Commit graph

26105 commits

Author SHA1 Message Date
Topi Miettinen 40652ca479 units: enable MemoryDenyWriteExecute (#3459)
Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute.

Closes: #3459
2016-06-08 14:23:37 +02:00
Lennart Poettering b9c59555b1 sysv-generator: remove more dead code (#3462)
The changes in 788d2b088b weren't complete, only
half the code that dealt with K links was removed. This is a follow-up patch
that removes the rest too.

No functional changes.
2016-06-08 10:18:56 +02:00
Evgeny Vereshchagin ea683512f9 hwdb: selinuxify a bit (#3460)
-bash-4.3# rm /etc/udev/hwdb.bin
-bash-4.3# systemd-hwdb update
-bash-4.3# ls -Z /etc/udev/hwdb.bin
system_u:object_r:systemd_hwdb_etc_t:s0 /etc/udev/hwdb.bin

Fixes: #3458
2016-06-07 19:47:41 +02:00
Lennart Poettering a849538e3b Merge pull request #3394 from poettering/triple-tstamp
timestamping improvements and IPv6 RA revamp
2016-06-07 11:13:39 +02:00
David Herrmann 82e4eda664 sd-netlink: fix deep recursion in message destruction (#3455)
On larger systems we might very well see messages with thousands of parts.
When we free them, we must avoid recursing into each part, otherwise we
very likely get stack overflows.

Fix sd_netlink_message_unref() to use an iterative approach rather than
recursion (also avoid tail-recursion in case it is not optimized by the
compiler).
2016-06-07 10:38:33 +02:00
Lennart Poettering 138f4c6906 fstab-generator: don't process root= if it happens to be "gpt-auto" (#3452)
As that's handled by "gpt-auto-generator".

Fixes: #3404
2016-06-07 10:23:20 +02:00
Benjamin Drung 646b997c11 os-release: Add VERSION_CODENAME field (#3445)
Debian and their derivatives (Ubuntu, Trisquel, etc.) use a code name
for their repositories. Thus record the code name in os-release for
processing.

Closes systemd/systemd#3429
2016-06-06 22:05:29 +02:00
Lennart Poettering bdc49d4491 cgtop: minimize aux variable scope 2016-06-06 22:04:33 +02:00
Lennart Poettering cf6f7f66a4 core: add minor comment
Let's explain #3444 briefly in the sources, too.
2016-06-06 22:03:31 +02:00
michaelolbrich 53203e5f8f mount: make sure got into MOUNT_DEAD state after a successful umount (#3444)
Without this code the following can happen:
1. Open a file to keep a mount busy
2. Try to stop the corresponding mount unit with systemctl
   -> umount fails and the failure is remembered in mount->result
3. Close the file and umount the filesystem manually
   -> mount_dispatch_io() calls "mount_enter_dead(mount, MOUNT_SUCCESS)"
   -> Old error in mount->result is reused and the mount unit enters a
      failed state

Clear the old error result when 'mountinfo' reports a successful umount to
fix this.
2016-06-06 21:59:51 +02:00
Lennart Poettering 1e7a0e21c9 network: beef up ipv6 RA support considerably
This reworks sd-ndisc and networkd substantially to support IPv6 RA much more
comprehensively. Since the API is extended quite a bit networkd has been ported
over too, and the patch is not as straight-forward as one could wish. The
rework includes:

- Support for DNSSL, RDNSS and RA routing options in sd-ndisc and networkd. Two
  new configuration options have been added to networkd to make this
  configurable.

- sd-ndisc now exposes an sd_ndisc_router object that encapsulates a full RA
  message, and has direct, friendly acessor functions for the singleton RA
  properties, as well as an iterative interface to iterate through known and
  unsupported options. The router object may either be retrieved from the wire,
  or generated from raw data. In many ways the sd-ndisc API now matches the
  sd-lldp API, except that no implicit database of seen data is kept. (Note
  that sd-ndisc actually had a half-written, but unused implementaiton of such
  a store, which is removed now.)

- sd-ndisc will now collect the reception timestamps of RA, which is useful to
  make sd_ndisc_router fully descriptive of what it covers.

