Compare commits
14 Commits
4cfbd7344f
...
ed5ef0db1a
| Author | SHA1 | Date |
|---|---|---|
leafcompost
|
ed5ef0db1a | |
|
Yu Watanabe
|
fed7857672 | |
|
Lennart Poettering
|
c8d45ebfd6 | |
|
Lennart Poettering
|
acc8bae0b3 | |
|
Lennart Poettering
|
a6d7cc74d6 | |
|
Luca Boccassi
|
d80d7a2f2a | |
|
Luca Boccassi
|
088793239e | |
|
Luca Boccassi
|
94a46c20da | |
|
Luca Boccassi
|
d6f4c96b10 | |
|
Luca Boccassi
|
9e51b12e13 | |
|
maia x.
|
bf2328c714 | |
|
maia x.
|
1e4e23cb7e | |
|
maia x.
|
77eb9bf10d | |
|
maia x.
|
650e82ee3c |
322
NEWS
322
NEWS
|
|
@ -103,37 +103,37 @@ CHANGES WITH 257 in spe:
|
|||
|
||||
libsystemd:
|
||||
|
||||
* systemd's JSON API is now available as public interface of libsystemd
|
||||
under the name "sd-json". The purpose of the library is to allow
|
||||
structures to be conveniently created in C code and serialized to
|
||||
JSON, and for JSON to be conveniently deserialized into in-memory
|
||||
structures, using callbacks to handle specific keys. Various data
|
||||
types like integers, floats, booleans, strings, UUIDs, base64-encoded
|
||||
and hex-encoded binary data, and arrays are supported natively. The
|
||||
library has been part of systemd for a while as internal component,
|
||||
and now being made publicly available, too. On major user of sd-json
|
||||
is the JSON interface sd-varlink (see below). Note that documentation
|
||||
on sd-json is very much incomplete for now, but the systemd codebase
|
||||
should provide plenty code real-life code examples.
|
||||
* systemd's JSON API is now available as public interface of
|
||||
libsystemd, under the name "sd-json". The purpose of the library is
|
||||
to allow structures to be conveniently created in C code and
|
||||
serialized to JSON, and for JSON to be conveniently deserialized into
|
||||
in-memory structures, using callbacks to handle specific
|
||||
keys. Various data types like integers, floats, booleans, strings,
|
||||
UUIDs, base64-encoded and hex-encoded binary data, and arrays are
|
||||
supported natively. The library has been part of systemd for a while
|
||||
as internal component, and is now made publicly available. One major
|
||||
user of sd-json is sd-varlink (see below). Note that the
|
||||
documentation of sd-json is very much incomplete for now, but the
|
||||
systemd codebase provides plenty real-life code examples.
|
||||
|
||||
* libsystemd's Varlink IPC API is now available as part of libsystemd
|
||||
* systemd's Varlink IPC API is now available as part of libsystemd,
|
||||
under the name "sd-varlink". This library is a C implementation of
|
||||
the Varlink IPC system (https://varlink.org/) that has been adopted
|
||||
by systemd for various interfaces. It relies on the sd-json JSON
|
||||
component, see above. Note that documentation on sd-varlink is very
|
||||
much incomplete for now, but the systemd codebase should provide
|
||||
plenty code real-life code examples.
|
||||
component, see above. Note that the documentation of sd-varlink is
|
||||
very much incomplete for now, but the systemd codebase provides
|
||||
plenty real-life code examples.
|
||||
|
||||
* sd-bus gained a new call sd_bus_pending_method_calls() which returns
|
||||
the number of currently open asynchronous method calls initiated on
|
||||
this connection towards peers.
|
||||
|
||||
* sd-device gained a new call sd_device_monitor_is_running() that
|
||||
returns whener the specified monitor object is already running. It
|
||||
returns whether the specified monitor object is already running. It
|
||||
also gained sd_device_monitor_get_fd(),
|
||||
sd_device_monitor_get_events(), sd_device_monitor_get_timeout() and
|
||||
sd_device_monitor_receive() to permit sd-device to run on a foreign
|
||||
event loop implementation. It also gained
|
||||
sd_device_monitor_receive() to permit sd-device to run on top of a
|
||||
foreign event loop implementation. It also gained
|
||||
sd_device_get_driver_subsystem() which returns the subsystem of
|
||||
driver objects. The new sd_device_get_device_id() call returns a
|
||||
short string identifying the device record.
|
||||
|
|
@ -148,8 +148,9 @@ CHANGES WITH 257 in spe:
|
|||
* Multipath TCP (MPTCP) is now supported as a socket protocol for
|
||||
.socket units.
|
||||
|
||||
* New /etc/fstab option x-systemd.wants= creates "Wants" dependencies.
|
||||
(This is similar to the previously available x-systemd.requires=.)
|
||||
* A new /etc/fstab option x-systemd.wants= creates "Wants="
|
||||
dependencies. (This is similar to the previously available
|
||||
x-systemd.requires=.)
|
||||
|
||||
* The initialization of the system clock during boot and updates has
|
||||
been simplified: both PID 1 or systemd-timesyncd will pick the latest
|
||||
|
|
@ -161,17 +162,17 @@ CHANGES WITH 257 in spe:
|
|||
shutdown, so that the user may use it to initiate a reboot if the
|
||||
system freezes otherwise.
|
||||
|
||||
* The new unit option PrivateUsers=identity can be used to request a
|
||||
user namespace with an identity mapping for the first 65536
|
||||
UIDs/GIDs. This is analogous to the systemd-nspawn's
|
||||
* The new value "identity" for the unit setting PrivateUsers= may be
|
||||
used to request a user namespace with an identity mapping for the
|
||||
first 65536 UIDs/GIDs. This is analogous to the systemd-nspawn's
|
||||
--private-users=identity.
|
||||
|
||||
* The new unit option PrivateTmp=disconnected can be used to specify
|
||||
that a separate tmpfs instance should be used for /tmp/ and /var/tmp/
|
||||
for the unit.
|
||||
* The new value "disconnected" for the unit setting PrivateTmp= may be
|
||||
used to specify that a separate tmpfs instance should be used for
|
||||
/tmp/ and /var/tmp/ for the unit.
|
||||
|
||||
* The manager (and various other tools too) use pidfds in more places
|
||||
to refer to processes.
|
||||
* The server manager (and various other tools too) use pidfds in more
|
||||
places to refer to processes.
|
||||
|
||||
* A build option -D link-executor-shared=false can be used to build
|
||||
the systemd-executor binary (added in a previous release) in a way
|
||||
|
|
@ -185,41 +186,41 @@ CHANGES WITH 257 in spe:
|
|||
execute.
|
||||
|
||||
* The systemd.machine_id= kernel command line parameter interpreted by
|
||||
PID 1 now supports an additional special value: if "firmware" is
|
||||
specified the machine ID is initialized from the SMBIOS/DeviceTree
|
||||
system UUID. (Previously this was already done in VM environments,
|
||||
this extends the concept to any system, but only on explicit request
|
||||
via this option.)
|
||||
PID 1 now supports an additional special value: if set to "firmware"
|
||||
the machine ID is initialized from the SMBIOS/DeviceTree system
|
||||
UUID. (Previously this was already done automatically in VM
|
||||
environments, this extends the concept to any system, but only on
|
||||
explicit request via this option.)
|
||||
|
||||
* The ImportCredential= setting in service unit files now permits
|
||||
renaming credentials imported.
|
||||
renaming of credentials as they are imported.
|
||||
|
||||
* The RestartMode= gained a new "debug" setting. If specified and the
|
||||
service fails so that it shall be restarted it is invoked in
|
||||
* The RestartMode= setting gained a new "debug" value. If specified and
|
||||
the service fails so that it shall be restarted it is invoked in
|
||||
"debugging mode". Debugging mode means that the $DEBUG_INVOCATION
|
||||
environment variable will be set to "1" for the new
|
||||
invocation. Moreover, any setting LogLevelMax= will be temporarily
|
||||
changed to "debug" for the next invocation. This mode is useful to
|
||||
repeat invocation of tools if they fail but with additional logging
|
||||
or testing routines turned on.
|
||||
automatically repeat invocation of tools in case they fail – but with
|
||||
additional logging or testing routines enabled.
