99-systemd.rules.in (L75).

Add ENV to the list of keys where string substitutions can be used.

While I'm at it, also sort the list in that paragraph alphabetically.
2024-02-20 13:10:30 +09:00
Yu Watanabe
4b6d8de09c home: fix typo
Follow-up for 25c89b8977 and
a4d72746c7.
2024-02-20 09:25:30 +09:00
Luca Boccassi
4086a16742
Merge pull request #31357 from keszybz/cleanups-vmspawn
Cleanups vmspawn
2024-02-19 16:45:42 +00:00
Adrian Vovk
25c89b8977 homectl: Add flags to edit blob directories
This makes it possible to edit blob directories using homectl. The
following syntax is available:

* `--blob-directory=/path/somewhere`: Replaces the entire blob directory
with the contents of /path/somewhere

* `--blob-directory=foobar=/path/somewhere`: Replaces just the file
foobar in the blob directory with the contents of /path/somewhere

* `--blob-directory=foobar=`: Deletes the file foobar from the blob
directory

* `--blob-directory=`: Resets all previous flags

* `--avatar=`, etc: Shortcuts for `--blob-directory=FILENAME=` for the
known files in the blob directory
2024-02-19 11:18:11 +00:00
Adrian Vovk
a4d72746c7 homework: Handle Update & Create w/ blob dir
Introduces new extended variants of the various incarnations of
Create and Update, which take a map of filenames to FDs. This map is
then used to populate the bulk directory.

FDs are used to prevent the client from abusing homed's blob directory
permissions (everything is made world-readable by homed) to open files
that they normally aren't allowed to open. Passing along an FD ensures
that the client has read access to the file it wants homed to make
world-readable.

Internally, homework uses the map to overwrite the system blob dir.
Later, homework's existing blob dir reconciliation logic will propagate
the new contents from the system blob dir into the embedded blob
dir
2024-02-19 11:18:11 +00:00
Adrian Vovk
c3d50255fc homed: Create & advertise blob directory
This ensures that a user-specific blob directory exists in
/var/cache/systemd/homed for as long as the user exists, and gets
deleted if the user gets deleted.

It also advertises this blob directory via the user record, so that
clients can find and use it.
2024-02-19 11:18:11 +00:00
Luca Boccassi
034569150f
Merge pull request #31364 from bluca/vpick_ext
core: add support for vpick for ExtensionImages=/ExtensionDirectories=
2024-02-19 11:15:54 +00:00
Zbigniew Jędrzejewski-Szmek
9eb195701e man: reword paragraph about --forward-journal= and adjust spacing
The previous text did not look right when rendered.

The text is much easier to read when paragraphs are separated by an empty
line, latex-style.
2024-02-19 11:56:28 +01:00
Luca Boccassi
8d2a38ef6c man: fix typo in uid0.xml
Follow-up for 72eb3081b2
2024-02-18 13:01:21 +00:00
Luca Boccassi
622efc544d core: add support for vpick for ExtensionDirectories= 2024-02-17 11:20:00 +00:00
Luca Boccassi
5e79dd96a8 core: add support for vpick for ExtensionImages= 2024-02-17 11:20:00 +00:00
Luca Boccassi
7fa428cf44 man: create reusable snippet for 'vpick' entries 2024-02-17 11:20:00 +00:00
Yu Watanabe
e21dd22040
Merge pull request #31338 from ssahani/network-bond-missed
network: netdev - bond add support for ARP missed max
2024-02-17 06:16:42 +09:00
Luca Boccassi
92d1419eb8
Merge pull request #31218 from CodethinkLabs/vmspawn/journal_forwarding
vmspawn: support journal forwarding
2024-02-16 12:09:52 +00:00
Susant Sahani
b33bba0434 network: netdev - bond add support for ARP missed max
Allows to configure bond arp_missed_max is the maximum number of arp_interval monitor cycle
for missed ARP replies. If this number is exceeded, link is reported as
down.
2024-02-16 14:44:51 +05:30
Luca Boccassi
e07e7017bb man: enchance sd_bus_set_watch_bind() example to handle one more failure
In case the D-Bus policy is not set up correctly the example just
loops forever. Check the return of sd_bus_request_name_async() in
a callback and exit if the error is not temporary.

