1
0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 17:51:22 +03:00
Commit Graph

52909 Commits

Author SHA1 Message Date
Mauricio Vásquez
00d6fceeb3 tests: add integration test for RestrictNetworkInterfaces=
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-19 07:25:01 -05:00
Ondrej Kozina
8186022c9d Add support for systemd-pkcs11 libcryptsetup plugin.
Add support for systemd-pkcs11 based LUKS2 device activation
via libcryptsetup plugin. This make the feature (pkcs11 sealed
LUKS2 keyslot passphrase) usable from both systemd utilities
and cryptsetup cli.

The feature is configured via -Dlibcryptsetup-plugins combo
with default value set to 'auto'. It get's enabled automatically
when cryptsetup 2.4.0 or later is installed in build system.
2021-08-19 13:58:10 +02:00
Ondrej Kozina
0ff605665a pkcs11-util: split pkcs11_token_login function
Future systemd-pkcs11 plugin requires unlock via single
call with supplied pin. To reduce needless code duplication
in plugin itself split original pkcs_11_token_login call in
two calls:

new pkcs11_token_login_by_pin and the former where loop
for retrying via PIN query callback remains.
2021-08-19 13:58:10 +02:00
Ondrej Kozina
ed3d3af148 cryptsetup-pkcs11: move pkcs11_callback and data in shared utils.
To be used later by both (future) systemd-pkcs11 libcryptsetup
plugin and cryptsetup-pkcs11.
2021-08-19 13:58:10 +02:00
Ondrej Kozina
351716e111 Add support for systemd-fido2 libcryptsetup plugin.
Add support for systemd-fido2 based LUKS2 device activation
via libcryptsetup plugin. This make the feature (fido2 sealed
LUKS2 keyslot passphrase) usable from both systemd utilities
and cryptsetup cli.

The feature is configured via -Dlibcryptsetup-plugins combo
with default value set to 'auto'. It get's enabled automatically
when cryptsetup 2.4.0 or later is installed in build system.
2021-08-19 13:58:10 +02:00
Hela Basa
12f76c3b38 po: Translated using Weblate (Sinhala)
Currently translated at 0.5% (1 of 189 strings)

Co-authored-by: Hela Basa <r45xveza@pm.me>
Translate-URL: https://translate.fedoraproject.org/projects/systemd/master/si/
Translation: systemd/main
2021-08-19 17:27:50 +09:00
Yu Watanabe
7ff592a454 creds-util: fix possible divide-by-zero
input_size may be zero.

Fixes #20469.
2021-08-19 09:49:00 +02:00
Lennart Poettering
ddb6eeafe2 tree-wide: port things over to FORMAT_PROC_FD_PATH() 2021-08-19 09:19:27 +02:00
Lennart Poettering
48a01cd934 test: add test for FORMAT_PROC_FD_PATH() 2021-08-19 09:19:23 +02:00
Lennart Poettering
6e1e4b59f9 fd-util: add macro for generating /proc/self/fd/ paths on the fly 2021-08-19 09:19:11 +02:00
Lennart Poettering
3832cb90ba stdio-util: give snprintf_ok() some love
as per docs snprintf() can fail in which case it returns -1. The
snprintf_ok() macro so far unconditionally cast the return value of
snprintf() to size_t, which would turn -1 to (size_t) INT_MAX,
presumably, at least on 2 complements system.

Let's be more careful with types here, and first check if return value
is positive, before casting to size_t.

Also, while we are at it, let's return the input buffer as return value
or NULL instead of 1 or 0. It's marginally more useful, but more
importantly, is more inline with most of our other codebase that
typically doesn't use booleans to signal success.

