Didier Roche [Fri, 22 May 2015 11:04:38 +0000 (13:04 +0200)]
fsckd daemon for inter-fsckd communication
Global logic:
Add systemd-fsckd multiplexer which accepts multiple (via systemd-fsck's
/run/systemd/fsck.progress socket) fsck instances to connect to it and sends
progress report. systemd-fsckd then computes and writes to /dev/console the
number of devices currently being checked and the minimum fsck progress.
Plymouth and user interaction:
Forward the progress to plymouth and support canellation of in progress fsck.
Try to connect and send to plymouth (if running) some checked report progress,
using direct plymouth protocole.
Update message is the following:
fsckd:<num_devices>:<progress>:<string>
* num_devices corresponds to the current number of devices being checked (int)
* progress corresponds to the current minimum percentage of all devices being
checked (float, from 0 to 100)
* string is a translated message ready to be displayed by the plymouth theme
displaying the information above. It can be overridden by plymouth themes
supporting i18n.
Grab in fsckd plymouth watch key Control+C, and propagate this cancel request
to systemd-fsck which will terminate fsck.
Send a message to signal to user what key we are grabbing for fsck cancel.
Message is: fsckd-cancel-msg:<string>
Where string is a translated string ready to be displayed by the plymouth theme
indicating that Control+C can be used to cancel current checks. It can be
overridden (matching only fsckd-cancel-msg prefix) for themes supporting i18n.
Misc:
systemd-fsckd stops on idle when no fsck is connected.
Add man page explaining the plymouth theme protocol, usage of the daemon
as well as the socket activation part. Adapt existing fsck man page.
Note that fsckd had lived in the upstream tree for a while, but was removed.
More information at
http://lists.freedesktop.org/archives/systemd-devel/2015-April/030175.html
-
Gbp-Pq: Topic debian
Gbp-Pq: Name fsckd-daemon-for-inter-fsckd-communication.patch
Martin Pitt [Mon, 9 Feb 2015 09:53:43 +0000 (10:53 +0100)]
Only start logind if dbus is installed
logind fails to start in environments without dbus, such as LXC containers or
servers. Add a startup condition to avoid the very noisy startup failure.
Part of #772700
Gbp-Pq: Topic debian
Gbp-Pq: Name Only-start-logind-if-dbus-is-installed.patch
for details. Once we grow a journal.conf.d/ directory, sysloggers can be moved
to pulling from the journal one by one and disable forwarding again in such a
conf.d snippet.
Gbp-Pq: Topic debian
Gbp-Pq: Name Re-enable-journal-forwarding-to-syslog.patch
systemd does not support non-mainline kernel features so upstream rejected this
patch.
It is however required for systemd integration by tuxonice-userui package.
We need to keep supporting systems with 75-persistent-net-generator.rules
generated names for a while after switching to net.ifnames. Re-apply this old
hack to make the renaming less likely to fail.
Gbp-Pq: Topic debian
Gbp-Pq: Name Revert-udev-network-device-renaming-immediately-give.patch
Michael Biebl [Thu, 4 Sep 2014 23:15:16 +0000 (01:15 +0200)]
Make /run/lock tmpfs an API fs
The /run/lock directory is world-writable in Debian due to historic
reasons. To avoid user processes filling up /run, we mount a separate
tmpfs for /run/lock. As this directory needs to be available during
early boot, we make it an API fs.
Drop it from tmpfiles.d/legacy.conf to not clobber the permissions.
Closes: #751392
Gbp-Pq: Topic debian
Gbp-Pq: Name Make-run-lock-tmpfs-an-API-fs.patch
Yu Watanabe [Fri, 22 Feb 2019 04:27:44 +0000 (13:27 +0900)]
network: remove routing policy rule from foreign rule database when it is removed
Previously, When the first link configures rules, it removes all saved
rules, which were configured by networkd previously, in the foreign rule
database, but the rules themselves are still in the database.
Thus, when the second or later link configures rules, it errnously
treats the rules already exist.
This is the root of issue #11280.
This removes rules from the foreign database when they are removed.
Previously, RUN and SECLABEL keys are stored in udev_list with its unique
flag is false. If the flag is false, then udev_list is just a linked
list and new entries are always added in the last.
So, we should use OrderedHashmap instead of Hashmap.
remove "." path components from required mount paths
unit_require_mounts_for may be passed path arguments that contain "."
components like for user's home directories where "." is sometimes used
to specify some form of anchor point.
This change stops considering such path as an error and removes the "."
components instead.
cgtop: Fix processing of controllers other than CPU
After debugging the issue with gdb, I found that the following change
94ddb08 "cgtop: Still try to get CPU statistics if controller-free"
has introduced a bug, which prevents process(..) method processing
memory and io controllers when cpu_accounting_is_cheap() is true.
