1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-22 17:35:35 +03:00
Commit Graph

230 Commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek
d59cae6ceb meson: add option to build systemd-executor "statically"
The new link-executor-shared option is similar to the existing
link-udev-shared: when set to false, we link to the static versions of our
internal libraries.

The resulting exuctor binary is fairly large, about as large as libsystemd-core
(14 MB without lto, 8 with lto).

This is intended as a workaround for the fuckup with the pinned executor
binary:
when an upgrade is performed, the package manager will install new version of
the libraries and new version of the code, and some time later reexecute the
managers. This creates a window when the pinned executor binary will fail to
execute. There are two factors which make the issue easier to hit:

- when the distribution uses a finely-grained shared-lib-tag. E.g. Fedora
  uses version-release as the tag, which means that the issue occurs on
  every package upgrade. This is the right thing to do, because the
  ABI of our internal libraries is not stable at all, so replacing the
  library from a different version in place creates a window where our
  programs may crash or misbehave.

- when the distribution doesn't immediately reexec all the managers after
  upgrade. In early versions of systemd, we used to hammer the machine during
  upgrade, doing daemon-reexecs repeatedly. This works, but is ugly and
  wasteful. Doing the reexecs while the upgrade is in progres also creates a
  window where a mix of old and new configs or both is loaded. Users are
  particularly annoyed by those reloads if there is some issue in the
  configuration causing us to emit warnings on every reexec. Doing the
  reexecs once after the new configuration and libraries have been put
  in place is nicer.

The pinning of the executor binary breaks upgrades and in particular
it penalizes the distributions which make use of the features which
were previously added to avoid bugs and inefficiency during upgrades.

When the executor is linked statically, there is a smaller chance that it'll
fail to load libraries. The issue can still occur because other libraries, not
our own, are linked dynamically.
2024-07-03 17:25:26 +02:00
Zbigniew Jędrzejewski-Szmek
c96cb64dce meson: use less verbose quoting 2024-06-28 18:52:59 +02:00
Zbigniew Jędrzejewski-Szmek
28f1f1a5e6 Drop support for nscd
nscd is known to be racy [1] and it was already deprecated and later dropped in
Fedora a while back [1,2]. We don't need to support obsolete stuff in systemd,
and the cache in systemd-resolved provides a better solution anyway.

We announced the plan to drop nscd in d44934f378.

[1] https://fedoraproject.org/wiki/Changes/DeprecateNSCD
[2] https://fedoraproject.org/wiki/Changes/RemoveNSCD

The option is kept as a stub without any effect to make the transition easier.
2024-06-28 18:51:56 +02:00
Richard Maw
945b722f13 test: Add mkosi-based integration test runner
The first two tests are included to ensure parallel test execution is
demonstrable.
2024-04-18 16:26:38 +01:00
Lennart Poettering
702a52f4b5 mountfsd: add new systemd-mountfsd component 2024-04-06 16:08:24 +02:00
Lennart Poettering
8aee931e7a nsresourced: add new daemon for granting clients user namespaces and assigning resources to them
This adds a small, socket-activated Varlink daemon that can delegate UID
ranges for user namespaces to clients asking for it.

The primary call is AllocateUserRange() where the user passes in an
uninitialized userns fd, which is then set up.

There are other calls that allow assigning a mount fd to a userns
allocated that way, to set up permissions for a cgroup subtree, and to
allocate a veth for such a user namespace.

Since the UID assignments are supposed to be transitive, i.e. not
permanent, care is taken to ensure that users cannot create inodes owned
by these UIDs, so that persistancy cannot be acquired. This is
implemented via a BPF-LSM module that ensures that any member of a
userns allocated that way cannot create files unless the mount it
operates on is owned by the userns itself, or is explicitly
allowelisted.