Follow-up for 34bbda18a5
2024-02-15 14:19:39 +00:00
Sam Leonard
258d26940f
vmspawn: add --forward-journal= 2024-02-15 14:08:21 +00:00
Sam Leonard
f31cff849d
journald: implement socket forwarding
This commit adds a new way of forwarding journal messages - forwarding
over a socket.

The socket can be any of AF_INET, AF_INET6, AF_UNIUX or AF_VSOCK.

The address to connect to is retrieved from the "journald.forward_address" credential.

It can also be specified in systemd-journald's unit file with ForwardAddress=
2024-02-15 14:08:20 +00:00
Benjamin Franzke
614d09a37d nspawn: add support for owneridmap bind option
owneridmap bind option will map the target directory owner from inside the
container to the owner of the directory bound from the host filesystem.
This will ensure files and directories created in the container will be owned
by the directory owner of the host filesystem. All other users will remain
unmapped. Files to be written as other users in the container will not be
allowed.

Resolves: #27037
2024-02-15 11:49:54 +01:00
Winterhuman
6c6ec5f728 Improve IgnoreSIGPIPE description
Reword the description of the `IgnoreSIGPIPE=` service option to be more grammatical.
2024-02-14 17:31:18 +00:00
Mike Yuan
3725766266 systemctl: don't warn unit needs reload if --no-warn 2024-02-15 00:37:19 +08:00
Lennart Poettering
955502121d man: update D-Bus docs with new calls 2024-02-14 15:08:03 +01:00
Lennart Poettering
6e9bf0ad29 logind: add ability to upgrade session class from 'user-incomplete' to 'user' 2024-02-14 15:00:46 +01:00
Lennart Poettering
53ebde6db4 logind: add new 'user-incomplete' session class 2024-02-14 14:58:37 +01:00
Luca Boccassi
25d80c2203
Merge pull request #31283 from CodethinkLabs/vmspawn/start_from_template
vmspawn: Support being invoked from a template unit
2024-02-14 13:55:04 +00:00
Adrian Vovk
49e55abb7f
user-record: Add languages field
This field is like preferredLanguage, but takes a priority list of
languages instead. If an app isn't translated into a user's primary
language, it can fall back to one of the other languages in the list
thus making the app more accessible to the user.

For instance: in my experience, many Ukrainians are fluent in Russian,
often significantly better than English (especially if they are of a
generation that grew up during the USSR). Such a person might set this
new variable to ["uk_UA.UTF-8", "ru_UA.UTF-8"] so that software that
lacks Ukrainian translations will first try Russian translations before
defaulting to English.

Fixes #31290
2024-02-13 17:39:14 -05:00
Sam Leonard
811ad9e6b2
vmspawn: support multiple initrds via merging 2024-02-13 12:26:33 +00:00
Lennart Poettering
c9cdbaed17
Merge pull request #30380 from keszybz/tmpfiles-dry-run
Make tmpfiles/sysusers nicer with local files and implement tmpfiles --dry-run
2024-02-13 09:45:50 +01:00
Ondrej Kozina
c5daf14c88 cryptsetup: Add optional support for linking volume key in keyring.
cryptsetup 2.7.0 adds feature to link effective volume key in custom
kernel keyring during device activation. It can be used later to pass
linked volume key to other services.

