1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-22 17:35:35 +03:00
Commit Graph

330 Commits

Author SHA1 Message Date
Luca Boccassi
d21b42b463 sysext: add initrd-specific unit
In the initrd we want to run as early as possible, before
any of the filesystems are set up, so that users can use
sysexts to customize kernel modules, firmware, etc. But
in the root fs it needs to run after /var/ has been set
up. Split the unit, and have an initrd-specific one that
runs very early.
2024-12-01 12:17:21 +00:00
Luca Boccassi
e813252378 confext: add initrd-specific unit
In the initrd we want to run as early as possible, before
any of the filesystems are set up, so that users can use
confexts to customize fstab/veritytab/crypttab/etc. But
in the root fs it needs to run after /var/ has been set
up. Split the unit, and have an initrd-specific one that
runs very early.
2024-12-01 12:16:54 +00:00
Daan De Meyer
4b1ad0398e Introduce systemd-keyutil to do various key/certificate operations
Let's gather generic key/certificate operations in a new tool
systemd-keyutil instead of spreading them across various special
purpose tools.

Fixes #35087
2024-11-08 15:00:21 +01:00
Luca Boccassi
d6f4c96b10 man: run update-man-rules 2024-11-06 19:19:13 +00:00
Lennart Poettering
4f5fabe7a3 man: add brief entrypoint man page for sd-varlink
We have this in a similar fashion for the other APIs libsystemd
provides. Add the same for sd-varlink. There isn't too much on it for
now, but at least it's a start.

Also link it up everywhere.
2024-11-05 22:57:51 +01:00
Zbigniew Jędrzejewski-Szmek
243b63d8a6 meson: add separate option for sysupdated, disable in release builds
This commit introduces a build-time option to enable/disable sysupdated
separately from sysupdate. 'auto' translated to enabled by default in
developer builds.
2024-10-31 21:08:08 +00:00
Adrian Vovk
e1384cfb09
sysupdate: Introduce optional features
Optional features allow distros to define sets of transfers that can
be enabled or disabled by the system administrator. This is useful for
situations where a distro may want to ship some resources version-locked
to the core OS, but many people have no need for the resource, such as:
development tools/compilers, drivers for specialized hardware, language
packs, etc

We also rename sysupdate.d/*.conf -> sysupdate.d/*.transfer, because
now there are more than one type of definition in sysupdate.d/. For
backwards compat, we still load *.conf files as long as no *.transfer
files are found and the *.conf files don't try to declare themselves
as part of any features

Fixes https://github.com/systemd/systemd/issues/33343
Fixes https://github.com/systemd/systemd/issues/33344
2024-10-18 17:58:45 -04:00
Yu Watanabe
fd0958762a man: add basic documents for org.freedesktop.timesync1
Closes #34352.
2024-09-11 04:42:50 +09:00
Yu Watanabe
1ff0164be5 sd-device: make device_get_device_id() public
We have already exposed sd_device_new_from_device_id(), but we have
never provide the way to get device ID from an existing sd_device
object.
2024-08-28 05:26:04 +09:00
Yu Watanabe
44bc6f3cab sd-device: introduce sd_device_get_driver_subsystem()
To create the sd_device object of a driver, the function
sd_device_new_from_subsystem_sysname() requires "drivers" for subsystem
and e.g. "pci:iwlwifi" for sysname. Similarly, sd_device_new_from_device_id()
also requires driver subsystem. However, we have never provided a
way to get the driver subsystem ("pci" for the previous example) from
an existing sd_device object.

Let's introduce a way to get driver subsystem.
2024-08-28 05:18:14 +09:00
Adrian Vovk
ec15bb71c2
sysupdate: Implement updatectl
This is the command-line tool to manage systemd-sysudpated

Co-authored-by: Tom Coldrick <thomas.coldrick@codethink.co.uk>
Co-authored-by: Abderrahim Kitouni <abderrahim.kitouni@codethink.co.uk>
2024-08-21 09:31:41 +01:00
Adrian Vovk
bf2c741fd7
sysupdate: Implement systemd-sysupdated dbus service
Co-authored-by: Tom Coldrick <thomas.coldrick@codethink.co.uk>
Co-authored-by: Abderrahim Kitouni <abderrahim.kitouni@codethink.co.uk>
2024-08-21 09:31:41 +01:00
Lennart Poettering
5f87b035fa import: add generator that synthesizes download jobs from kernel cmdline 2024-06-25 09:57:42 +02:00
Lennart Poettering
86d754050b man: add brief intro page to new sd-json APIs 2024-06-12 18:42:22 +02:00
Lennart Poettering
48ce0824dc sd-bus: add new sd_bus_pending_method_calls() call 2024-06-11 23:17:38 +01:00
Lennart Poettering
3f6551fc82 man: run update-man-rules again 2024-04-22 15:16:54 +02:00
Lennart Poettering
702a52f4b5 mountfsd: add new systemd-mountfsd component 2024-04-06 16:08:24 +02:00
Lennart Poettering
8aee931e7a nsresourced: add new daemon for granting clients user namespaces and assigning resources to them
This adds a small, socket-activated Varlink daemon that can delegate UID
ranges for user namespaces to clients asking for it.

