systemd is compiled with relative source file paths so we need to
issue a directory command to make sure gdb can find systemd's
source files. Let's put this in a .gdbinit file so it's executed
automatically when we run gdb.
Actually, systemd takes the minimum of
* a) the maximum tasks value the kernel allows on this architecture
* b) the cgroups pids_max attribute for the system
* c) the kernel's configured maximum PID value
to calculate the DefaultTasksMax. Here, kernel.thread-max should also be methioned.
As documented at the top of the file we require the normal property if we have
the horizontal property, and we require the CLICK_ANGLE property if the
CLICK_COUNT property is present. Codify this into the hwdb parser so we can
pick up on it.
Follow-up for 4ea8b443de. The logic that manages DnsQueryCandidate is rather
complicated: a calls to dns_query_complete() that wants to destroy a
DnsQueryCandidate can be nested inside a deep chain of calls. Using reference
counts seems like the simplest approach.
DnsSearchDomain already uses reference counting.
This patch effectively brings dns_query_candidate_go() to the state before
4ea8b443de, but wraps the iteration over DnsQueryCandidate.transactions in
dns_query_candidate_ref+dns_query_candidate_unref.
Follow-up for 133b34f69a where this was
forgotten.
While we are at it, bring the parameters into the same order as we
declare them in the PullRaw/PullTar objects, i.e. match them to the
canonical order.
Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC`
mount flag for the file system tree. This can be used to implement file system
W^X policies, and for example with allow-listing mode (NoExecPaths=/) a
compromised service would not be able to execute a shell, if that was not
explicitly allowed.
Example:
[Service]
NoExecPaths=/
ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib
Closes: #17942.
Let's enable the Packit integration and see if it's a viable option for
us. This configuration builds systemd on Fedora (on x86_64, i386, and
aarch64) and runs the unit test suite. To do that, it uses the specfile
from Fedora Rawhide[0] with some minor modifications, thus dropping the
need to have a specfile in the upstream repository.
So far the builds took around 25 minutes each, so speed-wise it's pretty
good. The two remaining supported architectures (s390x and armhfp) are
excluded, for now, since they're emulated and build there takes a really
long time (~4 hours).
[0] https://src.fedoraproject.org/rpms/systemd/
The target is update-syscall-tables, so let's call the script
update-syscall-tables.sh to reduce the cognitive overhead when
trying to find the right file.
Upstream uses .text, but this is rather unusual. Let's use .txt as the usual
suffix for text files. This tells various editors and such that the file should
be treated as plain text. I also want to a script to summarize license status,
and having an easy-to-recognize suffix makes this easier.
We don't include a license header in .conf and similar files,
but we should include a header that tells the user that this is
our file and points to some docs.
Even though many of those scripts are very simple, it is easier to include
the header than to try to say whether each of those files is trivial enough
not to require one.
If the file was always generated on the fly, the header would be pointless.
But since we distribute it, it should be there. C.f.
a0e150b2f4.
This was forgotten in 35b42e5600.
Meson itself requires Python 3.6, which has f-strings. So I think it's fine to
use them here too. I wanted to use walrus for 'if m:= re.search(...)', but that'd
require 3.8.
We reject all openat2() calls because it is currently not possible to
inspect its flags parameter via seccomp.
Fallback code is more likely to look for ENOSYS than EPERM.
The script is renamed to match.
Now all targets are named uniformly in a tab-completion-friendly fashion, with
the exception of systemd-update-po which is generated by the i18n module
automatically:
$ ninja -C build -t targets | grep update
systemd-update-po: phony
update-syscall-tables: phony
update-syscall-header: phony
update-hwdb: phony
update-hwdb-autosuspend: phony
update-dbus-docs: CUSTOM_COMMAND
update-man-rules: CUSTOM_COMMAND
Very old versions of meson did not include the subdirectory name in the
target name, so we started adding various "top-level" custom targets in
subdirectories. This was nice because the main meson.build file wasn't
as cluttered. But then meson started including the subdir name in the
target name. So let's move the definition to the root so we can have all
targets named uniformly.