All uses of snprintf_ok() don't care for the type of the return, hence
this change does not propagate anywhere else.
2021-08-19 09:19:03 +02:00
Lennart Poettering
12a7f04a2b discover-image: pass the right fd to fd_getcrtime() 2021-08-19 09:18:45 +02:00
Jan Janssen
87167331c9 sd-boot: Use UEFI provided CRC32 2021-08-18 22:01:09 +01:00
Mauricio Vásquez
2ce150f5ec src/test: add restrict network interfaces to test-cgroup-mask
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:54 -05:00
Mauricio Vásquez
795ccb03e0 man: add RestrictNetworkInterfaces= documentation
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:54 -05:00
Mauricio Vásquez
57585d5999 Document RestrictNetworkInterfaces dbus properties
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:53 -05:00
Mauricio Vásquez
a59cb62cf2 core: add D-bus properties for RestrictNetworkInterfaces=
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:53 -05:00
Mauricio Vásquez
4f0c25c794 core: add load fragment implementation for RestrictNetworkInterfaces=
Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:53 -05:00
Mauricio Vásquez
6f50d4f7d6 core: implement RestrictNetworkInterfaces=
This commit introduces all the logic to load and attach the BPF
programs to restrict network interfaces when a unit specifying it is
loaded.

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:53 -05:00
Mauricio Vásquez
dc83b840d3 core: add RestrictNetworkInterfaces= BPF program source code
The code is composed by two BPF_PROG_TYPE_CGROUP_SKB programs that
are loaded in the cgroup inet ingress and egress hooks
(BPF_CGROUP_INET_{INGRESS|EGRESS}).

The decision to let a packet pass or not is based on a map that contains
the indexes of the interfaces.

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
2021-08-18 15:55:53 -05:00
Franck Bui
d93857ae09 test: if haveged is part of initrd it needs to be installed in the image too
Otherwise haveged won't survive when switching root from initrd to host making
haveged service in host fail.
2021-08-18 17:37:55 +02:00
Franck Bui
138f761904 test: adapt install_pam() for openSUSE
On openSUSE the default pam config files are shipped in /usr/etc/pam.d.

Also empty password is not allowed by default.
2021-08-18 17:37:55 +02:00
Franck Bui
d8167c5212 Revert "test: adapt TEST-13-NSPAWN-SMOKE for SUSE"
This reverts commit 491b736a49.

If the _static_ linked version of busybox is installed, openSUSE doesn't need
any specific code.

A following commit will make sure that the static linked version of busybox is
installed in the busybox container.
2021-08-18 17:37:55 +02:00
Franck Bui
5231ec50e9 test: on openSUSE the static linked version of busybox is named "busybox-static" 2021-08-18 17:37:55 +02:00
Franck Bui
6c8ba239d5 TEST-13-*: in busybox container sleep(1) takes a delay in seconds only 2021-08-18 17:37:55 +02:00
Franck Bui
dfd73ccb14 test: don't try to find BUILD_DIR when NO_BUILD is set
NO_BUILD=1 indicates that we want to test systemd from the local system and not
the one from the local build. Hence there should be no need to call
find-build-dir.sh when NO_BUID=1 especially since it's likely that the script
will fail to find a local build in this case.

This avoids find-build-dir.sh to emit 'Specify build directory with $BUILD_DIR'
message when NO_BUILD=1 and no local build can be found.

This introduces a behavior change though: systemd from the local system will
always be preferred when NO_BUILD=1 even if a local build can be found.
2021-08-18 17:37:55 +02:00
Franck Bui
abf062674e test: add support for NO_BUILD=1 on openSUSE 2021-08-18 17:37:24 +02:00
Yu Watanabe
0d341eccef udev: make RxChannels= or friends also accept "max"
Follow-up for 406041b7de.

Also, this makes
- the settings accept an empty string,
- if the specified value is too large, also use the advertised maximum
  value.
- mention the range of the value in the man page.
2021-08-18 16:55:03 +02:00
Yu Watanabe
bdbb61f69f tree-wide: fix typo 2021-08-18 13:36:14 +02:00
Luca Boccassi
66e093def8 docs: portable services are no longer in preview
Reword the intro to the document, as portable services are a stable interface
and no longer a preview.
2021-08-18 11:30:53 +02:00
Vladimir Panteleev
e9aee93240 fstab-generator: Respect nofail when ordering 2021-08-18 16:00:49 +09:00
Vladimir Panteleev
ecfcf0244a Fix typo in dbus property name ("OnSuccesJobMode") 2021-08-18 16:00:05 +09:00
Yu Watanabe
21ee8eda50
Merge pull request #20460 from yuwata/udevadm-test-builtin-introduce-action
udevadm: introduce --action option for test-builtin
2021-08-18 15:59:40 +09:00
Daan De Meyer
406041b7de
udev: Support "max" string for BufferSize options (#20458)
"max" indicates the hardware advertised maximum queue buffer size
should be used.