|
||||
|
||||
* A new service setting BindLogSockets= has been added that
|
||||
controls whether the AF_UNIX sockets required for logging shall be
|
||||
bind mounted to the mount sandbox allocated for the service.
|
||||
|
||||
* PID 1 will now optionally load a policy for the new Linux IPE LSM at
|
||||
boot.
|
||||
* At early boot, PID 1 will now optionally load a policy for the new
|
||||
Linux IPE LSM.
|
||||
|
||||
* Transient services (StartTransientUnit() D-Bus method) may now
|
||||
receive additional, arbitrary file descriptors to pass to executed
|
||||
service processes on activation using the new ExtraFileDescriptor=
|
||||
unit property.
|
||||
* Transient services (as invoked by the StartTransientUnit() D-Bus
|
||||
method) may now receive additional, arbitrary file descriptors to
|
||||
pass to executed service processes during activation using the new
|
||||
ExtraFileDescriptor= unit property.
|
||||
|
||||
* Calendar .timer units gained a new boolean DeferReactivation=
|
||||
option. If enabled and the repetitive calendar timer elapses again
|
||||
while the service the timer activates is still running, immediate
|
||||
reactivation once it finishes is skipped, and the timer has to elapse
|
||||
again before the service is reactivated.
|
||||
reactivation of the service once it finishes is skipped, and the
|
||||
timer has to elapse again before the service is reactivated.
|
||||
|
||||
* Generator processes invoked by the service manager will now receive a
|
||||
new environment variable $SYSTEMD_SOFT_REBOOTS_COUNT that indicates
|
||||
|
|
@ -245,10 +246,10 @@ CHANGES WITH 257 in spe:
|
|||
"strict" a new cgroup namespace is allocated for the service, and
|
||||
cgroupfs is mounted read-only for the service.
|
||||
|
||||
* The StateDirectory=, RuntimeDirectory=, CacheDirectory=, LogsDirectory=,
|
||||
and ConfigurationDirectory= settings gained support for configuring the
|
||||
respective directories as read-only, via a ':ro' flag that can be
|
||||
appended to each setting.
|
||||
* The StateDirectory=, RuntimeDirectory=, CacheDirectory=,
|
||||
LogsDirectory=, and ConfigurationDirectory= settings gained support
|
||||
for configuring the respective directories as read-only, via a ':ro'
|
||||
flag that can be appended to each setting's value.
|
||||
|
||||
* When DynamicUser= is combined with
|
||||
StateDirectory=/RuntimeDirectory=/CacheDirectory=/LogsDirectory= and
|
||||
|
|
@ -258,15 +259,15 @@ CHANGES WITH 257 in spe:
|
|||
chown()ing.
|
||||
|
||||
* A new service property PrivatePIDs= has been added that runs executed
|
||||
processes as PID 1 - the init process - within their own PID namespace.
|
||||
PrivatePIDs= also mounts /proc/ so only processes within the new PID
|
||||
namespace are visible.
|
||||
processes as PID 1 - the init process - within their own PID
|
||||
namespace. PrivatePIDs= also mounts /proc/ so only processes within
|
||||
the new PID namespace are visible.
|
||||
|
||||
systemd-udevd:
|
||||
|
||||
* udev rules now set 'uaccess' for /dev/udmabuf, giving locally
|
||||
logged-in users access to the hardware. This is necessary to support
|
||||
IPMI cameras with libcamera.
|
||||
logged-in users access to the hardware. This is useful in order to
|
||||
support IPMI cameras with libcamera.
|
||||
|
||||
* Serial port devices will no longer show up as systemd units, unless
|
||||
they have an IO port or memory assigned to them. This means that only
|
||||
|
|
@ -281,9 +282,9 @@ CHANGES WITH 257 in spe:
|
|||
searched for both on the interface's parent device (as before) and
|
||||
the device itself (new).
|
||||
|
||||
* Various USB hardware wallets have are now recognized by udev via a
|
||||
.hwdb file, and get the ID_HARDWARE_WALLET= property set, which
|
||||
enables "uaccess" for them, i.e. direct unprivileged access.
|
||||
* Various USB hardware wallets are now recognized by udev via a .hwdb
|
||||
file, and get the ID_HARDWARE_WALLET= property set, which enables
|
||||
"uaccess" for them, i.e. direct unprivileged access.
|
||||
|
||||
* udevadm info will now output the device ID string in lines prefixed
|
||||
with "J:", and the driver subsystem in lines prefixed with "B:".
|
||||
|
|
@ -293,8 +294,8 @@ CHANGES WITH 257 in spe:
|
|||
|
||||
systemd-logind:
|
||||
|
||||
* New DesignatedMaintenanceTime= configuration option allows
|
||||
shutdowns to be automatically scheduled at the specified time.
|
||||
* New DesignatedMaintenanceTime= configuration option allows shutdowns
|
||||
to be automatically scheduled at the specified time.
|
||||
|
||||
* logind now reacts to Ctrl-Alt-Shift-Esc being pressed. It will send
|
||||
out a org.freedesktop.login1.SecureAttentionKey signal, indicating a
|
||||
|
|
@ -308,8 +309,8 @@ CHANGES WITH 257 in spe:
|
|||
session switches away.
|
||||
|
||||
* systemd-logind now exposes two D-Bus properties CanLock and CanIdle
|
||||
for all sessions that indicate whether the session's class supports
|
||||
screen locking and idle detection.
|
||||
for all sessions. These properties indicate whether the session's
|
||||
class supports screen locking and idleness detection.
|
||||
|
||||
* systemd-inhibit now allows interactive polkit authorization. It
|
||||
gained a --no-ask-password option to suppress it.
|
||||
|
|
@ -320,12 +321,13 @@ CHANGES WITH 257 in spe:
|
|||
Machines started via the systemd-vmspawn@.service unit will now be
|
||||
registered with systemd-machined.
|
||||
|
||||
* systemd-machined gained a pretty complete set of Varlink interfaces
|
||||
to its functionality as alternative to the existing D-Bus interface.
|
||||
* systemd-machined gained a pretty complete set of Varlink APIs
|
||||
exposing its functionality. This is an alternative to the
|
||||
pre-existing D-Bus interface.
|
||||
|
||||
systemd-resolved:
|
||||
|
||||
* resolvconf command now supports '-p' switch. If specified, the
|
||||
* The resolvconf command now supports '-p' switch. If specified, the
|
||||
interface will not be used as the default route for domain name
|
||||
lookups.
|
||||
|
||||
|
|
@ -337,11 +339,11 @@ CHANGES WITH 257 in spe:
|
|||
* IPv6 address labels can be configured in a new [IPv6AddressLabel]
|
||||
section with Prefix= and Label= settings.
|
||||
|
||||
* 'networkctl edit' can now read the new contents from standard input
|
||||
with the new --stdin option.
|
||||
* 'networkctl edit' can now read the new file contents from standard
|
||||
input with the new --stdin option.
|
||||
|
||||
* 'networkctl edit' and 'cat' now supports editing .netdev files by
|
||||
link. 'networkctl cat' can also list all configuration files
|
||||
* 'networkctl edit' and 'cat' now support editing/showing .netdev files
|
||||
by link. 'networkctl cat' can also list all configuration files
|
||||
associated with an interface at once with ':all'.
|
||||
|
||||
* networkctl gained a --no-ask-password option to suppress interactive
|
||||
|
|
@ -350,7 +352,7 @@ CHANGES WITH 257 in spe:
|
|||
* "mac" has been added to the default AlternativeNamesPolicy= setting
|
||||
for network links (via 99-default.link). This means "enx*" interface
|
||||
names will now be added to the list of alternative interface names by
|
||||
default for all interfaces that have a MAC address assigned to them
|
||||
default, for all interfaces that have a MAC address assigned
|
||||
by hardware.
|
||||
|
||||
* networkd .netdev bridge devices gained a new setting FDBMaxLearned=
|
||||
|
|
@ -365,18 +367,18 @@ CHANGES WITH 257 in spe:
|
|||
thus highlighting conflict of ownership/management of these knobs.
|
||||
|
||||
* systemd-networkd will now make RFC9463 DNR fields available to
|
||||
systemd-resolved, for automatic DoT configuration, and similar.
|
||||
systemd-resolved, for automatic DNS DoT configuration, and similar.
