1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-22 17:35:35 +03:00
Commit Graph

578 Commits

Author SHA1 Message Date
Abderrahim Kitouni
ec07c3c80b man: add version info
This tries to add information about when each option was added. It goes
back to version 183.

The version info is included from a separate file to allow generating it,
which would allow more control on the formatting of the final output.
2023-08-29 14:07:24 +01:00
Maanya Goenka
d07246a621 documentation: add man page data for confext 2023-08-16 19:19:44 +01:00
Luca Boccassi
b0d3095fd6 Drop split-usr and unmerged-usr support
As previously announced, execute order 66:

https://lists.freedesktop.org/archives/systemd-devel/2022-September/048352.html

The meson options split-usr, rootlibdir and rootprefix become no-ops
that print a warning if they are set to anything other than the
default values. We can remove them in a future release.
2023-07-28 19:34:03 +01:00
Erik Sjölund
6870daff03 man: fix typos 2023-07-27 09:54:43 +01:00
Luca Boccassi
3f37a82545 core: copy the host's os-release for /run/host/os-release
Currently for portable services we automatically add a bind mount
os-release -> /run/host/os-release. This becomes problematic for the
soft-reboot case, as it's likely that portable services will be configured
to survive it, and thus would forever keep a reference to the old host's
os-release, which would be a problem because it becomes outdated, and also
it stops the old rootfs from being garbage collected.

Create a copy when the manager starts under /run/systemd/propagate instead,
and bind mount that for all services using RootDirectory=/RootImage=, so
that on soft-reboot the content gets updated (without creating a new file,
so the existing bind mounts will see the new content too).

This expands the /run/host/os-release protocol to more services, but I
think that's a nice thing to have too.

Closes https://github.com/systemd/systemd/issues/28023
2023-07-18 17:26:02 +01:00
Zbigniew Jędrzejewski-Szmek
84214541fa Revert "pid1: order units using TTYVHangup= after vconsole setup"
This reverts commit e019ea738d.

In the new approach, a lock on /dev/console will be used. This lock will solve
the issue for services which run in early boot. Services which run later are
ordered after sysinit.target, so they'll run much later anyway so this
automatic dependency is not useful. Let's remove it again to make the code
simpler.
2023-07-12 15:54:33 +02:00
Lennart Poettering
de70ecb328 import-creds: add support for binary credentials specified on the kernel cmdline 2023-07-04 23:19:48 +02:00
Lennart Poettering
0dea5b7719 import-creds: define a new dir where initrd configurators can pass credentials to host 2023-07-04 22:59:07 +02:00
Zbigniew Jędrzejewski-Szmek
da89046643 tree-wide: "<n>bit" → "<n>-bit"
In some places, "<n> bits" is used when more appropriate.
2023-07-02 11:10:12 +01:00
Lennart Poettering
cc8fdd5d30 man: properly close XML tags 2023-06-28 22:12:03 +02:00
Lennart Poettering
f9c91932b4 execute: add support for XDG_STATE_HOME for placing service state data in --user mode
This adds support for the new XDG_STATE_HOME env var that was added to
the xdg basedir spec. Previously, because the basedir spec didn't know
the concept we'd alias the backing dir for StateDirectory= to the one
for ConfigurationDirectory= when runnin in --user mode. With this change
we'll make separate. This brings us various benefits, such as proper
"systemctl clean" support, where we can clear service state separately
from service configuration, now in user mode too.

This does not come without complications: retaining compatibility with
older setups is difficult, because we cannot possibly identitfy which
files in existing populated config dirs are actually "state" and which
one are true" configuration.

Hence let's deal with this pragmatically: if we detect that a service
that has both dirs configured only has the configuration dir existing,
then symlink the state dir to the configuration dir to retain
compatibility.

This is not great, but it's the only somewhat reasonable way out I can
see.

Fixes: #25739
2023-06-28 22:01:55 +02:00
Lennart Poettering
947c4d3952 core: restrict ImportCredential= globbing
Let's restrict how we apply credential globbing in ImportCredential=, so
that we have some flexibility in automatically extending the glob
expression with per-instance data eventually without getting into
conflict with the globbing parts.

In our current uses we only allow globbing at the end of the expression,
and this is a new, unreleased feature hence let's be restrictive on this
initially. We can still relax this later if we feel the need to after
all.

