mirror of
https://github.com/systemd/systemd
synced 2026-04-23 07:24:51 +02:00
Compare commits
8 Commits
c8a4306e63
...
4bb37359f6
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
4bb37359f6 | ||
|
|
3b1276c28b | ||
|
|
69811f4763 | ||
|
|
2979c852a4 | ||
|
|
cc20479f42 | ||
|
|
8f048bb76a | ||
|
|
172e3817b0 | ||
|
|
e60c3c72f7 |
@ -27,7 +27,7 @@ Please also have a look at our list of [code quality tools](CODE_QUALITY.md) we
|
|||||||
have setup for systemd, to ensure our codebase stays in good shape.
|
have setup for systemd, to ensure our codebase stays in good shape.
|
||||||
|
|
||||||
Please always test your work before submitting a PR. For many of the components
|
Please always test your work before submitting a PR. For many of the components
|
||||||
of systemd testing is straight-forward as you can simply compile systemd and
|
of systemd testing is straightforward as you can simply compile systemd and
|
||||||
run the relevant tool from the build directory.
|
run the relevant tool from the build directory.
|
||||||
|
|
||||||
For some components (most importantly, systemd/PID1 itself) this is not
|
For some components (most importantly, systemd/PID1 itself) this is not
|
||||||
|
|||||||
@ -60,7 +60,7 @@ bytes however, as well as any other binary data. Keys may not include the `=`
|
|||||||
or newline characters (or any other control characters or non-ASCII characters)
|
or newline characters (or any other control characters or non-ASCII characters)
|
||||||
and may not be empty.
|
and may not be empty.
|
||||||
|
|
||||||
Serialization into the datagram payload or `memfd` is straight-forward: each
|
Serialization into the datagram payload or `memfd` is straightforward: each
|
||||||
key/value pair is serialized via one of two methods:
|
key/value pair is serialized via one of two methods:
|
||||||
|
|
||||||
* The first method inserts a `=` character between key and value, and suffixes
|
* The first method inserts a `=` character between key and value, and suffixes
|
||||||
|
|||||||
@ -114,7 +114,7 @@ warning is shown if the specified user name does not qualify by the strict
|
|||||||
rules above.
|
rules above.
|
||||||
|
|
||||||
* No embedded NUL bytes (rationale: handling in C must be possible and
|
* No embedded NUL bytes (rationale: handling in C must be possible and
|
||||||
straight-forward)
|
straightforward)
|
||||||
|
|
||||||
* No names consisting fully of digits (rationale: avoid confusion with numeric
|
* No names consisting fully of digits (rationale: avoid confusion with numeric
|
||||||
UID/GID specifications)
|
UID/GID specifications)
|
||||||
|
|||||||
@ -1145,7 +1145,7 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
|
|||||||
<listitem>
|
<listitem>
|
||||||
<para>Dump the systemd manager environment block. This is the environment
|
<para>Dump the systemd manager environment block. This is the environment
|
||||||
block that is passed to all processes the manager spawns. The environment
|
block that is passed to all processes the manager spawns. The environment
|
||||||
block will be dumped in straight-forward form suitable for sourcing into
|
block will be dumped in straightforward form suitable for sourcing into
|
||||||
most shells. If no special characters or whitespace is present in the variable
|
most shells. If no special characters or whitespace is present in the variable
|
||||||
values, no escaping is performed, and the assignments have the form
|
values, no escaping is performed, and the assignments have the form
|
||||||
<literal>VARIABLE=value</literal>. If whitespace or characters which have
|
<literal>VARIABLE=value</literal>. If whitespace or characters which have
|
||||||
|
|||||||
@ -78,8 +78,7 @@ static int prepare_socket_bind_bpf(
|
|||||||
|
|
||||||
obj = socket_bind_bpf__open();
|
obj = socket_bind_bpf__open();
|
||||||
if (!obj)
|
if (!obj)
|
||||||
