Commit graph

8368 commits

Author SHA1 Message Date
Sam Leonard 7fe9c9909d
vmspawn: document --directory and --private-users 2024-02-12 09:46:01 +00:00
Mike Yuan 189a08e83d
core/service: allow RestartForceExitStatus= for oneshot services
I think this was just overlooked in #13754, which removed
the restriction of Restart= on Type=oneshot services.
There's no reason to prevent RestartForceExitStatus=
now that Restart= has been allowed.

Closes #31148
2024-02-10 21:19:36 +08:00
Mike Yuan a5d9df35ac
man/systemd.service: document that Restart=always/on-success are refused
by oneshot services
2024-02-10 21:19:35 +08:00
Daan De Meyer 1a0541d44c repart: Add --generate-fstab= and --generate-crypttab= options
These can be used along with two new settings MountPoint= and
EncryptedVolume= to write fstab and crypttab entries to the given
paths respectively in the root directory that repart is operating on.

This is useful to cover scenarios that aren't covered by the
Discoverable Partitions Spec. For example when one wants to mount
/home as a separate btrfs subvolume. Because multiple btrfs subvolumes
can be mounted from the same partition, we allow specifying MountPoint=
multiple times to add multiple entries for the same partition.
2024-02-10 13:07:02 +01:00
Luca Boccassi 769ca9ab55
Merge pull request #31261 from bluca/repart_engine
repart: support engines and providers
2024-02-09 21:28:59 +00:00
Luca Boccassi 0a8264080a repart: support OpenSSL engines/providers for signing
The provider API which is new requires providers, which are not
widely available and don't work very well yet, so also use a
fallback with the legacy engine API.
2024-02-09 15:11:25 +00:00
Sam Leonard 51747b3444
vmspawn: accept kvm/vhost-vsock device fds through sd_listen 2024-02-09 12:46:44 +00:00
Sam Leonard 75331bedeb
vmspawn: add nic configuration 2024-02-09 12:46:43 +00:00
Sam Leonard 88af28d170
vmspawn: add initrd configuration option 2024-02-09 12:46:43 +00:00
Sam Leonard 0f25e3e443
vmspawn: add kernel configuration options 2024-02-09 11:43:19 +00:00
Sam Leonard cf3beb273b
vmspawn: add swtpm feature 2024-02-09 11:43:18 +00:00
Daan De Meyer 7bf52f5d1c Add systemd.default_debug_tty=
Let's allow configuring the debug tty independently of enabling/disabling
the debug shell. This allows mkosi to configure the correct tty while
leaving enabling/disabling the debug tty to the user.
2024-02-09 11:47:53 +01:00
Yu Watanabe 6a32108812 man: add missing "=" after setting name
Follow-up for b93bf1bf9f.
2024-02-09 19:03:56 +09:00
Yu Watanabe d2eb27eb7b man: fix typo
Follow-up for 631cf7f004.
2024-02-09 17:49:48 +09:00
Luca Boccassi 82047a6aa7 portable: add --copy=mixed to copy images and link profiles
This new mode copies resources provided by the client, so that they
remain available for inspect/detach even if the original images are
deleted, but symlinks the profile as that is owned by the OS, so that
updates are automatically applied.
2024-02-08 21:11:26 +00:00
Zbigniew Jędrzejewski-Szmek eb47031694 man: mention that preset-all is performed during early boot
The intro of systemd-firstboot is rewritten to make it clearer how it fits into
the big picture. Systemd does some machine-id and presets and
systemd-firstboot.service is used to interactively fill in the blanks.

Closes #22225.
2024-02-08 20:36:44 +01:00
Lennart Poettering 9d99f1686a
Merge pull request #30766 from polarina/cryptenroll-tpm2-unlock
cryptenroll: Add support for unlocking through TPM2 enrollments
2024-02-08 17:41:03 +01:00
Sam Leonard a759d3239d vmspawn: fix incorrect mention of container 2024-02-08 16:04:42 +01:00
Yu Watanabe 7dc431839e network/dhcp4: disable IPv6OnlyMode= by default
As explained in #30891, IPv6OnlyMode= should be enabled with 464XLAT
support, but we do not support it yet. Let's disable by default.

Fixes #30891.
2024-02-07 23:30:17 +00:00
Yu Watanabe 3092bd7aa1
Merge pull request #31176 from yuwata/network-required-for-online
network: adjust default value of RequiredForOnline=
2024-02-08 05:26:12 +09:00
Ivan Shapovalov 00fcd79e65 nspawn: permit --ephemeral with --link-journal=try-* (treat as =no)
Common sense says that to "try" something means "to not fail if
something turns out not to be possible", thus do not make this
combination a hard error.

The actual implementation ignores any --link-journal= setting when
--ephemeral is in effect, so the semantics are upheld.
2024-02-03 03:03:41 +09:00
Vladimir Stoiakin 85686b37b0 cryptenroll: allow to use a public key on a token
This patch allows systemd-cryptenroll to enroll directly with a public key if a certificate is missing on a token.

Fixes: #30675
2024-02-03 03:00:51 +09:00
Antonio Alvarez Feijoo e104d77da2 man/systemd-bsod: fix command path 2024-02-03 02:59:44 +09:00
Yu Watanabe a853cc99e6 network: adjust default RequiredForOnline= and RequiredFamilyForOnline= setting
E.g. a bonding port does not support addressing, hence the default
should be 'enslaved'.

Follow-up for 3255bda698.

