systemd/shell-completion/zsh/_systemd-analyze

124 lines
5.5 KiB
Plaintext
Raw Normal View History

#compdef systemd-analyze
# SPDX-License-Identifier: LGPL-2.1-or-later
(( $+functions[_systemd-analyze_verify] )) ||
_systemd-analyze_verify() {
_sd_unit_files
}
(( $+functions[_systemd-analyze_cat-config] )) ||
_systemd-analyze_cat-config() {
_files -W '(/run/systemd/ /etc/systemd/ /usr/lib/systemd/)' -P 'systemd/'
}
(( $+functions[_systemd-analyze_critical-chain] )) ||
_systemd-analyze_critical-chain() {
local -a _units
systemctl list-units --no-legend --no-pager --plain --all |
while read -r a b c; do
_units+=($a)
done
compadd -a _units
}
(( $+functions[_systemd-analyze_security] )) ||
_systemd-analyze_security() {
_sd_unit_files
}
(( $+functions[_systemd-analyze_syscall-filter] )) ||
_systemd-analyze_syscall-filter() {
local -a _groups
_groups=( $(systemd-analyze --quiet --no-pager syscall-filter | grep '^@') )
_describe -t groups 'syscall groups' _groups || compadd "$@"
}
(( $+functions[_systemd-analyze_filesystems] )) ||
_systemd-analyze_filesystems() {
local -a _groups
_groups=( $(systemd-analyze --quiet --no-pager filesystems | grep '^@') )
_describe -t groups 'file system groups' _groups || compadd "$@"
}
(( $+functions[_systemd-analyze_plot] )) ||
_systemd-analyze_plot() {
local -a _options
_options=( '--json=off' '--json=pretty' '--json=short' '--table' '--no-legend' )
_describe 'plot options' _options
}
(( $+functions[_systemd-analyze_commands] )) ||
_systemd-analyze_commands(){
local -a _systemd_analyze_cmds
# Descriptions taken from systemd-analyze --help.
_systemd_analyze_cmds=(
'time:Print time spent in the kernel before reaching userspace'
'blame:Print list of running units ordered by time to init'
'critical-chain:Print a tree of the time critical chain of units'
'plot:Output SVG graphic showing service initialization, or raw time data in
JSON or table format'
'dot:Dump dependency graph (in dot(1) format)'
'dump:Dump server status'
'cat-config:Cat systemd config files'
'unit-files:List files and symlinks for units'
'unit-paths:List unit load paths'
'exit-status:List known exit statuses'
'capability:List capability definitions'
'syscall-filter:List syscalls in seccomp filters'
'filesystems:List known filesystems'
'condition:Evaluate Condition*= and Assert*= assignments'
'verify:Check unit files for correctness'
'calendar:Validate repetitive calendar time events'
'timestamp:Parse a systemd syntax timestamp'
'timespan:Parse a systemd syntax timespan'
'security:Analyze security settings of a service'
analyze: add inspect-elf verb to parse package metadata Parses and prints package metadata from executables, libraries and core files $ systemd-analyze inspect-elf /tmp/core ../fsverity-utils/fsverityb /bin/bash --json=off --no-pager __________________________ path: /tmp/core elfType: coredump elfArchitecture: AMD x86-64 module name: /tmp/crash type: deb name: hello version: 1.0 architecture: amd64 os: debian osVersion: 11 buildId: b33541096a09c29a0ba4ec5c69364a2711b7c269 module name: /usr/lib/x86_64-linux-gnu/libc-2.31.so type: deb name: hello version: 1.0 architecture: amd64 os: debian osVersion: 11 buildId: 54eef5ce96cf37cb175b0d93186836ca1caf470c module name: /usr/lib/x86_64-linux-gnu/ld-2.31.so type: deb name: hello version: 1.0 architecture: amd64 os: debian osVersion: 11 buildId: 32438eb3b034da54caf58c7a65446639f7cfe274 __________________________________________________________________ path: /home/luca/git/systemd/../fsverity-utils/fsverity elfType: executable elfArchitecture: AMD x86-64 type: deb name: fsverity-utils version: 1.3-1 architecture: amd64 os: debian debugInfoUrl: https://debuginfod.debian.net buildId: 05b899e6ee0d3653e20458719b202ed3ca8d566f _________________________ path: /bin/bash elfType: executable elfArchitecture: AMD x86-64 buildId: 4fef260f60e257d2dbd4126bf8add83837aea190 $ $ systemd-analyze inspect-elf /tmp/core ../fsverity-utils/fsverity /bin/bash /tmp/core.test-condition.1000.f9b9a84a9fd1482c9702d6afa6f6934b.37640.1637083078000000 --json=pretty --no-pager { "elfType" : "coredump", "elfArchitecture" : "AMD x86-64", "/home/bluca/git/fsverity-utils/fsverity" : { "type" : "deb", "name" : "fsverity-utils", "version" : "1.3-1", "buildId" : "7c895ecd2a271f93e96268f479fdc3c64a2ec4ee" }, "/home/bluca/git/fsverity-utils/libfsverity.so.0" : { "type" : "deb", "name" : "fsverity-utils", "version" : "1.3-1", "buildId" : "b5e428254abf14237b0ae70ed85fffbb98a78f88" } } { "elfType" : "executable", "elfArchitecture" : "AMD x86-64", "/home/bluca/git/systemd/../fsverity-utils/fsverity" : { "type" : "deb", "name" : "fsverity-utils", "version" : "1.3-1", "buildId" : "7c895ecd2a271f93e96268f479fdc3c64a2ec4ee" } } { "elfType" : "executable", "elfArchitecture" : "AMD x86-64", "/bin/bash" : { "buildId" : "3313b4cb119dcce16927a9b6cc61dcd97dfc4d59" } } { "elfType" : "coredump", "elfArchitecture" : "AMD x86-64" }