return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, SYNTHETIC_ERRNO(ENOMEM),
|
return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, errno, "Failed to open BPF object: %m");
|
||||||
"Failed to open BPF object");
|
|
||||||
|
|
||||||
if (sym_bpf_map__resize(obj->maps.sd_bind_allow, MAX(allow_count, 1u)) != 0)
|
if (sym_bpf_map__resize(obj->maps.sd_bind_allow, MAX(allow_count, 1u)) != 0)
|
||||||
return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, errno,
|
return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, errno,
|
||||||
|
|||||||
@ -34,11 +34,11 @@ static int prepare_restrict_ifaces_bpf(
|
|||||||
|
|
||||||
obj = restrict_ifaces_bpf__open();
|
obj = restrict_ifaces_bpf__open();
|
||||||
if (!obj)
|
if (!obj)
|
||||||
return log_unit_error_errno(u, SYNTHETIC_ERRNO(ENOMEM), "Failed to open BPF object");
|
return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, errno, "Failed to open BPF object: %m");
|
||||||
|
|
||||||
r = sym_bpf_map__resize(obj->maps.sd_restrictif, MAX(set_size(restrict_network_interfaces), 1u));
|
r = sym_bpf_map__resize(obj->maps.sd_restrictif, MAX(set_size(restrict_network_interfaces), 1u));
|
||||||
if (r != 0)
|
if (r != 0)
|
||||||
return log_unit_error_errno(u, r,
|
return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, r,
|
||||||
"Failed to resize BPF map '%s': %m",
|
"Failed to resize BPF map '%s': %m",
|
||||||
sym_bpf_map__name(obj->maps.sd_restrictif));
|
sym_bpf_map__name(obj->maps.sd_restrictif));
|
||||||
|
|
||||||
@ -46,7 +46,7 @@ static int prepare_restrict_ifaces_bpf(
|
|||||||
|
|
||||||
r = restrict_ifaces_bpf__load(obj);
|
r = restrict_ifaces_bpf__load(obj);
|
||||||
if (r != 0)
|
if (r != 0)
|
||||||
return log_unit_error_errno(u, r, "Failed to load BPF object: %m");
|
return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, r, "Failed to load BPF object: %m");
|
||||||
|
|
||||||
map_fd = sym_bpf_map__fd(obj->maps.sd_restrictif);
|
map_fd = sym_bpf_map__fd(obj->maps.sd_restrictif);
|
||||||
|
|
||||||
@ -61,7 +61,9 @@ static int prepare_restrict_ifaces_bpf(
|
|||||||
}
|
}
|
||||||
|
|
||||||
if (sym_bpf_map_update_elem(map_fd, &ifindex, &dummy, BPF_ANY))
|
if (sym_bpf_map_update_elem(map_fd, &ifindex, &dummy, BPF_ANY))
|
||||||
return log_unit_error_errno(u, errno, "Failed to update BPF map '%s' fd: %m", sym_bpf_map__name(obj->maps.sd_restrictif));
|
return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, errno,
|
||||||
|
"Failed to update BPF map '%s' fd: %m",
|
||||||
|
sym_bpf_map__name(obj->maps.sd_restrictif));
|
||||||
}
|
}
|
||||||
|
|
||||||
*ret_object = TAKE_PTR(obj);
|
*ret_object = TAKE_PTR(obj);
|
||||||
|
|||||||
@ -1151,26 +1151,16 @@ static int lock_image_fd(int image_fd, const char *ip) {
|
|||||||
* image file, and send it to our parent. homed will keep it open to ensure no other instance of
|
* image file, and send it to our parent. homed will keep it open to ensure no other instance of
|
||||||
* homed (across the network or such) will also mount the file. */
|
* homed (across the network or such) will also mount the file. */
|
||||||
|
|
||||||
|
assert(image_fd >= 0);
|
||||||
|
assert(ip);
|
||||||
|
|
||||||
r = getenv_bool("SYSTEMD_LUKS_LOCK");
|
r = getenv_bool("SYSTEMD_LUKS_LOCK");
|
||||||
if (r == -ENXIO)
|
if (r == -ENXIO)
|
||||||
return 0;
|
return 0;
|
||||||
if (r < 0)
|
if (r < 0)
|
||||||
return log_error_errno(r, "Failed to parse $SYSTEMD_LUKS_LOCK environment variable: %m");
|
return log_error_errno(r, "Failed to parse $SYSTEMD_LUKS_LOCK environment variable: %m");
|
||||||
if (r > 0) {
|
if (r == 0)
|
||||||
struct stat st;
|
|
||||||
|
|
||||||
if (fstat(image_fd, &st) < 0)
|
|
||||||
return log_error_errno(errno, "Failed to stat image file: %m");
|
|
||||||
if (S_ISBLK(st.st_mode)) {
|
|
||||||
/* Locking block devices doesn't really make sense, as this might interfere with
|
|
||||||