The max sizes can be checked by running `ethtool -g <dev>` (Preset maximums).
Since the buffer sizes can't be set to 0 by users, internally we use 0 to
indicate that the hardware advertised maximum should be used.
2021-08-18 15:59:13 +09:00
Yu Watanabe
91546abf9e
Merge pull request #20456 from tomty89/man
Adding a few notes in the systemd.network man page
2021-08-18 15:58:06 +09:00
Yu Watanabe
c4f7a34756 network: do not assume the highest priority when Priority= is unspecified
Previously, when Priority= is unspecified, networkd configured the rule with
the highest (=0) priority. This commit makes networkd distinguish the case
the setting is unspecified and one explicitly specified as Priority=0.

Note.
1) If the priority is unspecified on configure, then kernel dynamically picks
   a priority for the rule.
2) The new behavior is consistent with 'ip rule' command.

Replaces #15606.
2021-08-18 15:57:45 +09:00
Yu Watanabe
7ce05a8d66 udevadm: introduce -a|--action option for test-builtin command
As net_setup_link builtin requires that a device action is set for the
sd_device object.
2021-08-18 00:08:08 +09:00
Tom Yan
5cf9069f08 man: network: mention that RouteMetric= in [DHCPv4] is also applied to the prefix route 2021-08-17 22:53:49 +08:00
Tom Yan
5ea859ef01 man: network: mention that Promiscuous= can be used to set nopromisc for passthru MACV{LAN,TAP} 2021-08-17 22:53:29 +08:00
Lennart Poettering
f6e40037a0
Merge pull request #20448 from medhefgo/boot
sd-boot: UI improvements
2021-08-17 16:26:25 +02:00
Yu Watanabe
74614801f6 shell-completion: add missing uevent actions for udevadm 2021-08-17 23:22:26 +09:00
Yu Watanabe
6de7fa8759 udevadm: introduce parse_device_action() helper function 2021-08-17 23:22:26 +09:00
Yu Watanabe
d1429d8f78 udevadm: introduce find_device_with_action() helper function 2021-08-17 23:22:26 +09:00
Lennart Poettering
29278aa41d
Merge pull request #20281 from bluca/ext_release_naming
extension-release: allow fallback when image name is mangled after build, improve docs
2021-08-17 16:06:26 +02:00
Luca Boccassi
5d55791e3f docs: document layered images in PORTABLE_SERVICES.md 2021-08-17 13:15:13 +01:00
Luca Boccassi
9c8b6eaa46 man: further document extension-release 2021-08-17 13:15:13 +01:00
Luca Boccassi
9a4b883be2 extension-release: search for other files if expected name not found
In some cases image names are unpredictable - some orchestrators/deployment
tools like to mangle names to suit their internal formats. In these cases,
the requirement that the extension-release file matches exactly the image
name where it's contained cannot work.

Allow falling back to loading the first regular file which name starts with
'extension-release' located in /usr/lib/extension-release.d/ and tagged with
a user.extension-release.strict extended attribute with a true value, if the
one with the expected name cannot be found.
2021-08-17 13:04:44 +01:00
Luca Boccassi
5ce46344fd xattr-util: add fgetxattrat_fake_malloc variant 2021-08-17 13:04:44 +01:00
Jan Janssen
2e65d6103d sd-boot: Draw custom edit cursor
Firmware likes to draw the EFI provided cursor in a weird way that
makes it invisible sometimes. This is even more likely to happen
if unusual colors are picked. It also fails to draw attention to the
user by being very small and not blinking.

Additionally, to make it more clear that we are in edit mode, we
now default to inverting the general default color and use that for
our line edit.

Fixes: #19301
2021-08-17 13:59:13 +02:00
Jan Janssen
e313e934db sd-boot: Add compile-time color support
Fixes: #10139
2021-08-17 13:59:12 +02:00