Fixes: #28022
2023-06-22 16:07:09 +02:00
Daan De Meyer
9c0c670125 core: Add RootEphemeral= setting
This setting allows services to run in an ephemeral copy of the root
directory or root image. To make sure the ephemeral copies are always
cleaned up, we add a tmpfiles snippet to unconditionally clean up
/var/lib/systemd/ephemeral. To prevent in use ephemeral copies from
being cleaned up by tmpfiles, we use the newly added COPY_LOCK_BSD
and BTRFS_SNAPSHOT_LOCK_BSD flags to take a BSD lock on the ephemeral
copies which instruct tmpfiles to not touch those ephemeral copies as
long as the BSD lock is held.
2023-06-21 12:48:46 +02:00
Zbigniew Jędrzejewski-Szmek
966dd7527d man: missing/misplaced periods 2023-06-19 13:36:30 +02:00
Daan De Meyer
bbfb25f4b9 creds: Add ImportCredential=
ImportCredential= takes a credential name and searches for a matching
credential in all the credential stores we know about it. It supports
globs which are expanded so that all matching credentials are loaded.
2023-06-08 14:09:18 +02:00
Stefan Roesch
85614c6e2f add support for KSM
This adds support for KSM (kernel samepage merging). It adds a new
boolean parameter called MemoryKSM to enable the feature. The feature
can only be enabled with newer kernels.
2023-06-05 11:22:43 +02:00
Zbigniew Jędrzejewski-Szmek
e019ea738d pid1: order units using TTYVHangup= after vconsole setup
The goal of this change is to delay getty services until after
systemd-vconsole-setup has finished. systemd-vconsole-setup starts loadkeys,
and it seems that when loadkeys is interrupted by the TTY hangup call we do
when starting tty services [1], so that loadkeys starts getting EIO from the
ioctl("/dev/tty1", KDSKBENT) syscall it does.

Fixes #26908.

[1] https://github.com/legionus/kbd/issues/92#issuecomment-1554451788

Initially I wanted to add ordering dependencies to individual units, but
TTYVHangup= can be added to other various external units too. The solution with
an implicit dependency should cover those cases too.
2023-05-19 17:46:30 +02:00
Zbigniew Jędrzejewski-Szmek
ffcdd3194d
Merge pull request #27669 from keszybz/man-fixes-254
Some simple man page fixes to reduce the list of issues tagged for v254
2023-05-17 14:12:33 +02:00
Zbigniew Jędrzejewski-Szmek
8fb350049b man: fixes for assorted issues reported by the manpage-l10n project
Fixes #26761.
2023-05-17 12:25:01 +02:00
Zbigniew Jędrzejewski-Szmek
42eccfec6e man: say that ProtectClock= also affects reads
Fixes #26413: the docs said that the filter prevents writes, but it just a
filter at the system call level, and some of those calls are used for writing
and reading. This is confusing esp. when a higher level library call like
ntp_gettime() is denied.

I don't think it's realistic that we'll make the filter smarter in the near
future, so let's change the docs to describe the implementation.

Also, split out the advice part into a separate paragraph.
2023-05-17 11:17:39 +02:00
Lennart Poettering
3af48a86d9
Merge pull request #25608 from poettering/dissect-moar
dissect: add dissection policies
2023-04-12 13:46:08 +02:00
Lennart Poettering
75b29fda71 service: tell service processes that the fdstore is available via an env var 2023-04-12 10:34:31 +02:00
Lennart Poettering
9ea811914f man: document image policy syntax and semantics, and the hooks in the various components 2023-04-05 20:55:15 +02:00
Lennart Poettering
f452e0461f man: update syscal filter group list 2023-03-24 14:52:34 +01:00
Luca Boccassi
1092e82bb7 core: append LogExtraFields= values to log_unit* messages
This ensure messages from PID1 regarding a unit also contain those
fields. For example, portable services have PORTABLE=<image> as
extra fields, which is useful to identify which version of a portable
image produced a log message like an error or an oomd kill.
2023-03-14 16:38:23 +00:00
Topi Miettinen
7a114ed4b3 execute: use prctl(PR_SET_MDWE) for MemoryDenyWriteExecute=yes
On some ARM platforms, the dynamic linker could use PROT_BTI memory protection
flag with `mprotect(..., PROT_BTI | PROT_EXEC)` to enable additional memory
protection for executable pages. But `MemoryDenyWriteExecute=yes` blocks this
with seccomp filter denying all `mprotect(..., x | PROT_EXEC)`.

