1
0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 09:21:26 +03:00
Commit Graph

2980 Commits

Author SHA1 Message Date
Lennart Poettering
ae9d60ce4e seccomp: on s390 the clone() parameters are reversed
Add a bit of code that tries to get the right parameter order in place
for some of the better known architectures, and skips
restrict_namespaces for other archs.

This also bypasses the test on archs where we don't know the right
order.

In this case I didn't bother with testing the case where no filter is
applied, since that is hopefully just an issue for now, as there's
nothing stopping us from supporting more archs, we just need to know
which order is right.

Fixes: #5241
2017-02-08 22:21:27 +01:00
Philip Withnall
b53ede699c nspawn: Add support for sysroot pivoting (#5258)
Add a new --pivot-root argument to systemd-nspawn, which specifies a
directory to pivot to / inside the container; while the original / is
pivoted to another specified directory (if provided). This adds
support for booting container images which may contain several bootable
sysroots, as is common with OSTree disk images. When these disk images
are booted on real hardware, ostree-prepare-root is run in conjunction
with sysroot.mount in the initramfs to achieve the same results.
2017-02-08 16:54:31 +01:00
Lennart Poettering
8a50cf6957 seccomp: MemoryDenyWriteExecute= should affect both mmap() and mmap2() (#5254)
On i386 we block the old mmap() call entirely, since we cannot properly
filter it. Thankfully it hasn't been used by glibc since quite some
time.

Fixes: #5240
2017-02-08 15:14:02 +01:00
Lennart Poettering
cec2a20dab man: s/--unmount/--umount/g (#5243)
The --help text currently uses the "--umount" spelling, hence to the
same in the man page too.

And let's settle on "umount" instead of "unmount" here, since most folks
probably expect that when typing in a command, as util-linux' tool is
called "umount" after all, and so is the symlink "systemd-umount" we
install.
2017-02-07 19:54:37 -05:00
Lucas Werkmeister
8331eaabc7 man: document *.d/ drop-in file order (#5262) 2017-02-07 18:58:02 -05:00
Lucas Werkmeister
c04becfa72 man: document that systemd-run --on-* cannot be used with --pty 2017-02-07 16:26:02 +01:00
Lucas Werkmeister
ee3c52ebbe man: use systemctl enable --now 2017-02-07 16:20:25 +01:00
Lucas Werkmeister
aa9f9e587d man: add cross-reference
The third paragraph of the Description already linked to
systemd.resource-control(5), but it was missing from the list of
additional options for the [Service] section.
2017-02-07 16:20:25 +01:00
Evgeny Vereshchagin
d52fbaa58c Merge pull request #5225 from poettering/seccomp-socket
make RestrictAddressFamilies= officially a NOP on i386
2017-02-07 05:06:54 +03:00
Lennart Poettering
aa20394579 notify: document that we fake the PID when sending sd_notify() 2017-02-06 20:01:24 +01:00
Lennart Poettering
b3bb64767a man: document that sd_notify() is racy in some cases 2017-02-06 18:21:27 +01:00
Lennart Poettering
142bd808a1 man: Document that RestrictAddressFamilies= doesn't work on s390/s390x/...
We already say that it doesn't work on i386, but there are more archs
like that apparently.
2017-02-06 14:17:12 +01:00
Martin Pitt
d2697a95fe Merge pull request #5223 from keszybz/root-workdir
Fix WorkDir=~ with empty User=
2017-02-05 22:31:02 +01:00
Zbigniew Jędrzejewski-Szmek
d20a328f97 build-sys,man: describe systemd-umount and hook it up to installation (#5227) 2017-02-05 22:27:38 +01:00
Martin Pitt
63927b9f4c man: clarify interface for suspend/resume integration (#5220)
Fixes #4916.
2017-02-03 12:11:37 -05:00
Zbigniew Jędrzejewski-Szmek
8b89628a10 core/execute: set HOME, USER also for root users
This changes the environment for services running as root from:

LANG=C.utf8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
INVOCATION_ID=ffbdec203c69499a9b83199333e31555
JOURNAL_STREAM=8:1614518

to

LANG=C.utf8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
HOME=/root
LOGNAME=root
USER=root
SHELL=/bin/sh
INVOCATION_ID=15a077963d7b4ca0b82c91dc6519f87c
JOURNAL_STREAM=8:1616718

Making the environment special for the root user complicates things
unnecessarily. This change simplifies both our logic (by making the setting
of the variables unconditional), and should also simplify the logic in
services (particularly scripts).

