SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4c172b81cbffc5fb9268fe17c206487432318f75
systemd/src
T
History
totoro 2fa149f2c4 nspawn: set ping group range for userns containers 
A newly created network namespace may disallow ICMP echo sockets for
unprivileged users even when their GIDs are mapped into the container.

When creating both user and network namespaces, initialize
net.ipv4.ping_group_range using the mapped GID range capped at INT32_MAX.
This follows the system-wide default from sysctl.d/50-default.conf while
respecting the user namespace mapping and the kernel's accepted limit.
Leave externally supplied network namespaces untouched and treat write
failures as non-fatal warnings.

Add regression coverage for the default 64K mapped range using the tools
already available in the minimal container image.

Fixes #41603
2026-08-26 11:45:35 +02:00
..
ac-power
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
analyze
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
ask-password
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
backlight
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
basic
Pressure metrics (#43377)
2026-08-25 14:45:16 +02:00
battery-check
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
binfmt
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
bless-boot
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
boot
boot: cover BCD offsets past the buffer
2026-07-19 20:21:47 +09:00
bootctl
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
bpf
nsresourced: harden the transient UID/GID write restriction (#43196)
2026-08-21 22:05:25 +01:00
busctl
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
cgls
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
cgtop
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
clonesetup
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
core
core/service: document & improve STOPPING=1
2026-08-24 22:46:01 +09:00
coredump
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
coverage
…
creds
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
cryptenroll
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
cryptsetup
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
debug-generator
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
delta
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
detect-virt
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
dissect
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
environment-d-generator
tree-wide: add missing assertions
2026-08-18 06:30:10 +09:00
escape
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
factory-reset
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
firstboot
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
fsck
fsck: don't apply invalid mode or repair values
2026-07-08 12:13:43 +01:00
fstab-generator
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
fundamental
Revert "macro: EDG compiler frontends doesn't support enum types"
2026-08-04 22:46:13 +09:00
fuzz
Rename basic-forward.h, sd-forward.h, and shared-forward.h to forward.h
2026-07-15 02:18:05 +09:00
getty-generator
getty-generator: strip whitespace from getty.auto credential
2026-08-14 11:59:58 +02:00
gpt-auto-generator
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
growfs
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
hibernate-resume
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
home
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
hostname
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
hwdb
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
id128
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
imds
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
import
test-tar: log failure in loading libarchive on LOG_ERR
2026-08-26 08:20:34 +09:00
include
coredump: do not leak TID in the host to container (#43349)
2026-08-15 01:38:04 +09:00
integritysetup
tree-wide: drop DLOPEN_FOO() macros
2026-07-18 04:56:32 +09:00
journal
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
journal-remote
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
kernel-install
kernel-install: convert to VERB_COMMAND and add --introspect-cli
2026-08-25 09:33:52 +02:00
keyutil
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
libc
libc: dlsym the time64 alias for epoll_pwait2() on 32-bit _TIME_BITS=64
2026-05-24 15:00:37 +02:00
libsystemd
sd-journal: constify several arguments
2026-08-23 15:27:41 +09:00
libsystemd-network
tree-wide: add missing assertions
2026-08-18 06:30:10 +09:00
libudev
libudev: cache the errno for a failed parent lookup
2026-07-30 07:24:17 +09:00
locale
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
login
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
machine
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
machine-id-setup
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
measure
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
modules-load
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
mount
mount: convert to VERB_COMMAND and add --introspect-cli
2026-08-25 09:36:33 +02:00
mountfsd
Rename basic-forward.h, sd-forward.h, and shared-forward.h to forward.h
2026-07-15 02:18:05 +09:00
mstack
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
mute-console
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
network
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
notify
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
nspawn
nspawn: set ping group range for userns containers
2026-08-26 11:45:35 +02:00
nsresourced
nsresourced: restore the BPF-LSM policy from the registry on startup
2026-08-12 10:49:34 +02:00
nss-myhostname
nss-myhostname: keep IPv6 probe result stable
2026-07-11 17:09:14 +01:00
nss-mymachines
…
nss-resolve
nss-resolve: use resolve-varlink-util.h helpers
2026-06-26 16:03:18 -04:00
nss-systemd
Rename basic-forward.h, sd-forward.h, and shared-forward.h to forward.h
2026-07-15 02:18:05 +09:00
oom
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
path
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
pcrextend
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
pcrlock
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
portable
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
pstore
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
ptyfwd
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
quotacheck
quotacheck: don't apply an invalid quotacheck.mode= value
2026-07-01 18:18:00 +01:00
random-seed
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
remount-fs
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
repart
Pressure metrics (#43377)
2026-08-25 14:45:16 +02:00
reply-password
…
report
Pressure metrics (#43377)
2026-08-25 14:45:16 +02:00
resolve
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
rfkill
…
rpm
…
run
shared/verbs: allow commands to specify footer highlighting
2026-08-24 13:46:21 +02:00
run-generator
…
sbsign
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
shared
tar-util: add missing dlopen libarchive
2026-08-26 08:20:34 +09:00
shutdown
meson: rework -Dstandalone-binaries= option
2026-07-24 00:35:10 +02:00
sleep
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
socket-activate
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
socket-proxy
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
ssh-generator
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
stdio-bridge
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
storage
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
storagetm
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
sulogin-shell
…
sysctl
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
sysext
sysext: convert to VERB_COMMAND and add --introspect-cli
2026-08-25 09:33:58 +02:00
sysinstall
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
system-update-generator
…
systemctl
shared/verbs: allow commands to filter option groups
2026-08-25 09:33:59 +02:00
systemd
Revert "macro: EDG compiler frontends doesn't support enum types"
2026-08-04 22:46:13 +09:00
sysupdate
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
sysusers
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
test
Pressure metrics (#43377)
2026-08-25 14:45:16 +02:00
timedate
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
timesync
timesyncd: don't ask for AAAA when IPv6 is disabled
2026-08-15 13:12:50 -07:00
tmpfiles
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
tpm2-setup
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
tty-ask-password-agent
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
udev
Another batch of conversions to COMMAND structures and additions of --introspect-cli (#43503)
2026-08-25 11:04:22 +02:00
ukify
ukify: add naming a certificate created by genkey
2026-08-25 07:22:47 +09:00
update-done
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
update-utmp
update-utmp: shorten comm on boot/shutdown
2026-07-29 11:41:17 +09:00
user-sessions
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
userdb
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
validatefs
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
varlinkctl
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
vconsole
vconsole: allow to control font scaling
2026-08-25 06:58:06 +09:00
veritysetup
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
version
…
vmspawn
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
volatile-root
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
vpick
shared/verbs: stop requiring an explicit program name
2026-08-24 13:45:07 +02:00
xdg-autostart-generator
tree-wide: add missing assertions
2026-08-18 06:30:10 +09:00