1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-25 01:34:28 +03:00
Commit Graph

39425 Commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek
dff6c6295b test-seccomp: fix compilation on arm64
It has no open().
2019-04-03 13:24:43 +02:00
Zbigniew Jędrzejewski-Szmek
7eb8a47e42 build-sys: bump package version 2019-04-03 10:00:14 +02:00
Zbigniew Jędrzejewski-Szmek
d822bd4e26 Merge pull request #12121 from poettering/contrib 2019-04-03 09:53:51 +02:00
Lennart Poettering
570ee29ce1 docs: fix path to unit files 2019-04-03 13:47:12 +09:00
Davide Cavalca
639dd43a36 core: fix build failure if seccomp is disabled 2019-04-03 13:46:32 +09:00
Lennart Poettering
b2b33eb064 Revert "build: install /etc/systemd/{system,user}-generators"
This reverts commit 509276f2b7.
2019-04-02 21:09:35 +02:00
Yu Watanabe
33ca308f38
Merge pull request #12188 from poettering/coccinelle-fixlets
tree-wide: let's run coccinelle again
2019-04-03 01:46:54 +09:00
Lennart Poettering
2eb466fc10 update NEWS 2019-04-02 17:31:41 +02:00
Lennart Poettering
bfe6bb2007 meson: bump so versions
Since we aren't quite ready for release v242 yet, let's not bump the
package version yet, but let's already bump the soversion.
2019-04-02 17:31:41 +02:00
Lennart Poettering
5b2fc74fca NEWS: add preliminary contributor list 2019-04-02 17:31:41 +02:00
Lennart Poettering
e67ccb54a2 update .mailmap 2019-04-02 17:31:00 +02:00
Lennart Poettering
82c604607f
Merge pull request #12056 from poettering/seccomp-suid-sgid
Introduce RestrictSUIDSGID= for disabling SUID/SGID file creation
2019-04-02 17:30:11 +02:00
Lennart Poettering
6d85ba7299 update TODO 2019-04-02 16:56:48 +02:00
Lennart Poettering
bf65b7e0c9 core: imply NNP and SUID/SGID restriction for DynamicUser=yes service
Let's be safe, rather than sorry. This way DynamicUser=yes services can
neither take benefit of, nor create SUID/SGID binaries.