* udev's workings, and these locks aren't network propagated anyway, hence not what
|
|
||||||
* we are after here. */
|
|
||||||
log_debug("Not locking image file '%s', since it's a block device.", ip);
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
|
||||||
r = stat_verify_regular(&st);
|
|
||||||
if (r < 0)
|
|
||||||
return log_error_errno(r, "Image file to lock is not a regular file: %m");
|
|
||||||
|
|
||||||
if (flock(image_fd, LOCK_EX|LOCK_NB) < 0) {
|
if (flock(image_fd, LOCK_EX|LOCK_NB) < 0) {
|
||||||
|
|
||||||
@ -1188,7 +1178,6 @@ static int lock_image_fd(int image_fd, const char *ip) {
|
|||||||
r = sd_pid_notify_with_fds(0, false, "SYSTEMD_LUKS_LOCK_FD=1", &image_fd, 1);
|
r = sd_pid_notify_with_fds(0, false, "SYSTEMD_LUKS_LOCK_FD=1", &image_fd, 1);
|
||||||
if (r < 0)
|
if (r < 0)
|
||||||
log_warning_errno(r, "Failed to send LUKS lock fd to parent, ignoring: %m");
|
log_warning_errno(r, "Failed to send LUKS lock fd to parent, ignoring: %m");
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
@ -1203,6 +1192,8 @@ static int open_image_file(
|
|||||||
const char *ip;
|
const char *ip;
|
||||||
int r;
|
int r;
|
||||||
|
|
||||||
|
assert(h || force_image_path);
|
||||||
|
|
||||||
ip = force_image_path ?: user_record_image_path(h);
|
ip = force_image_path ?: user_record_image_path(h);
|
||||||
|
|
||||||
image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
|
image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
|
||||||
@ -1216,9 +1207,14 @@ static int open_image_file(
|
|||||||
S_ISDIR(st.st_mode) ? SYNTHETIC_ERRNO(EISDIR) : SYNTHETIC_ERRNO(EBADFD),
|
S_ISDIR(st.st_mode) ? SYNTHETIC_ERRNO(EISDIR) : SYNTHETIC_ERRNO(EBADFD),
|
||||||
"Image file %s is not a regular file or block device: %m", ip);
|
"Image file %s is not a regular file or block device: %m", ip);
|
||||||
|
|
||||||
|
/* Locking block devices doesn't really make sense, as this might interfere with
|
||||||
|
* udev's workings, and these locks aren't network propagated anyway, hence not what
|
||||||
|
* we are after here. */
|
||||||
|
if (S_ISREG(st.st_mode)) {
|
||||||
r = lock_image_fd(image_fd, ip);
|
r = lock_image_fd(image_fd, ip);
|
||||||
if (r < 0)
|
if (r < 0)
|
||||||
return r;
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
if (ret_stat)
|
if (ret_stat)
|
||||||
*ret_stat = st;
|
*ret_stat = st;
|
||||||
@ -2204,12 +2200,10 @@ int home_create_luks(
|
|||||||
|
|
||||||
/* Let's place the home directory on a real device, i.e. an USB stick or such */
|
/* Let's place the home directory on a real device, i.e. an USB stick or such */
|
||||||
|
|
||||||
setup->image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
|
setup->image_fd = open_image_file(h, ip, &st);
|
||||||
if (setup->image_fd < 0)
|
if (setup->image_fd < 0)
|
||||||
return log_error_errno(errno, "Failed to open device %s: %m", ip);
|
return setup->image_fd;
|
||||||
|
|
||||||
if (fstat(setup->image_fd, &st) < 0)
|
|
||||||
return log_error_errno(errno, "Failed to stat device %s: %m", ip);
|
|
||||||
if (!S_ISBLK(st.st_mode))
|
if (!S_ISBLK(st.st_mode))
|
||||||
return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Device is not a block device, refusing.");
|
return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Device is not a block device, refusing.");
|
||||||
|
|
||||||
|
|||||||
@ -91,7 +91,7 @@ static int open_source(const char *path, const char *local, int *ret_open_fd) {
|
|||||||
if (path) {
|
if (path) {
|
||||||
open_fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY);
|
open_fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY);
|
||||||
if (open_fd < 0)
|
if (open_fd < 0)
|
||||||
return log_error_errno(errno, "Failed to open raw image to import: %m");
|
return log_error_errno(errno, "Failed to open source file '%s': %m", path);
|
||||||
|
|
||||||
retval = open_fd;
|
retval = open_fd;
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user