If dbus dies, it is then immediately reactivated by dbus.socket as soon
as a client reconnects. In that case pid1's own connection to the bus
drops and is reestablished by manager_recheck_dbus() (which comes from
the unit_notify() when dbus.services goes back to being running).
As part of bringing the bus back up, bus_setup_api() issues
GetNameOwner() for every name we watch on behalf of a BusName= unit.
For a Type=dbus service this is a problem. Consider this scenario:
1. spearmint.service is Type=dbus, owns com.example.Spearmint, and is
running.
2. The broker crashes and is re-activated through dbus.socket.
3. spearmint's client connection dropped too, so it is now reconnecting
to the new broker to grab its name again.
4. pid1 racily reconnects first given it is triggered the moment
dbus.service reaches SERVICE_RUNNING, whereas spearmint is an
ordinary client that must first notice its own disconnection and thus
when we do GetNameOwner() com.example.Spearmint is reported as having
no owner.
5. service_bus_name_owner_change() sets bus_name_good = false, and since
service_good() returns false for a Type=dbus service without its
name, service_enter_running() stops the (perfectly healthy, other
than dbus kicking the bucket temporarily) service.
In other words, a broker restart can tear down running Type=dbus
services that did nothing wrong, really.
So, to fix this, we can use the fact that a NameOwnerChanged signal is
definitive. That is, the name's owner changed while we were connected,
so a service that crashes or drops its name can still be stopped
immediately. By contrast a GetNameOwner() reply is less authoritative.
There is, importantly, no change to how losing the name on a live
connection works, we only give grace on reconnect.
For a Type=dbus service we sometimes want to keep treating it as running
while its bus name has briefly gone away (for example, due to a broker
restart).
SERVICE_RUNNING_REVALIDATING is active and keeps its main process like
SERVICE_RUNNING, but it's deliberately not part of the runtime timer
set, so RuntimeMaxSec= is paused while we sit in it.
Newly allocated new_res variable was left unreferenced if memory
allocation failed in ndisc_option_add_encrypted_dns_internal().
Co-authored-by: Siteshwar Vashisht <svashisht@redhat.com>
While keyring_describe() allocates a 64 byte buffer it still passes the
value of c as the buffer length. It's -1 on the first iteration. So
keyctl_describe_key() copies the whole description whenever buflen >=
its length. So any key whose description exceeding 64 bytes overflows.
Pass the actual buffer size.
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
[zjs: adjust comment]
We copy linux/magic.h from the kernel source tree and use it when
building systemd. Let's also make the kernel-filesystem-magics test
use the copy in our tree rather than the one installed on the system.
To achieve that now the 'check' command takes both 'cpp' and
'system_include_args' from meson.
Before this change, the code checked for presence of virtio-pci
devices to decide whether transport-agnostic virtio drivers needed
to be loaded early.
Do it also if virtio-ccw devices are present, that is, devices with
the control unit type (CU type) 0x3832, under /sys/devices/css0.
(This CU type value is documented in "Virtio Over Channel I/O" virtio
specification section.)
In other words, extend to virtio-ccw devices the fix previously
done for virtio-pci:
#40161: commit 356cc4a1c3#40503: commit 6d36e5fae6
Tested-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
PAM is a bit quirky: the main libpam calls are pam_authenticate(),
pam_open_session(), pam_acctmgmt(), pam_chauthtok(), pam_setcred() and
each have their own PAM "management group" in PAM configuration files
that configure the modules to call: "auth", "account", "session",
"password" – except for pam_setcred() which shares its grpup with
pam_authenticate() and uses "auth".
Both our PAM configuration files we ship by default are never used for
authentication (they just appear in PAMname= in a service to get a PAM
session set up, and PAMName= never calls pam_authenticate()). However,
they end up being used for pam_setcreds() (because some modules want to
use that the service manager calls it).
So far we used the pam_deny module for the "auth" management group for
these two PA; configurations (since
d6aed1dca8) but that's not ideal, since it
means we'll always cause pam_setcreds() to fail which will create debug
log noise (since the service manager debug logs pam_secreds() failures).
Let's switch to pam_rootok for this instead. This has the benefit that
pam_setcred() will always succeed for this, and pam_authenticate() only
if the caller is root anyway.