Fixes: #1079
2016-06-06 20:11:38 +02:00
Lennart Poettering 1f152e4b41 network: use inet_ntop() rather than SD_NDISC_ADDRESS_FORMAT_VAL() when serializing
Let's use the usual libc API for serializing IPv6 addresses, instead of the
NDISC-specific macro we should get rid of anyway.
2016-06-06 19:59:09 +02:00
Lennart Poettering 34380032fb util: make it easier to check whether in_addr or in6_addr addresses are NULL 2016-06-06 19:59:09 +02:00
Lennart Poettering c917a32122 util-lib: add accessors for unaligned native endian words 2016-06-06 19:59:09 +02:00
Lennart Poettering c9d81ae858 exit-status: update comments a bit 2016-06-06 19:59:08 +02:00
Lennart Poettering f848976364 lldp: include sys/types.h in sd-lldp.h
After all, we use clockid_t which is defined there.
2016-06-06 19:59:08 +02:00
Lennart Poettering a1fb61b0e8 lldp: minor coding style improvement 2016-06-06 19:59:08 +02:00
Lennart Poettering 3db2ec568c lldp: add sd_lldp_get_event() call
sd-ndisc has something like this, let's add this for sd-lldp, too.
2016-06-06 19:59:08 +02:00
Lennart Poettering f3315c5860 lldp: deal properly with recv() returning EAGAIN/EINTR
It might very well return EAGAIN in case of packet checksum problems and
suchlike, hence let's better handle this nicely, the same way as we do it in
the other sd-network libraries for incoming datagrams.
2016-06-06 19:59:08 +02:00
Lennart Poettering 35ad2cd7ce lldp: pass correct neighbor object to REMOVED callback 2016-06-06 19:59:08 +02:00
Lennart Poettering f137029bb8 lldp: rename TLV accessor pseudo-macros
Let's make sure the inline functions for retrieving TLV data actually carry TLV
in the name, so that we don#t assume they retrieve the whole, raw packet data.
2016-06-06 19:59:08 +02:00
Lennart Poettering a85b46c33f lldp: make sd_lldp_neighbor_tlv_rewind() return whether there's a first entry
This way it's nicer to use as it matches how sd_lldp_neighbor_tlv_next()
indicates an EOF too via its return value.
2016-06-06 19:59:08 +02:00
Lennart Poettering a2966471d8 lldp: use NULL instead 0, when we deal with a pointer 2016-06-06 19:59:08 +02:00
Lennart Poettering 09155f682a lldp: add _public_ to a two exported functions missing it 2016-06-06 19:59:08 +02:00
Lennart Poettering 8a19206d1b lldp: clarify that sd_lldp_neighbor_get_ttl() returns seconds
Let's simply encode this in the parameter name.
2016-06-06 19:59:08 +02:00
Lennart Poettering fc6a313b5b lldp: add proper ref counting to sd_lldp object and a separate call for setting the ifindex
Let's make sd-lldp a bit more like sd-ndisc ant the other APIs, and add proper
ref counting and a separate call for setting the ifindex.

This also adds a new lldp_reset() call we can use at various places to close
all fds. This is also similar to how sd-ndisc already does it.
2016-06-06 19:59:07 +02:00
Lennart Poettering 5f94b4e62e exit-code: minor coding style updates 2016-06-06 19:59:07 +02:00
Lennart Poettering 16fed825d6 sd-lldp: take triple timestamp when reading LLDP packets
It's a good idea to store away the recption time of LLDP packets in the
neighbor object, simply because the LLDP data only has a validity of a certain
amount of time.

Hence, let's record the timestamp when we receive the datagram and expose an
API for it. Also, automatically expire LLDP neighbors based on this new
timestamp.
2016-06-06 19:59:07 +02:00
Lennart Poettering e475d10c1b sd-event: port over to new triple timestamp logic 2016-06-06 19:59:07 +02:00
Lennart Poettering fe624c4c07 time-util: add triple timestamp object
We already have a double timestamp object that we use whenever we need both a
MONOTONIC and a REALTIME timestamp taken and stored. With this change we
also add a triple timestamp object that in addition stores a BOOTTIME
timestamp, which is useful for a few usecases.