BPF LSM program with contributions from Alexei Starovoitov.
2024-04-06 16:08:24 +02:00
Lennart Poettering
593428680c build-sys: pick up vmlinux.h from running kernel BTF or user 2024-04-06 16:08:24 +02:00
Lennart Poettering
5360b10f29 ssh-generator: create privsep dir via tmpfiles.d/ if we are told to
To make it easy to have a workable ssh-generator on various distros,
let's optionally generate the ssh privsep dir via tmpfiles.d/ drop-in.

This enables the concept with a path of /run/sshd/ as default. This is
the path Debian/Ubuntu uses, and means that we just work on those
distros. Debian/Ubuntu is the only distro (apparently?) that puts the
privsep dir under /run/, hence always needs the dir to be created
manually. Other distros don't need it that much, because they place the
dir in /usr/ (fedora, best choice!) or /var/ (others, not ideal, because
still mutable).

Also adds a longer explanation about this in NEWS, in the hope that
distro maintaines read that and maybe start cleaning this up.

Alternative to: #31543
2024-04-04 01:01:10 +09:00
Eli Schwartz
5656c593ce fix the value of default shells to use /bin and not /usr/bin
Partially reverts commit b0d3095fd6.

While it is generally worthwhile for systemd to drop split-usr support,
these options are NOT about split-usr support. The universal location of
POSIX sh is always /bin/sh. Bash is pretty reasonably standardized there
too.

This happens irrespective of /bin being a symlink to /usr/bin.
Ramifications of this change include things like:

- portably running shell scripts that might run very nearly anywhere
- /etc/shells support

For standardization and compatibility reasons, these commands with these
paths need to be consistently found on any system, and thus distros make
sure this works, although even on split-usr systems /usr/bin/bash may be
a symlink to /bin/bash.

Embedding the *access path* of bash as /usr/bin/bash in systemd, for
example in libnss_systemd.so, means that login shells must agree with
systemd on how they invoke the shell. End result: users fail to login
because of access violations.

This cannot be fixed by "fixing PAM" because PAM does not follow
symlinks by design: one example is that it needs to treat rbash as
different from bash.

Fixes: https://bugs.gentoo.org/919749
Signed-off-by: Eli Schwartz <eschwartz93@gmail.com>
2024-02-29 21:51:03 +01:00
Lennart Poettering
78266a54f1 tree-wide: use "_" rather than "-" as separator in kernel cmdline options
Most of our kernel cmdline options use underscores as word separators in
kernel cmdline options, but there were some exceptions. Let's fix those,
and also use underscores.

Since our /proc/cmdline parsers don't distinguish between the two
characters anyway this should not break anything, but makes sure our own
codebase (and in particular docs and log messages) are internally
consistent.
2024-02-28 15:33:51 +01:00
Mike Yuan
31323f21bb
meson: drop default-hierarchy= option, always use unified 2024-02-27 23:10:49 +08:00
Daan De Meyer
3f6ce3d4f0 meson: Decouple the version tag from the vcs tag
Let's split off a new vcs-tag option from version-tag that configures whether
the current commit should be appended to the version tag. Doing this saves
us from having to fiddle around with generating git versions in packaging
specs and instead let's meson do it for us, even if we pass in a custom
version tag.

With this approach there's no more need for tools/meson-vcs-tag.sh so
we remove it.
2024-02-21 14:01:25 +01:00
Michael Biebl
50b68cff54 systemctl: drop chain invocation of telinit
This functionality relied on telinit being available in a different path
then the compat symlink shipped by systemd itself. This is no longer the
case for any known distro, so remove that code.

Fixes: #31220
Replaces: #31249
2024-02-15 14:29:20 +00:00
Lennart Poettering
b68f4cade4 dissect: add --make-archive option to convert DDI to tarball 2024-01-25 18:47:39 +01:00
Lennart Poettering
0abd510f7f ssh-proxy: add ssh ProxyCommand tool that can connect to AF_UNIX + AF_VSOCK sockets
This adds a tiny binary that is hooked into SSH client config via
ProxyCommand and which simply connects to an AF_UNIX or AF_VSOCK socket
of choice.

