Daan De Meyer 6c2d437585 nsresourced: Allow operations outside transient UID/GID ranges ...

The purpose of the userns-restrict BPF-LSM program is to prevent the
transient ranges leaking to disk, so let's allow operations outside the
transient UID ranges, even if the mount is not allowlisted.

This is preparation for the next commits where we'll add support for mapping
the current user and the foreign UID range into the user namespaces provisioned
by nsresourced. Operations creating files/directories as these UIDs/GIDs should
not need the corresponding mount to be allowlisted with nsresourced.

2026-02-24 18:29:37 +01:00

..

ac-power

…

analyze

portable: Enable unpriv operation

2026-01-21 15:09:46 +01:00

ask-password

ask-password: install polkit policy

2026-02-03 08:16:25 +09:00

backlight

backlight: also change clamp percentage on ID_BACKLIGHT_CLAMP/ID_LEDS_CLAMP=yes

2026-02-16 21:24:55 +09:00

basic

nsresourced: Allow operations outside transient UID/GID ranges

2026-02-24 18:29:37 +01:00

battery-check

…

binfmt

…

bless-boot

bless-boot-generator: skip if current system is entered via soft-reboot

2026-01-20 11:09:27 +09:00

boot

stub: more hardening against malformed images

2026-02-18 15:05:44 +00:00

bootctl

parse-argument: make parse_tristate_argument() do something useful

2026-02-20 21:20:45 +01:00

busctl

…

cgls

…

cgtop

cgtop: fix confusion in --help

2026-02-11 11:46:12 +01:00

core

manager: add needs-stop/needs-start (#40709)

2026-02-24 00:36:06 +01:00

coredump

coredump: Use error log level in coredump_send_to_container()

2026-02-17 16:44:35 +01:00

coverage

…

creds

…

cryptenroll

cryptenroll: simplification

2026-02-11 11:47:59 +01:00

cryptsetup

cryptsetup: extend HAVE_TPM2 conditioning to cover more

2026-02-17 22:00:13 +01:00

debug-generator

…

delta

…

detect-virt

…

dissect

parse-argument: make parse_tristate_argument() do something useful

2026-02-20 21:20:45 +01:00

environment-d-generator

…

escape

…

factory-reset

…

firstboot

firstboot/homectl: hide plymouth splashscreen when asking questions

2026-02-03 13:21:03 +01:00

fsck

…

fstab-generator

…

fundamental

systemd-boot: add a preferred setting that's similar to default but avoids booting known-bad entries

2026-02-18 03:28:12 +09:00

fuzz

…

getty-generator

…

gpt-auto-generator

gpt-auto-generator: enable nvpcr logic by default

2026-02-17 22:00:14 +01:00

growfs

…

hibernate-resume

…

home

Use sectorsize for partition tables on block devs

2026-02-17 18:23:35 +05:30

hostname

pam_systemd: remove handling of obsolete "existing" attr from CreateSession() call (#40432)

2026-01-23 17:50:44 +01:00

hwdb

…

id128

…

import

import/pull-oci: fix several OOM checks

2026-02-24 17:34:09 +01:00

include

include: update kernel headers from v7.0-rc1

2026-02-24 23:08:52 +09:00

integritysetup

…

journal

journalctl-vl-server: allow querying units for specific uid in system scope

2026-02-23 10:43:00 +01:00

journal-remote

journal-upload: drop custom option error handling

2026-02-11 11:48:29 +01:00

kernel-install

kernel-install: allocate "Context" object only in verb_xyz() functions, not already in run()

2026-02-09 10:21:16 +01:00

keyutil

…

libc

Bump required minimum version of glibc to 2.34

2026-01-28 10:56:53 +09:00

libsystemd

sd-device: do not try to remove previous tag indexes

2026-02-23 05:46:42 +09:00

libsystemd-network

various: port manual goto cleanup to CLEANUP_TMPFILE_AT

2026-02-11 02:39:26 +01:00

libudev

…

locale

…

login

login1: Emit NCurrentInhibitors changed events

2026-02-23 20:03:07 -05:00

machine

machine: switch CleanPool to SD_VARLINK_REQUIRES_MORE

2026-02-20 18:01:08 +01:00

machine-id-setup

…

measure

…

modules-load

…

mount

mount-tool: fix confusion in --help

2026-02-11 11:46:44 +01:00

mountfsd

mountfsd: Try to polkit auth when the verity key is not available

2026-02-23 12:11:04 +01:00

mstack

mstack: parse --mkdir option

2026-02-20 16:56:16 +01:00

mute-console

mute-console: io.systemd.MuteConsole requires 'more'

