1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-22 17:35:35 +03:00
Commit Graph

64383 Commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek
b0bd2ae8b3 meson: fix indentation 2023-05-09 08:11:10 +02:00
Zbigniew Jędrzejewski-Szmek
6089235829 meson: add check-includes test to the test suite
Let's just call it always. It is quite fast (meson says 0.12 s).
2023-05-09 08:11:10 +02:00
Zbigniew Jędrzejewski-Szmek
ba9ca60a88 meson: include .cc files in tags too
We only have one, but it seems reasonable to not exclude it.
Result tested with emacs.
2023-05-09 08:11:10 +02:00
Zbigniew Jędrzejewski-Szmek
c4a090d60e Rewrite check-includes.pl in python 2023-05-09 08:11:10 +02:00
Zbigniew Jędrzejewski-Szmek
083e2ba445 pid1: drop duplicate include 2023-05-09 08:11:10 +02:00
Zbigniew Jędrzejewski-Szmek
7d3d147c4a test_ukify: print message when skipping whole test file 2023-05-09 08:11:10 +02:00
Zbigniew Jędrzejewski-Szmek
fb5578b3c3 test-udev: add an optional timeout argument
The tests wants to call some workers with a delay. This implements the delay
directly in test-udev so that the caller can be simplified.

Note that the argument is to be used by the other test file, so this is
purposefully implemented in a simple way.
2023-05-09 08:10:20 +02:00
Yu Watanabe
210cb8d690 core/unit: check the validity of unit type with activation_details_vtable
Follow-up for 24e91e08f8.
2023-05-08 09:49:55 +02:00
Yu Watanabe
d2132d3d8d parse-util: make parse_fd() return -EBADF
The previous error code -ERANGE is slightly ambiguous, and use more
specific one. This also drops unnecessary error handlings.

Follow-up for 754d8b9c33 and
e652663a04.
2023-05-08 09:49:55 +02:00
Ronan Pigott
b3d12ac0da zsh: add service-log-{level,target} completions for systemctl 2023-05-08 01:08:36 +01:00
Janne Sirén
78e0dd2244
hwdb: add landscape IdeaPad Miix 310 sensor orientation (#27555)
Enables support for landscape orientated display variants of the IdeaPad Miix 310 2-in-1 laptop.
2023-05-07 09:18:55 +09:00
Klaus Zipfel
703902400d
crypttab: Support for VeraCrypt PIM and detached headers for TrueCrypt/VeraCrypt (#27548)
* Added veracrypt-pim=<PIM> LUKS option for crypttab
2023-05-06 21:55:05 +01:00
Luca Boccassi
3be6943e07
Merge pull request #26357 from ddstreet/tpm2_policy_session
Tpm2 policy session
2023-05-06 17:02:26 +01:00
Zbigniew Jędrzejewski-Szmek
9dfed0d4cc
Merge pull request #27262 from keszybz/ukify-install
Add kernel-install plugin that calls ukify
2023-05-06 13:34:08 +02:00
Yu Watanabe
5b5e54e058 hwdb: do not include '#' in modalias
Follow-up for 7bd3d6e35a.
Fixes #27516.
2023-05-06 10:27:34 +02:00
Luca Boccassi
8069cdc7e7
Merge pull request #27527 from mrc0mmand/fuzz-manager-serialize
core: a couple of follow-ups for issues found by fuzz-manager-serialize
2023-05-06 01:53:26 +01:00
Dan Streetman
2cd9d57548 tpm2: move policy building out of policy session creation
This retains the use of policy sessions instead of trial sessions
in most cases, based on the code comment that some TPMs do not
implement trial sessions correctly. However, it's likely that the
issue was not the TPMs, but our code's incorrect use of PolicyPCR
inside a trial session; we are not providing expected PCR values
with our call to PolicyPCR inside a trial session, but the spec
indicates that in a trial session, the TPM *may* return error if
the expected PCR value(s) are not provided. That may have been the
source of the original confusion about trial sessions.

More details:
https://github.com/systemd/systemd/pull/26357#pullrequestreview-1409983694

Also, future commits will replace the use of trial sessions with
policy calculations, which avoids the problem entirely.
2023-05-05 18:34:46 -04:00
Dan Streetman
e976445d03 tpm2: add tpm2_is_encryption_session() 2023-05-05 18:32:39 -04:00
Ronan Pigott
8139407ec1 zsh: remove usage of PREFIX in _systemctl
The usage of PREFIX in this completion is mostly counter to the intended
usage of compsys in zsh. It is generally expected that completion code
provide the available completions and tags in that word position so that
compsys, with user configuration, can filter them to the appropriate set.