|
||||
|
||||
systemd-boot, systemd-stub, and related tools:
|
||||
|
||||
* The EFI stub now supports loading of .ucode sections with microcode
|
||||
from PE add-on files. It now also supports loading .initrd sections
|
||||
from PE add-on files. It also now supports loading .initrd sections
|
||||
from PE add-on files.
|
||||
|
||||
* A new .profile PE section type is now documented and supported in
|
||||
systemd-measure, ukify, systemd-stub and systemd-boot. Those new
|
||||
systemd-measure, ukify, systemd-stub and systemd-boot. These new
|
||||
sections allow multiple "profiles" to be stored together in the UKI,
|
||||
with .profile sections creating groupings of sections in the UKI,
|
||||
where each .profile section creates groupings of sections in the UKI,
|
||||
allowing some sections to be shared and other sections like .cmdline
|
||||
or .initrd unique to the profile. This may be used to provide a
|
||||
single UKI that synthesizes multiple menu items in the boot menu (for
|
||||
|
|
@ -389,10 +391,10 @@ CHANGES WITH 257 in spe:
|
|||
can contain multiple .dtbauto sections, and the 'compatible' string
|
||||
therein will be compared with the equivalent field in the DTB
|
||||
provided by the firmware, if present. If absent, SMBIOS will be used
|
||||
to calculate hardware IDs and compare them with the content of
|
||||
.hwids. This allows including multiple DTBs in a single UKI, with
|
||||
the bootloader automatically selecting the correct one for the
|
||||
current hardware.
|
||||
to calculate hardware IDs (CHIDs) and look them up in the content of
|
||||
.hwids, hopefully revealing an fallback 'compatible' string. This
|
||||
allows including multiple DTBs in a single UKI, with systemd-stub
|
||||
automatically loading the correct one for the current hardware.
|
||||
|
||||
* ukify gained an --extend switch to import an existing UKI to
|
||||
be extended, and a --measure-base= switch to support measurement
|
||||
|
|
@ -405,25 +407,26 @@ CHANGES WITH 257 in spe:
|
|||
|
||||
* systemd-stub will report the partition UUID and image identifier its
|
||||
UKI executable is placed on separately from the data systemd-boot
|
||||
provides about where to find its own executable. This is useful when
|
||||
systemd-boot and UKIs are placed on distinct partitions (i.e. ESP and
|
||||
XBOOTLDR).
|
||||
provides about where to find its own executable, via EFI
|
||||
variables. This is useful when systemd-boot and UKIs are placed on
|
||||
distinct partitions (i.e. ESP and XBOOTLDR).
|
||||
|
||||
* bootctl --print-loader-path and --print-stub-path that output the
|
||||
path to the boot loader or UKI used for the current boot.
|
||||
* bootctl gained new switches --print-loader-path and --print-stub-path
|
||||
that output the path to the boot loader or UKI used for the current
|
||||
boot.
|
||||
|
||||
* bootctl kernel-identify now supports identifying EFI add-ons.
|
||||
* bootctl kernel-identify now recognizes EFI add-ons.
|
||||
|
||||
* bootctl gained a --random-seed=yes|no option to control provisioning
|
||||
of the random seed file in ESP. (This is useful when producing an
|
||||
image that will be used multiple times.)
|
||||
of the random seed file in the ESP. (This is useful when producing an
|
||||
image that will be used in multiple instances.)
|
||||
|
||||
* bootctl now optionally supports installing UEFI Secure Boot databases
|
||||
(ESLs) for systemd-boot to pick up and automatically enroll if the
|
||||
system is booted in Setup Mode. This is controlled via bootctl's new
|
||||
--secure-boot-auto-enroll=yes switch (and some auxiliary ones). A
|
||||
certificate can be provided in DER format, and it is automatically
|
||||
converted into an ESL, as needed.
|
||||
(i.e. db/dbx/… databases in ESL format) for systemd-boot to pick up
|
||||
and automatically enroll if the system is booted in Setup Mode. This
|
||||
is controlled via bootctl's new --secure-boot-auto-enroll=yes switch
|
||||
(and some auxiliary ones). A certificate can be provided in DER
|
||||
format, and is automatically converted into an ESL, as needed.
|
||||
|
||||
* bootctl, systemd-measure, systemd-repart when referencing signing
|
||||
keys on OpenSSL engines may now query for PINs and similar via
|
||||
|
|
@ -431,9 +434,9 @@ CHANGES WITH 257 in spe:
|
|||
caching and UI).
|
||||
|
||||
* A new systemd-sbsign tool has been added, that can be used to sign
|
||||
EFI binaries (PE). This tool supports OpenSSL engines and providers,
|
||||
with pin caching support for PKCS11. ukify supports it as an
|
||||
alternative to sbsigntool and pesign.
|
||||
EFI binaries (PE) for Secure Boot. This tool supports OpenSSL engines
|
||||
and providers, with pin caching support for PKCS11. ukify supports it
|
||||
as an alternative to sbsigntool and pesign.
|
||||
|
||||
The journal:
|
||||
|
||||
|
|
@ -468,22 +471,22 @@ CHANGES WITH 257 in spe:
|
|||
and AppStream metadata.
|
||||
|
||||
* Transfer definitions for systemd-sysupdate are supposed to carry the
|
||||
".transfer" suffix now, changing from ".conf". The latter is
|
||||
supported for compatibility too, but it's recommended to rename all
|
||||
files reflecting this suffix change.
|
||||
".transfer" suffix now, changing from ".conf". The latter remains
|
||||
supported for compatibility, but it's recommended to rename all files
|
||||
reflecting this suffix change.
|
||||
|
||||
* systemd-sysupdate now supports a new ".feature" files that may be
|
||||
* systemd-sysupdate now supports new ".feature" files that may be
|
||||
used in conjunction with ".transfer" files to group them together, and
|
||||
allow them to be turned off or on, individually per group.
|
||||
|
||||
TPM & systemd-cryptsetup:
|
||||
|
||||
* The 'tpm2' verb which lists usable TPM2 devices has been moved from
|
||||
systemd-creds to systemd-analyze.
|
||||
* The 'has-tpm2' verb which reports whether TPM2 functionality is
|
||||
available has been moved from systemd-creds to systemd-analyze.
|
||||
|
||||
* systemd-tpm2-setup will gracefully handle TPMs that have a PIN set on
|
||||
the TPM, and not automatically set up a Storage Root Key (SRK) in
|
||||
that case.
|
||||
the TPM, and not attempt to automatically set up a Storage Root Key
|
||||
(SRK) in that case.
|
||||
|
||||
* New crypttab option password-cache=yes|no|read-only can be used to
|
||||
customize password caching.
|
||||
|
|
@ -525,7 +528,7 @@ CHANGES WITH 257 in spe:
|
|||
start the specified executable on the remote side, and communicate
|
||||
with the remote process using the Varlink protocol.
|
||||
|
||||
"ssh:" address specification has been renamed to "ssh-unix:"
|
||||
The "ssh:" address specification has been renamed to "ssh-unix:"
|
||||
(reflecting the fact it is used to connect to a remote AF_UNIX socket
|
||||
via SSH). The old syntax is still supported for backwards
|
||||
compatibility.
|
||||
|
|
@ -546,7 +549,8 @@ CHANGES WITH 257 in spe:
|
|||
to enable internal compression in filesystems created offline.
|
||||
|
||||
* systemd-repart understands a new MakeSymlinks= option to create one
|
||||
or more symlinks (each specified as a symlink name and target).
|
||||
or more symlinks (each specified as a symlink name and target) within
|
||||
a newly formatted file system.
|
||||
|
||||
* systemd-repart gained a new SupplementFor= setting that allows
|
||||
allocating a partition only if some other existing partition cannot
|
||||
|
|
@ -559,15 +563,15 @@ CHANGES WITH 257 in spe:
|
|||
|
||||
systemd-ssh-proxy:
|
||||
|
||||
* systemd-ssh-proxy now also supports the "VSOCK MUX" protocol used by
|
||||
CloudHypervisor/Firecracker to expose AF_VSOCK sockets of the VM on
|
||||
the host. Or in other words: it's now possible to directly connect to
|
||||
ssh via AF_VSOCK from hosts to VMs of these two hypervisors
|
||||
(previously this was only supported for hypervisors which expose
|
||||
AF_VSOCK on the host as AF_VSOCK, such as qemu).