The syntax is as simple as this:

     ssh unix/some/path     # (this connects to AF_UNIX socket /some/path)

or:

     ssh vsock/4711

I used "/" as separator of the protocol ID and the value since ":" is
already taken by SSH itself when doing sftp. And "@" is already taken
for separating the user name.
2024-01-11 16:05:20 +01:00
Lennart Poettering
7e3607996a userdbctl: enable ssh-authorized-keys logic by default
sshd now supports config file drop-ins, hence let's install one to hook
up "userdb ssh-authorized-keys", so that things just work.

We put the drop-in relatively early, so that other drop-ins generally
will override this.

Ideally sshd would support such drop-ins in /usr/ rather than /etc/, but
let's take what we can get. It's not that sshd's upstream was
particularly open to weird ideas from Linux people.
2023-12-06 22:11:04 +01:00
Yu Watanabe
35dbb8b0d6 meson: disable -Ddefault-network by default
Follow-up for 9b7a624267.

This may break existing setups. Let's disable it by default.
2023-11-08 21:48:30 +09:00
Zbigniew Jędrzejewski-Szmek
2b84d62869 meson: enable vmspawn by default in developer mode
This should also implicitly enabled vmspawn in CI. It wasn't passing even the
basic tests, which we didn't see, because it needs to be explicitly enabled.
2023-11-07 21:56:57 +01:00
Luca Boccassi
1af46aecf5
Merge pull request #29508 from CodethinkLabs/systemd-vmspawn-pr
systemd-vmspawn implementation that only supports disk images
2023-11-03 16:04:38 +00:00
Yu Watanabe
9b7a624267 network: add meson option to rename .example files on install
Also this renames 80-ethernet.network.example -> 89-ethernet.network.example,
to make it have lower precedence over other default .network files for
Ethernet interfaces.

Closes #29765.
2023-11-03 11:57:46 +09:00
Sam Leonard
9de3cc1484
vmspawn: added initial code for vmspawn
vmspawn-settings.c is currently empty but this will be used in future to
house code for parsing settings from a file
2023-11-02 16:21:40 +00:00
Lennart Poettering
1761066b13 storagetm: add new systemd-storagetm component
This implements a "storage target mode", similar to what MacOS provides
since a long time as "Target Disk Mode":

        https://en.wikipedia.org/wiki/Target_Disk_Mode

This implementation is relatively simple:

1. a new generic target "storage-target-mode.target" is added, which
   when booted into defines the target mode.

2. a small tool and service "systemd-storagetm.service" is added which
   exposes a specific device or all devices as NVMe-TCP devices over the
   network.  NVMe-TCP appears to be hot shit right now how to expose
   block devices over the network. And it's really simple to set up via
   configs, hence our code is relatively short and neat.

The idea is that systemd-storagetm.target can be extended sooner or
later, for example to expose block devices also as USB mass storage
devices and similar, in case the system has "dual mode" USB controller
that can also work as device, not just as host. (And people could also
plug in sharing as NBD, iSCSI, whatever they want.)

How to use this? Boot into your system with a kernel cmdline of
"rd.systemd.unit=storage-target-mode.target ip=link-local", and you'll see on
screen the precise "nvme connect" command line to make the relevant
block devices available locally on some other machine. This all requires
that the target mode stuff is included in the initrd of course. And the
system will the stay in the initrd forever.

Why bother? Primarily three use-cases:

1. Debug a broken system: with very few dependencies during boot get
   access to the raw block device of a broken machine.

2. Migrate from system to another system, by dd'ing the old to the new
   directly.

3. Installing an OS remotely on some device (for example via Thunderbolt
   networking)

(And there might be more, for example the ability to boot from a
laptop's disk on another system)

Limitations:

1. There's no authentication/encryption. Hence: use this on local links
   only.

2. NVMe target mode on Linux supports r/w operation only. Ideally, we'd
   have a read-only mode, for security reasons, and default to it.