The primary call is AllocateUserRange() where the user passes in an
uninitialized userns fd, which is then set up.

There are other calls that allow assigning a mount fd to a userns
allocated that way, to set up permissions for a cgroup subtree, and to
allocate a veth for such a user namespace.

Since the UID assignments are supposed to be transitive, i.e. not
permanent, care is taken to ensure that users cannot create inodes owned
by these UIDs, so that persistancy cannot be acquired. This is
implemented via a BPF-LSM module that ensures that any member of a
userns allocated that way cannot create files unless the mount it
operates on is owned by the userns itself, or is explicitly
allowelisted.

BPF LSM program with contributions from Alexei Starovoitov.
2024-04-06 16:08:24 +02:00
Zbigniew Jędrzejewski-Szmek
a1887f8b48 man: regenerate rules
Fixup for dfad86b838.
2024-04-04 12:18:30 +02:00
Mike Yuan
dfad86b838
units: introduce systemd-hibernate-clear.service that clears
stale HibernateLocation EFI variable

Currently, if the HibernateLocation EFI variable exists,
but we failed to resume from it, the boot carries on
without clearing the stale variable. Therefore, the subsequent
boots would still be waiting for the device timeout,
unless the variable is purged manually.

There's no point to keep trying to resume after a successful
switch-root, because the hibernation image state
would have been invalidated by then. OTOH, we don't
want to clear the variable prematurely either,
i.e. in initrd, since if the resume device is the same
as root one, the boot won't succeed and the user might
be able to try resuming again. So, let's introduce a
unit that only runs after switch-root and clears the var.

Fixes #32021
2024-04-03 22:07:43 +08:00
Zbigniew Jędrzejewski-Szmek
c38e4e2fda
Merge pull request #29721 from poettering/systemd-project
New capsule@.service feature
2024-03-26 13:19:33 +01:00
Krzesimir Nowak
ca49d4c33d man: Install sysext man pages when ENABLE_SYSEXT is true 2024-03-25 08:14:36 +01:00
Zbigniew Jędrzejewski-Szmek
7aed434371 Rename uid0 to run0
Naming is always a matter of preference, and the old name would certainly work,
but I think the new one has the following advantages:
- A verb is better than a noun.
- The name more similar to "the competition", i.e. 'sudo', 'pkexec', 'runas',
  'doas', which generally include an action verb.
- The connection between 'systemd-run' and 'run0' is more obvious.

There has been no release yet with the old name, so we can rename without
caring for backwards compatibility.
2024-03-19 16:37:22 +01:00
Lennart Poettering
e8fd555471 man: document the new concepts 2024-03-14 11:34:04 +01:00
Mike Yuan
32104d3251
sd-journal: introduce sd_journal_stream_fd_with_namespace 2024-03-14 14:25:52 +08:00
Luca Boccassi
3cf1e7d678 man: fix systemd-measure manpage conditional
Follow-up for ec3cf73f30
2024-03-10 17:50:54 +00:00
Zbigniew Jędrzejewski-Szmek
ec3cf73f30 meson/man: allow man pages to use multiple conditions
This way the man pages are installed only when the corresponding binary is
installed. The conditions in man pages and man/rules/meson.build are adjusted to
match the conditions for units in units/meson.build.
2024-03-06 09:55:01 +00:00
Lennart Poettering
fd571c9df0 man: document new importctl/importd functionality
This also replaces the Fedora download example with another one from
Ubuntu, since Fedora's images these days no longer qualify as DDIs, they
have no distinctive partition type UUIDs set for multiple of their
partitions, hence the images cannot be booted. A bit sad. Let's provide
a command that just works in its place.
2024-03-01 22:29:07 +01:00
Franck Bui
887b2529eb man: always install bootctl
Since dedb925eaf /usr/bin/bootctl is always built
so does its man page.
2024-01-31 10:32:46 +00:00
Lennart Poettering
a667107594 man: document the new APIs 2024-01-29 14:43:05 +01:00
Yu Watanabe
967cd1712c
Merge pull request #30867 from dtardon/udev-conf-dropins
Allow dropins for udev.conf
2024-01-12 06:37:23 +09:00
David Tardon
810a5895e6 man: update udev.conf man page 2024-01-12 05:12:44 +09:00
Lennart Poettering
0abd510f7f ssh-proxy: add ssh ProxyCommand tool that can connect to AF_UNIX + AF_VSOCK sockets
This adds a tiny binary that is hooked into SSH client config via
ProxyCommand and which simply connects to an AF_UNIX or AF_VSOCK socket
of choice.

The syntax is as simple as this:

     ssh unix/some/path     # (this connects to AF_UNIX socket /some/path)

or:

     ssh vsock/4711

I used "/" as separator of the protocol ID and the value since ":" is
already taken by SSH itself when doing sftp. And "@" is already taken
for separating the user name.
2024-01-11 16:05:20 +01:00
Lennart Poettering
0e3220684c ssh-generator: add simple new generator 2024-01-11 16:05:20 +01:00
Lennart Poettering
7d93e4af80 man: document the new vpick concept 2024-01-03 18:38:46 +01:00
Lennart Poettering
4e1f0037b8 units: add a tpm2.target synchronization point and small generator that pulls in
Distributions apparently only compile a subset of TPM2 drivers into the
kernel. For those not compiled it but provided as kmod we need a
synchronization point: we must wait before the first TPM2 interaction
until the driver is available and accessible.