2021-11-17 01:45:07 +00:00
'inspect-elf:Parse and print ELF package metadata'
# log-level, log-target, service-watchdogs have been deprecated
)
if (( CURRENT == 1 )); then
_describe "options" _systemd_analyze_cmds
else
local curcontext="$curcontext"
cmd="${${_systemd_analyze_cmds[(r)$words[1]:*]%%:*}}"
if (( $#cmd )); then
if (( $+functions[_systemd-analyze_$cmd] )) && (( CURRENT == 2 )); then
_systemd-analyze_$cmd
else
_message "no more options"
fi
else
_message "unknown systemd-analyze command: $words[1]"
fi
fi
}
_arguments \
improve zsh completion (#32098) * fix error * remove options that are no longer supported * add missing options * stop completion if an option `--help` or `--version` is supplied [[[ zjs: a note for the reader: zshcompsys(1) in the section about optspecs in _arguments says: > Each of the forms above may be preceded by a list in parentheses of option names and argument num‐ > bers. If the given option is on the command line, the options and arguments indicated in parentheses > will not be offered. For example, ‘(-two -three 1)-one:...' completes the option ‘-one'; if this ap‐ > pears on the command line, the options -two and -three and the first ordinary argument will not be > completed after it. ‘(-foo):...' specifies an ordinary argument completion; -foo will not be com‐ > pleted if that argument is already present. > > Other items may appear in the list of excluded options to indicate various other items that should > not be applied when the current specification is matched: a single star (\*) for the rest arguments > (i.e. a specification of the form ‘\*:...'); a colon (:) for all normal (non-option-) arguments; and a > hyphen (-) for all options. For example, if ‘(\*)' appears before an option and the option appears on > the command line, the list of remaining arguments (those shown in the above table beginning with > ‘\*:') will not be completed. The intended effect of the change is to remove irrelevant completion matches from the completion. tl;dr: (- : ) prevents further completion ]]]
2024-04-15 08:58:48 +00:00
'(- *)'{-h,--help}'[Show help text]' \
'(- *)--version[Show package version]' \
'--system[Operate on system systemd instance]' \
'--user[Operate on user systemd instance]' \
'--global[Show global user instance config]' \
'--root=[Add support for root argument]:PATH' \
systemd-analyze: support discrete images for 'verify' verb Adding --image parameter for verify verb using the dissect image functionality ----------------------------------------------------------------------------------- Example Run: I created a unit service file testrun.service with an invalid key-value pairing (foo = bar) and a squashfs image run.raw to test the code. maanya-goenka@debian:~/systemd (img-support)$ cat <<EOF>img/usr/lib/systemd/system/testrun.service > [Unit] > foo = bar > > [Service] > ExecStart = /opt/script0.sh > EOF maanya-goenka@debian:~/systemd (img-support)$ mksquashfs img/ run.raw Parallel mksquashfs: Using 4 processors Creating 4.0 filesystem on run.raw, block size 131072. [==============================================================================================================================|] 6/6 100% Exportable Squashfs 4.0 filesystem, gzip compressed, data block size 131072 compressed data, compressed metadata, compressed fragments, compressed xattrs duplicates are removed Filesystem size 0.60 Kbytes (0.00 Mbytes) 52.32% of uncompressed filesystem size (1.14 Kbytes) Inode table size 166 bytes (0.16 Kbytes) 43.01% of uncompressed inode table size (386 bytes) Directory table size 153 bytes (0.15 Kbytes) 58.40% of uncompressed directory table size (262 bytes) Number of duplicate files found 1 Number of inodes 12 Number of files 6 Number of fragments 1 Number of symbolic links 0 Number of device nodes 0 Number of fifo nodes 0 Number of socket nodes 0 Number of directories 6 Number of ids (unique uids + gids) 1 Number of uids 1 maanya-goenka (1000) Number of gids 1 maanya-goenka (1000) maanya-goenka@debian:~/systemd (img-support)$ sudo build/systemd-analyze verify --image=run.raw testrun.service /tmp/.#systemd-analyzec71c7297a936b91c/usr/lib/systemd/system/testrun.service:2: Unknown key name 'foo' in section 'Unit', ignoring. testrun.service: Failed to create testrun.service/start: Unit sysinit.target not found. The 'Unit sysinit.target not found' error that we see here is due to recursive dependency searching during unit loading and has been addressed in a different PR: systemd-analyze: add option to return an error value when unit verification fails #20233
