1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-23 21:35:11 +03:00
Commit Graph

27065 Commits

Author SHA1 Message Date
Lennart Poettering
7429b2eb83 tree-wide: drop some misleading compiler warnings
gcc at some optimization levels thinks thes variables were used without
initialization. it's wrong, but let's make the message go anyway.
2016-10-06 19:04:10 +02:00
Lennart Poettering
2d6fce8d7c core: leave PAM stub process around with GIDs updated
In the process execution code of PID 1, before
096424d123 the GID settings where changed before
invoking PAM, and the UID settings after. After the change both changes are
made after the PAM session hooks are run. When invoking PAM we fork once, and
leave a stub process around which will invoke the PAM session end hooks when
the session goes away. This code previously was dropping the remaining privs
(which were precisely the UID). Fix this code to do this correctly again, by
really dropping them else (i.e. the GID as well).

While we are at it, also fix error logging of this code.

Fixes: #4238
2016-10-06 19:04:10 +02:00
Lennart Poettering
729c6467df sd-bus: add DNS errors to the errno translation table
We generate these, hence we should also add errno translations for them.
2016-10-06 19:04:10 +02:00
Lennart Poettering
6f21e066f6 resolved: properly handle BADCOOKIE DNS error
Add this new error code (documented in RFC7873) to our list of known errors.
2016-10-06 19:04:09 +02:00
Lennart Poettering
19526c6679 sd-bus: add a few missing entries to the error translation tables
These were forgotten, let's add some useful mappings for all errors we define.
2016-10-06 19:04:09 +02:00
Lennart Poettering
429b435026 sd-device/networkd: unify code to get a socket for issuing netdev ioctls on
As suggested here:

https://github.com/systemd/systemd/pull/4296#issuecomment-251911349

Let's try AF_INET first as socket, but let's fall back to AF_NETLINK, so that
we can use a protocol-independent socket here if possible. This has the benefit
that our code will still work even if AF_INET/AF_INET6 is made unavailable (for
exmple via seccomp), at least on current kernels.
2016-10-06 19:04:01 +02:00
Lennart Poettering
d21494ea25 update TODO 2016-10-06 17:27:23 +02:00
Lennart Poettering
e057995bb1 Merge pull request #4280 from giuseppe/unprivileged-user
[RFC] run systemd in an unprivileged container
2016-10-06 15:44:27 +02:00
Yu Watanabe
94f42fe3a6 units: systemd-udevd: add AF_INET and AF_INET6 to RestrictAddressFamilies= (#4296)
The udev builtin command `net_setup_link` requires AF_INET and AF_INET6.

Fixes #4293.
2016-10-06 15:40:53 +02:00
Lennart Poettering
8ffce876de Merge pull request #4199 from dvdhrm/hwdb-order
hwdb: return conflicts in a well-defined order
2016-10-06 11:58:13 +02:00
Giuseppe Scrivano
36d854780c core: do not fail in a container if we can't use setgroups
It might be blocked through /proc/PID/setgroups
2016-10-06 11:49:00 +02:00
Giuseppe Scrivano
f006b30bd5 audit: disable if cannot create NETLINK_AUDIT socket 2016-10-06 11:49:00 +02:00
Susant Sahani
197e280932 networkd: fix coding style (#4294) 2016-10-06 11:45:07 +02:00
Yuki Inoguchi
d2665e0866 journald, ratelimit: fix inaccurate message suppression in journal_rate_limit_test() (#4291)
Currently, the ratelimit does not handle the number of suppressed messages accurately.
Even though the number of messages reaches the limit, it still allows to add one extra messages to journal.

This patch fixes the problem.
2016-10-06 11:44:51 +02:00
Piotr Drąg
100a5f579d catalog,po: update Polish translation (#4290) 2016-10-05 22:59:37 +02:00
Giuseppe Scrivano
77531863ca Fix typo 2016-10-05 18:36:48 +02:00
Tobias Jungel
f6bb7ac5c6 networkd: use BridgeFDB as well on bridge ports (#4253)
[BridgeFDB] did not apply to bridge ports so far. This patch adds the proper
handling. In case of a bridge interface the correct flag NTF_MASTER is now set
in the netlink call. FDB MAC addresses are now applied in
link_enter_set_addresses to make sure the link is setup.
2016-10-05 17:06:40 +02:00
Zeal Jagannatha
110b7e909a Added ArchLinux config for mkosi (#4274) 2016-10-05 14:00:06 +02:00
hbrueckner
6abfd30372 seccomp: add support for the s390 architecture (#4287)
Add seccomp support for the s390 architecture (31-bit and 64-bit)
to systemd.

