Commit graph

74061 commits

Author SHA1 Message Date
Franck Bui
de0f11d790 meson: don't put a symlink pointing to '20-systemd-ssh-proxy.conf' in /etc in all cases
On distros like SUSE where ssh config dropins in /usr are supported, there's no
need for a symlink in /etc/ssh/ssh_config.d/ that points to the dropin
installed somewhere in /usr (that is not reachable by ssh).
2024-05-27 17:20:26 +02:00
Daan De Meyer
d821a1103f
Merge pull request #33038 from DaanDeMeyer/mkosi
Various integration test improvents
2024-05-27 16:12:24 +02:00
Chris Hofstaedtler
815025d767 test: fix iscsi TEST-64-UDEV-STORAGE on Debian 2024-05-27 14:33:32 +02:00
Daan De Meyer
fedac4c279 test: Extend meson + mkosi integration test docs
Let's also put the meson + mkosi docs first to nudge readers towards
it instead of the old fashioned way to run the integration tests.
2024-05-27 13:59:26 +02:00
Daan De Meyer
65638f4855 Rewrite testsuite README in markdown
Let's use markdown here like we do for everything else as well.
2024-05-27 13:59:05 +02:00
Luca Boccassi
86b89c7309
Merge pull request #33028 from yuwata/blockdev-util
blockdev-util: also check loop/partscan sysattr
2024-05-27 12:44:38 +02:00
Daan De Meyer
2189b3268d meson: Add genkey target
Let's automatically generate keys instead of requiring developers to
do it manually.
2024-05-27 12:02:31 +02:00
Daan De Meyer
e2f9f3409a meson: Look up mkosi once 2024-05-27 12:02:31 +02:00
Luca Boccassi
cafe40ec82 executor: check for all permission related errnos when setting up IPC namespace
Denials from AppArmor are raised as EACCES, so EPERM is not enough. Do
the same check as PrivateNetwork above.

Fixes https://github.com/systemd/systemd/issues/31037

Related to 06384eb3c5
2024-05-27 10:58:15 +02:00
Luca Boccassi
e8b81df8b2 docs: add note about URL where to find recent Ubuntu CI logs 2024-05-27 09:50:50 +02:00
Daan De Meyer
09a2585686
Merge pull request #33013 from yuwata/journal-flush
journal: several fixlets for flushing runtime journal
2024-05-27 08:56:46 +02:00
Mike Yuan
8d4fa6531b man/run0: remove @ syntax for --machine=
For run0 (as opposed to systemd-run in general), connecting to
the system bus (of localhost or container) as a different user
than root and then trying to elevate privilege from that
makes little sense:
https://github.com/systemd/systemd/issues/32997#issuecomment-2127992973

The @ syntax is mostly useful when connecting to the user bus,
which is not a use case for run0. Hence, let's remove the example.
The syntax will be properly refused in #32999.
2024-05-27 09:40:47 +09:00
Mike Yuan
006c02b371 man/run0: remove -M alias for --machine=
run0 doesn't know about the former.
2024-05-27 09:40:47 +09:00
Yu Watanabe
c7cd75b0bf
Merge pull request #33016 from YHNdnzj/transient-working-dir
core: several cleanups/fixes for WorkingDirectory= handling
2024-05-27 09:40:26 +09:00
Yu Watanabe
bab8c851da blockdev-util: also check loop/partscan sysattr
With b9684a71fc (v5.19),
we cannot check partition scanning is enabled for a loopback block device
without checking the attribute.
2024-05-27 09:33:46 +09:00
Yu Watanabe
f0c2668c99 blockdev-util: also check newer value of GENHD_FL_NO_PART flag
With 430cc5d3ab,
the value of GENHD_FL_NO_PART, previously named as GENHD_FL_NO_PART_SCAN,
is changed from 0x0200 to 0x0004. So, we need to check both flags.
2024-05-27 09:33:09 +09:00
Mike Yuan
7fbb637ac9 run: also show a pretty string for main exit status, if any
This brings output on par with unit_log_process_exit().
2024-05-27 04:31:33 +09:00
Mike Yuan
100bed702b blockdev-util: "partscan" sysattr now directly shows the enabled state
See also: https://lore.kernel.org/r/20240502130033.1958492-3-hch@lst.de
2024-05-26 13:52:31 +02:00
Yu Watanabe
fbe1e72eff test: use SYSLOG_IDENTIFIER= filter instead of "journalctl -u"
"journalctl -u foo.service" may not work as expected, especially entries
for _TRANSPORT=stdout, for short-living services or when the service manager
generates debugging logs. Instead, SYSLOG_IDENTIFIER= should be reliable for
stdout. Let's use it.