Note that we keep dual_timestamp around, as it is useful in many cases where
triple_timestamp is not, in particular because retrieving the monotonic and
realtime timestamps is much cheaper on Linux that getting the boottime
timestamp.
2016-06-06 19:59:07 +02:00
Christian Rebischke b2bb19bbda machinectl: Added stop as alias for poweroff (#3406) 2016-06-06 17:06:20 +02:00
Tobias Jungel 45819e7cbf networkd: remove unused variable (#3447)
this patch solves the following waring:

../src/network/networkd-ndisc.c:197:13: warning: unused variable ‘r’
[-Wunused-variable]
         int r;

fixes acac5b2f
2016-06-06 14:03:07 +02:00
Alessandro Puccetti 0738b927a1 cgtop: fix ret pointer usage (#3443) 2016-06-06 12:38:23 +02:00
Alessandro Puccetti 308253c5a2 cgtop: add option to show a single cgroup subtree (#3413)
When many services are running, it was difficult to see only the interesting ones.
This patch allows to show only the subtree of interest.
2016-06-05 13:42:37 -04:00
michaelolbrich 0a62f81045 automount: handle expire_tokens when the mount unit changes its state (#3434)
This basically reverts 7b2fd9d512 ("core:
remove duplicate code in automount_update_mount()").

This was not duplicate code. The expire_tokens need to be handled as well:
Send 0 == success for MOUNT_DEAD (umount successful), do nothing for
MOUNT_UNMOUNTING (not yet done) and an error for everything else.

Otherwise the automount logic will assume unmounting is not done and will
not send any new requests for mounting. As a result, the corresponding
mount unit is never mounted.

Without this, automounts with TimeoutIdleSec= are broken. Once the idle
timeout triggered a umount, any access to the corresponding filesystem
hangs forever.

Fixes #3332.
2016-06-05 11:25:14 -04:00
Evgeny Vereshchagin 592705f2f7 systemctl: install sigbus handler (#3435)
This makes systemctl robust regarding journal truncation.
This is a follow-up for 2cf4172a71

Fixes:
Core was generated by `./systemctl status systemd-journald'.
Program terminated with signal SIGBUS, Bus error.
PID 8569 - core
TID 8569:
 #0  0x00007f246cc89ed6 __memcmp_sse4_1
 #1  0x0000557ebbc6f42c journal_file_init_header
 #2  0x0000557ebbc77262 journal_file_open
 #3  0x0000557ebbc42999 file_type_wanted
 #4  0x0000557ebbc42e08 add_any_file
 #5  0x0000557ebbc43832 add_directory
 #6  0x0000557ebbc4401c add_root_directory
 #7  0x0000557ebbc442e9 add_root_directory
 #8  0x0000557ebbc446fc add_search_paths
 #9  0x0000557ebbbacb5e show_journal_by_unit
 #10 0x0000557ebbb8376d print_status_info
 #11 0x0000557ebbb86a0b show_one
 #12 0x0000557ebbb87954 show
 #13 0x0000557ebbc20b1f dispatch_verb
 #14 0x0000557ebbb90615 systemctl_main
 #15 0x0000557ebbb9159f main
 #16 0x00007f246cb3e731 __libc_start_main
 #17 0x0000557ebbb75ae9 _start
2016-06-04 19:24:20 -04:00
Zbigniew Jędrzejewski-Szmek 20f8477be5 Merge pull request #3392 from poettering/assorted-stuff
Assorted stuff
2016-06-04 18:47:56 -04:00
tomty89 3fb1ac5d57 networkd-link: fix handler typo for route_remove() (#3433)
Obviously we've been using the wrong handler here. Fixes #3352.
2016-06-04 12:31:07 +02:00
Topi Miettinen f3e4363593 core: Restrict mmap and mprotect with PAGE_WRITE|PAGE_EXEC (#3319) (#3379)
New exec boolean MemoryDenyWriteExecute, when set, installs
a seccomp filter to reject mmap(2) with PAGE_WRITE|PAGE_EXEC
and mprotect(2) with PAGE_EXEC.
2016-06-03 17:58:18 +02:00
Lennart Poettering de4503c8d9 Merge pull request #3409 from tomty89/update-2
networkd-dhcp6: DHCPv6 starting fixes
2016-06-03 17:57:04 +02:00
Lennart Poettering 18b9beb199 Merge pull request #3418 from htejun/cgroup2-log-compat
core: log cgroup legacy and unified hierarchy setting translations
2016-06-03 17:49:50 +02:00
Tejun Heo e57c9ce169 core: always use "infinity" for no upper limit instead of "max" (#3417)
Recently added cgroup unified hierarchy support uses "max" in configurations
for no upper limit.  While consistent with what the kernel uses for no upper
limit, it is inconsistent with what systemd uses for other controllers such as
memory or pids.  There's no point in introducing another term.  Update cgroup
unified hierarchy support so that "infinity" is the only term that systemd
uses for no upper limit.
2016-06-03 17:49:05 +02:00
Tobias Jungel ac9b215d0c missing include added for build with -DDEBUG (#3424) 2016-06-03 12:33:12 +02:00
Evgeny Vereshchagin 856ca72b29 tests: introduce UNIFIED_CGROUP_HIERARCHY (#3419)
There are many cgroups-related changes (thanks, @htejun!)
This commit will simplify testing a bit.