For example: kdump enabled systems installed on LUKS2 device.
This feature allows it to store volume key linked in a kernel keyring
to the kdump reserved memory and reuse it to reactivate LUKS2 device
in case of kernel crash.
2024-02-13 09:45:08 +01:00
cunshunxia
c18c7e2322 Fix OOMPolicy= version in manpage of systemd.scope
OOMPolicy in scope units is separately supported in
version v253, so I think it cannot be directly used
in the manpage with the version from the service.

fix:#30836
2024-02-12 16:49:42 +00:00
Lennart Poettering
a85daa97d9
Merge pull request #31233 from poettering/pcrlock-varlink
pcrlock: add simple Varlink API + some varlinkctl tweaks
2024-02-12 15:48:03 +01:00
Lennart Poettering
8b68a199c2
Merge pull request #31242 from poettering/socket-uid-account
pid1: make MaxConnectionsPerSource= do something useful on AF_UNIX sockets
2024-02-12 14:07:51 +01:00
Zbigniew Jędrzejewski-Szmek
9e90d4f42e tmpfiles: implement --dry-run
The idea is simple: skip the final operation that creates or removes things
or changes the attributes, but otherwise go through the rest of the code.
This results in quite a lot of fairly repetitive conditions in the low-level
code. Another approach would be to print earlier, at a higher level, but then
we'd have less precise information about what is about to happen.
2024-02-12 13:33:30 +01:00
Lennart Poettering
a66ab6d801
Merge pull request #31076 from CodethinkLabs/vmspawn/directory_image_support
[vmspawn] directory type image support
2024-02-12 12:20:16 +01:00
Mike Yuan
4d0b06d535
Merge pull request #31181 from fbuihuu/gpt-auto-more-defensive
gpt-auto-generator: be more defensive when checking the presence of E…
2024-02-12 19:12:17 +08:00
Lennart Poettering
7781d28fd7 varlinkctl: add new --collect switch
It exposes the varlink_collect() call we internally provide: it collects
all responses of a method call that is issued with the "more" method
call flag. It then returns the result as a single JSON array.
2024-02-12 12:04:18 +01:00
Lennart Poettering
48930a5ded pid1: make MaxConnectionsPerSource= also work for AF_UNIX sockets
The setting currently puts limits on connections per IP address and
AF_UNIX CID. Let's extend it to cover AF_UNIX too, where it puts a limit
on connections per UID.

This is particularly useful for the various Accept=yes Varlink services
we now have, as it means, the number of per-user instance services
cannot grow without bounds.
2024-02-12 11:57:16 +01:00
Sam Leonard
a8f940c4b5
vmspawn: add support for --bind(-ro)= 2024-02-12 09:46:02 +00:00
Sam Leonard
7fe9c9909d
vmspawn: document --directory and --private-users 2024-02-12 09:46:01 +00:00
Franck Bui
8a1326581d gpt-auto-generator: be more defensive when checking the presence of ESP in fstab
Looking for the ESP node is useful to shortcut things but if we're told that
the node is not referenced in fstab that doesn't necessarily mean that ESP is
not mounted via fstab. Indeed the check is not reliable in all cases. Firstly
because it assumes that udev already set the symlinks up. This is not the case
for initrd-less boots. Secondly the devname of the ESP partition can be wrongly
constructed by the dissect code. For example, the approach which consists in
appending "p<partnum>" suffix to construct the partition devname from the disk
devname doesn't work for DM devices.

Hence this patch makes the logic more defensive and do not mount neither ESP
nor XBOOTLDR automatically if any path in paths that starts with /efi or /boot
exists.
2024-02-12 09:30:35 +01:00
Mike Yuan
189a08e83d
core/service: allow RestartForceExitStatus= for oneshot services
I think this was just overlooked in #13754, which removed
the restriction of Restart= on Type=oneshot services.
There's no reason to prevent RestartForceExitStatus=
now that Restart= has been allowed.

Closes #31148
2024-02-10 21:19:36 +08:00
Mike Yuan
a5d9df35ac
man/systemd.service: document that Restart=always/on-success are refused
by oneshot services
2024-02-10 21:19:35 +08:00
Daan De Meyer
1a0541d44c repart: Add --generate-fstab= and --generate-crypttab= options
These can be used along with two new settings MountPoint= and
EncryptedVolume= to write fstab and crypttab entries to the given
paths respectively in the root directory that repart is operating on.