This is great, because it means our PAM configuration cannot be misused
for other purposes accidentally (authentication will fail, unless you
are already root), but won't result in any log noise (debug or
otherwise).
Follow-up for: d6aed1dca8Fixes: #39617
Current code does not hold a reference to object returned from
`tempfile.NamedTemporaryFile()`. This would cause the object to be
immediately garbage collected and the temporary file is deleted. A new
file is created with `linux.write_bytes()` which never gets cleaned up.
Keeping a reference to this object would automatically clean up the
temporary file when `make_uki()` function returns.
This reverts commit bc4a027f9c.
The match key names the chip, not the machine. `of:N<name>T<type>C<compatible>`
describes the sensor node, and the Pine64 PineNote carries the same silan
sc7a20 mounted in a different orientation, so it presents an identical
modalias:
$ cat /sys/bus/iio/devices/iio:device2/../modalias
of:NaccelerometerT(null)Csilan,sc7a20
On a device-tree machine there is no `/sys/class/dmi/id/modalias` to narrow it
with, so 60-sensor.rules looks up `sensor:modalias:of:...:` with the DMI half
empty and both boards land on the one entry. A second, PineNote-scoped entry
cannot be written: it would carry the same match string and simply shadow the
first.
The entry also overrides a correct value. The PineNote's device tree supplies
the matrix and the kernel publishes it:
$ cat /sys/bus/iio/devices/iio:device2/mount_matrix
-1, 0, 0; 0, 1, 0; 0, 0, 1
but udev then replaces it with the PineTab2's, and the four orientations
collapse into two, both landscape -- iio-sensor-proxy only ever reports
`normal` and `bottom-up`, so the display never selects portrait.
Where the kernel supplies a mount matrix, hwdb has nothing to add here; where
it does not, a local hwdb entry remains available. Tested on a PineNote v1.2,
kernel 6.12.11, systemd 257.
Closes#43321
The man page udevadm(8) have explicitly documented that the option -V is
a short form of --version. Let's not hide the short form in the help
message.
This introduces OPTION_COMMON_VERSION_WITH_V then use it in udevadm,
udevd, and run0.
Alos, this moves print_version() to build.c, and renames it to
version_only(). Now the function is also used in udevd amd test-libudev.
With this change, the -V option is hidden only in dmi_memory_id and
scsi_id. So, this removes the OPTION_COMMON_VERSION_WITH_HIDDEN_V macro
and explicitly list the hidden option in their code.
Also add a note that the function does not support multiple groups. I
think that's fair, it doesn't make sense to generalize the functionality
when we're unlikely to ever use that. (Verb options are only used by
udevadm right now.)
Let's treat unset SYSTEMD_INVOKED_AS and SYSTEMD_INVOKED_AS='' the same.
I encountered this when testing various --help outputs. It is often
more convenient to override a variable with VAR= instead of removing it,
in particular on the commandline. But we'd then print help with the
program name missing. We look at the variable in two places, so adjust
both as in $subject.
All programs print their help through the COMMAND machinery now:
- the VERB_COMMON_HELP() and VERB_COMMON_HELP_HIDDEN() macros which
wired the help verb to a hand-written help() implementation are
unused — everything uses the VERB_COMMON_HELP_AUTO*() family,
- the verbs help table is only built internally, so the function
becomes static, as the TODO promised,
- help_abstract() and help_man_page_reference() are unused — the
generated help renders the abstract via print_wrapped() and the man
page links via print_man_links().
The hand-written help() functions were the only users of the
namespace+group help table builder, and they are all gone. The one
remaining caller in the verbs machinery is ported to
options_find_namespace() + options_get_help_table_group(), which
build the identical table.
Also drop OPTION_COMMON_INTROSPECT_CLI_ENTRY: it has no users, and
references the no-longer-existing _OPTION_ENTRY() macro, so it could
not even be used.
The variadic pair-wise variant was only used by the hand-written help()
functions to synchronize their verb and option tables. Those are all
gone, and the verbs machinery uses table_sync_all_column_widths().
The last five hand-written help() functions are replaced by COMMAND()
descriptions: test-homectl-prompts, test-libudev,
test-modem-manager-mock, test-chase-manual, and test-journal-append
(which open-coded the help inside the option parsing loop). None of the
binaries are installed, so no man pages are referenced and they are not
added to the introspection smoke test.