An example case:
```
__CURSOR=s=06278e3bf011458e973c81d370a8f7a5;i=1e4dc;b=1b0258a5c78341609bf462c72d4541c3;m=308de65;t=6194c3895a13f;x=50c7e9af5b8cfc37
__REALTIME_TIMESTAMP=1716665017803071
__MONOTONIC_TIMESTAMP=50912869
_BOOT_ID=1b0258a5c78341609bf462c72d4541c3
SYSLOG_FACILITY=3
_UID=0
_GID=0
_MACHINE_ID=d3490e076ab24968bfa19a6aab26beb3
_HOSTNAME=H
_RUNTIME_SCOPE=system
_TRANSPORT=stdout
PRIORITY=6
_PID=2668
_STREAM_ID=3f9b8855636041988d003a9c63379b8a
SYSLOG_IDENTIFIER=echo
MESSAGE=foo
```
As you can see, there is no unit identifier.
2024-05-26 11:00:22 +02:00
Mike Yuan
52d8ba71b6
core: introduce unit_verify_contexts
Refuse WorkingDirectory=~ both in that and exec_invoke()
when dynamic user is used.
2024-05-26 13:41:43 +08:00
Mike Yuan
4dd884af1b
core/unit: don't set missing_ok if WorkingDirectory=~ is explicitly requested 2024-05-26 13:40:49 +08:00
Mike Yuan
3a14167102
core/exec-invoke: add a comment that acquire_home uses result from get_fixed_user
Prompted by https://github.com/systemd/systemd/pull/33016#discussion_r1614848067
2024-05-26 13:40:48 +08:00
Mike Yuan
c0afdec5cf
core/exec-invoke: drop unused param for acquire_home, prefix out param with ret_ 2024-05-26 13:40:48 +08:00
Mike Yuan
6f8ef80bb3
core/dbus-execute: don't trigger assertion if WorkingDirectory="" or "-"
Follow-up for 14631951ce

Before this commit, if WorkingDirectory= is empty or literally "-",
'simplified' is not populated, resulting in the ASSERT_PTR
in unit_write_settingf() below getting triggered.

Also, do not accept "-", so that the parser is consistent
with load-fragment.c

Fixes #33015
2024-05-26 13:40:48 +08:00
Mike Yuan
af87bdc6bc
core/dbus-execute: use correct char for representing WorkingDirectory=home 2024-05-26 13:40:48 +08:00
Mike Yuan
f28a7e87f1
core/load-fragment: also clear missing_ok when WorkingDirectory="" 2024-05-26 13:40:48 +08:00
Mike Yuan
bf7d672f5d
Merge pull request #33019 from yuwata/tpm2-unseal
tpm2: several fixlets
2024-05-26 09:27:31 +08:00
Yu Watanabe
41d45bd96c cryptenroll: upgrade log level of critical failure 2024-05-26 04:45:55 +09:00
Yu Watanabe
16f51e2909 cryptenroll: do not pass an empty pcrlock policy
Otherwise, tpm2_uneal() -> tpm2_build_sealing_policy() ->
tpm2_deserialize() will trigger assertion.

Prompted by #33017.
2024-05-26 04:42:19 +09:00
Yu Watanabe
caebda361e cryptsetup: use TPM2_FLAGS_USE_PCRLOCK at one more place
Follow-up for 404aea7815.
2024-05-26 04:29:18 +09:00
Yu Watanabe
485f5148b3 NEWS: mention backward incompatibility of IP forwarding
Closes #33004.
2024-05-25 21:01:17 +02:00
Yu Watanabe
7d93a340aa test: enable persistent storage for journal in TEST-82-SOFTREBOOT 2024-05-26 03:11:24 +09:00
Yu Watanabe
7ae27cefd7 unit: also stop systemd-journal-flush.service on soft-reboot
After soft-reboot, /var/log/journal may be initially read-only,
and becomes writable a bit later. In such case, runtime journal is
initially opened by journald. Hence, we need to flush to /var when it is
ready.
2024-05-26 03:11:24 +09:00
Yu Watanabe
3148edb254 journald: always unset flushed flag when the runtime journal is opened
If the runtime journal is opened, we will anyway write journal entries
to the runtime journal, even if the persistent journal is writable.
Hence, we need to flush the runtime journal file later.
2024-05-26 03:11:24 +09:00
Yu Watanabe
349fa06134 journald: log removal of runtime journal directories 2024-05-26 03:11:24 +09:00
Yu Watanabe
672a9ac7d0 journald: close runtime journal earlier
Then, we can use SD_JOURNAL_ASSUME_IMMUTABLE flag, and the performance
of reading runtime journal should be improved.
2024-05-26 03:11:14 +09:00
Yu Watanabe
1ef586af23 test: applying timezone is asynchronous
So, we need to try to read timezone several times.
Also, on failure, show journal of timedated instead of hostnamed,
as the timezone is handled by timedated.