This adds a tpm2.target unit as such a synchronization point. It's
ordered after /dev/tpmrm0, and is pulled in by a generator whenever we
detect that the kernel reported a TPM2 to exist but we have no device
for it yet.

This should solve the issue, but might create problems: if there are TPM
devices supported by firmware that we don't have Linux drivers for we'll
hang for a bit. Hence let's add a kernel cmdline switch to disable (or
alternatively force) this logic.

Fixes: #30164
2024-01-03 13:49:02 +01:00
Luca Boccassi
d45ca9a905 man: conditionalize sd-pcrlock and sd-measure on the same variable as their binaries
The binaries are built and installed if HAVE_TPM2 is set, and ignore ENABLE_BOOTLOADER,
so do the same for the manpages.

For the sd-pcrlock case this also installs the manpage aliases for the units, which
are not installed with -Dbootloader=disabled, but there's no way to conditionalize
the aliases, so on balance it's better to have too much documentation rather than
too little.

Fixes https://github.com/systemd/systemd/issues/30588
2023-12-23 18:04:08 +08:00
Lennart Poettering
72eb3081b2 run: when invoked as "uid0", expose some sudo-like behaviour
This turns "systemd-run" into a multi-call binary. When invoked under
the name "uid0", then it behaves a bit more like traditional "sudo".
This mostly means defaults appropriuate for that, for example a PAM
stack, interactivity and more.

Fixes: #29199
2023-12-21 19:14:43 +01:00
Lennart Poettering
3ccadbce33 homectl: add "firstboot" command
This extends what systemd-firstboot does and runs on first boots only
and either processes user records passed in via credentials to create,
or asks the user interactively to create one (only if no regular user
exists yet).
2023-12-18 11:10:53 +01:00
Luca Boccassi
8d04721507
Merge pull request #28891 from poettering/pcrlock
new pcrlock tool for generating signed PCR policies for PCR 0, 1, 4, …
2023-11-03 16:07:43 +00:00
Luca Boccassi
1af46aecf5
Merge pull request #29508 from CodethinkLabs/systemd-vmspawn-pr
systemd-vmspawn implementation that only supports disk images
2023-11-03 16:04:38 +00:00
Lennart Poettering
e206210909 man: document pcrlock 2023-11-03 11:24:58 +01:00
Sam Leonard
5b1c37775b
vmspawn: created man page 2023-11-02 16:21:40 +00:00
Lennart Poettering
eae4943afa man: add docs for new storagetm service 2023-11-02 14:19:32 +01:00
Lennart Poettering
c2ba2625d7 man: run ninja update-man-rules again
Apparently this has been forgotten a couple of times.
2023-11-01 16:02:05 +01:00
Jin Liu
a28b7310ee New PAM module: pam_systemd_loadkey
This module reads password from kernel keyring and sets it as PAM authtok.
It's inspired by gdm's pam_gdm, which reads the LUKS password stored by
systemd-cryptsetup, so Gnome Keyring can be automatically unlocked if set
to the same password (when autologin is enabled so the user doesn't enter
a password in gdm).
2023-10-31 18:20:23 +08:00
Daan De Meyer
7e7ea1b1c8 meson: Always build systemd-measure
Same idea as with bootctl, we might be doing image builds from a
system that doesn't boot with UEFI but we still might want to measure
stuff for the image we're building so let's not gate this behind
ENABLE_BOOTLOADER.
2023-10-25 16:49:30 +02:00
Daan De Meyer
dedb925eaf meson: Always build bootctl
bootctl is rather useful to have, even if on a system without UEFI,
as it has a number of verbs that are unrelated to UEFI (e.g kernel-identify),
and more importantly, it supports --root to operate on directory trees
(which could be intended to be deployed on UEFI) so let's make sure we
always build it.
2023-10-25 16:49:24 +02:00
Lennart Poettering
d408a53f78 varlinkctl: add new varlinkctl tool 2023-10-06 11:49:38 +02:00
Lennart Poettering
2e64cb71b9 tpm2-setup: add new early boot tool for initializing the SRK
This adds an explicit service for initializing the TPM2 SRK. This is
implicitly also done by systemd-cryptsetup, hence strictly speaking
redundant, but doing this early has the benefit that we can parallelize
this in a nicer way. This also write a copy of the SRK public key in PEM
format to /run/ + /var/lib/, thus pinning the disk image to the TPM.
Making the SRK public key is also useful for allowing easy offline
encryption for a specific TPM.

Sooner or later we should probably grow what this service does, the
above is just the first step. For example, the service should probably
offer the ability to reset the TPM (clear the owner hierarchy?) on a
factory reset, if such a policy is needed. And we might want to install
some default AK (?).

Fixes: #27986
Also see: #22637
2023-09-29 19:36:04 +02:00