1
0
mirror of https://github.com/systemd/systemd.git synced 2024-10-27 10:25:37 +03:00
Commit Graph

42299 Commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek
c86ebcf389 test-unit-name: add usual headers and add more verbose output
This makes it easier to see what unit_name_is_valid() returns at a glance.
The output is not whitespace clean, but I think it's good enough for a test.
2019-11-12 11:52:22 +01:00
Zbigniew Jędrzejewski-Szmek
9e9dd3e329
Merge pull request #13862 from zachsmith/systemd-tmpfiles-deprecate-for-force
systemd-tmpfiles: deprecate F for f+
2019-11-12 10:28:59 +01:00
Yu Watanabe
a566ed2c82 udev: do not append newline when write attributes
Before 25de7aa7b9, the content is written
by `fprintf()` without new line. So WRITE_STRING_FILE_AVOID_NEWLINE flag
is necessary.

Fixes #13985.
2019-11-12 09:25:00 +01:00
Zbigniew Jędrzejewski-Szmek
e9f4f5667d meson: apply our -Wno-* options also in c++ calls
We compile some c++ code for tests. We would simply use the default options for
those. When the previous commit raised the default warning level, we started
getting warnings from c++ code. Let's add the most important options to the c++
command, so that we get a compilation without any warnings again.

I don't think it makes sense to add *all* the options that we add for c to the
c++ flags, because testing them takes quite a while, and the c++ compilations
are for small amounts of code, mostly to check that the headers have compatible
syntax.
2019-11-12 09:23:31 +01:00
Zbigniew Jędrzejewski-Szmek
827ca90986 meson: use warning_level=2 by default
Let's bump up the warning level, and not add by -Wextra by hand. This is the
approach recommended by meson. The idea is that all projects should be as
similar as possible to make it easier for users to switch between projects.
2019-11-12 09:23:31 +01:00
Zbigniew Jędrzejewski-Szmek
cbe8049474 meson: avoid bogus meson warning
With meson-0.52.0-1.module_f31+6771+f5d842eb.noarch I get:
src/test/meson.build:19: WARNING: Overriding previous value of environment variable 'PATH' with a new one

When we're using *prepend*, the whole point is to modify an existing variable,
so meson shouldn't warn. But let's set avoid the warning and shorten things by
setting the final value immediately.
2019-11-12 09:23:31 +01:00
Yu Watanabe
b64b83d13e udev: ignore error caused by device disconnection
During an add or change event, the device may be disconnected.

Fixes #13976.
2019-11-12 14:58:53 +09:00
Yu Watanabe
ffdc9c891f udev: fix error code in the log message 2019-11-12 14:58:53 +09:00
Yu Watanabe
4b613ec212 udev: ignore ENOENT when chmod_and_chown() device node 2019-11-12 14:58:53 +09:00
Anita Zhang
68f98816cb
Merge pull request #13997 from khfeng/hwdb-dell-vostro5581-ish
hwdb: Mark Intel Sensor Hub's accel sensor on Vostro 5581 as being in…
2019-11-11 17:56:56 -08:00
Anita Zhang
4da0b33511
Merge pull request #13996 from poettering/utc-fix
accept UTC timezone explicitly, even if timezone data is missing
2019-11-11 17:47:43 -08:00
Kevin Kuehler
07cab0f72b tests: Add capability tests for ProtectKernelLogs 2019-11-11 12:12:02 -08:00
Kevin Kuehler
8470304018 core: Add ProtectKernelLogs
If seccomp is enabled, load the SYSCALL_FILTER_SET_SYSLOG into the
seccomp filter set. Drop the CAP_SYSLOG capability.
2019-11-11 12:12:02 -08:00
Kevin Kuehler
620dbdd248 shared: Add ProtectKernelLogs property
Add seccomp_protect_syslog, which adds a filter rule for the syslog
system call.
2019-11-11 12:11:56 -08:00
Zbigniew Jędrzejewski-Szmek
26444635ea test-bpf-devices: skip test on !unified
The code in cgroup.c has support for all hierarchies, but the test,
as written, will only work on unified. Since the test is really about
bpf code, and not the legacy devices controller, let's just skip
the test.
2019-11-11 21:05:08 +01:00
Kai-Heng Feng
fe156aeafc hwdb: Mark Intel Sensor Hub's accel sensor on Vostro 5581 as being in the base
This laptop uses the accelerometer as a freefall sensor, so mark it as
in base to prevent screen rotation.
2019-11-12 00:30:46 +08:00
Lennart Poettering
55fd6dca07 time-util: uniquify timezone list, in case UTC is listed in timezone1970.tab, too 2019-11-11 17:06:09 +01:00
Lennart Poettering
e8b9e9c470 time-util: always accept UTC as valid timezone
We already handle it specially in get_timezones(), hence we should OK it
here too, even if the timezone file doesn't actually exist.