Fixes #5124.
2017-02-03 11:49:22 -05:00
Lennart Poettering
b415174d8e Merge pull request #5202 from keszybz/cgls-units
systemd-cgls --unit --user-unit
2017-02-02 11:45:51 +01:00
Zbigniew Jędrzejewski-Szmek
e7aa3f5014 cgls: add --user-unit to show user units 2017-02-01 22:31:41 -05:00
Zbigniew Jędrzejewski-Szmek
d9855d87eb cgls: add --unit to show units
$ systemd-cgls -u systemd-journald.service machine.slice

I opted for a "global" switch, instead of modifying the behaviour of just one
argument. It seem to be a more useful setting, since usually one will want to
query one or more units, and not mix unit names with paths.

Closes #5156.
2017-02-01 22:30:03 -05:00
Brandon Philips
9806301614 man: fix spelling error parth -> path 2017-02-02 00:54:42 +01:00
Zbigniew Jędrzejewski-Szmek
bef19548a2 systemctl: restore --failed (#5198)
'systemctl --failed' is an extremely common operation and it's nice to have
a shortcut for it.

Revert "man: don't document systemctl --failed" and add the option back to
systemctl's help and shell completion scripts.

This reverts commit 036359ba8d.
2017-02-02 00:23:46 +01:00
Zbigniew Jędrzejewski-Szmek
c954f33233 man: mention ConditionFirstBoot= in systemd-firstboot(1) (#5186) 2017-01-31 08:25:19 +01:00
Rike-Benjamin Schuppner
b03ec00960 man: fix flag in systemd-run (#5107) 2017-01-20 03:10:30 +03:00
Jakub Wilk
301a21a880 man: fix typos (#5109) 2017-01-19 16:54:22 +01:00
Zbigniew Jędrzejewski-Szmek
5b3637b44a Merge pull request #4991 from poettering/seccomp-fix 2017-01-17 23:10:46 -05:00
AsciiWolf
542ca7c9d2 man: fix typo (#5093) 2017-01-17 12:09:38 +01:00
Zbigniew Jędrzejewski-Szmek
6b3d378331 Merge pull request #4879 from poettering/systemd 2017-01-14 21:29:27 -05:00
Mark Stosberg
ab8864ebc3 man: provide a basic guide to the systemctl status output (#4950)
- Show example of all `systemctl status` output and documents what possible
   "Loaded:", "Active" and "Enabled" values mean.

 - Documents what different colors of the dot mean.

 - Documents "gotcha" with load-on-demand behavior which will report units as
   "loaded" even if they are only loaded to show their status.
   (From @poettering: https://github.com/systemd/systemd/issues/5063#issuecomment-272115024 )
2017-01-14 17:43:32 -05:00
Lennart Poettering
e843b04ee9 Merge pull request #5069 from keszybz/fixlets
Small fixes and enhancements to docs and code
2017-01-12 10:19:30 +01:00
Zbigniew Jędrzejewski-Szmek
9a4bf1e8d3 man: link to sd-j-{remote,upload} from journalctl(1) 2017-01-11 16:37:35 -05:00
Zbigniew Jędrzejewski-Szmek
374e692252 Merge pull request #5009 from ian-kelling/ian-mnt-namespace-doc 2017-01-11 15:23:00 -05:00
micah
6539dd7c42 Document how restart actions work (#5052)
When a user is trying to understand what is going on with a restart action, it is useful to explicitly describe how the action is run. It may seem obvious, but it is helpful to be explicit so one knows there isn't a special ExecRestart= or similar option that they could be looking at.
2017-01-11 15:07:35 -05:00
Zbigniew Jędrzejewski-Szmek
c65aafbb33 man: add more links to systemd-ask-password and systemd-tty-ask-password-agent
Loosely inspired by https://bugzilla.redhat.com/show_bug.cgi?id=1411134.
2017-01-11 12:11:42 -05:00
Lennart Poettering
84e6712f94 Merge pull request #5046 from stefanha/vsock
Add AF_VSOCK socket activation support
2017-01-11 10:53:59 +01:00
Stefan Hajnoczi
359a5bcf78 core: add AF_VSOCK support to socket units
Accept AF_VSOCK listen addresses in socket unit files.  Both guest and
host can now take advantage of socket activation.