This requires libseccomp >= 2.3.1.
2016-10-05 13:58:55 +02:00
Djalal Harouni
41eb436265 nspawn: add log message to let users know that nspawn needs an empty /dev directory (#4226)
Fixes https://github.com/systemd/systemd/issues/3695

At the same time it adds a protection against userns chown of inodes of
a shared mount point.
2016-10-05 06:57:02 +02:00
Thomas H. P. Andersen
d4c08299f2 NEWS: typo fixes (#4285) 2016-10-04 20:41:46 +02:00
Stefan Schweter
629ff674ac tree-wide: remove consecutive duplicate words in comments 2016-10-04 17:06:25 +02:00
Michael Olbrich
5076f4219e list: LIST_INSERT_BEFORE: update head if necessary (#4261)
If the new item is inserted before the first item in the list, then the
head must be updated as well.
Add a test to the list unit test to check for this.
2016-10-04 16:15:37 +02:00
Michael Olbrich
c080fbce9c automount: make sure the expire event is restarted after a daemon-reload (#4265)
If the corresponding mount unit is deserialized after the automount unit
then the expire event is set up in automount_trigger_notify(). However, if
the mount unit is deserialized first then the automount unit is still in
state AUTOMOUNT_DEAD and automount_trigger_notify() aborts without setting
up the expire event.
Explicitly call automount_start_expire() during coldplug to make sure that
the expire event is set up as necessary.

Fixes #4249.
2016-10-04 16:13:27 +02:00
Lucas Werkmeister
1f4f4cf76c Typo (mathesmatches) (#4283) 2016-10-04 15:53:16 +02:00
andhe
20b8e666d3 po: updated Swedish translation (#4241)
* po: updated Swedish translation

* po: swedish: fix login vs write logs to confusion

Since previous commit (updated messages) there's now a mix of
different translation meanings for the same thing.
While both translations are technically correct I think the
meaning of the original messages are probably "to login" rather
than "to write log messages to". This commit switches all
translations to the "login" meaning.
2016-10-04 15:36:03 +02:00
Martin Pitt
bbe4743ba7 Merge pull request #4273 from keszybz/docs
Routing-domains-manpage tweak and NEWS update
2016-10-04 15:34:08 +02:00
Elias Probst
05ecf467ee Typo (virtiualizationvirtualization) (#4281) 2016-10-04 14:37:28 +02:00
Stefan Schweter
cfaf4b75e0 man: remove consecutive duplicate words (#4268)
This PR removes consecutive duplicate words from the man pages of:

* `resolved.conf.xml`
* `systemd.exec.xml`
* `systemd.socket.xml`
2016-10-03 17:09:54 +02:00
Alban Crequy
19caffac75 nspawn: set shared propagation mode for the container 2016-10-03 14:19:27 +02:00
Zbigniew Jędrzejewski-Szmek
1ef11fb628 build-sys: use non-breaking spaces in contributor list
I think it's easier to read peoples' names with this change.
2016-10-03 07:36:59 -04:00
Zbigniew Jędrzejewski-Szmek
4a77c53d64 NEWS: add another batch of entries 2016-10-03 07:36:59 -04:00
Zbigniew Jędrzejewski-Szmek
2df225294f man: rework the explanation of Domains=
Put more emphasis on the routing part. This is the more interesting
thing, and also more complicated and novel.

Explain "search domains" as the special case. Also explain the effect of
~. in more detail.
2016-10-03 07:36:59 -04:00
Zbigniew Jędrzejewski-Szmek
ba9fa3bc48 man: fix indentation in table
<entry>-ies must be a single line of text. Otherwise docbook does strange
things to the indentation.
2016-10-03 07:36:59 -04:00
Zbigniew Jędrzejewski-Szmek
a63ee40751 core: do not try to create /run/systemd/transient in test mode
This prevented systemd-analyze from unprivileged operation on older systemd
installations, which should be possible.
Also, we shouldn't touch the file system in test mode even if we can.
2016-10-01 22:53:17 +02:00
Zbigniew Jędrzejewski-Szmek
d941ea22e3 analyze-verify: honour $SYSTEMD_UNIT_PATH, allow system paths to be ignored
SYSTEMD_UNIT_PATH=foobar: systemd-analyze verify barbar/unit.service
will load units from barbar/, foobar/, /etc/systemd/system/, etc.