Given that DynamicUser= is a recent addition only we should be able to
get away with turning this on, even though this is strictly speaking a
binary compatibility breakage.
2019-04-02 16:56:48 +02:00
Lennart Poettering
62aa29247c units: turn on RestrictSUIDSGID= in most of our long-running daemons 2019-04-02 16:56:48 +02:00
Lennart Poettering
7445db6eb7 man: document the new RestrictSUIDSGID= setting 2019-04-02 16:56:48 +02:00
Lennart Poettering
9d880b70ba analyze: check for RestrictSUIDSGID= in "systemd-analyze security"
And let's give it a heigh weight, since it pretty much can be used for
bad things only.
2019-04-02 16:56:48 +02:00
Lennart Poettering
f69567cbe2 core: expose SUID/SGID restriction as new unit setting RestrictSUIDSGID= 2019-04-02 16:56:48 +02:00
Lennart Poettering
167fc10cb3 test: add test case for restrict_suid_sgid() 2019-04-02 16:56:48 +02:00
Lennart Poettering
3c27973b13 seccomp: introduce seccomp_restrict_suid_sgid() for blocking chmod() for suid/sgid files 2019-04-02 16:56:48 +02:00
Lennart Poettering
9e6e543c17 seccomp: add debug messages to seccomp_protect_hostname() 2019-04-02 16:56:48 +02:00
Lennart Poettering
42561fc99c core: add a generic helper that forwards per-unit method calls from Manager
Quite often we have a method DoSomethingWithUnit() on the Manager object
that is the same as a function DoSomething() on a Unit object. Let's
shorten things by introducing a common function that forwards the
former to the latter, instead of writing this again and again.
2019-04-02 16:38:20 +02:00
Zbigniew Jędrzejewski-Szmek
237ebf61e2
Merge pull request #12013 from yuwata/fix-switchroot-11997
core: on switching root do not emit device state change based on enumeration results
2019-04-02 16:06:07 +02:00
Lennart Poettering
568ee8fc46 udev: use strempty() where appropriate 2019-04-02 14:54:42 +02:00
Lennart Poettering
02dab76e93 json: use SYNTHETIC_ERRNO() where appropriate 2019-04-02 14:54:42 +02:00
Lennart Poettering
bab4820ee2 sd-event: use DIV_ROUND_UP where appropriate 2019-04-02 14:54:42 +02:00
Lennart Poettering
39f2bc6e7e sd-device: use xsprintf() where appropriate 2019-04-02 14:54:42 +02:00
Lennart Poettering
c614711386 tree-wide: use SYNTHETIC_ERRNO() where appropriate 2019-04-02 14:54:42 +02:00
Lennart Poettering
c1db999eb8 boot: use TAKE_PTR() where appropriate 2019-04-02 14:54:42 +02:00
Lennart Poettering
a7798cd81b tree-wide: use reallocarray() where appropriate 2019-04-02 14:54:42 +02:00
Lennart Poettering
0c21dafb54 util-lib: use FLAGS_SET() where appropriate 2019-04-02 14:54:38 +02:00
Lennart Poettering
d737b451fe analyze: use empty_or_root() where appropriate 2019-04-02 14:53:25 +02:00
Zbigniew Jędrzejewski-Szmek
84ce204a93
Merge pull request #12185 from poettering/login-unstore-fd
logind: remove unused fds from fdstore
2019-04-02 14:27:27 +02:00
Zbigniew Jędrzejewski-Szmek
8a306989b3
Merge pull request #12186 from poettering/lgtm-updates
lgtm ruleset updates
2019-04-02 14:19:27 +02:00
Zbigniew Jędrzejewski-Szmek
2356d683f8
Merge pull request #12183 from poettering/askpwargv
tty-ask-password: let's copy argv[] before forking
2019-04-02 13:50:14 +02:00
Frantisek Sumsal
1a862e2151 journal: LGTM doesn't recognize suppressions in /* */ 2019-04-02 12:47:14 +02:00
Lennart Poettering
f71611fed2 test: stop using dup() needlessly 2019-04-02 12:45:46 +02:00
Lennart Poettering
9b4805421e lgtm: beef up list of dangerous/questionnable API calls not to make 2019-04-02 12:45:46 +02:00
Lennart Poettering
efc19ee485 logind: when we cannot attach a passed fd to a device, close it
Replaces: #8532
2019-04-02 11:52:58 +02:00
Lennart Poettering
883d1b01b0 logind: simplify removal of device fds
let's use sd_notifyf(). Let's also stop validating the session ID here.
This is the destructor. if it contains a dash, we are already too late
here anyway.
2019-04-02 11:51:50 +02:00
Chris Morin
924426a703 journal-remote: use source's boot-id
systemd-journal-remote always wrote the boot-id of the device it was running on
to the header of its journal files. When the source had a different boot-id
(because it was generated on a different boot, or a different device), the
boot-ids in the file were inconsistent. The _BOOT_ID field was that of the
source, but the journal file header and each entry object header were that of
the device systemd-journal-remote ran on. This breaks journalctl --list-boots
on any of these files.

Set the boot-id in the header to be that of the source. This also fixes the
entry object headers.
2019-04-02 10:32:21 +02:00
Yu Watanabe
52cf2b13a0 ipv4ll: do not reset seed generation counter on restart
Fixes #12145.
2019-04-02 10:27:30 +02:00
Lennart Poettering
d9550542a8
Merge pull request #12007 from poettering/clock-change
.timer OnClockChange= and OnTimezoneChange= settings
2019-04-02 10:24:35 +02:00
Lennart Poettering
189b03779e tty-ask-password: re-break comment 2019-04-02 10:19:23 +02:00
Lennart Poettering
d850296466 tty-ask-password: simplify signal handler installation 2019-04-02 10:19:22 +02:00
Lennart Poettering
7452917740 tty-ask-password: no need to initialize something already NUL initialized to NUL 2019-04-02 10:19:22 +02:00
Lennart Poettering
4bec7f09f8 tty-ask-password: drop redundant local variable 2019-04-02 10:19:22 +02:00
Lennart Poettering
ed179fd710 tty-ask-password: copy argv[] before forking child
Another fix in style of bd169c2be0.

Let's also avoid strjoina() in a loop (i.e. stack allocation). While in
this specific caseone could get away with it (since we'd immediately
afterwards leave the loop) it's still ugly, and every static checker
would be totally within its rights to complain.

Also, let's simplify things by not relying on argc, since it's redundant
anyway, and it's nicer to just treat things as NULL terminated strv
array.

Fixes: #12180
2019-04-02 10:19:17 +02:00
Lennart Poettering
ee6bb34d4a update TODO 2019-04-02 08:20:10 +02:00
Lennart Poettering
d9b8c2ef8b man: document the two new .timer settings 2019-04-02 08:20:10 +02:00