Prompted by:

https://serverfault.com/questions/991172/invalid-time-zone-utc

(Yes, Ubuntu should install the UTC timezone data unconditionally: it
should not be an option, even if all other timezone data is excluded,
but since it's our business to validate user input but not out business
to validate distros, let's just accept "UTC" unconditionally, it's magic
after all)
2019-11-11 17:05:06 +01:00
Zbigniew Jędrzejewski-Szmek
45669ae264 bpf: make sure the kernel do not submit an invalid program if no pattern matched
It turns out that the kernel verifier would reject a program we would build
if there was a whitelist, but no entries in the whitelist matched.
The program would approximately like this:
   0: (61) r2 = *(u32 *)(r1 +0)
   1: (54) w2 &= 65535
   2: (61) r3 = *(u32 *)(r1 +0)
   3: (74) w3 >>= 16
   4: (61) r4 = *(u32 *)(r1 +4)
   5: (61) r5 = *(u32 *)(r1 +8)
  48: (b7) r0 = 0
  49: (05) goto pc+1
  50: (b7) r0 = 1
  51: (95) exit
and insn 50 is unreachable, which is illegal. We would then either keep a
previous version of the program or allow everything. Make sure we build a
valid program that simply rejects everything.
2019-11-11 15:14:09 +01:00
Zbigniew Jędrzejewski-Szmek
0048657828 bpf: optimize device type access away most of the time
Most of the time, we specify the allowed access mode as "rwm", so the check
always trivially passes. In that case, skip the check.

The repeating part changes from:
   5: (55) if r2 != 0x2 goto pc+6
   6: (bc) w1 = w3
   7: (54) w1 &= 7
   8: (5d) if r1 != r3 goto pc+3
   9: (55) if r4 != 0x1 goto pc+2
  10: (55) if r5 != 0x3 goto pc+1
  11: (05) goto pc+8
to
   6: (55) if r2 != 0x2 goto pc+3
   7: (55) if r4 != 0x1 goto pc+2
   8: (55) if r5 != 0x3 goto pc+1
   9: (05) goto pc+40
2019-11-11 15:14:02 +01:00
Zbigniew Jędrzejewski-Szmek
8ad08622d6 bpf: convert 'c'/'b' to bpf_type at the very end
This makes the code a bit longer, but easier to read I think, because
the cgroup v1 and v2 code paths are more similar. And whent he type is
a char, any backtrace is easier to interpret.
2019-11-11 15:13:56 +01:00
Zbigniew Jędrzejewski-Szmek
7973f56468 test-bpf-devices: new test for the devices bpf code 2019-11-11 15:13:38 +01:00
Zbigniew Jędrzejewski-Szmek
a72a5326a4 bpf: fix off-by-one in class whitelisting
We would jump one insn too many, landing in the middle of the subsequent block.
2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek
415fe5ec7d bpf: fix device type filter
On big endian arches, we were taking the wrong half-word, so the check
was giving bogus results.

https://bugzilla.redhat.com/show_bug.cgi?id=1769148.
2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek
786cce0099 bpf: add trace logging
Very helpful when trying to figure out what exactly is going on.
2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek
4140351189 test-bpf-firewall: fix message 2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek
0848715cab bpf: make bpf_devices_apply_policy() independent of any unit code 2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek
64ad9e088d tests: modify enter_cgroup_subroot() to return the new path 2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek
48e98ba5c3 tests: get rid of test-helper.[ch] completely
I don't think there's any particular reason to keep those functions in a separate
file.
2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek
2025f0f602 tests: make is_run_on_travis_ci() static
This is a pretty specific hack, so let's just define it close to the one
place where it is used.
2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek
5eecb1030f tests: make manager_skip_test() not a macro and move to tests.h
There is nothing magic in it.
2019-11-11 14:55:57 +01:00
Zbigniew Jędrzejewski-Szmek
8b139557fe core: split out one more function 2019-11-11 14:55:52 +01:00
Hans de Goede
5b1733cdae hwdb: Add accel orientation quirk for Wortmann Terra Pad 1061
Add a quirk to fix the accelerometer orientation on the Wortmann
Terra Pad 1061 tablet.
2019-11-11 09:43:37 +01:00
Zbigniew Jędrzejewski-Szmek
a9aac7d8dd core: also split out helper to handle static device nodes 2019-11-10 23:22:15 +01:00
Zbigniew Jędrzejewski-Szmek
124e05b3b6 core: move bpf devices implementation to bpf-devices.[ch] and rename
The naming of the functions was a complete mess: the most specific functions
which don't know anything about cgroups had "cgroup_" prefix, while more
general functions which took a node path and a cgroup for reporting had no
prefix. Let's use "bpf_devices_" for the latter group, and "bpf_prog_*" for the
rest.