This is useful to cover scenarios that aren't covered by the
Discoverable Partitions Spec. For example when one wants to mount
/home as a separate btrfs subvolume. Because multiple btrfs subvolumes
can be mounted from the same partition, we allow specifying MountPoint=
multiple times to add multiple entries for the same partition.
2024-02-10 13:07:02 +01:00
Luca Boccassi
769ca9ab55
Merge pull request #31261 from bluca/repart_engine
repart: support engines and providers
2024-02-09 21:28:59 +00:00
Zbigniew Jędrzejewski-Szmek
b1935cc943 tmpfiles: use dir_cleanup() for R and D
... i.e. apply nested config (exclusions and such) when executing R and D.

This fixes a long-standing RFE. The existing logic seems to have been an
accident of implementation. After all, if somebody specifies a config with
'R /foo; x /tmp/bar', then probably the goal is to remove stuff from under /foo,
but keep /tmp/bar. If they just wanted to nuke everything, then would not specify
the second item.

This also makes R and D use O_NOATIME, i.e. the access times of the directories
that are accessed will not be changed by the cleanup.

Obviously, we'll have to add this to NEWS and such.
Looking at the whole tmpfiles.d config in Fedora, this change has no effect.

The test cases are adjusted as appropriate. I also added another test case for
'R'/'D' with a file, just to test this code path more.

Replaces #20641.
Fixes #1633.
2024-02-09 17:57:42 +01:00
Zbigniew Jędrzejewski-Szmek
9c8a0ca69e tmpfiles: split out verbs in help
One of the three must always be specified, but they buried in a long list of
options in the output of --help. Make them more visible to draw the eye.

Also, drop "marked" from the description. It's supposed to mean "configured",
but it's a strange way to say that, and also it's generally obvious that the
program does what its configuration tells it to, and it's not going to remove
all files found on the system.
2024-02-09 17:57:41 +01:00
Zbigniew Jędrzejewski-Szmek
f7862b2a00 tree-wide: use normal spelling of "reopen"
It's a commonly used verb meaning "to open again".
2024-02-09 17:57:41 +01:00
Zbigniew Jędrzejewski-Szmek
ec3917d282 tmpfiles,sysusers: rework path argument handling
Previously, if given an absolute path, we would open the file, but when given a
relative path, we'd attempt to search the directories. If the user wants to open
a file from the search path, allowing paths is very confusing. E.g. with a path
like 'sysusers/foo.conf', we'd try to open '/etc/sysusers.d/sysusers/foo.conf',
'/run/sysusers.d/sysusers/foo.conf', …, and with '../foo.conf', we'd try to open
'/etc/sysusers.d/../foo.conf', '/run/sysusers.d/../foo.conf', …. This just isn't
useful, and in fact for a scheme like sysusers.d and tmpfiles.d where there we
have a flat directory with config files, only searching for plain names can
result in success. When a user specifies a relative path, it's more likely that
they wanted to open some local file. OTOH, to correctly open a local file, e.g.
one that they're just writing, this interface is also awkward, because something
like '$PWD/file.conf' has to be used to open a file with a relative path.

This patch changes the interface so that any path (i.e. an argument with "/") is
used to open a file directly, and only plain basenames are used for searching.

