1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-23 21:35:11 +03:00
Commit Graph

52777 Commits

Author SHA1 Message Date
Lennart Poettering
72fba0c4e5
Merge pull request #20488 from yuwata/timesync-fix
timesync: fix wrong type for receiving timestamp in nanoseconds
2021-08-20 13:34:20 +02:00
Lennart Poettering
fbe3d9591f
Merge pull request #20490 from poettering/id128-format-compound-literal
compound literal love for sd_id128_to_string()
2021-08-20 13:33:51 +02:00
Alfonso Sánchez-Beato
d48f9174cf src/boot/efi/linux: fix linux_exec prototype
Callers to linux_exec() are actually passing an EFI_HANDLE, not a pointer to
it. linux_efi_handover(), which is called by linux_exec(), also expects an
EFI_HANDLE.
2021-08-20 12:33:09 +02:00
Lennart Poettering
85b55869bc tree-wide: port everything over to new sd-id128 compund literal bliss 2021-08-20 11:09:48 +02:00
Lennart Poettering
c970388b22 sd-id128: add compound literal love to sd_id128_to_string() + id128_to_uuid_string() 2021-08-20 11:09:48 +02:00
Lennart Poettering
f3ce631bbc man: reference getrandom(2) instead of urandom from sd_id128_randomize() page
It's 2021, /dev/urandom is mostly a thing of the past now.
2021-08-20 11:09:48 +02:00
Lennart Poettering
7f3c90ed79 man: document SD_ID128_ALLF 2021-08-20 11:09:47 +02:00
Lennart Poettering
f47234b6e6 man: re-run ninja -C update-man-rules 2021-08-20 11:09:47 +02:00
Yu Watanabe
7d93b92f31 network: add UseMTU= in [IPv6AcceptRA]
Note that kernel has similar knob in sysctl: accept_ra_mtu.

Closes #18868.
2021-08-20 17:14:08 +09:00
Lennart Poettering
dc131951b5
Merge pull request #18385 from kinvolk/mauricio/restrict-network-interfaces
Add RestrictNetworkInterfaces=
2021-08-20 03:41:11 +02:00
Yu Watanabe
6da22a2fa5 icmp6: drop unnecessary assertion
Follow-up for 3691bcf3c5.
2021-08-20 08:44:31 +09:00
Yu Watanabe
6f96bdc587 timesync: fix wrong type for receiving timestamp in nanoseconds
Fixes #20482.
2021-08-20 08:42:13 +09:00
Daan De Meyer
6c35ea5ef0 udev: Add support for configuring nic coalescing settings
These are configured via the corresponding ethtool ioctl.
2021-08-20 00:32:28 +01:00
Luca Boccassi
a622c58993
Merge pull request #20486 from DaanDeMeyer/sd-bus-eproto
sd-bus: Return detailed (sd-buscntr) error from bus_container_connect_socket().
2021-08-19 23:32:34 +01:00
Luca Boccassi
468d9bc901
Merge pull request #20436 from fbuihuu/add-no-build-support-on-opensuse
Add no build support on opensuse
2021-08-19 21:11:31 +01:00
Daan De Meyer
e4cdadf3bd sd-bus: Improve (sd-buscntr) error logging
We're only doing one thing in the child process which is connecting
to the D-Bus socket so let's mention that in the error message when
something goes wrong instead of having a generic error message.
2021-08-19 15:47:27 +01:00
Daan De Meyer
405a028e65 sd-bus: Return detailed (sd-buscntr) error from bus_container_connect_socket()
Previously, when the connect() call in (sd-buscntr) failed, we returned
-EPROTO without ever reading the actual errno from the error pipe. To fix
the issue, delay checking the process exit status until after we've read
and processed any error from the error pipe.
2021-08-19 15:47:24 +01:00
Lennart Poettering
7b58fcdd70
Merge pull request #19797 from oniko/systemd-fido2-pkcs11-plugins
Add support for remaining systemd fido2 and pkcs11 libcryptsetup plugins
2021-08-19 16:37:55 +02:00
Luca Boccassi
61a6aa21a5
Merge pull request #20471 from poettering/format-str-proc-fd
add FORMAT_PROC_FD_PATH() macro for generating /proc/self/fd/ paths on-the-fly
2021-08-19 14:05:22 +01:00
Mauricio Vásquez
43689840a2 README: add requirements for RestrictNetworkInterfaces=
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-19 07:25:01 -05:00
Mauricio Vásquez
7e959a73af systemctl: show RestrictNetworkInterfaces= in systemctl show
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-19 07:25:01 -05:00
Mauricio Vásquez
00d6fceeb3 tests: add integration test for RestrictNetworkInterfaces=
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-19 07:25:01 -05:00
Ondrej Kozina
8186022c9d Add support for systemd-pkcs11 libcryptsetup plugin.
Add support for systemd-pkcs11 based LUKS2 device activation
via libcryptsetup plugin. This make the feature (pkcs11 sealed
LUKS2 keyslot passphrase) usable from both systemd utilities
and cryptsetup cli.