Hopefully fixes #33007.
2024-05-25 11:27:19 +02:00
Luca Boccassi
af52b7d286
Merge pull request #33011 from yuwata/machine-id-setup-follow-ups
machine-id-setup: several follow-ups for #32915
2024-05-25 00:04:11 +02:00
Yu Watanabe
d2a11fd3ff machine-id-setup: update comment
If an initrd has an empty or uninitialized /etc/machine-id file,
then PID1 write a valid machine ID. So, the logic is important only on
soft-reboot. Let's mention that explicitly.

Follow-up for 16718dcf78.
2024-05-25 02:13:22 +09:00
Yu Watanabe
4c42df8166 man: update machine-id-setup(1)
- mention that /run/machine-id is used if exist.
- mention system.machine_id credential,
- credential, VM uuid, and container uuid are not read when --root=
  is specified or running in a chroot environment.
2024-05-25 02:13:00 +09:00
Yu Watanabe
9ab78ad109 machine-id-setup: use isempty() instead of empty_or_root()
This effectively reverts ba540e9f1c.

https://github.com/systemd/systemd/pull/32915#discussion_r1608258136
> In many cases we allow --root=/ as a mechanism for forcing an "offline" mode,
> while still operating on the root dir. if we do the getenv_for_pid() thing
> below I'd claim this is very much an "online" operation, and hence --root=/
> should really disable that.
2024-05-25 01:45:10 +09:00
Lennart Poettering
15875231c5 update TODO 2024-05-24 14:43:52 +02:00
Luca Boccassi
e67129e5e4
Merge pull request #32994 from keszybz/kernel-install-parsing
Improve parsing of kernel/install.conf
2024-05-24 11:25:26 +02:00
Luca Boccassi
5f5ee2eb07 man: mention that NFTSet is only available for system services 2024-05-24 11:21:04 +02:00
Lennart Poettering
c09f7e5a82
Merge pull request #32993 from poettering/cryptenroll-no-pcr
cryptenroll: make sure enrolling signed PCR policy without literal PCR policy works correctly
2024-05-23 15:58:30 -05:00
Mike Yuan
8045604c49
TODO: drop implemented entry 2024-05-24 01:39:17 +08:00
Michal Koutný
307abfc83a Revert "TEST-19-CGROUP: Skip on opensuse"
This reverts commit 60d064d3fd.

The logged test failure was because of missing memory controller in
testing cgroup. With the test fixed in previous commit, memory
attributes are delegated as expected.

Ref: #32439
2024-05-23 18:05:25 +02:00
Michal Koutný
8fd755ffe6 test: Ensure delegation test unit has memory controller
When the test used to be run on distro that doesn't enable memory
accounting by default (such as openSUSE TW), there is no guarantee that
testing unit has memory.* cgroup attributes and delegation test would
fail if they are missing.

Require memory controller explicitly inside the unit so that test can
work in any environment.
2024-05-23 18:05:25 +02:00
Zbigniew Jędrzejewski-Szmek
600a7405a9 shared/conf-parser: do not print "(null)" as section name
Before:
/etc/kernel/install.conf:6: Unknown key name 'asdf' in section '(null)', ignoring.
After:
/etc/kernel/install.conf:6: Unknown key 'asdf', ignoring.

Also make the message a bit better.
2024-05-23 16:15:24 +02:00
Zbigniew Jędrzejewski-Szmek
3f5196ffb8 kernel-install,bootctl: unify the config parsing procedure
Fixes https://github.com/systemd/systemd/issues/32992.
2024-05-23 16:15:24 +02:00