The main goal of this move is to split the implementation from the calling code
and add unit tests in a later patch.
2019-11-10 23:22:15 +01:00
Zbigniew Jędrzejewski-Szmek
084870f9c0 core: rename CGROUP_AUTO/STRICT/CLOSED to CGROUP_DEVICE_POLICY_…
The old names were very generic, and when used without context it wasn't at all
clear that they are about the devices policy.
2019-11-10 23:22:15 +01:00
Zbigniew Jędrzejewski-Szmek
77abd02985 tests: move memlock helper to shared code 2019-11-10 23:22:15 +01:00
Zbigniew Jędrzejewski-Szmek
ee19c80733 test-bpf-firewall: do not mlock() a large amount of memory
64MB is not that much, but let's not be greedy, esp. because we may run
many things in parallel.

Also, rlim_cur should never be higher than rlim_max, so let's simplify our
code.
2019-11-10 23:22:15 +01:00
Zbigniew Jędrzejewski-Szmek
d3472f9b50 test-bpf: rename to test-bpf-firewall
Let's make the name better reflect its scope.
2019-11-10 23:22:15 +01:00
Zbigniew Jędrzejewski-Szmek
672cbcbc20 bpf: return normally from whitelist_major()
All callers do (void) anyway, so we can just use normal return here.
2019-11-10 23:22:15 +01:00
Zbigniew Jędrzejewski-Szmek
d49c180826 bpf: do not bother adding device patterns after whitelisting the full class
This seems to have been unintentional.
2019-11-10 23:22:15 +01:00
Zbigniew Jędrzejewski-Szmek
fa6613fc53 bpf: refactor how we create device major:minor whitelists
No functional change intended except for minor adjustments to error messages.
2019-11-10 23:22:15 +01:00
Zbigniew Jędrzejewski-Szmek
2899aac46a core: constify bpf program arrays
In cases where the programs were modified after being initially declared,
reorder operations so that the declaration is already in final form.
2019-11-10 23:22:14 +01:00
Vito Caputo
a602d93e44 journal-file: delete some unnecessary braces
Trivial change, just something I noticed skimming the code.
2019-11-10 12:39:44 +01:00
Yu Watanabe
e64664cefe
Merge pull request #13975 from keszybz/more-seccomp-syscalls
Add more syscalls to the seccomp lists
2019-11-09 23:27:34 +09:00
Zbigniew Jędrzejewski-Szmek
5021735fad shared/sleep-config: fix potential SEGV
We were looking at the wrong variable, and would always crash if this
comparison was reached. Fixes #13965.

Also, fix crash (_cleanup_ called on uninitialized variable) if we failed in
error path.

While at it, let's shorten some messages.
2019-11-09 09:19:36 +00:00
Zach Smith
4b55952dbe systemd-tmpfiles: cleanup man page program listing 2019-11-08 20:29:36 -08:00
Zbigniew Jędrzejewski-Szmek
9493b16871 Add @pkey syscall group
Inspired by https://bugzilla.redhat.com/show_bug.cgi?id=1769299.
This change doesn't solve the issue, but makes it easier to whitelist the
syscall group.
2019-11-08 14:41:22 +01:00
Zbigniew Jędrzejewski-Szmek
6ca6771069 seccomp: add all *time64 syscalls
From https://bugzilla.redhat.com/show_bug.cgi?id=1770154:
> utime is an obsolete system call. The current kernel interface is
> utimensat_time64. New 32-bit architectures do not even provide the utime
> system call.

Also add all other *time64 syscalls listed in
https://fedora.juszkiewicz.com.pl/syscalls.html.
2019-11-08 14:40:49 +01:00
Zbigniew Jędrzejewski-Szmek
7fd7dab90f
Merge pull request #13554 from keur/systemctl_status_timer
systemctl: Add timer activation to status
2019-11-08 14:19:40 +01:00