One egregious error caused by the usage of PREFIX here is the caching of
SYS_ALL_UNITS, which stored only the unit names prematurely filtered by
the completion prefix, affecting all future completions. For example,

  $ systemctl cat nonsense<TAB>

might find no matching units if nonsense* has no matches, but now

  $ systemctl cat <TAB>

will fail in all future completions even though every unit file
is a valid match, because the cached set has been erroneously filtered
by the last prefix.
2023-05-05 22:12:50 +01:00
Frantisek Sumsal
380a36582d test: add a test case for #27521
Which got resolved by e652663a04.
2023-05-05 22:15:23 +02:00
Frantisek Sumsal
24e91e08f8 core: check the unit type more thoroughly when deserializing
Resolves: #27523
2023-05-05 22:15:23 +02:00
Frantisek Sumsal
cc938f1ce0 shared: refuse fd == INT_MAX
Since we do `FD_TO_PTR(fd)` that expands to `INT_TO_PTR(fd) + 1` which
triggers an integer overflow.

Resolves: #27522
2023-05-05 22:15:23 +02:00
Frantisek Sumsal
77be02ad3c core: use extract_first_word() instead of sscanf() 2023-05-05 22:15:23 +02:00
Nick Rosbrook
362235bf59 basic/audit-util: make a test request before enabling use of audit
If a container manager does not follow the guidance in
https://systemd.io/CONTAINER_INTERFACE/ regarding audit capabilities,
then the current check may not be sufficient to determine that audit
will function properly. In particular, when calling bind() on the audit
fd, we will get EPERM if running in a user-namespaced container.

Expand the check to make an AUDIT_GET_FEATURE request on the audit fd to
test if it is working. If this fails with ECONNREFUSED, we know it is
because the kernel does not support the use of audit outside of the
initial user namespace.

Note that the approach of this patch was suggested here:
https://github.com/systemd/systemd/pull/19443#issuecomment-829566659

Fixes: #6519
2023-05-05 21:06:16 +01:00
Luca Boccassi
6ad7989ea0
Merge pull request #27536 from dtardon/checked-fd-parsing
Always check parsed fds for validity
2023-05-05 20:55:48 +01:00
Zbigniew Jędrzejewski-Szmek
46886f130d test_ukify: add test for combining config and cmdline 2023-05-05 18:43:20 +02:00
Zbigniew Jędrzejewski-Szmek
248be6ef37 man: describe all the changes to ukify
As in mkosi(1), let's describe the config file and commandline options
together. This is nice for us, because we don't need to duplicate descriptions
and we're less likely to forget to update one place or the other. This is also
nice for users, because they can easily figure out what can be configured
where.

The options are now ordered by config file section.

--summary was not described before.

More examples are added.
2023-05-05 18:43:20 +02:00
Zbigniew Jędrzejewski-Szmek
bac18826e9 ci: install pytest-flakes
Some web searches say that it's packaged for those distros and not the others…

v2:
- drop arch. https://aur.archlinux.org/packages/python-pytest-flakes exists,
  but installation fails in CI.
2023-05-05 18:42:37 +02:00
Zbigniew Jędrzejewski-Szmek
55be961f48 test_ukify: rework how --flakes argument is appended
The usual approach is to put 'addopts = --flakes' in setup.cfg. Unfortunately
this fails badly when pytest-flakes is not installed:
  ERROR: usage: test_ukify.py [options] [file_or_dir] [file_or_dir] [...]
  test_ukify.py: error: unrecognized arguments: --flakes

pytest-flakes is not packaged everywhere, and this test is not very important,
so let's just do it only if pytest-flakes is available. We now detect if
pytest-flakes is available and only add '--flakes' conditionally. This
unfortunately means that when invoked via 'pytest' or directly as
'src/ukify/test/test_ukify.py', '--flakes' will not be appended automatically.
But I don't see a nice way to achieve previous automatic behaviour.