Newly preferred method is to use prctl(PR_SET_MDWE) on supported kernels. Then
in-kernel implementation can allow PROT_BTI as necessary, without weakening
MDWE. In-kernel version may also be extended to more sophisticated protections
in the future.
2023-03-13 18:44:36 +00:00
Lennart Poettering
6bb0084204 pid1: add unit file settings to control memory pressure logic 2023-03-01 09:43:23 +01:00
Lennart Poettering
e7a2594219 man: document REMOTE_ADDR/REMOTE_PORT along with the other env vars 2023-02-24 10:23:53 +01:00
Yu Watanabe
c2da3bf237 core/namespace: mount new sysfs when new network namespace is requested
Even when a mount namespace is created, previously host's sysfs is used,
especially with RootDirectory= or RootImage=, thus service processes can
still access the properties of the network interfaces in the main network
namespace through sysfs.

This makes, sysfs is remounted with the new network namespace tag, except
when PrivateMounts= is explicitly disabled. Hence, the properties of the
network interfaces in the main network namespace cannot be accessed by
service processes through sysfs.

Fixes #26422.
2023-02-23 15:09:13 +09:00
Luca Boccassi
398dc7d39b core: imply DeviceAllow=/dev/tpmrm0 with LoadCredentialEncrypted
If the device access policy is restricted, add implicitly access to the TPM
if at least one encrypted credential needs to be loaded.

Fixes https://github.com/systemd/systemd/issues/26042
2023-02-08 10:59:55 +00:00
Lennart Poettering
4c8ca41fa5 man: extend Personality= docs a bit
Let's make clear personalities are supported on ARM (as per
https://github.com/systemd/systemd/pull/26152#issuecomment-1400321944).

Also, clarify that on many archs this functionality is pretty pointless,
i.e. where only a single native arch was ever known.
2023-01-24 16:08:09 +01:00
Lennart Poettering
793fc32169 Revert "Resolves #26142 - Fix list of supported personalities"
This reverts commit fdbbb5ffc0.
2023-01-24 15:53:30 +01:00
Steve Ramage
fdbbb5ffc0 Resolves #26142 - Fix list of supported personalities 2023-01-22 18:57:12 +01:00
Luca Boccassi
f2af682cd6 man: note that cgroup-based sandboxing is not bypassed by '+'
DeviceAllow= and others are applied to the whole cgroup via bpf, so
using '+' on an Exec line will not bypass them. Explain this in the
manpage.

Fixes https://github.com/systemd/systemd/issues/26035
2023-01-18 17:59:43 +00:00
Zbigniew Jędrzejewski-Szmek
8b9f092112 man: fix issues reported by the manpage-l10n project
Fixes #25780.

> Man page: crypttab.5
> Issue 1:  Missing fullstop
> Issue 2:  I<cipher=>, I<hash=>, I<size=> → B<cipher=>, B<hash=>, B<size=>
>
> "Force LUKS mode\\&. When this mode is used, the following options are "
> "ignored since they are provided by the LUKS header on the device: "
> "I<cipher=>, I<hash=>, I<size=>"

Seems OK to me. The full stop is there and has been for at least a few years. And we use <option> for the markup, which is appropriate here.

> Man page: crypttab.5
> Issue 1:  Missing fullstop
> Issue 2:  I<cipher=>, I<hash=>, I<keyfile-offset=>, I<keyfile-size=>, I<size=> → B<cipher=>, B<hash=>, B<keyfile-offset=>, B<keyfile-size=>, B<size=>
>
> "Use TrueCrypt encryption mode\\&. When this mode is used, the following "
> "options are ignored since they are provided by the TrueCrypt header on the "
> "device or do not apply: I<cipher=>, I<hash=>, I<keyfile-offset=>, I<keyfile-"
> "size=>, I<size=>"

Same.

> Man page: journalctl.1
> Issue 1:  make be → may be

Fixed.

> Issue 2:  below\\&. → below:

Fixed.