|
||||
* systemd-ssh-proxy now also supports the AF_UNIX-based "VSOCK MUX"
|
||||
protocol used by CloudHypervisor/Firecracker to expose AF_VSOCK
|
||||
sockets of the VM on the host. Or in other words: it's now possible
|
||||
to directly connect to ssh via AF_VSOCK from hosts to VMs of these
|
||||
two hypervisors (previously this was only supported for hypervisors
|
||||
which expose AF_VSOCK on the host as AF_VSOCK, such as qemu).
|
||||
|
||||
* systemd-ssh-proxy can now reference local VMs by their name: connect
|
||||
to any local VM "foobar" registered with machined via "ssh
|
||||
to any local VM "foobar" registered with systemd-machined via "ssh
|
||||
machine/foobar" using the AF_VSOCK protocol.
|
||||
|
||||
systemd-analyze:
|
||||
|
|
@ -591,7 +595,6 @@ CHANGES WITH 257 in spe:
|
|||
|
||||
* 'busctl monitor' gained new options --limit-messages= and --timeout=
|
||||
to set the number of matches or limit the runtime of the command.
|
||||
This is intended to be used in scripts.
|
||||
|
||||
* busctl now supports doing method calls with embedded unix file
|
||||
descriptors.
|
||||
|
|
@ -609,9 +612,9 @@ CHANGES WITH 257 in spe:
|
|||
|
||||
systemd-importd:
|
||||
|
||||
* A new generator sytemd-import-generator has been added to
|
||||
synthetisize image download jobs. This provides functionality similar
|
||||
to importctl, but configured via the kernel command line and system
|
||||
* A new generator sytemd-import-generator has been added to synthesize
|
||||
image download jobs. This provides functionality similar to
|
||||
importctl, but is configured via the kernel command line and system
|
||||
credentials. It may be used to automatically download sysext,
|
||||
confext, portable service, nspawn container or vmspawn VM images at
|
||||
boot.
|
||||
|
|
@ -640,6 +643,32 @@ CHANGES WITH 257 in spe:
|
|||
systemd-homed to allow users to change selected properties of their
|
||||
own user records.
|
||||
|
||||
systemd-run & run0:
|
||||
|
||||
* run0 gained a new pair of settings --pty and --pipe that control
|
||||
whether to invoke the specified binary on a freshly allocated pseudo
|
||||
TTY, or whether to pass the client's STDIN/STDOUT/STDERR through
|
||||
directly.
|
||||
|
||||
* run0 gained a new switch --shell-prompt-prefix= that permits passing
|
||||
in a string to display on each shell prompt as prefix. If not
|
||||
specified otherwise this will show a superhero emoji (🦸), in order
|
||||
to visually communicate the temporarily elevated privileges a run0
|
||||
session provides. This makes use of the $SHELL_PROMPT_PREFIX
|
||||
environment variables mentioned below.
|
||||
|
||||
* systemd-run can output some of its runtime data in JSON format via
|
||||
the new --json= option.
|
||||
|
||||
systemd-tmpfiles:
|
||||
|
||||
* systemd-tmpfiles --purge switch now requires specification of at
|
||||
least one tmpfiles.d/ drop-in file.
|
||||
|
||||
* tmpfiles.d/ files gained a new '?' specifier for the 'L' line type to
|
||||
create a symlink only if the source exists, and gracefully skip the
|
||||
line otherwise.
|
||||
|
||||
Miscellaneous:
|
||||
|
||||
* systemctl now supports the --now option with the 'reenable' verb.
|
||||
|
|
@ -654,21 +683,13 @@ CHANGES WITH 257 in spe:
|
|||
* localectl gained a -l/--full option to show output without
|
||||
ellipsization.
|
||||
|
||||
* systemd-run can output some data as JSON via the new --json= option.
|
||||
|
||||
* timedatectl now supports interactive polkit authorization.
|
||||
|
||||
* systemd-tmpfiles --purge switch now requires specification of at
|
||||
least one tmpfiles.d/ drop-in file.
|
||||
|
||||
* tmpfiles.d gained a new '?' specifier for the 'L' type to create a
|
||||
symlink only if the source exists, and gracefully skip otherwise.
|
||||
|
||||
* The new Linux mseal(), listmount(), statmount() syscalls have been
|
||||
added to relevant system call groups.
|
||||
|
||||
* The systemd-ask-password concept has been extended with a per-user
|
||||
concept, i.e. user programs may now ask for passwords via the same
|
||||
* The systemd-ask-password logic has been extended with a per-user
|
||||
scope, i.e. user programs may now ask for passwords via the same
|
||||
mechanism and the previously system-wide only mechanism.
|
||||
|
||||
* A new set of system/service credentials are added:
|
||||
|
|
@ -681,17 +702,8 @@ CHANGES WITH 257 in spe:
|
|||
useful to visually highlight the fact a specific shell prompt
|
||||
originates from a specific system, execution context or tool. These
|
||||
credentials and environment variables are supposed to be generically
|
||||
useful within and outside of the immediate systemd context.
|
||||
|
||||
* run0 gained a new pair of settings --pty and --pipe that control
|
||||
whether to invoke the specified binary on a freshly allocated pseudo
|
||||
TTY, or whether to pass the client's STDIN/STDOUT/STDERR through
|
||||
directly. run0 also gained a new switch --shell-prompt-prefix= that
|
||||
permits passing in a string to display on each shell prompt as
|
||||
prefix. If not specified otherwise this will show a superman emoji
|
||||
(🦸), in order to visually communicate the temporarily elevated
|
||||
privileges a run0 session provides. This makes use of the
|
||||
$SHELL_PROMPT_PREFIX environment variables mentioned above.
|
||||
useful within and outside of the immediate systemd context. It is
|
||||
also used by 'run0', see above.
|
||||
|
||||
* New RELEASE_TYPE=, EXPERIMENT=, EXPERIMENT_URL= fields have been
|
||||
defined for the /etc/os-release file. For example,
|
||||
|
|
@ -718,28 +730,28 @@ CHANGES WITH 257 in spe:
|
|||
https://github.com/microsoft/terminal/pull/8055
|
||||
https://conemu.github.io/en/AnsiEscapeCodes.html#ConEmu_specific_OSC
|
||||
|
||||
* systemd-sysusers is now able to create fully locked accounts. For
|
||||
compatibility it so far created accounts with a locked (i.e. invalid)
|
||||
password, but not marked locked as a whole. With the new "!" modifier
|
||||
for "u" lines, it is now possible to create fully locked
|
||||
accounts. The distinction between accounts with a locked password and
|
||||
fully locked accounts is relevant when considering non-password forms
|
||||
of authentication, i.e. SSH and such. It is strongly recommended to
|
||||
make use of this new feature for almost all system accounts, since
|
||||
they usually do not require (and should not permit) interactive
|
||||
logins. All of systemd's own system users have been changed to be
|
||||
marked as fully locked.
|
||||
* systemd-sysusers is now able to create fully locked user
|
||||
accounts. For compatibility it so far created accounts with a locked
|
||||
(i.e. invalid) password, but not marked locked as a whole. With the
|
||||
new "!" modifier for "u" lines, it is now possible to create fully
|
||||
locked accounts. The distinction between accounts with a locked
|
||||
password and fully locked accounts is relevant when considering
|
||||
non-password forms of authentication, i.e. SSH and such. It is
|
||||
strongly recommended to make use of this new feature for almost all
|
||||
system accounts, since they usually do not require (and should not
|
||||
permit) interactive logins. All of systemd's own system users have
|
||||
been changed to be marked as fully locked.
|
||||
|
||||
* systemd-coredump now supports a new EnterNamespace= option, which
|
||||
defaults to off. If enabled systemd-coredump will access the mount
|
||||
namespace of any crashed process to acquire debug symbol information,
|
||||
in order to be able to symbolized backtraces. This option is useful
|
||||
to improve backtraces of processes of containerized
|
||||
applications. (Note that the host systemd-coredump preferably
|
||||
dispatches coredump processing to the container itself, if it
|
||||
supports that. Only full-OS containers which run systemd inside will
|
||||
support this however, in which case EnterNamespace= might be an
|
||||
alternative approach to acquire symbolized backtraces.)