Use:
make run UNIFIED_CGROUP_HIERARCHY=yes to enable cgroup-v2
make run UNIFIED_CGROUP_HIERARCHY=no to enable cgroup-v1
2016-06-03 11:17:00 +02:00
Martin Pitt d2bc125132 resolved: fix comments in resolve.conf for search domain overflows (#3422)
Write comments about "too many search domains" and "Total length of all search
domains is too long" just once. Also put it on a separate line, as
resolv.conf(5) only specifies comments in a line by themselves.

This is ugly to do if write_resolv_conf_search() gets called once for every
search domain. So change it to receive the complete OrderedSet instead and do
the iteration by itself.

Add test cases to networkd-test.py.

https://launchpad.net/bugs/1588229
2016-06-03 11:15:44 +02:00
Matthieu Codron 21fce63ecf hwdb: Add Thinkpad X1 carbon 4th gen to 70-pointingstick.hwdb (#3426)
Like many other recent thinkpads the factory default pointingstick
sensitivity on these devices is quite low, making the pointingstick
very slow in moving the cursor.

This extends the existing hwdb rules for tweaking the sensitivity to
also apply to the X1 carbon 4thgen model.
2016-06-03 09:41:14 +02:00
Tejun Heo 128fadc927 core: log cgroup legacy and unified hierarchy setting translations
To accommodate changes in kernel interface, cgroup unified hierarchy support
added several configuration items which overlap with the existing resource
control settings and there is simple config translation between the overlapping
settings to ease the transition.  As why certain cgroup knobs are being
configured can become confusing, this patch adds a master warning message which
is printed once when such translation is first used and logs each translation
with a debug message.

v2:

- Switched to log_unit*().
2016-06-02 13:02:53 -04:00
Tejun Heo f29ff1159c core: pass Unit into cgroup_context_apply() and use log_unit*()
cgroup_context_apply() and friends take CGroupContext and cgroup path as input
and has no way of getting back to the associated Unit and thus uses raw cgroup
path for logging.  This makes the log messages difficult to track down.
There's no reason to avoid passing in Unit into these functions.  Pass in Unit
and use log_unit*() instead.

While at it, make cgroup_context_apply(), which has no outside users, static.
Also, drop cgroup path from log messages where the path itself isn't too
interesting and can be easily obtained from the unit.
2016-06-02 13:02:49 -04:00
Tom Yan acac5b2f51 networkd-ndisc: do not start DHCPv6 when after NDISC timeout
For it's silly and unnecessary. Although it was apparently mandated by RFC 2462 in [5.5.2. Absence of Router Advertisements], that has been changed in the same section of RFC 4862, which obsoleted the former RFC.
2016-06-02 01:05:50 +08:00
Topi Miettinen 201c1cc22a core: add pre-defined syscall groups to SystemCallFilter= (#3053) (#3157)
Implement sets of system calls to help constructing system call
filters. A set starts with '@' to distinguish from a system call.

Closes: #3053, #3157
2016-06-01 11:56:01 +02:00