> Man page: journalctl.1
> Issue:    Colon at the end?
>
> "The following commands are understood\\&. If none is specified the default "
> "is to display journal records\\&."
> msgstr ""
> "Die folgenden Befehle werden verstanden\\&. Falls keiner festgelegt ist, ist "
> "die Anzeige von Journal-Datensätzen die Vorgabe\\&."

This is a bit awkward, but I'm not sure how to fix it.

> Man page: kernel-install.8
> Issue:    methods a fallback → methods fallback

It was correct, but I added a comma to make the sense clearer.

> Man page: loader.conf.5
> Issue 1:  secure boot variables → Secure Boot variables
> Issue 2:  one → one for (multiple times)
>
> "Supported secure boot variables are one database for authorized images, one "
> "key exchange key (KEK) and one platform key (PK)\\&. For more information, "
> "refer to the \\m[blue]B<UEFI specification>\\m[]\\&\\s-2\\u[2]\\d\\s+2, "
> "under Secure Boot and Driver Signing\\&. Another resource that describe the "
> "interplay of the different variables is the \\m[blue]B<EDK2 "
> "documentation>\\m[]\\&\\s-2\\u[3]\\d\\s+2\\&."

"one of" would sound strange. "One this and one that" is OK.

> Man page: loader.conf.5
> Issue:    systemd-boot → B<systemd-boot>(7)

Fixed.

> Man page: logind.conf.5
> Issue:    systemd-logind → B<systemd-logind>(8)

We use <filename>systemd-logind</> on subsequent references… I think that's good enough.

> Man page: nss-myhostname.8
> Issue:    B<getent> → B<getent>(1)

Fixed.

> Man page: nss-resolve.8
> Issue:    B<systemd-resolved> → B<systemd-resolved>(8)

The first reference does this, subsequent are shorter.

> Man page: os-release.5
> Issue:    Portable Services → Portable Services Documentation?

Updated.

> Man page: pam_systemd_home.8
> Issue:    auth and account use "reason", while session and password do not?

Reworded.

> Man page: portablectl.1
> Issue:    In systemd-portabled.service(8): Portable Services Documentation

Updated.

> Man page: repart.d.5
> Issue:    The partition → the partition

Fixed.

> Man page: repart.d.5
> Issue:    B<systemd-repart> → B<systemd-repart>(8)

The first reference does this. I also change this one, because it's pretty far down in the text.

> Man page: systemd.1
> Issue:    kernel command line twice?
>
> "Takes a boolean argument\\&. If false disables importing credentials from "
> "the kernel command line, qemu_fw_cfg subsystem or the kernel command line\\&."

Apparently this was fixed already.

> Man page: systemd-boot.7
> Issue:    enrollement → enrollment

Fixed.

> Man page: systemd-cryptenroll.1
> Issue:    multiple cases: any specified → the specified

Reworded.

> Man page: systemd-cryptenroll.1
> Issue:    If this this → If this

Fixed tree-wide.

> Man page: systemd-cryptsetup-generator.8
> Issue:    and the initrd → and in the initrd

"Is honoured by the initrd" is OK, because we often speak about the initrd as a single unit. But in the same paragraph we also used "in the initrd", which makes the other use look sloppy. I changed it to "in the initrd" everywhere in that file.

> Man page: systemd.directives.7
> Issue:    Why are these two quoted (but not others)?
>
> "B<\\*(Aqh\\*(Aq>"
>
> B<\\*(Aqs\\*(Aq>"
>
> "B<\\*(Aqy\\*(Aq>"

This is autogenerated from files… We use slightly different markup in different files, and it's just too hard to make it consistent. We gave up on this.

> Man page: systemd.exec.5
> Issue 1:  B<at>(1p) → B<at>(1)
> Issue 2:  B<crontab>(1p) → B<crontab>(1)

Fixed.

> Man page: systemd.exec.5
> Issue:    B<select()> → B<select>(2)

Fixed.

> Man page: systemd.exec.5
> Issue:   qemu → B<qemu>(1)

The man page doesn't seem to be in any of the canonical places on the web.
I added a link to online docs.

> Man page: systemd.exec.5
> Issue:    variable → variables

Seems to be fixed already.

> Man page: systemd-integritysetup-generator.8
> Issue:    systemd-integritysetup-generator → B<systemd-integritysetup-generator>

I changed <filename> to <command>.