|
||||
in order to be able to symbolize backtraces. This option is useful to
|
||||
improve backtraces of processes of containerized applications. (Note
|
||||
that the host systemd-coredump preferably dispatches coredump
|
||||
processing to the container itself, if it supports that. Only full-OS
|
||||
containers which run systemd inside will support this however, in
|
||||
other cases EnterNamespace= might be an suitable approach to acquire
|
||||
symbolized backtraces.)
|
||||
|
||||
Contributions from: A. Wilcox, Abderrahim Kitouni, Adrian Vovk,
|
||||
Alain Greppin, Allison Karlitskaya, Alyssa Ross, Anders Jonsson,
|
||||
|
|
|
|||
6
TODO
6
TODO
|
|
@ -129,6 +129,12 @@ Deprecations and removals:
|
|||
|
||||
Features:
|
||||
|
||||
* machined: when registering a machine, also take a relative cgroup path,
|
||||
relative to the machine's unit. This is useful when registering unpriv
|
||||
machines, as they might sit down the cgroup tree, below a cgroup delegation
|
||||
boundary. Then, install an inotify watch on that cgroup to track when the
|
||||
machine's local cgroup goes down.
|
||||
|
||||
* resolved: report ttl in resolution replies if we know it. This data is useful
|
||||
for tools such as wireguard which want to periodically re-resolve DNS names,
|
||||
and might want to use the TTL has hint for that.
|
||||
|
|
|
|||
|
|
@ -15,18 +15,19 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
|||
6. [RC1] Update library numbers in `meson.build`
|
||||
7. Update version number in `meson.version` (e.g. from `256~devel` to `256~rc1` or from `256~rc3` to `256`). Note that this uses a tilde (\~) instead of a hyphen (-) because tildes sort lower in version comparisons according to the [version format specification](https://uapi-group.org/specifications/specs/version_format_specification/), and we want `255~rc1` to sort lower than `255`.
|
||||
8. Check dbus docs with `ninja -C build update-dbus-docs`
|
||||
9. Update translation strings (`ninja -C build systemd-pot`, `ninja -C build systemd-update-po`) - drop the header comments from `systemd.pot` + re-add SPDX before committing. If the only change in a file is the 'POT-Creation-Date' field, then ignore that file.
|
||||
10. Tag the release: `version="v$(sed 's/~/-/g' meson.version)" && git tag -s "${version}" -m "systemd ${version}"` (tildes are replaced with hyphens, because git doesn't accept the former).
|
||||
11. Do `ninja -C build`
|
||||
12. Make sure that the version string and package string match: `build/systemctl --version`
|
||||
13. [FINAL] Close the github milestone and open a new one (https://github.com/systemd/systemd/milestones)
|
||||
14. "Draft" a new release on github (https://github.com/systemd/systemd/releases/new), mark "This is a pre-release" if appropriate.
|
||||
15. Check that announcement to systemd-devel, with a copy&paste from NEWS, was sent. This should happen automatically.
|
||||
16. Update IRC topic (`/msg chanserv TOPIC #systemd Version NNN released | Online resources https://systemd.io/`)
|
||||
17. [FINAL] Create an empty -stable branch: `git push systemd origin/main:refs/heads/v${version}-stable`.
|
||||
18. [FINAL] Build and upload the documentation (on the -stable branch): `ninja -C build doc-sync`
|
||||
9. Check manpages list with `ninja -C build update-man-rules`
|
||||
10. Update translation strings (`ninja -C build systemd-pot`, `ninja -C build systemd-update-po`) - drop the header comments from `systemd.pot` + re-add SPDX before committing. If the only change in a file is the 'POT-Creation-Date' field, then ignore that file.
|
||||
11. Tag the release: `version="v$(sed 's/~/-/g' meson.version)" && git tag -s "${version}" -m "systemd ${version}"` (tildes are replaced with hyphens, because git doesn't accept the former).
|
||||
12. Do `ninja -C build`
|
||||
13. Make sure that the version string and package string match: `build/systemctl --version`
|
||||
14. [FINAL] Close the github milestone and open a new one (https://github.com/systemd/systemd/milestones)
|
||||
15. "Draft" a new release on github (https://github.com/systemd/systemd/releases/new), mark "This is a pre-release" if appropriate.
|
||||
16. Check that announcement to systemd-devel, with a copy&paste from NEWS, was sent. This should happen automatically.
|
||||
17. Update IRC topic (`/msg chanserv TOPIC #systemd Version NNN released | Online resources https://systemd.io/`)
|
||||
18. [FINAL] Create an empty -stable branch: `git push systemd origin/main:refs/heads/v${version}-stable`.
|
||||
19. [FINAL] Build and upload the documentation (on the -stable branch): `ninja -C build doc-sync`
|
||||
20. [FINAL] Change the Github Pages branch to the newly created branch (https://github.com/systemd/systemd/settings/pages) and set the 'Custom domain' to 'systemd.io'
|
||||
21. [FINAL] Update version number in `meson.version` to the devel version of the next release (e.g. from `v256` to `v257~devel`)
|
||||
21. [FINAL] Update version number in `meson.version` to the devel version of the next release (e.g. from `256` to `257~devel`)
|
||||
|
||||
# Steps to a Successful Stable Release
|
||||
|
||||
|
|
|
|||
|
|
@ -1069,6 +1069,7 @@ manpages = [
|
|||
'ENABLE_RFKILL'],
|
||||
['systemd-run-generator', '8', [], ''],
|
||||
['systemd-run', '1', [], ''],
|
||||
['systemd-sbsign', '1', [], ''],
|
||||
['systemd-sleep.conf', '5', ['sleep.conf.d'], ''],
|
||||
['systemd-socket-activate', '1', [], ''],
|
||||
['systemd-socket-proxyd', '8', [], ''],
|
||||
|
|
|
|||
|
|
@ -83,7 +83,7 @@
|
|||
|
||||
<varlistentry>
|
||||
<term><option>--private-key=<replaceable>PATH/URI</replaceable></option></term>
|
||||
<term><option>--private-key-source=<replaceable>TYPE</replaceable>[:<replaceable>NAME<replaceable>]</option></term>
|
||||
<term><option>--private-key-source=<replaceable>TYPE</replaceable>[:<replaceable>NAME</replaceable>]</option></term>
|
||||
<term><option>--certificate=<replaceable>PATH</replaceable></option></term>
|
||||
|
||||
<listitem><para>Set the Secure Boot private key and certificate for use with the
|
||||
|
|
|
|||
|
|
@ -562,6 +562,13 @@
|
|||
To disable the safety check that the extension-release file name matches the image file name, the
|
||||
<varname>x-systemd.relax-extension-release-check</varname> mount option may be appended.</para>
|
||||
|
||||
<para>This option can be used together with a <option>notify-reload</option> service type and