The obvious fix is to move this branch to be the last one, keeping
the intended behavior of the above change, without having a negative
effect on the other controllers.
Fixes #11773 [systemd-cgtop no longer shows memory (and io) usage]
Martin Pitt [Wed, 27 Feb 2019 22:15:31 +0000 (23:15 +0100)]
networkd-test: ignore failures of test_route_only_dns* in containers
This test exposes a race condition when running in LXC, see issue #11848
for details. Until that is understood and fixed, skip the test as it's
not a recent regression.
Martin Pitt [Thu, 21 Feb 2019 11:34:23 +0000 (12:34 +0100)]
networkd-test: fix test_dropin()
- This test needs resolved, so make sure it is started. In some Debian
environments it is not.
- It was an unnecessary, and now failing assumption that name servers
get atomically written to the resolved's resolv.conf. Wait until both
expected name servers are in the file.
Martin Pitt [Thu, 21 Feb 2019 11:26:44 +0000 (12:26 +0100)]
networkd-test: use a complete domain name in test_route_only_dns()
Since version 241 (commit ea4678?), querying MX type records for
single-label domains does not actually forward the query to the DNS
server any more. Use "example.com" instead, which is the recommended
test domain anyway.
Martin Pitt [Thu, 21 Feb 2019 11:24:16 +0000 (12:24 +0100)]
networkd-test: disable DNSSEC in domain-restricted DNS test
dnsmasq 2.80 changed behaviour when being queried by resolved with
enabled DNSSEC: It returns errors for SOA and DS queries which cause the
entire query to fail. As we don't configure DNSSEC in this test anyway,
just disable it so that we retain compatibility with old and new dnsmasq
versions.
Before a3ce813697bcc1c4644e097a2f1cd0459326d6ee, all properties in
src->properties and src->properties_db are mixed and copied to
dst->properties_db by device_copy_properties().
So, it is not necessary to store data from udev database file to
sd_device::properties_db before copying properties.
But now, properties are not mixed. So, the read data need to be
stored to also ::properties_db.
Martin Pitt [Sun, 17 Feb 2019 09:17:45 +0000 (10:17 +0100)]
sd-bus: enforce a size limit on D-Bus object paths
Replace stack with heap allocation. This avoids accessing/modifying
memory outside of the allocated stack region by sending specially
crafted D-Bus messages with very large object paths.
Vulnerability discovered by Chris Coulson <chris.coulson@canonical.com>,
patch provided by Riccardo Schirone <rschiron@redhat.com>.
CVE-2019-6454
Gbp-Pq: Name sd-bus-enforce-a-size-limit-on-D-Bus-object-paths.patch
Michael Biebl [Mon, 8 Apr 2019 10:59:32 +0000 (11:59 +0100)]
systemd (241-3) unstable; urgency=high
[ Michael Biebl ]
* Drop systemd-shim alternative from libpam-systemd.
A fixed systemd-shim package which works with newer versions of systemd
is unlikely to happen given that the systemd-shim package has been
removed from the archive. Drop the alternative dependency from
libpam-systemd accordingly.
* Properly remove duplicate directories from systemd package.
When removing duplicate directories from the systemd package, sort the
list of directories in reverse order so we properly delete nested
directories.
* udev: Run programs in the specified order (Closes: #925190)
* bash-completion: Use default completion for redirect operators
(Closes: #924541)
* networkd: Clarify that IPv6 RA uses our own stack, no the kernel's
(Closes: #815582)
* Revert "Drop systemd-timesyncd.service.d/disable-with-time-daemon.conf"
Apparently Conflicts= are not a reliable mechanism to ensure alternative
NTP implementations take precedence over systemd-timesyncd.
(Closes: #902026)
* network: Fix routing policy rule issue.
When multiple links request a routing policy, make sure they are all
applied correctly. (Closes: #924406)
* pam-systemd: Use secure_getenv() rather than getenv()
Fixes a vulnerability in the systemd PAM module which insecurely uses
the environment and lacks seat verification permitting spoofing an
active session to PolicyKit. (CVE-2019-3842)
[ Martin Pitt ]
* Enable udev autopkgtest in containers.
This test doesn't actually need udev.service (which is disabled in
containers) and works fine in LXC.
* Enable boot-and-service autopkgtest in containers
- Skip tests which can't work in containers.
- Add missing rsyslog test dependency.
- e2scrub_reap.service fails in containers, ignore (filed as #926138)
- Relax pgrep pattern for gdm, as there's no wayland session in
containers.
projects / systemd.git / log