The feature is configured via -Dlibcryptsetup-plugins combo
with default value set to 'auto'. It get's enabled automatically
when cryptsetup 2.4.0 or later is installed in build system.
2021-08-19 13:58:10 +02:00
Ondrej Kozina
0ff605665a pkcs11-util: split pkcs11_token_login function
Future systemd-pkcs11 plugin requires unlock via single
call with supplied pin. To reduce needless code duplication
in plugin itself split original pkcs_11_token_login call in
two calls:

new pkcs11_token_login_by_pin and the former where loop
for retrying via PIN query callback remains.
2021-08-19 13:58:10 +02:00
Ondrej Kozina
ed3d3af148 cryptsetup-pkcs11: move pkcs11_callback and data in shared utils.
To be used later by both (future) systemd-pkcs11 libcryptsetup
plugin and cryptsetup-pkcs11.
2021-08-19 13:58:10 +02:00
Ondrej Kozina
351716e111 Add support for systemd-fido2 libcryptsetup plugin.
Add support for systemd-fido2 based LUKS2 device activation
via libcryptsetup plugin. This make the feature (fido2 sealed
LUKS2 keyslot passphrase) usable from both systemd utilities
and cryptsetup cli.

The feature is configured via -Dlibcryptsetup-plugins combo
with default value set to 'auto'. It get's enabled automatically
when cryptsetup 2.4.0 or later is installed in build system.
2021-08-19 13:58:10 +02:00
Hela Basa
12f76c3b38 po: Translated using Weblate (Sinhala)
Currently translated at 0.5% (1 of 189 strings)

Co-authored-by: Hela Basa <r45xveza@pm.me>
Translate-URL: https://translate.fedoraproject.org/projects/systemd/master/si/
Translation: systemd/main
2021-08-19 17:27:50 +09:00
Yu Watanabe
7ff592a454 creds-util: fix possible divide-by-zero
input_size may be zero.

Fixes #20469.
2021-08-19 09:49:00 +02:00
Lennart Poettering
ddb6eeafe2 tree-wide: port things over to FORMAT_PROC_FD_PATH() 2021-08-19 09:19:27 +02:00
Lennart Poettering
48a01cd934 test: add test for FORMAT_PROC_FD_PATH() 2021-08-19 09:19:23 +02:00
Lennart Poettering
6e1e4b59f9 fd-util: add macro for generating /proc/self/fd/ paths on the fly 2021-08-19 09:19:11 +02:00
Lennart Poettering
3832cb90ba stdio-util: give snprintf_ok() some love
as per docs snprintf() can fail in which case it returns -1. The
snprintf_ok() macro so far unconditionally cast the return value of
snprintf() to size_t, which would turn -1 to (size_t) INT_MAX,
presumably, at least on 2 complements system.

Let's be more careful with types here, and first check if return value
is positive, before casting to size_t.

Also, while we are at it, let's return the input buffer as return value
or NULL instead of 1 or 0. It's marginally more useful, but more
importantly, is more inline with most of our other codebase that
typically doesn't use booleans to signal success.