> Man page: systemd-integritysetup-generator.8
> Issue:    superfluous comma at the end

Already fixed.

> Man page: systemd-measure.1
> Issue:    (see B<--pcr-bank=>) below → (see B<--pcr-bank=> below)

Reworded.

> Man page: systemd-measure.1
> Issue:    =PATH> → =>I<PATH>

Fixed.

> Man page: systemd-measure.1.po
> Issue:    B<--bank=DIGEST> → B<--bank=>I<DIGEST>

Fixed.

> Man page: systemd.netdev.5
> Issue:    os the → on the

Appears to have been fixed already.

> Man page: systemd.netdev.5
> Issue:    Onboard → On-board (as in previous string)

Updated.

> Man page: systemd.network.5
> Issue:    B<systemd-networkd> -> B<systemd-networkd>(8)

First reference does this, subsequent do not.

> Man page: systemd.network.5
> Issue:    B<netlabelctl> → B<netlabelctl>(8)

First reference does this, subsequent do not.

> Man page: systemd.network.5
> Issue:    Missing verb (aquired? configured?) in the half sentence starting with "or by a "

I dropped the comma.

> Man page: systemd-nspawn.1
> Issue:    All host users outside of that range → All other host users

Reworded.

> # FIXME no effect → no effect\\&.
> #. type: Plain text
> #: archlinux debian-unstable fedora-rawhide mageia-cauldron opensuse-tumbleweed
> msgid ""
> "Whichever ID mapping option is used, the same mapping will be used for users "
> "and groups IDs\\&. If B<rootidmap> is used, the group owning the bind "
> "mounted directory will have no effect"

A period is added. Not sure if there's some other issue.

> Man page: systemd-oomd.service.8
> Issue:    B<systemd> → B<systemd>(1)

Done.

> Man page: systemd.path.5
> Issue 1:  B<systemd.exec>(1) → B<systemd.exec>(5)
> Issue 2:  This section does not (yet?) exist

Fixed.

> Man page: systemd-pcrphase.service.8
> Issue 1:  indicate phases into TPM2 PCR 11 ??
> Issue 2: Colon at the end of the paragraph?

Fixed.

> Man page: systemd-pcrphase.service.8
> Issue:    final boot phase → final shutdown phase?

Updated.

> Man page: systemd-pcrphase.service.8
> Issue:    for the the → for the

Fixed tree-wide.

> Man page: systemd-portabled.service.8
> Issue:    In systemd-portabled.service(8): Portable Services Documentation

Updated.

> Man page: systemd-pstore.service.8
> Issue:    Here and the following paragraphs: . → \\&. // Upstream: What does this comment mean? // You normally write \\&. for a full dot (full stop etc.); here you write only "." (i.e. a plain dot).
>
> "and we look up \"localhost\", nss-dns will send the following queries to "
> "systemd-resolved listening on 127.0.0.53:53: first \"localhost.foobar.com\", "
> "then \"localhost.barbar.com\", and finally \"localhost\". If (hopefully) the "
> "first two queries fail, systemd-resolved will synthesize an answer for the "
> "third query."

Looks all OK to me.

> Man page: systemd.resource-control.5
> Issue:    Missing closing bracket after link to Control Groups version 1

Fixed.

> Man page: systemd-sysext.8
> Issue:    In systemd-portabled.service(8): Portable Services Documentation

Updated.

> Man page: systemd.timer.5
> Issue 1:  B<systemd.exec>(1) → B<systemd.exec>(5)
> Issue 2:  This section does not (yet?) exist

Fixed.

> Man page: systemd.unit.5
> Issue:    that is → that are

Fixed.

> Man page: systemd-veritysetup-generator.8
> Issue:    systemd-veritysetup-generator → B<systemd-veritysetup-generator>
>
 > "systemd-veritysetup-generator implements B<systemd.generator>(7)\\&."
>
> "systemd-veritysetup-generator understands the following kernel command line "
> "parameters:"

Updated.

> Man page: systemd-volatile-root.service.8
> Issue:    initrdyes → Initrd

Fixed.

> Man page: sysupdate.d.5
> Issue:    : → \\&. (As above in TRANSFER)

Updated.

> Man page: sysupdate.d.5
> Issue:    some → certain

Updated.

> Man page: sysupdate.d.5
> Issue 1:  i\\&.e\\& → I\\&.e\\&

Fixed.