Future love:

1. We should have another mode, where we simply expose the homed LUKS
   home dirs like that.

2. Some lightweight hookup with plymouth, to display a (shortened)
   version of the info we write to the console.

To test all this, just run:

    mkosi --kernel-command-line-extra="rd.systemd.unit=storage-target-mode.target" qemu
2023-11-02 14:19:32 +01:00
Franck Bui
6495361c7d meson: add build option for install path of main config files
This allows distros to install configuration file templates in /usr/lib/systemd
for example.

Currently we install "empty" config files in /etc/systemd/. They serve two
purposes:

- The file contains commented-out values that show the default settings.
- It is easier to edit the right file if it is already there, the user doesn't
  have to type in the path correctly, and the basic file structure is already in
  place so it's easier to edit.

Things that have happened since this approach was put in place:

- We started supporting drop-ins for config files, and drop-ins are the
  recommended way to create local configuration overrides.
- We have systemd-analyze cat-config which takes care of iterating over
  all possible locations (/etc, /run, /usr, /usr/local) and figuring out
  the right file.
- Because of the first two points, systemd-analyze cat-config is much better,
  because it takes care of finding all the drop-ins and figuring out the
  precedence. Looking at files manually is still possible of course, but not
  very convenient.

The disadvantages of the current approach with "empty" files in /etc:

- We clutter up /etc so it's harder to see what the local configuration actually is.
- If a user edits the file, package updates will not override the file (e.g.
  systemd.rpm uses %config(noreplace). This means that the "documented defaults"
  will become stale over time, if the user ever edits the main config file.

Thus, I think that it's reasonable to:

- Install the main config file to /usr/lib so that it serves as reference for
  syntax and option names and default values and is properly updated on package
  upgrades.
- Recommend to users to always use drop-ins for configuration and
  systemd-analyze cat-config to view the documentation.

This setting makes this change opt-in.

Fixes #18420.

[zjs: add more text to the description]
2023-10-17 18:57:45 +02:00
Jan Janssen
7f9a0d6d74 meson: Drop skip-deps option
Now that we use meson feature options for our dependencies, we can just
rely on '--auto-features=disabled' to do the same. One benefit of this
is that specific features can still be force-enabled by overriding it
with the appropriate '-Dfeature=enabled' flag.

The two remaining uses for skip-deps can simply rely on their default
logic that sets the value to 'no' when the dependency is disabled.
2023-08-23 14:57:49 +02:00
Jan Janssen
1e73a64a7a meson: Convert more options to meson features
The semantics for libidn2 and pwquality have changed slightly: We will
pick a preferred one if both are enabled instead of making it an error.
2023-08-23 14:45:02 +02:00
Jan Janssen
847e5585b6 meson: Convert bpf-framework to meson feature 2023-08-23 14:45:02 +02:00
Jan Janssen
40e9c4e45d meson: Convert options to meson features (require)
These options use requre() to conveniently express their dependency
requirements.
2023-08-23 14:45:02 +02:00
Jan Janssen
101b59433b meson: Convert dbus to meson feature
Also, there is no need to conditionalize the get_variable() calls
because not-found dependencies will just return the passed default value
if provided.
2023-08-23 14:45:02 +02:00
Jan Janssen
a0c9ac9ae4 meson: Convert options to meson features (find_library fallback)
This uses a two-step approach to make sure we can fall back to
find_library(), while also skipping the detection if the features are
explicitly disabled.
2023-08-23 14:45:02 +02:00
Jan Janssen
9ee80846f8 meson: Convert fidsk to meson feature
By making this a disabler dependency, we can slightly simplify the code
and it als fixes the build for -Dfdisk=disabled as we failed to create a
fallback empty libshared_fdisk variable.
2023-08-23 14:45:02 +02:00
Jan Janssen
43abc59a27 meson: Use feature options
By using meson features we can replace the handcrafted dependency
auto-detection by just passing the value from get_option directly to the
required arg for dependency, find_library etc.
'auto' features make the dependency optional, 'enabled' requires it
while 'disabled' features will skip detection entirely.

Any skipped or not found dependency will just be a no-op when passed to
build steps and therefore we can also skip the creation of empty vars.