(Note that tpmfiles and sysusers are somewhat special here: their "config files"
make sense without the other config and users are likely to want to test them
without the other config. I was trying to do just that when writing a spec file
for a package and attempting to convert the existing scripts to sysusers and
tmpfiles. The same logic wouldn't apply for example to units or udev rules,
because they generally can only be interpreted with the whole rest of config
also available.)
2024-02-09 17:57:41 +01:00
Luca Boccassi
0a8264080a repart: support OpenSSL engines/providers for signing
The provider API which is new requires providers, which are not
widely available and don't work very well yet, so also use a
fallback with the legacy engine API.
2024-02-09 15:11:25 +00:00
Sam Leonard
51747b3444
vmspawn: accept kvm/vhost-vsock device fds through sd_listen 2024-02-09 12:46:44 +00:00
Sam Leonard
75331bedeb
vmspawn: add nic configuration 2024-02-09 12:46:43 +00:00
Sam Leonard
88af28d170
vmspawn: add initrd configuration option 2024-02-09 12:46:43 +00:00
Sam Leonard
0f25e3e443
vmspawn: add kernel configuration options 2024-02-09 11:43:19 +00:00
Sam Leonard
cf3beb273b
vmspawn: add swtpm feature 2024-02-09 11:43:18 +00:00
Daan De Meyer
7bf52f5d1c Add systemd.default_debug_tty=
Let's allow configuring the debug tty independently of enabling/disabling
the debug shell. This allows mkosi to configure the correct tty while
leaving enabling/disabling the debug tty to the user.
2024-02-09 11:47:53 +01:00
Yu Watanabe
6a32108812 man: add missing "=" after setting name
Follow-up for b93bf1bf9f.
2024-02-09 19:03:56 +09:00
Yu Watanabe
d2eb27eb7b man: fix typo
Follow-up for 631cf7f004.
2024-02-09 17:49:48 +09:00
Luca Boccassi
82047a6aa7 portable: add --copy=mixed to copy images and link profiles
This new mode copies resources provided by the client, so that they
remain available for inspect/detach even if the original images are
deleted, but symlinks the profile as that is owned by the OS, so that
updates are automatically applied.
2024-02-08 21:11:26 +00:00
Zbigniew Jędrzejewski-Szmek
eb47031694 man: mention that preset-all is performed during early boot
The intro of systemd-firstboot is rewritten to make it clearer how it fits into
the big picture. Systemd does some machine-id and presets and
systemd-firstboot.service is used to interactively fill in the blanks.

Closes #22225.
2024-02-08 20:36:44 +01:00
Lennart Poettering
9d99f1686a
Merge pull request #30766 from polarina/cryptenroll-tpm2-unlock
cryptenroll: Add support for unlocking through TPM2 enrollments
2024-02-08 17:41:03 +01:00
Sam Leonard
a759d3239d vmspawn: fix incorrect mention of container 2024-02-08 16:04:42 +01:00
Yu Watanabe
7dc431839e network/dhcp4: disable IPv6OnlyMode= by default
As explained in #30891, IPv6OnlyMode= should be enabled with 464XLAT
support, but we do not support it yet. Let's disable by default.

Fixes #30891.
2024-02-07 23:30:17 +00:00
Yu Watanabe
3092bd7aa1
Merge pull request #31176 from yuwata/network-required-for-online
network: adjust default value of RequiredForOnline=
2024-02-08 05:26:12 +09:00
Ivan Shapovalov
00fcd79e65 nspawn: permit --ephemeral with --link-journal=try-* (treat as =no)
Common sense says that to "try" something means "to not fail if
something turns out not to be possible", thus do not make this
combination a hard error.

The actual implementation ignores any --link-journal= setting when
--ephemeral is in effect, so the semantics are upheld.
2024-02-03 03:03:41 +09:00
Vladimir Stoiakin
85686b37b0 cryptenroll: allow to use a public key on a token
This patch allows systemd-cryptenroll to enroll directly with a public key if a certificate is missing on a token.

Fixes: #30675
2024-02-03 03:00:51 +09:00
Antonio Alvarez Feijoo
e104d77da2 man/systemd-bsod: fix command path 2024-02-03 02:59:44 +09:00
Yu Watanabe
a853cc99e6 network: adjust default RequiredForOnline= and RequiredFamilyForOnline= setting
E.g. a bonding port does not support addressing, hence the default
should be 'enslaved'.

Follow-up for 3255bda698.

Closes #27724.
2024-02-02 15:38:30 +09:00
Yu Watanabe
c89efaf9e5 man: fix default behavior of RequiredFamilyForOnline= 2024-02-02 15:38:30 +09:00
Yu Watanabe
04a755466b man/creds: fix typo
Follow-up for 7704c3474d.
2024-02-02 09:25:57 +09:00
Yu Watanabe
49d6e3c8a8 man: fix typo
Follow-up for 34bbda18a5.
2024-02-02 09:24:25 +09:00
Gabríel Arthúr Pétursson
631cf7f004 cryptenroll: Add support for unlocking through TPM2 enrollments 2024-02-01 12:37:12 +00:00
Lennart Poettering
3557f1a62a resolvectl: add JSON output support for "resolvectl query"
It's easy to add. Let's do so.