> Issue 2:  the image → the system

"image" seems correct.

> Man page: tmpfiles.d.5
> Issue:    systemd-tmpfiles → B<systemd-tmpfiles>(8)

Updated.
2023-01-11 17:12:54 +01:00
Ulrich Ölmann
fe0bdcacd1 man: exec,nspawn: fix typo 2023-01-10 16:45:22 +09:00
Lennart Poettering
578033356d man: document explicitly that LogRateLimit= has no effect on StandardOutput=file:…
Fixes: #25951
2023-01-06 14:13:09 +01:00
Luca Boccassi
0a207d8f23 man: note that DynamicUser=yes is incompatible with D-Bus
Due to policy checks against system users this cannot currently work, and it is non-obvious.
In the future it might be implemented if support is added to dbus-broker/dbus-daemon, e.g.:

https://github.com/bus1/dbus-broker/issues/259
2023-01-04 17:49:41 +01:00
Quentin Deslandes
523ea1237a journal: log filtering options support in PID1
Define new unit parameter (LogFilterPatterns) to filter logs processed by
journald.

This option is used to store a regular expression which is carried from
PID1 to systemd-journald through a cgroup xattrs:
`user.journald_log_filter_patterns`.
2022-12-15 09:57:39 +00:00
Zbigniew Jędrzejewski-Szmek
db81144428 tree-wide: BLS and DPS are now on uapi-group website 2022-11-21 12:26:35 +01:00
Lennart Poettering
5bdf35c14e man: make clear NNP has no effect on processes invoked through systemd-run/at/crontab and such things 2022-10-31 12:53:52 +01:00
Luca Boccassi
06768b90a3 portable: allow caller to override extension-release name check
When the --force flag is used, do not insist that the extension-release
file has to match the extension image name
2022-10-12 09:57:24 +01:00
adrian5
b72e5d9d8e man: Minor punctuation and word tweak 2022-08-29 11:29:57 +09:00
Luca Boccassi
c8bc7519c8 service: set TRIGGER_UNIT= and TRIGGER_TIMER_REALTIME_USEC/MONOTONIC_USEC on activation by timer unit
Same as path unit, best effort.
2022-08-23 21:19:54 +01:00
Luca Boccassi
4c42032854 service: set TRIGGER_UNIT= and TRIGGER_PATH= on activation by path unit
When a service is triggered by a path unit, pass the
path unit name and the path that triggered it via env vars
to the spawned processes.
Note that this is best-effort, as there might be many triggers
at the same time, but we only get woken up by one.
2022-08-23 20:38:08 +01:00
Zbigniew Jędrzejewski-Szmek
15102ced42 man: similar → similarly
Something *is* similar
Something *works* similarly
Something does something, similarly to how something else does something

See https://sites.ulethbridge.ca/roussel/2017/11/29/similar-and-similarly-are-they-similar/
for a clear explanation.
2022-08-23 12:14:58 +02:00
Max Gautier
e0a12b9634 docs: Correct StandartOutput documentation
fix #2114
2022-07-30 13:48:36 +01:00
Jan Janssen
6a1d8f1161 man: Miscellaneous fixes
Fixes: #24056
2022-07-19 10:41:13 +01:00
Lennart Poettering
8de7de462b pid1: import creds from SMBIOS too, not just qemu's fw_cfg
This imports credentials also via SMBIOS' "OEM vendor string" section,
similar to the existing import logic from fw_cfg.

Functionality-wise this is very similar to the existing fw_cfg logic,
both of which are easily settable on the qemu command line.

Pros and cons of each:

SMBIOS OEM vendor strings:
   - pro: fast, because memory mapped
   - pro: somewhat VMM independent, at least in theory
   - pro: qemu upstream sees this as the future
   - pro: no additional kernel module needed
   - con: strings only, thus binary data is base64 encoded

fw_cfg:
   - pro: has been supported for longer in qemu
   - pro: supports binary data
   - con: slow, because IO port based
   - con: only qemu
   - con: requires qemu_fw_cfg.ko kernel module
   - con: qemu upstream sees this as legacy
2022-07-15 08:31:34 +09:00
Lennart Poettering
8c88895772 man: explain why various resource limits don't make sense and should not be used. 2022-07-14 23:53:51 +02:00