|
||||
<citerefentry><refentrytitle>systemd.v</refentrytitle><manvolnum>7</manvolnum></citerefentry>
|
||||
to manage configuration updates. When such a service carrying confext images is reloaded, the confext
|
||||
itself will also be reloaded to pick up any changes. This only applies to confext extensions. See
|
||||
<citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
||||
also for details.</para>
|
||||
|
||||
<para>When <varname>DevicePolicy=</varname> is set to <literal>closed</literal> or
|
||||
<literal>strict</literal>, or set to <literal>auto</literal> and <varname>DeviceAllow=</varname> is
|
||||
set, then this setting adds <filename>/dev/loop-control</filename> with <constant>rw</constant> mode,
|
||||
|
|
@ -606,6 +613,14 @@
|
|||
or the host. See:
|
||||
<citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
|
||||
|
||||
<para>This option can be used together with a <option>notify-reload</option> service type and
|
||||
<citerefentry><refentrytitle>systemd.v</refentrytitle><manvolnum>7</manvolnum></citerefentry>
|
||||
to manage configuration updates. When such a system service carrying confext directories is reloaded,
|
||||
the confext itself will also be reloaded to pick up any changes. This only applies to confext
|
||||
extensions. See
|
||||
<citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
||||
also for details.</para>
|
||||
|
||||
<para>Note that usage from user units requires overlayfs support in unprivileged user namespaces,
|
||||
which was first introduced in kernel v5.11.</para>
|
||||
|
||||
|
|
|
|||
|
|
@ -71,6 +71,7 @@
|
|||
#include "unit-serialize.h"
|
||||
#include "user-util.h"
|
||||
#include "utmp-wtmp.h"
|
||||
#include "vpick.h"
|
||||
|
||||
static bool is_terminal_input(ExecInput i) {
|
||||
return IN_SET(i,
|
||||
|
|
@ -1938,6 +1939,25 @@ char** exec_context_get_restrict_filesystems(const ExecContext *c) {
|
|||
return l ? TAKE_PTR(l) : strv_new(NULL);
|
||||
}
|
||||
|
||||
int exec_context_has_vpicked_extensions(const ExecContext *context) {
|
||||
int r;
|
||||
|
||||
assert(context);
|
||||
|
||||
FOREACH_ARRAY(mi, context->extension_images, context->n_extension_images) {
|
||||
r = path_uses_vpick(mi->source);
|
||||
if (r != 0)
|
||||
return r;
|
||||
}
|
||||
STRV_FOREACH(ed, context->extension_directories) {
|
||||
r = path_uses_vpick(*ed);
|
||||
if (r != 0)
|
||||
return r;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
void exec_status_start(ExecStatus *s, pid_t pid, const dual_timestamp *ts) {
|
||||
assert(s);
|
||||
|
||||
|
|
|
|||
|
|
@ -559,6 +559,8 @@ char** exec_context_get_syscall_log(const ExecContext *c);
|
|||
char** exec_context_get_address_families(const ExecContext *c);
|
||||
char** exec_context_get_restrict_filesystems(const ExecContext *c);
|
||||
|
||||
int exec_context_has_vpicked_extensions(const ExecContext *context);
|
||||
|
||||
void exec_status_start(ExecStatus *s, pid_t pid, const dual_timestamp *ts);
|
||||
void exec_status_exit(ExecStatus *s, const ExecContext *context, pid_t pid, int code, int status);
|
||||
void exec_status_handoff(ExecStatus *s, const struct ucred *ucred, const dual_timestamp *ts);
|
||||
|
|
|
|||
|
|
@ -37,6 +37,8 @@
|
|||
#include "nulstr-util.h"
|
||||
#include "os-util.h"
|
||||
#include "path-util.h"
|
||||
#include "pidref.h"
|
||||
#include "process-util.h"
|
||||
#include "selinux-util.h"
|
||||
#include "socket-util.h"
|
||||
#include "sort-util.h"
|
||||
|
|
@ -3296,6 +3298,117 @@ bool ns_type_supported(NamespaceType type) {
|
|||
return access(ns_proc, F_OK) == 0;
|
||||
}
|
||||
|
||||
int refresh_extensions_in_namespace(
|
||||
const PidRef *target,
|
||||
const char *hierarchy_env,
|
||||
const NamespaceParameters *p) {
|
||||
|
||||
const char *overlay_prefix = "/run/systemd/mount-rootfs";
|
||||
_cleanup_(mount_list_done) MountList ml = {};
|
||||
_cleanup_free_ char *extension_dir = NULL;
|
||||
_cleanup_strv_free_ char **hierarchies = NULL;
|
||||
MountInNamespaceFlags min_flags = 0;
|
||||
int r;
|
||||
|
||||
assert(pidref_is_set(target));
|
||||
assert(hierarchy_env);
|
||||
assert(p);
|
||||
|
||||
log_debug("Refreshing extensions in-namespace for hierarchy '%s'", hierarchy_env);
|
||||
|
||||
extension_dir = path_join(p->private_namespace_dir, "unit-extensions");
|
||||
if (!extension_dir)
|
||||
return -ENOMEM;
|
||||
|
||||
min_flags |= MOUNT_IN_NAMESPACE_MAKE_FILE_OR_DIRECTORY;
|
||||
|
||||
r = parse_env_extension_hierarchies(&hierarchies, hierarchy_env);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
r = append_extensions(
|
||||
&ml,
|
||||
overlay_prefix,
|
||||
p->private_namespace_dir,
|
||||
hierarchies,
|
||||
p->extension_images,
|
||||
p->n_extension_images,
|
||||
p->extension_directories);
|
||||
if (r < 0)
|
||||
return r;
|
||||
if (ml.n_mounts == 0)
|
||||
return 0;
|
||||
|
||||
r = safe_fork("(sd-ns-refresh-exts)",
|
||||
FORK_DEATHSIG_SIGTERM | FORK_WAIT | FORK_NEW_MOUNTNS | FORK_MOUNTNS_SLAVE,
|
||||
NULL);
|
||||
if (r < 0)
|
||||
return r;
|
||||
if (r == 0) {
|
||||
(void) mkdir_p_label(overlay_prefix, 0555);
|
||||
|
||||
/* This is effectively two rounds, since all the extensions come before overlays
|
||||
* (setup_namespace() similarly relies on this property).
|
||||
*
|
||||
* (1) First, set up all the extension mounts in the child, which are not visible from the
|
||||
* process. (2) Then, set up overlays for the sysext/confext hierarchies again using the new
|
||||
* extension mounts as layers, and move them into the namespace. */
|
||||
FOREACH_ARRAY(m, ml.mounts, ml.n_mounts) {
|
||||
if (IN_SET(m->mode, MOUNT_EXTENSION_DIRECTORY, MOUNT_EXTENSION_IMAGE)) {
|
||||
r = apply_one_mount(p->root_directory, m, p);
|
||||
if (r < 0) {
|
||||
log_debug_errno(r, "Failed to apply extension mount: %m");
|
||||
_exit(EXIT_FAILURE);
|
||||
}
|
||||
} else if (m->mode == MOUNT_OVERLAY) {
|
||||
_cleanup_free_ char *path_relative = NULL, *path_in_namespace = NULL;
|
||||
|
||||
r = apply_one_mount(p->root_directory, m, p);
|
||||
if (r < 0)
|
||||
_exit(EXIT_FAILURE);
|
||||
if (r == 0) {
|
||||
/* Tried to mount overlay, but it is now empty - umount it then. */
|
||||
min_flags |= MOUNT_IN_NAMESPACE_UMOUNT;
|
||||
}
|
||||
|
||||
/* bind_mount_in_namespace takes a src on the outside and a dest evaluated
|
||||
* within the namespace. First, figure out where we want the overlay on top
|
||||
* of within the namespace.