The use of skip_deps for these is dropped here as meson provides a way
to disable all optional features in one go by passing
'-Dauto_features=disabled'.
2023-08-23 14:45:02 +02:00
Luca Boccassi
b0d3095fd6 Drop split-usr and unmerged-usr support
As previously announced, execute order 66:

https://lists.freedesktop.org/archives/systemd-devel/2022-September/048352.html

The meson options split-usr, rootlibdir and rootprefix become no-ops
that print a warning if they are set to anything other than the
default values. We can remove them in a future release.
2023-07-28 19:34:03 +01:00
Egor Ignatov
1d8aae4327 shared: add libpasswdqc support
Co-authored-by: Dmitry V. Levin <ldv@altlinux.org>
Resolves: #15055
2023-07-06 10:59:41 +00:00
James Hilliard
4a7a13b5a0 bpf: stabilize GCC BPF support
Now that we have a GCC release which should support our bpf programs
lets set the minimum version and stabilize it.
2023-05-30 09:27:56 +09:00
Yu Watanabe
5571048919 meson: fix description for link-udev-shared option 2023-05-16 14:14:06 +08:00
Robert Scheck
c06d2e440c portable, meson: allow statically linked build
Build option "link-portabled-shared" to build a statically linked
systemd-portabled by using

  -Dlink-portabled-shared=false

on systems with full systemd stack except systemd-portabled, such
as CentOS/RHEL 9.
2023-05-15 13:30:04 +02:00
Jan Janssen
dfca5587cf tree-wide: Drop gnu-efi
This drops all mentions of gnu-efi and its manual build machinery. A
future commit will bring bootloader builds back. A new bootloader meson
option is now used to control whether to build sd-boot and its userspace
tooling.
2023-03-10 11:41:03 +01:00
Zbigniew Jędrzejewski-Szmek
50b35193ec meson: merge our two valgrind configuration conditions into one
Most of the support for valgrind was under HAVE_VALGRIND_VALGRIND_H, i.e. we
would enable if the valgrind headers were found. The operations then we be
conditionalized on RUNNING_UNDER_VALGRIND.

But in a few places we had code which was conditionalized on VALGRIND, i.e. the
config option. I noticed because I compiled with -Dvalgrind=true on a machine
that didn't have valgrind.h, and the build failed because
RUNNING_UNDER_VALGRIND was not defined. My first idea was to add a check that
the header is present if the option is set, but it seems better to just remove
the option. The code to support valgrind is trivial, and if we're
!RUNNING_UNDER_VALGRIND, it has negligible cost. And the case of running under
valgrind is always some special testing/debugging mode, so we should just do
those extra steps to make valgrind output cleaner. Removing the option makes
things simpler and we don't have to think if something should be covered by the
one or the other configuration bit.

I had a vague recollection that in some places we used -Dvalgrind=true not
for valgrind support, but to enable additional cleanup under other sanitizers.
But that code would fail to build without the valgrind headers anyway, so
I'm not sure if that was still used. If there are uses like that, we can
extend the condition for cleanup_pools().
2023-02-22 11:39:44 +01:00
Mike Yuan
f129d0e77c vconsole: allow setting default keymap through build option
Allow defining the default keymap to be used by
vconsole-setup through a build option. A template
vconsole.conf also gets populated by tmpfiles if
it doesn't exist.
2023-02-15 20:00:51 +00:00
Zbigniew Jędrzejewski-Szmek
e4c7b5f517 core: split system/user job timeouts and make them configurable
Config options are -Ddefault-timeout-sec= and -Ddefault-user-timeout-sec=.
Existing -Dupdate-helper-user-timeout= is renamed to -Dupdate-helper-user-timeout-sec=
for consistency. All three options take an integer value in seconds. The
renaming and type-change of the option is a small compat break, but it's just
at compile time and result in a clear error message. I also doubt that anyone was
actually using the option.

This commit separates the user manager timeouts, but keeps them unchanged at 90 s.
The timeout for the user manager is set to 4/3*user-timeout, which means that it
is still 120 s.