All uses of snprintf_ok() don't care for the type of the return, hence
this change does not propagate anywhere else.
2021-08-19 09:19:03 +02:00
Lennart Poettering
12a7f04a2b discover-image: pass the right fd to fd_getcrtime() 2021-08-19 09:18:45 +02:00
Jan Janssen
87167331c9 sd-boot: Use UEFI provided CRC32 2021-08-18 22:01:09 +01:00
Mauricio Vásquez
2ce150f5ec src/test: add restrict network interfaces to test-cgroup-mask
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:54 -05:00
Mauricio Vásquez
795ccb03e0 man: add RestrictNetworkInterfaces= documentation
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:54 -05:00
Mauricio Vásquez
57585d5999 Document RestrictNetworkInterfaces dbus properties
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:53 -05:00
Mauricio Vásquez
a59cb62cf2 core: add D-bus properties for RestrictNetworkInterfaces=
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:53 -05:00
Mauricio Vásquez
4f0c25c794 core: add load fragment implementation for RestrictNetworkInterfaces=
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:53 -05:00
Mauricio Vásquez
6f50d4f7d6 core: implement RestrictNetworkInterfaces=
This commit introduces all the logic to load and attach the BPF
programs to restrict network interfaces when a unit specifying it is
loaded.

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:53 -05:00
Mauricio Vásquez
dc83b840d3 core: add RestrictNetworkInterfaces= BPF program source code
The code is composed by two BPF_PROG_TYPE_CGROUP_SKB programs that
are loaded in the cgroup inet ingress and egress hooks
(BPF_CGROUP_INET_{INGRESS|EGRESS}).

The decision to let a packet pass or not is based on a map that contains
the indexes of the interfaces.

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:53 -05:00
Franck Bui
d93857ae09 test: if haveged is part of initrd it needs to be installed in the image too
Otherwise haveged won't survive when switching root from initrd to host making
haveged service in host fail.
2021-08-18 17:37:55 +02:00
Franck Bui
138f761904 test: adapt install_pam() for openSUSE
On openSUSE the default pam config files are shipped in /usr/etc/pam.d.

Also empty password is not allowed by default.
2021-08-18 17:37:55 +02:00
Franck Bui
d8167c5212 Revert "test: adapt TEST-13-NSPAWN-SMOKE for SUSE"
This reverts commit 491b736a49.

If the _static_ linked version of busybox is installed, openSUSE doesn't need
any specific code.

A following commit will make sure that the static linked version of busybox is
installed in the busybox container.
2021-08-18 17:37:55 +02:00
Franck Bui
5231ec50e9 test: on openSUSE the static linked version of busybox is named "busybox-static" 2021-08-18 17:37:55 +02:00
Franck Bui
6c8ba239d5 TEST-13-*: in busybox container sleep(1) takes a delay in seconds only 2021-08-18 17:37:55 +02:00
Franck Bui
dfd73ccb14 test: don't try to find BUILD_DIR when NO_BUILD is set
NO_BUILD=1 indicates that we want to test systemd from the local system and not
the one from the local build. Hence there should be no need to call
find-build-dir.sh when NO_BUID=1 especially since it's likely that the script
will fail to find a local build in this case.

This avoids find-build-dir.sh to emit 'Specify build directory with $BUILD_DIR'
message when NO_BUILD=1 and no local build can be found.

This introduces a behavior change though: systemd from the local system will
always be preferred when NO_BUILD=1 even if a local build can be found.
2021-08-18 17:37:55 +02:00
Franck Bui
abf062674e test: add support for NO_BUILD=1 on openSUSE 2021-08-18 17:37:24 +02:00
Yu Watanabe
0d341eccef udev: make RxChannels= or friends also accept "max"
Follow-up for 406041b7de.

Also, this makes
- the settings accept an empty string,
- if the specified value is too large, also use the advertised maximum
  value.
- mention the range of the value in the man page.
2021-08-18 16:55:03 +02:00
Yu Watanabe
bdbb61f69f tree-wide: fix typo 2021-08-18 13:36:14 +02:00