|
||||
*/
|
||||
r = path_make_relative(overlay_prefix, mount_entry_path(m), &path_relative);
|
||||
if (r < 0) {
|
||||
log_debug_errno(r, "Failed to make path relative: %m");
|
||||
_exit(EXIT_FAILURE);
|
||||
}
|
||||
r = asprintf(&path_in_namespace, "%s/%s", empty_to_root(p->root_directory), path_relative);
|
||||
if (r < 0) {
|
||||
log_oom_debug();
|
||||
_exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
r = bind_mount_in_namespace(
|
||||
target,
|
||||
p->propagate_dir,
|
||||
p->incoming_dir,
|
||||
/* src= */ mount_entry_path(m),
|
||||
/* dest= */ path_in_namespace,
|
||||
min_flags);
|
||||
if (r < 0) {
|
||||
log_debug_errno(
|
||||
r,
|
||||
"Failed to move overlay within %s->%s: %m",
|
||||
mount_entry_path(m),
|
||||
path_in_namespace);
|
||||
_exit(EXIT_FAILURE);
|
||||
}
|
||||
}
|
||||
}
|
||||
_exit(EXIT_SUCCESS);
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static const char *const protect_home_table[_PROTECT_HOME_MAX] = {
|
||||
[PROTECT_HOME_NO] = "no",
|
||||
[PROTECT_HOME_YES] = "yes",
|
||||
|
|
|
|||
|
|
@ -16,6 +16,7 @@ typedef struct MountImage MountImage;
|
|||
#include "fs-util.h"
|
||||
#include "macro.h"
|
||||
#include "namespace-util.h"
|
||||
#include "pidref.h"
|
||||
#include "runtime-scope.h"
|
||||
#include "string-util.h"
|
||||
|
||||
|
|
@ -250,3 +251,8 @@ const char* namespace_type_to_string(NamespaceType t) _const_;
|
|||
NamespaceType namespace_type_from_string(const char *s) _pure_;
|
||||
|
||||
bool ns_type_supported(NamespaceType type);
|
||||
|
||||
int refresh_extensions_in_namespace(
|
||||
const PidRef *target,
|
||||
const char *hierarchy_env,
|
||||
const NamespaceParameters *p);
|
||||
|
|
|
|||
|
|
@ -21,6 +21,7 @@
|
|||
#include "devnum-util.h"
|
||||
#include "env-util.h"
|
||||
#include "escape.h"
|
||||
#include "execute.h"
|
||||
#include "exec-credential.h"
|
||||
#include "exit-status.h"
|
||||
#include "fd-util.h"
|
||||
|
|
@ -33,11 +34,13 @@
|
|||
#include "manager.h"
|
||||
#include "missing_audit.h"
|
||||
#include "mount-util.h"
|
||||
#include "namespace.h"
|
||||
#include "open-file.h"
|
||||
#include "parse-util.h"
|
||||
#include "path-util.h"
|
||||
#include "process-util.h"
|
||||
#include "random-util.h"
|
||||
#include "runtime-scope.h"
|
||||
#include "selinux-util.h"
|
||||
#include "serialize.h"
|
||||
#include "service.h"
|
||||
|
|
@ -2709,6 +2712,67 @@ static void service_enter_reload_by_notify(Service *s) {
|
|||
log_unit_warning(UNIT(s), "Failed to schedule propagation of reload, ignoring: %s", bus_error_message(&error, r));
|
||||
}
|
||||
|
||||
static bool service_should_reload_extensions(Service *s) {
|
||||
int r;
|
||||
|
||||
assert(s);
|
||||
|
||||
/* Only support this for notify-reload service types. */
|
||||
if (s->type != SERVICE_NOTIFY_RELOAD)
|
||||
return false;
|
||||
|
||||
/* TODO: Add support for user services, which can use
|
||||
* ExtensionDirectories= + notify-reload. For now, skip for user
|
||||
* services. */
|
||||
if (UNIT(s)->manager->runtime_scope != RUNTIME_SCOPE_SYSTEM) {
|
||||
log_unit_debug(UNIT(s), "Not reloading extensions for user services.");
|
||||
return false;
|
||||
}
|
||||
|
||||
r = exec_context_has_vpicked_extensions(&s->exec_context);
|
||||
if (r < 0) {
|
||||
log_unit_warning_errno(UNIT(s), r, "Failed to determine if service should reload extensions, assuming false: %m");
|
||||
return false;
|
||||
}
|
||||
return r > 0;
|
||||
}
|
||||
|
||||
static int service_reload_extensions(Service *s) {
|
||||
/* TODO: do this asynchronously */
|
||||
_cleanup_free_ char *propagate_dir = NULL;
|
||||
|
||||
assert(s);
|
||||
|
||||
/* TODO: remove after adding support for user services */
|
||||
assert(UNIT(s)->manager->runtime_scope == RUNTIME_SCOPE_SYSTEM);
|
||||
|
||||
if (!service_should_reload_extensions(s))
|
||||
return 0;
|
||||
|
||||
propagate_dir = path_join("/run/systemd/propagate/", UNIT(s)->id);
|
||||
if (!propagate_dir)
|
||||
return -ENOMEM;
|
||||
|
||||
NamespaceParameters p = {
|
||||
.private_namespace_dir = "/run/systemd",
|
||||
.incoming_dir = "/run/systemd/incoming",
|
||||
.propagate_dir = propagate_dir,
|
||||
.runtime_scope = UNIT(s)->manager->runtime_scope,
|
||||
.root_directory = s->exec_context.root_directory,
|
||||
.extension_images = s->exec_context.extension_images,
|
||||
.n_extension_images = s->exec_context.n_extension_images,
|
||||
.extension_directories = s->exec_context.extension_directories,
|
||||
.extension_image_policy = s->exec_context.extension_image_policy
|
||||
};
|
||||
|
||||
/* Only reload confext, and not sysext, because it doesn't make sense
|
||||
for program code to be swapped at reload. */
|
||||
return refresh_extensions_in_namespace(
|
||||
unit_main_pid(UNIT(s)),
|
||||
"SYSTEMD_CONFEXT_HIERARCHIES",
|
||||
&p);
|
||||
}
|
||||
|
||||
static void service_enter_reload(Service *s) {
|
||||
bool killed = false;
|
||||
int r;
|
||||
|
|
@ -2720,6 +2784,14 @@ static void service_enter_reload(Service *s) {
|
|||
|
||||
usec_t ts = now(CLOCK_MONOTONIC);
|
||||
|
||||
/* If we have confexts extensions, try to reload vpick'd confext extensions, which is particularly
|
||||
* beneficial for notify-reload services that could potentially pick up a new version of its
|
||||
* configuration.
|
||||
*/
|
||||
r = service_reload_extensions(s);
|
||||
if (r < 0)
|
||||
log_unit_warning_errno(UNIT(s), r, "Failed to reload confexts, ignoring: %m");
|
||||
|
||||
if (s->type == SERVICE_NOTIFY_RELOAD && pidref_is_set(&s->main_pid)) {
|
||||
r = pidref_kill_and_sigcont(&s->main_pid, s->reload_signal);
|
||||
if (r < 0) {
|
||||
|
|
|
|||
|
|
@ -1132,7 +1132,7 @@ static int mount_in_namespace(
|
|||
_cleanup_close_pair_ int errno_pipe_fd[2] = EBADF_PAIR;
|
||||
pid_t child;
|
||||
|
||||
if (flags & MOUNT_IN_NAMESPACE_IS_IMAGE) {
|
||||
if (!(flags & MOUNT_IN_NAMESPACE_UMOUNT) && flags & MOUNT_IN_NAMESPACE_IS_IMAGE) {
|
||||
r = verity_dissect_and_mount(
|
||||
chased_src_fd,
|
||||
chased_src_path,
|
||||
|
|
@ -1150,7 +1150,7 @@ static int mount_in_namespace(
|
|||
return log_debug_errno(r,
|
||||
"Failed to dissect and mount image '%s': %m",
|
||||
chased_src_path);
|
||||
} else {
|
||||
} else if (!(flags & MOUNT_IN_NAMESPACE_UMOUNT)) {
|
||||
new_mount_fd = open_tree(
|
||||
chased_src_fd,
|
||||
"",
|
||||
|
|
@ -1189,6 +1189,18 @@ static int mount_in_namespace(
|
|||
if (r == 0) {
|
||||
errno_pipe_fd[0] = safe_close(errno_pipe_fd[0]);
|
||||
|
||||
if (flags & MOUNT_IN_NAMESPACE_UMOUNT) {
|
||||
r = umount_verbose(LOG_DEBUG, dest, UMOUNT_NOFOLLOW);
|
||||
if (r < 0) {
|
||||
(void) write(errno_pipe_fd[1], &r, sizeof(r));
|
||||
errno_pipe_fd[1] = safe_close(errno_pipe_fd[1]);
|
||||
|
||||
_exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
_exit(EXIT_SUCCESS);
|
||||
}
|
||||
|
||||