(I first considered making 'setup.cfg' templated. But then it is created
in the build directory, but we would need it in the source directory for
pytest to load it automatically. So to load the file, we'd need to give an
argument to pytest anyway, so we don't gain anything with this more complex
approach.)
2023-05-05 18:42:37 +02:00
Zbigniew Jędrzejewski-Szmek
041f536f9a test_ukify: propagate failure
Oops. This explains why the tests were "passing" in CI even
though a direct pytest invocation would fail.
2023-05-05 18:42:37 +02:00
Zbigniew Jędrzejewski-Szmek
a758f95c33 ukify: appease mypy
Note to self: PEP 585 introduced using collection types as types,
and is available since 3.9. PEP 604 allows writing unions with "|",
but is only available since 3.10, so not yet here because we maintain
compat with 3.9.
2023-05-05 18:42:37 +02:00
Zbigniew Jędrzejewski-Szmek
a4b329e6aa TODO: remove two entries
0ccfd3564b implemented one of the items, and this
pull requests handles the other one.
2023-05-05 18:42:37 +02:00
Zbigniew Jędrzejewski-Szmek
3f80c1393e test/60-ukify: override stub location in tests
Without this, build would fail if the stub is not available in /usr/lib/.
2023-05-05 18:42:37 +02:00
Zbigniew Jędrzejewski-Szmek
f9a6cb0e13 test-kernel-install: test 60-ukify.install and 90-uki-copy.install
We install a kernel with layout=uki and uki_generator=ukify, and test
that a UKI gets installed in the expected place. The two plugins cooperate,
so it's easiest to test them together.
2023-05-05 18:42:37 +02:00
Zbigniew Jędrzejewski-Szmek
ca1abaa5c4 60-ukify: kernel-install plugin that calls ukify to create a UKI
60-ukify.install calls ukify with a config file, so singing and policies and
splash will be done through the ukify config file, without 60-ukify.install
knowing anything directly.

In meson.py, the variable for loaderentry.install.in is used just once, let's
drop it. (I guess this approach was copied from kernel_install_in, which is
used in another file.)

The general idea is based on cvlc12's #27119, but now in Python instead of
bash.
2023-05-05 18:42:37 +02:00
Zbigniew Jędrzejewski-Szmek
47a6df4da0 test_ukify: add tests for the new functionality 2023-05-05 18:42:37 +02:00
Zbigniew Jędrzejewski-Szmek
7081db294c ukify: PeError → PEError
We don't lowercase acronyms in systemd usually.
Remove unnused f'' prefix to avoid a pylint warning.
2023-05-05 18:42:37 +02:00
Zbigniew Jędrzejewski-Szmek
5143a47a81 ukify: rework option parsing to support a config file
In some ways this is similar to mkosi: we have a argparse.ArgumentParser()
with a bunch of options, and a configparser.ConfigParser() with an
overlapping set of options. Many options are settable in both places, but
not all. In mkosi, we define this in three places (a dataclass, and a
function for argparse, and a function for configparser). Here, we have one
huge list of ConfigItem instances. Each instance specifies the full metadata
for both parsers. Argparse generates a --help string for all the options,
and we also append a config file sample to --help based on the ConfigItem
data:

$ python src/ukify/ukify.py --help|tail -n 25
config file:
  [UKI]
  Linux = LINUX
  Initrd = INITRD…
  Cmdline = TEXT|@PATH
  OSRelease = TEXT|@PATH
  DeviceTree = PATH
  Splash = BMP
  PCRPKey = KEY
  Uname = VERSION
  EFIArch = ia32|x64|arm|aa64|riscv64
  Stub = STUB
  PCRBanks = BANK…
  SigningEngine = ENGINE
  SecureBootPrivateKey = SB_KEY
  SecureBootCertificate = SB_CERT
  SignKernel = SIGN_KERNEL

  [PCRSignature:NAME]
  PCRPrivateKey = PATH
  PCRPublicKey = PATH
  Phases = PHASE-PATH…

While writing this I needed to check the argument parsing, so I added
a --summary switch. It just pretty-prints the resulting option dictionary:

$ python src/ukify/ukify.py /efi//3a9d668b4db749398a4a5e78a03bffa5/6.2.11-300.fc38.x86_64/linux /efi//3a9d668b4db749398a4a5e78a03bffa5/6.2.11-300.fc38.x86_64/initrd --pcr-private-key=PRIV.key --pcr-public-key=PUB.key --config=man/ukify-example.conf --summary
Host arch 'x86_64', EFI arch 'x64'
{'_groups': [0, 'initrd', 'system'],
 'cmdline': 'A1 B2 C3',
 'config': 'man/ukify-example.conf',
 'devicetree': None,
 'efi_arch': 'x64',
 'initrd': [PosixPath('initrd1'),
            PosixPath('initrd2'),
            PosixPath('initrd3'),
            PosixPath('/efi/3a9d668b4db749398a4a5e78a03bffa5/6.2.11-300.fc38.x86_64/initrd')],
 'linux': PosixPath('/efi/3a9d668b4db749398a4a5e78a03bffa5/6.2.11-300.fc38.x86_64/linux'),
 'measure': None,
 'os_release': PosixPath('/etc/os-release'),
 'output': 'linux.efi',
 'pcr_banks': ['sha1', 'sha384'],
 'pcr_private_keys': [PosixPath('PRIV.key'),
                      PosixPath('pcr-private-initrd-key.pem'),
                      PosixPath('pcr-private-system-key.pem')],
 'pcr_public_keys': [PosixPath('PUB.key'),
                     PosixPath('pcr-public-initrd-key.pem'),
                     PosixPath('pcr-public-system-key.pem')],
 'pcrpkey': None,
 'phase_path_groups': [None,
                       ['enter-initrd'],
                       ['enter-initrd:leave-initrd',
                        'enter-initrd:leave-initrd:sysinit',
                        'enter-initrd:leave-initrd:sysinit:ready']],
 'sb_cert': PosixPath('mkosi.secure-boot.crt'),
 'sb_key': PosixPath('mkosi.secure-boot.key'),
 'sections': [],
 'sign_kernel': None,
 'signing_engine': None,
 'splash': None,
 'stub': PosixPath('/usr/lib/systemd/boot/efi/linuxx64.efi.stub'),
 'summary': True,
 'tools': None,
 'uname': None}

With --summary, existence of input paths is not checked. I think we'll
want to show them, instead of throwing an error, but in red, similarly to
'bootctl list'.

This also fixes tests which were failing with e.g.
E       FileNotFoundError: [Errno 2] No such file or directory: '/ARG1'
=========================== short test summary info ============================
FAILED ../src/ukify/test/test_ukify.py::test_parse_args_minimal - FileNotFoun...
FAILED ../src/ukify/test/test_ukify.py::test_parse_args_many - FileNotFoundEr...
FAILED ../src/ukify/test/test_ukify.py::test_parse_sections - FileNotFoundErr...
=================== 3 failed, 10 passed, 3 skipped in 1.51s ====================
2023-05-05 18:42:03 +02:00
David Tardon
b45e316708 main: improve log message 2023-05-05 14:18:17 +02:00
OMOJOLA
d685a5f6a4 tpm2 PCRs: fix unchecked attempt to set PCR[24] 2023-05-05 13:07:10 +01:00
David Tardon
e652663a04 tree-wide: use parse_fd() 2023-05-05 09:10:56 +02:00
David Tardon
754d8b9c33 test: add a test for parse_fd() 2023-05-05 09:10:26 +02:00
David Tardon
b8f83d7f0c fd-util: introduce parse_fd()
It's a simple wrapper for safe_atoi() that returns error if the parsed
fd is < 0 .
2023-05-05 08:54:28 +02:00
David Tardon
9f2f16a344 main: add missing return
Follow-up-for: 2b5107e162
2023-05-05 08:49:37 +02:00
Christopher Gurnee
5de02fe107 man: small fixes to systemd.time Calendar Events 2023-05-05 10:55:57 +08:00
Luca Boccassi
92c5d3ff30
Merge pull request #27529 from DaanDeMeyer/kernel-top
mkosi: A few kernel build QOL improvements
2023-05-04 19:17:37 +01:00
Daan De Meyer
5ebf0b321f mkosi: Disable a bunch of useless configs when building a kernel
Let's speed up the kernel build a bit by disabling some stuff we
don't use.
2023-05-04 19:05:12 +02:00
Lennart Poettering
57485012c2
Merge pull request #27525 from poettering/creds-empty-gone
suppress per-service credentials dir when empty
2023-05-04 16:22:54 +02:00
Daan De Meyer
bfb7635544 mkosi: Look for mkosi.kernel/ in the top level directory
Let's make this slightly easier to use by looking for mkosi.kernel/
in the top level directory instead of in mkosi.presets/20-final/.
2023-05-04 15:45:42 +02:00
Lennart Poettering
3aaa376342 execute: remove credentials dir again when empty
This is closely related to the previous commit: if the credentials dir
is empty and nothing mounted on it, let's remove it again.

This will in particular happen if we decided to not actually install the
mount we prepared for the credentials because it is empty. In that case
the mount point inode is already there, and with this we'll remove it.
Primary effect, users will see ENOENT rather than EACCESS when trying to
access it, which should be preferable, given we already handle that
nicely in our credential consumption code.

This should also be useful on systems where we lack any privs to create
mounts, and thus operate on a regular dir anyway.
2023-05-04 12:10:06 +02:00