2026-02-16 09:44:54 +01:00

network

metrics: fix casing for metrics names (take 2)

2026-02-19 15:30:18 +01:00

notify

…

nspawn

mountfsd,nsresource: allow recycling mountfsd/nsresourced client connections

2026-02-19 15:08:19 +01:00

nsresourced

nsresourced: Allow operations outside transient UID/GID ranges

2026-02-24 18:29:37 +01:00

nss-myhostname

…

nss-mymachines

…

nss-resolve

…

nss-systemd

…

oom

oomd: Fix unnecessary delays during OOM kills with pending kills present

2026-02-17 18:26:04 +09:00

path

path: simplify run()

2026-02-11 11:47:18 +01:00

pcrextend

pcrextend: allow access to the userspace event type field when measuring something

2026-02-17 22:00:13 +01:00

pcrlock

tree-wide: drop redundant check for SD_VARLINK_METHOD_MORE flag

2026-02-16 09:44:54 +01:00

portable

portable: fix log levels

2026-02-19 15:08:20 +01:00

pstore

…

ptyfwd

…

quotacheck

…

random-seed

…

remount-fs

…

repart

repart: Report correct current disk size and error (#39813)

2026-02-20 17:00:28 +00:00

reply-password

…

report

report: install systemd-report binary to /usr/lib/systemd/ for now

2026-02-20 08:25:12 +01:00

resolve

resolved: Add ifindex=0 support for BrowseServices to browse all mDNS interfaces

2026-02-23 02:54:56 +01:00

rfkill

…

rpm

…

run

parse-argument: make parse_tristate_argument() do something useful

2026-02-20 21:20:45 +01:00

run-generator

…

sbsign

bootctl,sbsign: fix $SOURCE_DATE_EPOCH parsing

2026-01-20 15:54:55 +01:00

shared

Several follow-ups for JournalAccess varlink interface (#40794)

2026-02-23 20:17:31 +01:00

shutdown

…

sleep

sleep: allow HibernateDelaySec and low-battery hibernation to work together

2026-02-05 10:28:47 +01:00

socket-activate

…

socket-proxy

…

ssh-generator

ssh-proxy: Support ssh machine/xxx for nspawn containers

2026-02-19 21:32:29 +01:00

stdio-bridge

…

storagetm

Fix bug in DM iteration and standardise how to iterate through DM layers (#40426)

2026-01-30 15:36:03 +09:00

sulogin-shell

…

sysctl

…

sysext

tree-wide: drop redundant check for SD_VARLINK_METHOD_MORE flag

2026-02-16 09:44:54 +01:00

system-update-generator

…

systemctl

systemctl: introduce enqueue-marked-jobs verb, stop lumping it with distinct verbs

2026-02-24 16:00:05 +01:00

systemd

xaccess: Rework from boolean into a list of tags

2026-02-17 15:27:24 +01:00

sysupdate

sysupdated: Split Update() into Acquire() and Install() D-Bus methods (#40628)

2026-02-23 22:08:37 +01:00

sysusers

install-file: add a generalized parser for $SOURCE_DATE_EPOCH

2026-01-20 15:54:55 +01:00

test

test: test io.systemd.JournalAccess

2026-02-24 12:59:38 +00:00

timedate

…

timesync

timesync: actually disables built-in fallback NTP servers when an empty string is specified

2026-02-16 09:53:03 +09:00

tmpfiles

various: use xstatx()

2026-02-05 14:14:40 +01:00

tpm2-setup

tpm2-setup: introduce nvpcr for measuring Verity images

2026-02-17 22:00:13 +01:00

tty-ask-password-agent

…

udev

udev/dump: also dump current tags

2026-02-23 05:52:49 +09:00

ukify

…

update-done

…

update-utmp

…

user-sessions

…

userdb

tree-wide: Migrate to varlink_set_sentinel()

2026-02-11 14:25:36 +01:00

validatefs

…

varlinkctl

varlinkctl: add pluggable protocol support to sd-varlink

2026-02-13 19:07:20 +01:00

vconsole

…

veritysetup

veritysetup: optionally measure Verity once we activated it

2026-02-17 22:00:14 +01:00

version

…

vmspawn

vmspawn: clean up OVMF secure boot support check a bit

2026-02-20 21:21:01 +01:00

volatile-root

…

vpick

vpick: Make suffix a single string again instead of a strv

2026-02-18 23:14:11 +01:00

xdg-autostart-generator

…