SYSTEMD_UNIT_PATH= systemd-analyze verify barbar/unit.service
will load units only from barbar/, which is useful e.g. when testing
systemd's own units on a system with an older version of systemd installed.
2016-10-01 22:53:17 +02:00
Zbigniew Jędrzejewski-Szmek
dd5e7000cb core: complain if Before= dep on .device is declared
[Unit]
Before=foobar.device

[Service]
ExecStart=/bin/true
Type=oneshot

$ systemd-analyze verify before-device.service
before-device.service: Dependency Before=foobar.device ignored (.device units cannot be delayed)
2016-10-01 22:53:17 +02:00
Martin Pitt
93a0884126 systemctl: Add --wait option to wait until started units terminate again
Fixes #3830
2016-10-01 17:58:59 +02:00
Stefan Schweter
c49b50113e man: update mx record example (#4257) 2016-10-01 17:11:38 +02:00
Zbigniew Jędrzejewski-Szmek
e7866f2543 Merge pull request #4164 from martinpitt/nss-resolve
nss-resolve: return NOTFOUND instead of UNAVAIL for DNSSEC validation failures
2016-10-01 17:09:51 +02:00
Martin Pitt
d7247512a9 nss-resolve: return NOTFOUND instead of UNAVAIL on resolution errors
It needs to be possible to tell apart "the nss-resolve module does not exist"
(which can happen when running foreign-architecture programs) from "the queried
DNS name failed DNSSEC validation" or other errors. So return NOTFOUND for these
cases too, and only keep UNAVAIL for the cases where we cannot handle the given
address family.

This makes it possible to configure a fallback to "dns" without breaking
DNSSEC, with "resolve [!UNAVAIL=return] dns". Add this to the manpage.

This does not change behaviour if resolved is not running, as that already
falls back to the "dns" glibc module.

Fixes #4157
2016-10-01 16:59:06 +02:00
Martin Pitt
4484e1792b man: drop myhostname from recommended nsswitch host configuration
resolve includes myhostname functionality, so there is no need to add it again.
2016-10-01 16:54:45 +02:00
Martin Pitt
46c7a7ac87 nss-resolve: simplify error handling
Handle general errors from the resolved call in _nss_resolve_gethostbyaddr2_r()
the same say as in the other variants: Just "goto fail" as that does exactly
the same.
2016-10-01 16:43:29 +02:00
Zbigniew Jędrzejewski-Szmek
5fd2c135f1 core: update warning message
"closing all" might suggest that _all_ fds received with the notification message
will be closed. Reword the message to clarify that only the "unused" ones will be
closed.
2016-10-01 11:01:31 +02:00
Zbigniew Jędrzejewski-Szmek
c4bee3c40e core: get rid of unneeded state variable
No functional change.
2016-10-01 11:01:31 +02:00
Elias Probst
82936769a8 networkd: fix "parametres" typo (#4244) 2016-09-30 13:25:25 +02:00
Martin Pitt
6740ec4a65 Merge pull request #4225 from keszybz/coredump
coredump: remove Storage=both support, various fixes for sd-coredump and coredumpctl
2016-09-30 11:16:51 +02:00
Martin Pitt
b9fe94cad9 resolved: don't query domain-limited DNS servers for other domains (#3621)
DNS servers which have route-only domains should only be used for
the specified domains. Routing queries about other domains there is a privacy
violation, prone to fail (as that DNS server was not meant to be used for other
domains), and puts unnecessary load onto that server.

Introduce a new helper function dns_server_limited_domains() that checks if the
DNS server should only be used for some selected domains, i. e. has some
route-only domains without "~.". Use that when determining whether to query it
in the scope, and when writing resolv.conf.

Extend the test_route_only_dns() case to ensure that the DNS server limited to
~company does not appear in resolv.conf. Add test_route_only_dns_all_domains()
to ensure that a server that also has ~. does appear in resolv.conf as global
name server. These reproduce #3420.

Add a new test_resolved_domain_restricted_dns() test case that verifies that
domain-limited DNS servers are only being used for those domains. This
reproduces #3421.

Clarify what a "routing domain" is in the manpage.

Fixes #3420
Fixes #3421
2016-09-30 09:30:08 +02:00
Zbigniew Jędrzejewski-Szmek
a86b76753d pid1: more informative error message for ignored notifications
It's probably easier to diagnose a bad notification message if the
contents are printed. But still, do anything only if debugging is on.
2016-09-29 22:57:57 +02:00
Zbigniew Jędrzejewski-Szmek
8523bf7dd5 pid1: process zero-length notification messages again
This undoes 531ac2b234. I acked that patch without looking at the code
carefully enough. There are two problems:
- we want to process the fds anyway
- in principle empty notification messages are valid, and we should
  process them as usual, including logging using log_unit_debug().
2016-09-29 22:57:57 +02:00