if (flags & MOUNT_IN_NAMESPACE_MAKE_FILE_OR_DIRECTORY)
|
||||
(void) mkdir_parents(dest, 0755);
|
||||
|
||||
|
|
|
|||
|
|
@ -119,6 +119,7 @@ typedef enum MountInNamespaceFlags {
|
|||
MOUNT_IN_NAMESPACE_READ_ONLY = 1 << 0,
|
||||
MOUNT_IN_NAMESPACE_MAKE_FILE_OR_DIRECTORY = 1 << 1,
|
||||
MOUNT_IN_NAMESPACE_IS_IMAGE = 1 << 2,
|
||||
MOUNT_IN_NAMESPACE_UMOUNT = 1 << 3,
|
||||
} MountInNamespaceFlags;
|
||||
|
||||
int bind_mount_in_namespace(
|
||||
|
|
|
|||
|
|
@ -681,6 +681,41 @@ int path_pick_update_warn(
|
|||
return 1;
|
||||
}
|
||||
|
||||
int path_uses_vpick(const char *path) {
|
||||
_cleanup_free_ char *dir = NULL, *parent = NULL, *fname = NULL;
|
||||
int r;
|
||||
|
||||
assert(path);
|
||||
|
||||
r = path_extract_filename(path, &fname);
|
||||
if (r == -EADDRNOTAVAIL)
|
||||
return 0;
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
/* ...PATH/NAME.SUFFIX.v */
|
||||
if (endswith(fname, ".v"))
|
||||
return 1;
|
||||
|
||||
/* ...PATH.v/NAME___.SUFFIX */
|
||||
if (!strrstr(fname, "___"))
|
||||
return 0;
|
||||
|
||||
r = path_extract_directory(path, &dir);
|
||||
if (IN_SET(r, -EDESTADDRREQ, -EADDRNOTAVAIL)) /* only filename specified (no dir), or root or "." */
|
||||
return 0;
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
r = path_extract_filename(dir, &parent);
|
||||
if (r == -EADDRNOTAVAIL)
|
||||
return 0;
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
return !!endswith(parent, ".v");
|
||||
}
|
||||
|
||||
const PickFilter pick_filter_image_raw = {
|
||||
.type_mask = (UINT32_C(1) << DT_REG) | (UINT32_C(1) << DT_BLK),
|
||||
.architecture = _ARCHITECTURE_INVALID,
|
||||
|
|
|
|||
|
|
@ -56,6 +56,8 @@ int path_pick_update_warn(
|
|||
PickFlags flags,
|
||||
PickResult *ret);
|
||||
|
||||
int path_uses_vpick(const char *path);
|
||||
|
||||
extern const PickFilter pick_filter_image_raw;
|
||||
extern const PickFilter pick_filter_image_dir;
|
||||
extern const PickFilter pick_filter_image_any;
|
||||
|
|
|
|||
|
|
@ -168,4 +168,27 @@ TEST(path_pick) {
|
|||
assert_se(result.architecture == ARCHITECTURE_S390);
|
||||
}
|
||||
|
||||
TEST(path_uses_vpick) {
|
||||
assert_se(path_uses_vpick("foo.v") > 0);
|
||||
assert_se(path_uses_vpick("path/to/foo.v") > 0);
|
||||
assert_se(path_uses_vpick("./path/to/foo.v") > 0);
|
||||
assert_se(path_uses_vpick("path/to.v/foo.v") > 0);
|
||||
assert_se(path_uses_vpick("path/to/foo.raw.v") > 0);
|
||||
assert_se(path_uses_vpick("/var/lib/machines/mymachine.raw.v/") > 0);
|
||||
assert_se(path_uses_vpick("path/to.v/foo___.hi/a.v") > 0);
|
||||
assert_se(!path_uses_vpick("path/to/foo.mp4.vtt"));
|
||||
assert_se(!path_uses_vpick("path/to/foo.mp4.v.1"));
|
||||
assert_se(!path_uses_vpick("path/to.v/a"));
|
||||
|
||||
assert_se(path_uses_vpick("to.v/foo___.raw") > 0);
|
||||
assert_se(path_uses_vpick("path/to.v/foo___.raw") > 0);
|
||||
assert_se(!path_uses_vpick("path/to/foo___.raw"));
|
||||
assert_se(!path_uses_vpick("path/to.v/foo__"));
|
||||
assert_se(!path_uses_vpick("foo___.raw"));
|
||||
|
||||
assert_se(path_uses_vpick("/") < 1);
|
||||
assert_se(path_uses_vpick(".") < 1);
|
||||
assert_se(path_uses_vpick("") < 1);
|
||||
}
|
||||
|
||||
DEFINE_TEST_MAIN(LOG_DEBUG);
|
||||
|
|
|
|||
|
|
@ -518,6 +518,72 @@ rm -rf "$VDIR" "$EMPTY_VDIR"
|
|||
systemd-dissect --umount "$IMAGE_DIR/app0"
|
||||
systemd-dissect --umount "$IMAGE_DIR/app1"
|
||||
|
||||
# Check reloading refreshes vpick extensions
|
||||
VBASE="vtest$RANDOM"
|
||||
VDIR="/tmp/${VBASE}.v"
|
||||
mkdir "$VDIR"
|
||||
cat >/run/systemd/system/testservice-50g.service <<EOF
|
||||
[Service]
|
||||
Type=notify-reload
|
||||
EnvironmentFile=-/usr/lib/systemd/systemd-asan-env
|
||||
ExtensionDirectories=${VDIR}
|
||||
ExecStart=bash -c ' \\
|
||||
trap "{ \\
|
||||
systemd-notify --reloading; \\
|
||||
ls /etc | grep marker; \\
|
||||
systemd-notify --ready; \\
|
||||
}" SIGHUP; \\
|
||||
systemd-notify --ready; \\
|
||||
while true; do sleep 1; done; \\
|
||||
'
|
||||
EOF
|
||||
mkdir -p "$VDIR/${VBASE}_1/etc/extension-release.d/"
|
||||
echo "ID=_any" >"$VDIR/${VBASE}_1/etc/extension-release.d/extension-release.${VBASE}_1"
|
||||
touch "$VDIR/${VBASE}_1/etc/${VBASE}_1.marker"
|
||||
systemctl start testservice-50g.service
|
||||
systemctl is-active testservice-50g.service
|
||||
# First reload; at reload time, the marker file in /etc should be picked up.
|
||||
systemctl try-reload-or-restart testservice-50g.service
|
||||
journalctl -b -u testservice-50g | grep -q -F "${VBASE}_1.marker"
|
||||
# Make a version 2 and reload again; this time we should see the v2 marker
|
||||
mkdir -p "$VDIR/${VBASE}_2/etc/extension-release.d/"
|
||||
echo "ID=_any" >"$VDIR/${VBASE}_2/etc/extension-release.d/extension-release.${VBASE}_2"
|
||||
touch "$VDIR/${VBASE}_2/etc/${VBASE}_2.marker"
|
||||
systemctl try-reload-or-restart testservice-50g.service
|
||||
journalctl --sync
|
||||
journalctl -b -u testservice-50g | grep -q -F "${VBASE}_2.marker"
|
||||
# Do it for a couple more times (to make sure we're tearing down old overlays)
|
||||
for _ in {1..5}; do systemctl reload testservice-50g.service; done
|
||||
systemctl stop testservice-50g.service
|
||||
|
||||
# Repeat the same vpick notify-reload test with ExtensionImages= (keeping the
|
||||
# same VBASE and reusing VDIR files for convenience, but using .raw extensions
|
||||
# this time)
|
||||
VDIR2="/tmp/${VBASE}.raw.v"
|
||||
mkdir "$VDIR2"
|
||||
cp /run/systemd/system/testservice-50g.service /run/systemd/system/testservice-50h.service
|
||||
sed -i "s%ExtensionDirectories=.*%ExtensionImages=$VDIR2%g" \
|
||||
/run/systemd/system/testservice-50h.service
|
||||
mksquashfs "$VDIR/${VBASE}_1" "$VDIR2/${VBASE}_1.raw"
|
||||
systemctl start testservice-50h.service
|
||||
systemctl is-active testservice-50h.service
|
||||
# First reload should pick up the v1 marker
|
||||
systemctl try-reload-or-restart testservice-50h.service
|
||||
journalctl --sync
|
||||
journalctl -b -u testservice-50h | grep -q -F "${VBASE}_1.marker"
|
||||
# Second reload should pick up the v2 marker
|
||||
mksquashfs "$VDIR/${VBASE}_2" "$VDIR2/${VBASE}_2.raw"
|
||||
systemctl try-reload-or-restart testservice-50h.service
|
||||
journalctl --sync
|
||||
journalctl -b -u testservice-50h | grep -q -F "${VBASE}_2.marker"
|
||||
# Test that removing all the extensions don't cause any issues
|
||||
rm -rf "${VDIR2:?}"/*
|
||||
systemctl try-reload-or-restart testservice-50h.service
|
||||
systemctl is-active testservice-50h.service
|
||||
systemctl stop testservice-50h.service
|
||||
|
||||
rm -rf "$VDIR" "$VDIR2"
|
||||
|
||||
# Test that an extension consisting of an empty directory under /etc/extensions/ takes precedence
|
||||
mkdir -p /var/lib/extensions/
|
||||
ln -s /tmp/app-nodistro.raw /var/lib/extensions/app-nodistro.raw
|
||||
|
|
|
|||
Loading…
Reference in New Issue