The QEMU guest agent has recently been modified to support socket
activation and can run over AF_VSOCK with this patch.
2017-01-10 15:29:04 +00:00
(GalaxyMaster)
23d0fff78d socket-proxyd: fix --connections-max help message and docs (#5044) 2017-01-10 08:55:50 +01:00
Ian Kelling
fa2a396620 doc: MountFlags= don't reference container which may not exist (#5011) 2017-01-03 21:32:31 +01:00
Ian Kelling
7141028d30 doc: correct "or" to "and" in MountFlags= description (#5010) 2017-01-03 21:31:20 +01:00
Ian Kelling
4b957756b8 man: document mount deletion between commands 2017-01-03 02:17:50 -08:00
Martin Pitt
56a9366d7d Merge pull request #4994 from poettering/private-tmp-tmpfiles
automatically clean up PrivateTmp= left-overs in /var/tmp on next boot
2016-12-29 11:18:38 +01:00
Lennart Poettering
9eb484fa40 man: add brief documentation for the (sd-pam) processes created due to PAMName= (#4967)
A follow-up for #4942, adding a brief but more correct explanation of
the processes.
2016-12-29 10:55:27 +01:00
Lennart Poettering
d71f050599 core: implicitly order units with PrivateTmp= after systemd-tmpfiles-setup.service
Preparation for fixing #4401.
2016-12-27 23:25:24 +01:00
Lennart Poettering
7f129a1f7c man: document that "systemd-run -M" propagates exit codes, and "machinectl shell" does not
This adds a brief explanation, suggesting the use of "systemd-run -M" to
acquire exit status/code information for the invoked process.

My original plan was to propagate the exit code/status in "machinectl
shell" too, but this would mean we'd have to actively watch the shell's
runtime status, and thus would need full, highly privileged and
continious access to the container's system manager, the way
"systemd-run" does it. This would be quite a departure from the
simplistic, low-priviliged OpenShell() bus call implementation of the
current code, that really just acquires a PTY device with a shell
connected.

Moreover it would blur the lines between the two commands even further,
which I think is not desirable. Hence, from now on:

    "machinectl shell" is the full-session, interactive shell for human
    users

    "systemd-run -M …" is the low-level tool, that supports
    on-interactive mode, and is more configurable and suitable for
    streaming.

Fixes: #4215
2016-12-27 18:32:45 +01:00
Lennart Poettering
bd2ab3f4f6 seccomp: add two new filter sets: @reboot and @swap
These groupe reboot()/kexec() and swapon()/swapoff() respectively
2016-12-27 18:09:37 +01:00
Lucas Werkmeister
2dcf2a1724 man: minor improvements (#4981) 2016-12-25 12:14:00 +01:00
Felipe Sateler
99479986ea man: Align ExecStop= documentation with actual kill behavior (#4974)
The manpage claimed that ExecStop would be followed immediately by
SIGKILL, whereas the actual behavior is to go through KillMode= and
KillSignal= first.

Fixes #4490
2016-12-24 11:34:26 +01:00
Susant Sahani
42125eda21 networkd: Add example to create MACVTAP and attach it to a link (#4946)
Fixes: #4914
2016-12-23 18:09:29 +01:00
Susant Sahani
8f9a206b6c networkd: Rename ProxyARP to IPv4ProxyARP (#4947)
Rename the arp proxy option to IPv4ProxyARP= in order to clarify
its relationship to IPv4, and map to the various IPv6 options we have.

Fixes: #4768
2016-12-22 10:23:29 +01:00
Martin Pitt
4050e04b2c resolved: correctly handle non-address RR types with /etc/hosts lookups (#4808)
Fix wrong condition test in manager_etc_hosts_lookup(), which caused it to
return an IPv4 answer when an IPv6 question was asked, and vice versa.
Also only return success if we actually found any A or AAAA record.

In systemd-resolved.service(8), point out that /etc/hosts mappings only
affect address-type lookups, not other types.

The test case currently disables DNSSEC in resolved, as there is a bug
where "-t MX" fails due to "DNSSEC validation failed" even after
"downgrading to non-DNSSEC mode". This should be dropped once that bug
gets fixed.

Fixes #4801
2016-12-22 07:58:02 +01:00
Susant Sahani
eb64b435eb networkd: bond support primary slave and active slave (#4873)
active_slave:

Specifies the new active slave for modes that support it
(active-backup, balance-alb and balance-tlb).

primary slave:
systemd-networks currently lacks the capability to set the primary slave
in an
active-backup bonding. This is necessary if you prefer one interface
over the
other. A common example is a eth0-wlan0 bonding on a laptop where you'd
want to
switch to the wired connection whenever it's available.

Fixes: #2837
2016-12-21 19:10:36 +01:00