Closes #27724.
2024-02-02 15:38:30 +09:00
Yu Watanabe c89efaf9e5 man: fix default behavior of RequiredFamilyForOnline= 2024-02-02 15:38:30 +09:00
Yu Watanabe 04a755466b man/creds: fix typo
Follow-up for 7704c3474d.
2024-02-02 09:25:57 +09:00
Yu Watanabe 49d6e3c8a8 man: fix typo
Follow-up for 34bbda18a5.
2024-02-02 09:24:25 +09:00
Gabríel Arthúr Pétursson 631cf7f004 cryptenroll: Add support for unlocking through TPM2 enrollments 2024-02-01 12:37:12 +00:00
Lennart Poettering 3557f1a62a resolvectl: add JSON output support for "resolvectl query"
It's easy to add. Let's do so.

This only covers record lookups, i.e. with the --type= switch.

The higher level lookups are not covered, I opted instead to print a
message there to use --type= instead.

I am a bit reluctant to defining a new JSON format for the high-level
lookups, hence I figured for now a helpful error is good enough, that
points people to the right use.

Fixes: #29755
2024-01-31 16:13:16 +01:00
Franck Bui 887b2529eb man: always install bootctl
Since dedb925eaf /usr/bin/bootctl is always built
so does its man page.
2024-01-31 10:32:46 +00:00
Adrian Vovk 691b99160d homed: Add InhibitSuspend() method
This returns an FD that can be used to temporarily inhibit the automatic
locking on system suspend behavior of homed. As long as the FD is open,
LockAllHomes() won't lock that home directory on suspend. This allows
desktop environments to implement custom more complicated behavior
2024-01-31 09:48:23 +01:00
Lennart Poettering b45f47aaad
Merge pull request #30968 from poettering/per-user-creds
per-user encrypted credentials
2024-01-31 09:47:12 +01:00
Franck Bui d537bf72ae meson: fix installation of html doc aliases
Apparently since 9289e093ae, "ln_s" takes
*absolute* paths only.
2024-01-30 17:56:48 +00:00
Lennart Poettering f65d44d1f6
Merge pull request #31124 from keszybz/various-small-tweaks
Various small tweaks
2024-01-30 17:08:21 +01:00
Lennart Poettering 7704c3474d man: document new user-scoped credentials 2024-01-30 17:07:47 +01:00
Zbigniew Jędrzejewski-Szmek 8835a6ff0c man/networkd.conf: remove strange comment
Does anyone even read those pages‽
2024-01-30 11:27:31 +01:00
Mike Yuan 5d4cf5a87d
man/systemd-notify: don't say "the latter" if more than 2 options 2024-01-30 03:27:36 +08:00
Lennart Poettering a667107594 man: document the new APIs 2024-01-29 14:43:05 +01:00
Luca Boccassi 34bbda18a5 man: add working example for sd_bus_set_watch_bind()
This example is able to deal with D-Bus going away and reappearing,
like on soft-reboot, so link it in both manpages.
2024-01-26 14:41:20 +00:00
Lennart Poettering b68f4cade4 dissect: add --make-archive option to convert DDI to tarball 2024-01-25 18:47:39 +01:00
Daan De Meyer 6811774510 man: Document ranges for distributions config files and local config files
Let's recommend that config files and drop-ins in /usr use the range
0-49 and config files in /etc and /run use the range 50-99 so that
files in /run and /etc will generally always override files from
/usr.
2024-01-25 18:46:24 +01:00
Andrew Sayers cd752b2590 Make RestartPreventExitStatus= documentation resemble SuccessExitStatus=
The documentation for `RestartPreventExitStatus=` differs from that for `SuccessExitStatus=` in ways that are sometimes confusing (e.g. using `numeric exit codes` instead of `numeric termination statuses`), and other times plain incorrect (e.g. not mentioning `termination status names`, which I've just confirmed to work in systemd 255).

This patch modifies the documentation to be as similar as possible, so as to reduce the reader's cognitive load.
2024-01-24 18:00:53 +01:00
Daan De Meyer 98118c44ae Remove a few references to dracut
Let's remove some explicit references to dracut as we prefer initrds
built with mkosi these days.
2024-01-24 17:54:38 +01:00
Lennart Poettering ed4498a193
Merge pull request #31067 from RA-Kooi/xen-uuid
machine-id-setup: Generate stable machine IDs on Xen virtual machines.
2024-01-24 09:35:30 +01:00
Rafaël Kooi 9fe1f1ca95 man: Describe how machine ID is initialized on Xen 2024-01-24 02:19:00 +01:00
Ivan Shapovalov a97476c8ac hostname-setup: read hostname from system.hostname credential
`system.hostname` credential is treated similarly to the pre-existing
`system.machine_id` credential. It is considered after /etc/hostname,
but prior to the kernel defaults or os-release defaults.

Fixes #30667.

Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
2024-01-23 22:03:06 +00:00
Luca Boccassi f70daee8f2
Merge pull request #30130 from poettering/pcrlock-root
pcrlock: add support for unlocking a root fs with a pcrlock file
2024-01-23 21:41:02 +00:00
Lennart Poettering 3d8ba7b83f nspawn: optionally tint the background color of a container 2024-01-23 16:45:37 +01:00
Frantisek Sumsal 43b238f1c1 man: suffix signals with ()
Since signals can take arguments, let's suffix them with () as we
already do with functions. To make sure we remain consistent, make the
`update-dbus-docs.py` script check & fix any occurrences where this is
not the case.

Resolves: #31002
2024-01-23 16:27:50 +01:00
Lennart Poettering 3bda8bc58c
Merge pull request #31057 from aafeijoo-suse/bootctl-print-fix
bootctl: return earlier with `--print-esp-path`
2024-01-23 14:26:25 +01:00