2021-06-30 17:02:51 +00:00
'--image=[Add support for discrete images]:PATH' \
systemd-analyze: option to exit with an error when 'verify' fails The commit introduces a callback invoked from log_syntax_internal. Use it from systemd-analyze to gather a list of units that contain syntax warnings. A new command line option is added to make use of this. The new option --recursive-errors takes in three possible modes: 1. yes - which is the default. systemd-analyze exits with an error when syntax warnings arise during verification of the specified units or any of their dependencies. 3. no - systemd-analyze exits with an error when syntax warnings arise during verification of only the selected unit. Analyzing and loading any dependencies will be skipped. 4. one - systemd-analyze exits with an error when syntax warnings arise during verification of only the selected units and their direct dependencies. Below are two service unit files that I created for the purposes of testing: 1. First, we run the commands on a unit that does not have dependencies but has a non-existing key-value setting (i.e. foo = bar). > cat <<EOF>testcase.service [Unit] foo = bar [Service] ExecStart = echo hello EOF OUTPUT: maanya-goenka@debian:~/systemd (log-error)$ sudo build/systemd-analyze verify testcase.service /home/maanya-goenka/systemd/testcase.service:2: Unknown key name 'foo' in section 'Unit', ignoring. /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. maanya-goenka@debian:~/systemd (log-error)$ echo $? 1 maanya-goenka@debian:~/systemd (log-error)$ sudo build/systemd-analyze verify --recursive-errors=yes testcase.service /home/maanya-goenka/systemd/testcase.service:2: Unknown key name 'foo' in section 'Unit', ignoring. /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. maanya-goenka@debian:~/systemd (log-error)$ echo $? 1 maanya-goenka@debian:~/systemd (log-error)$ sudo build/systemd-analyze verify --recursive-errors=no testcase.service /home/maanya-goenka/systemd/testcase.service:2: Unknown key name 'foo' in section 'Unit', ignoring. maanya-goenka@debian:~/systemd (log-error)$ echo $? 1 maanya-goenka@debian:~/systemd (log-error)$ sudo build/systemd-analyze verify --recursive-errors=one testcase.service /home/maanya-goenka/systemd/testcase.service:2: Unknown key name 'foo' in section 'Unit', ignoring. /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. maanya-goenka@debian:~/systemd (log-error)$ echo $? 1 2. Next, we run the commands on a unit that is syntactically valid but has a non-existing dependency (i.e. foo2.service) > cat <<EOF>foobar.service [Unit] Requires = foo2.service [Service] ExecStart = echo hello EOF OUTPUT: maanya-goenka@debian:~/systemd (log-error)$ sudo build/systemd-analyze verify foobar.service /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. foobar.service: Failed to create foobar.service/start: Unit foo2.service not found. maanya-goenka@debian:~/systemd (log-error)$ echo $? 1 maanya-goenka@debian:~/systemd (log-error)$ sudo build/systemd-analyze verify --recursive-errors=yes foobar.service /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. foobar.service: Failed to create foobar.service/start: Unit foo2.service not found. maanya-goenka@debian:~/systemd (log-error)$ echo $? 1 maanya-goenka@debian:~/systemd (log-error)$ sudo build/systemd-analyze verify --recursive-errors=no foobar.service maanya-goenka@debian:~/systemd (log-error)$ echo $? 0 maanya-goenka@debian:~/systemd (log-error)$ sudo build/systemd-analyze verify --recursive-errors=one foobar.service /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. foobar.service: Failed to create foobar.service/start: Unit foo2.service not found. maanya-goenka@debian:~/systemd (log-error)$ echo $? 1
2021-07-26 20:02:17 +00:00
'--recursive-errors=[When verifying a unit, control dependency verification]:MODE' \
'--offline=[Perform a security review of the specified unit files]:BOOL:(yes no)' \
