shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-26 03:22:00 +03:00
Code
22,286 Commits 4 Branches 398 Tags 556 MiB
f1f679c5b6
Commit Graph

7 Commits

Author SHA1 Message Date
Lennart Poettering
658f26b828 units: set KillMode=mixed for our daemons that fork worker processes 
The daemons should really have the time to kill the workers first,
before systemd does it, hence use KillMode=mixed for these daemons.

https://bugs.freedesktop.org/show_bug.cgi?id=90051
 2015-04-24 16:14:46 +02:00
Lubomir Rintel
15d7b51724 importd: add CAP_DAC_OVERRIDE capability 
Fedora's filesystem package ships /usr/bin (and other directories) which are
not writable by its owner. machinectl pull-dkr (and possibly others) are not
able to extract those:

  14182 mkdirat(3, "usr", 0700)           = 0
  14182 mkdirat(3, "usr/bin", 0500)       = 0
  14182 openat(3, "usr/bin/[", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_NONBLOCK|O_CLOEXEC, 0700) = -1 EACCES (Permission denied)
  ...
 2015-04-21 02:45:34 +02:00
Lennart Poettering
113b3fc1a8 importd: create a loopback btrfs file system for /var/lib/machines, if necessary 
When manipulating container and VM images we need efficient and atomic
directory snapshots and file copies, as well as disk quota. btrfs
provides this, legacy file systems do not. Hence, implicitly create a
loopback file system in /var/lib/machines.raw and mount it to
/var/lib/machines, if that directory is not on btrfs anyway.

This is done implicitly and transparently the first time the user
invokes "machinectl import-xyz".

This allows us to take benefit of btrfs features for container
management without actually having the rest of the system use btrfs.

The loopback is sized 500M initially. Patches to grow it dynamically are
to follow.
 2015-02-24 17:27:53 +01:00
Lennart Poettering
a24111cea6 Revert "units: add SecureBits" 
This reverts commit 6a716208b3.

Apparently this doesn't work.

http://lists.freedesktop.org/archives/systemd-devel/2015-February/028212.html
 2015-02-11 18:28:06 +01:00
Topi Miettinen
6a716208b3 units: add SecureBits 
No setuid programs are expected to be executed, so add
SecureBits=noroot noroot-locked
to unit files.
 2015-02-11 17:33:36 +01:00
Lennart Poettering
e57565dd5b importd: run daemon at minimal capabilities 2015-01-22 18:55:08 +01:00
Lennart Poettering
3d7415f43f import: introduce new mini-daemon systemd-importd, and make machinectl a client to it 
The old "systemd-import" binary is now an internal tool. We still use it
as asynchronous backend for systemd-importd. Since the import tool might
require some IO and CPU resources (due to qcow2 explosion, and
decompression), and because we might want to run it with more minimal
priviliges we still keep it around as the worker binary to execute as
child process of importd.

machinectl now has verbs for pulling down images, cancelling them and
listing them.
 2015-01-22 04:02:07 +01:00