The custom help() is replaced by a COMMAND() description, matching the
other report-sign services. The abstract is now wrapped at 80 columns
in the help output.
Negative return values, e.g. from option parsing, were propagated verbatim
as the exit status of main() and truncated to meaningless values (-EINVAL
became 234). The positive-failure variant is needed because the binary may
exit with EXIT_TEST_SKIP.
Also propagate EXIT_TEST_SKIP instead of suppressing it.
Unfortunately udevadm is special, so some more infra extensions turned
out to be necessary.
Retroactively, we might want to apply some of the new functionality in
other places too, but I'm leaving that for later.
The petnames wordlist added in [1] is Apache-2.0 and this
causes problems with the distribution of systemd as the
GPL-2 and Apache-2.0 are considered incompatible by the FSF.
So this commit replaces the previous wordlist with
a new one:
- weather (basic english weather adjectives)
- colors (basic english color names)
- worlds (planets, moons, minor bodies of the solar system)
All common vocabulary and compiled for this project, not taken
from anywhere.
An example with the new list:
- wintry-rust-dione-9393
- warm-yellow-saturn-39f9
The "worlds" are picked on the following principles:
- well-known
- memorable
- short(ish)
- cool
This is why e.g. we have "thetis" (an astroid) instead of
"tethys" (a moon): easier to spell and more well known.
[1] https://github.com/systemd/systemd/pull/42566
The previous commit uses `parse_source_date_epoch()` for creating FAT
time stamps. Do the same in `mtools_exec()`, `mkfs.*`, and
`$E2FSPROGS_FAKE_TIME` instead of passing the raw environment variable.
That avoids these programs creating time stamps from a value we would
have rejected ourselves (unparsable, overflowing), read differently
(e.g. octal numbers), or from one that `secure_getenv()` declines to
look at under AT_SECURE.
Note: mtools derives file and directory timestamps from
$SOURCE_DATE_EPOCH since v4.0.20 (2018).
Use the new copy timestamp clamping mechanism from the previous commit
to fix unreproducible wall-clock files in the generated images.
That covers both modes: online mode writes through the kernel, and
offline mode stages the tree in a temporary directory before handing it
to mkfs or mcopy. `mcopy -m` then carries the clamped mtimes into the
FAT.
This complements commit 34c3d57474 (directory times) and commit
f191ca982c (FAT insertion order).
Cover all combinations (online/offline, with and without epoch) in the
new `testcase_vfat_reproducibility()`. Update `testcase_make_symlinks()`
to cover the symlink creation/re-fix their parent directory code paths.
Sadly, images are still not reproducible byte for byte. Document
systemd-repart's $SOURCE_DATE_EPOCH handling and remaining
reproducibility issues in the manpage.
Add a `ts_clamp` argument to `copy_tree_at_full()` and
`copy_times_full()` that clamps copied inodes to a given time stamp.
This is the recommended `$SOURCE_DATE_EPOCH` semantics [1] for
reproducible builds. Their non-`_full` APIs keep existing behaviour by
clamping to `USEC_INFINITY`.
atime and mtime are clamped separately: a file that was merely read
after the epoch has to keep its mtime and still lose its atime. E.g. FAT
(EFI partition) stores an access date.
[1] https://reproducible-builds.org/specs/source-date-epoch/
systemd-udevd is the same binary as udevadm, so the introspection data
describes both commands, from either name. The COMMAND intentionally
owns no verbs — all of udevadm's verbs are defined in udevadm.c right
after its own COMMAND, so that they are attributed to it.
The -V/--version output (GIT_VERSION) is preserved.
The custom help() is replaced by the common verb help, which derives the
synopsis, abstract, and option list from the verb declaration in
udevadm.c and the "udevadm-wait" option namespace. The verb's one-line
description from the abstract is retained, I think it is good enough
but shorter.
Chris Down
Yu WatanabeandSiteshwar Vashisht
Luca Boccassi
Jelle van der Waa
Christian Brauner
Fabian Vogt
Konstantin Shkolnyy
Lennart Poettering
Siteshwar Vashisht
cverorg
Bone NI
Zbigniew Jędrzejewski-Szmek
Michael Vogt
Martin Pitt