systemd-analyze: add new 'security' option to compare unit's overall exposure level with --threshold option added to work with security verb and with the --offline option so that users can determine what qualifies as a security threat. The threshold set by the user is compared with the overall exposure level assigned to a unit file and if the exposure is higher than the threshold, 'security' will return a non-zero exit status. The default value of the --threshold option is 100. Example Run: 1. testcase.service is a unit file created for testing the --threshold option maanya-goenka@debian:~/systemd (systemd-security)$ cat<<EOF>testcase.service > [Service] > ExecStart = echo hello > EOF For the purposes of this demo, the security table outputted below has been cut to show only the first two security settings. maanya-goenka@debian:~/systemd (systemd-security)$ sudo build/systemd-analyze security --offline=true testcase.service /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. NAME DESCRIPTION EXPOSURE ✗ PrivateNetwork= Service has access to the host's network 0.5 ✗ User=/DynamicUser= Service runs as root user 0.4 → Overall exposure level for testcase.service: 9.6 UNSAFE 😨 maanya-goenka@debian:~/systemd (systemd-security)$ echo $? 0 2. Next, we use the same testcase.service file but add an additional --threshold=60 parameter. We would expect 'security' to exit with a non-zero status because the overall exposure level (= 96) is higher than the set threshold (= 60). maanya-goenka@debian:~/systemd (systemd-security)$ sudo build/systemd-analyze security --offline=true --threshold=60 testcase.service /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. NAME DESCRIPTION EXPOSURE ✗ PrivateNetwork= Service has access to the host's network 0.5 ✗ User=/DynamicUser= Service runs as root user 0.4 → Overall exposure level for testcase.service: 9.6 UNSAFE 😨 maanya-goenka@debian:~/systemd (systemd-security)$ echo $? 1
2021-08-17 17:40:15 +00:00
'--threshold=[Set a value to compare the overall security exposure level with]: NUMBER' \
'--security-policy=[Use customized requirements to compare unit files against]: PATH' \
"--json=[Generate a JSON output of the security analysis table or plot's raw time data]:MODE:(pretty short off)" \
"--table=[Generate a table of plot's raw time data]" \
'--profile=[Include the specified profile in the security review of units]: PATH' \
'--no-pager[Do not pipe output into a pager]' \
"--no-legend[Do not show the headers and footers for plot's raw time data formats]" \
'--man=[Do (not) check for existence of man pages]:BOOL:(yes no)' \
'--generators=[Do (not) run unit generators]:BOOL:(yes no)' \
'--order[When generating graph for dot, show only order]' \
'--require[When generating graph for dot, show only requirement]' \
'--fuzz=[When printing the tree of the critical chain, print also services, which finished TIMESPAN earlier, than the latest in the branch]:TIMESPAN' \
'--from-pattern=[When generating a dependency graph, filter only origins]:GLOB' \
'--to-pattern=[When generating a dependency graph, filter only destinations]:GLOB' \
improve zsh completion (#32098) * fix error * remove options that are no longer supported * add missing options * stop completion if an option `--help` or `--version` is supplied [[[ zjs: a note for the reader: zshcompsys(1) in the section about optspecs in _arguments says: > Each of the forms above may be preceded by a list in parentheses of option names and argument num‐ > bers. If the given option is on the command line, the options and arguments indicated in parentheses > will not be offered. For example, ‘(-two -three 1)-one:...' completes the option ‘-one'; if this ap‐ > pears on the command line, the options -two and -three and the first ordinary argument will not be > completed after it. ‘(-foo):...' specifies an ordinary argument completion; -foo will not be com‐ > pleted if that argument is already present. > > Other items may appear in the list of excluded options to indicate various other items that should > not be applied when the current specification is matched: a single star (\*) for the rest arguments > (i.e. a specification of the form ‘\*:...'); a colon (:) for all normal (non-option-) arguments; and a > hyphen (-) for all options. For example, if ‘(\*)' appears before an option and the option appears on > the command line, the list of remaining arguments (those shown in the above table beginning with > ‘\*:') will not be completed. The intended effect of the change is to remove irrelevant completion matches from the completion. tl;dr: (- : ) prevents further completion ]]]
2024-04-15 08:58:48 +00:00
'(-H --host)'{-H+,--host=}'[Operate on remote host]:userathost:_sd_hosts_or_user_at_host' \
'(-M --machine)'{-M+,--machine=}'[Operate on local container]:machine:_sd_machines' \
'--quiet[Do not show hints]' \
'*::systemd-analyze commands:_systemd-analyze_commands'