This only covers record lookups, i.e. with the --type= switch.

The higher level lookups are not covered, I opted instead to print a
message there to use --type= instead.

I am a bit reluctant to defining a new JSON format for the high-level
lookups, hence I figured for now a helpful error is good enough, that
points people to the right use.

Fixes: #29755
2024-01-31 16:13:16 +01:00
Franck Bui
887b2529eb man: always install bootctl
Since dedb925eaf /usr/bin/bootctl is always built
so does its man page.
2024-01-31 10:32:46 +00:00
Adrian Vovk
691b99160d homed: Add InhibitSuspend() method
This returns an FD that can be used to temporarily inhibit the automatic
locking on system suspend behavior of homed. As long as the FD is open,
LockAllHomes() won't lock that home directory on suspend. This allows
desktop environments to implement custom more complicated behavior
2024-01-31 09:48:23 +01:00
Lennart Poettering
b45f47aaad
Merge pull request #30968 from poettering/per-user-creds
per-user encrypted credentials
2024-01-31 09:47:12 +01:00
Franck Bui
d537bf72ae meson: fix installation of html doc aliases
Apparently since 9289e093ae, "ln_s" takes
*absolute* paths only.
2024-01-30 17:56:48 +00:00
Lennart Poettering
f65d44d1f6
Merge pull request #31124 from keszybz/various-small-tweaks
Various small tweaks
2024-01-30 17:08:21 +01:00
Lennart Poettering
7704c3474d man: document new user-scoped credentials 2024-01-30 17:07:47 +01:00
Zbigniew Jędrzejewski-Szmek
8835a6ff0c man/networkd.conf: remove strange comment
Does anyone even read those pages‽
2024-01-30 11:27:31 +01:00
Mike Yuan
5d4cf5a87d
man/systemd-notify: don't say "the latter" if more than 2 options 2024-01-30 03:27:36 +08:00
Lennart Poettering
a667107594 man: document the new APIs 2024-01-29 14:43:05 +01:00
Luca Boccassi
34bbda18a5 man: add working example for sd_bus_set_watch_bind()
This example is able to deal with D-Bus going away and reappearing,
like on soft-reboot, so link it in both manpages.
2024-01-26 14:41:20 +00:00
Lennart Poettering
b68f4cade4 dissect: add --make-archive option to convert DDI to tarball 2024-01-25 18:47:39 +01:00
Daan De Meyer
6811774510 man: Document ranges for distributions config files and local config files
Let's recommend that config files and drop-ins in /usr use the range
0-49 and config files in /etc and /run use the range 50-99 so that
files in /run and /etc will generally always override files from
/usr.
2024-01-25 18:46:24 +01:00
Andrew Sayers
cd752b2590 Make RestartPreventExitStatus= documentation resemble SuccessExitStatus=
The documentation for `RestartPreventExitStatus=` differs from that for `SuccessExitStatus=` in ways that are sometimes confusing (e.g. using `numeric exit codes` instead of `numeric termination statuses`), and other times plain incorrect (e.g. not mentioning `termination status names`, which I've just confirmed to work in systemd 255).

This patch modifies the documentation to be as similar as possible, so as to reduce the reader's cognitive load.
2024-01-24 18:00:53 +01:00
Daan De Meyer
98118c44ae Remove a few references to dracut
Let's remove some explicit references to dracut as we prefer initrds
built with mkosi these days.
2024-01-24 17:54:38 +01:00
Lennart Poettering
ed4498a193
Merge pull request #31067 from RA-Kooi/xen-uuid
machine-id-setup: Generate stable machine IDs on Xen virtual machines.
2024-01-24 09:35:30 +01:00
Rafaël Kooi
9fe1f1ca95 man: Describe how machine ID is initialized on Xen 2024-01-24 02:19:00 +01:00