Fedora wants to experiment with lower timeouts, but doing this via a patch would
be annoying and more work than necessary. Let's make this easy to configure.
2023-02-01 11:52:29 +00:00
Jan Janssen
d84bdadb43 boot: Remove option TPM PCR compat option
It says remove in 2023; happy to oblige.
2023-01-09 09:52:55 +01:00
Zbigniew Jędrzejewski-Szmek
30ec2eaef5 meson,ukify: hook up ukify, add --version option
The option is added because we have a similar one for kernel-install. This
program requires python, and some people might want to skip it because of this.

The tool is installed in /usr/lib/systemd for now, since the interface might
change.

A template file is used, but there is no .in suffix.
The problem is that we'll later want to import the file as a module
for tests, but recent Python versions make it annoyingly hard to import
a module from a file without a .py suffix. imp.load_sources() works, but it
is deprecated and throws warnings.
importlib.machinery.SourceFileLoader().load_module() works, but is also
deprecated. And the documented replacements are a maze of twisted little
callbacks that result in an empty module.
So let's take the easy way out, and skip the suffix which makes it easy
to import the template as a module after adding the directory to sys.path.
2022-12-07 15:32:13 +01:00
Samuel Thibault
ede5a78f50 shutdown: Add Xen kexec support
In the Xen case, it's the hypervisor which manages kexec. We thus
have to ask it whether a kernel is loaded, instead of relying on
/sys/kernel/kexec_loaded.
2022-11-02 20:47:41 +01:00
Franck Bui
2306b4656a core: allow disabling system time correction if rtc returns time far in the future
There might be (embedded) systems that get never updated (things like
e.g. entertainment systems of trains, for example) and where the adjustment of
the system clock (introduced by b10abe4bba) would
do the wrong thing even if the difference between the systemd build time and
the rtc is 15 years or more.

This patch allows disabling the adjustment by setting
'clock-valid-range-usec-max' meson option to 0 or to a negative value.
2022-08-24 21:39:46 +01:00
Eli Schwartz
792d5e87b6 meson: fix type for many build options
Integers and booleans are supposed to be actual integers and booleans,
not strings describing their value, but Meson silently accepted either
one. It's still wrong to do it though, and other implementations of
Meson such as muon choke on it.
2022-07-30 13:58:22 +09:00
Yu Watanabe
a36be3e57f meson: use 0 for default uids, gids, and time epoch
0 UID and GID are special, and should not be acceptable for the settings.
Hence, we can handle 0 as unset.

Strictly speaking, time epoch with 0 is valid, but I guess no one use
0 as a valid value.
2022-07-30 13:58:12 +09:00
James Hilliard
0a0d489968 journalctl: allow statically linked build
The journalctl tool may be needed on cross compilation hosts in order
to run --update-catalog against a target rootfs.

To avoid reliability issues caused by shared linking allow journalctl
to be linked statically.
2022-07-29 09:22:54 +09:00
Łukasz Stelmach
aa5ae9711e smack: Add DefaultSmackProcessLabel to user.conf and system.conf
DefaultSmackProcessLabel tells systemd what label to assign to its child
process in case SmackProcessLabel is not set in the service file. By
default, when DefaultSmackProcessLabel is not set child processes inherit
label from systemd.

If DefaultSmackProcessLabel is set to "/" (which is an invalid character
for a SMACK label) the DEFAULT_SMACK_PROCESS_LABEL set during compilation
is ignored and systemd act as if the option was unset.
2022-07-12 22:47:32 +01:00
Zbigniew Jędrzejewski-Szmek
132b63bd31
Merge pull request #15205 from jlebon/pr/preset-all-firstboot
manager: optionally, do a full preset on first boot
2022-07-06 19:11:01 +02:00
Zbigniew Jędrzejewski-Szmek
e538d59367
Merge pull request #23683 from keszybz/status-format
Default to default-status-unit-format=name in developer mode
2022-06-10 14:11:53 +02:00