summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* test: add test for 'thread safety' of libudevYu Watanabe2018-10-29
| | | | | | This adds a test for 715a970548d03fed18dc66c411c8b42ff21029cf. (cherry picked from commit cb3e926a5da4f73b48f71b541febe646bc1008d7)
* test: add tests for $SYSTEMD_MEMPOOL=Yu Watanabe2018-10-29
| | | | | | | This adds tests for b4f607433cac749b617e15b3d5d122322ed2bc71 and 205c085bc36c2c61a09dc40621d8561b135d9b57 (#9792). (cherry picked from commit 3ffd12bfbe9f91b392d80fbf6a8b2def2a13bf6d)
* mempool: only enable mempool use when linked to libsystemd-shared.soZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | | | | | Mempool use is enabled or disabled based on the mempool_use_allowed symbol that is linked in. Should fix assert crashes in external programs caused by #9792. Replaces #10286. v2: - use two different source files instead of a gcc constructor (cherry picked from commit a5d8835c78112206bbf0812dd4cb471f803bfe88)
* meson: update bug referenceZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | https://github.com/mesonbuild/meson/issues/1644 was resolved in 0.42: https://github.com/mesonbuild/meson/pull/2191/commits/be4428005dff8b17af5696c8f05567de9af1a8c5, but still no-go. (cherry picked from commit 6939fb9eb4c76de630b71f6b2ad98686d7fbd1bf)
* meson: remove old commentZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | The linked page is gone, and I can't quite remember what the warning was about. Something about recursive copying... Everything seems to work. (cherry picked from commit c42c98192484f48342c2c032ea3d00022bd20e92)
* meson: drop workaroundZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | It was added way back, and seems to work fine now without it. (cherry picked from commit 5dbf13fa6c2d5311a9fc236a0a95c1babcc11937)
* meson: include more build settings in status outputLennart Poettering2018-10-29
| | | | (cherry picked from commit 19d8c9c9b7b3507eb2fdcf668a85456a4ae0dbeb)
* Move use_pool() to mempool.c and rename to mempool_enabled()Zbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | The only user is in hashmap.c, but it's a mempool thing. (cherry picked from commit 7c48ea02800782651b7da373c6165abb052f1382)
* hashmap: add an explicit assert() for detecting when objects migrated ↵Lennart Poettering2018-10-29
| | | | | | | | | | | | | between threads When clients don't follow protocol and use the same object from different threads, then we previously would silently corrupt memory. With this assert we'll fail with an assert(). This doesn't fix anything but certainly makes mis-uses easier to detect and debug. Triggered by https://bugzilla.redhat.com/show_bug.cgi?id=1609349 (cherry picked from commit 205c085bc36c2c61a09dc40621d8561b135d9b57)
* hashmap: add an environment variable to turn off the memory pool used by ↵Lennart Poettering2018-10-29
| | | | | | | | hashmaps Triggered by https://bugzilla.redhat.com/show_bug.cgi?id=1609349 (cherry picked from commit b4f607433cac749b617e15b3d5d122322ed2bc71)
* terminal-util: extra safety checks when parsing $COLUMNS or $LINES (#10314)Lennart Poettering2018-10-29
| | | | | | | | Let's make sure the integers we parse out are not larger than USHRT_MAX. This is a good idea as the kernel's TIOCSWINSZ ioctl for sizing terminals can't take larger values, and we shouldn't risk an overflow. (cherry picked from commit d09a71356e3ed78be7cef3cd7d9919dc77508b41)
* shared/sleep-config: add switches to kill specific sleep modesZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | | | | | | /etc/systemd/sleep.conf gains four new switches: AllowSuspend=, AllowHibernation=, AllowSuspendThenHibernate=, AllowHybridSleep=. Disabling specific modes was already possible by masking suspend.target, hibernate.target, suspend-then-hibernate.target, or hybrid-sleep.target. But this is not convenient for distributions, which want to set some defaults based on what they want to support. Having those available as configuration makes it easy to put a config file in /usr/lib/systemd/sleep.conf.d/ that overrides the defaults and gives instructions how to undo that override. (cherry picked from commit e8f1d00d695f491654d50e57c82623288d3bcbeb)
* shared/sleep-config: forbid hibernation if resume= is not configuredZbigniew Jędrzejewski-Szmek2018-10-29
| | | | (cherry picked from commit 5fdf2d51c244288ac41443d1bd81365fab7b7b81)
* basic/proc-cmdline: allow parsing of cmdline from a stringZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | | | Comes with tests. Also add direct test for $SYSTEMD_PROC_CMDLINE. In test-proc-cmdline, "true" was masquerading as PROC_CMDLINE_STRIP_RD_PREFIX, fix that. Also, reorder functions to match call order. (cherry picked from commit 9a135c084ae6d06734ec3380f0eafdecd7c216f8)
* Add $SYSTEMD_IN_INITRD=yes|no override for debuggingZbigniew Jędrzejewski-Szmek2018-10-29
| | | | (cherry picked from commit 0307ea49c70b1ed4f3af3c80566c8c098dc080bb)
* logind: ensure seat0 CanGraphical state is writtenRay Strode2018-10-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For non-`seat0` seats, attaching a graphics card to a seat can lead to it getting created. This is because the graphics device is a "master device" which means that device is a seat-defining device. `seat0` may get created, even before the graphics driver is loaded, though. This is because the graphics driver is loaded asynchronously at startup, and `seat0` is the primary seat of system, associated with the system VTs. When a graphics card is attached to a seat the `CanGraphical` property on that seat will flip to `true`. For seats that haven't been created yet (non-`seat0` seats), this leads to `seat_start` getting called which ultimately causes the seat to get serialized to `/run/systemd/seats`. For `seat0`, which is already created, `seat_start` will return immediately, which means the updated `CanGraphical` state will never get written to `/run/systemd/seats`. The end result is that clients querying `sd_seat_can_graphical` won't get the correct answer for `seat0` in cases where the graphics device takes a long time to load until some other peice of seat state is updated. This commit fixes the problem by calling `seat_save` explicitly for already running seats at the time a graphics device is attached. (cherry picked from commit ad1bf59c67e8d05629a4db00bbbe4d4c1c37fe46)
* * hack around deficiencies in prctl() PR_SET_MM_*Frank Schaefer2018-10-29
| | | | (cherry picked from commit 14ee72b7d8de34a6b02767b865c3c49ceef2ed84)
* fileio: fix error propagation in link_tmpfile()Lennart Poettering2018-10-29
| | | | (cherry picked from commit eaa680c09e5701a62e8ac819211e5969eda84f2d)
* basic/hexdecoct: check for overflowZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | LGTM was complaining: > Multiplication result may overflow 'int' before it is converted to 'long'. Fix this by changing all types to ssize_t and add a check for overflow while at it. (cherry picked from commit 3d6c1844744f631995af72867d5f293430d8015b)
* bus-message: avoid wrap-around when using length read from messageZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | | We would read (-1), and then add 1 to it, call message_peek_body(..., 0, ...), and when trying to make use of the data. The fuzzer test case is just for one site, but they all look similar. v2: fix two UINT8_MAX/UINT32_MAX mismatches founds by LGTM (cherry picked from commit 902000c19830f5e5a96e8948d691b42e91ecb1e7)
* bus-message: return -EBADMSG not -EINVAL on invalid !gvariant messagesZbigniew Jędrzejewski-Szmek2018-10-29
| | | | (cherry picked from commit d831fb6f2bde829f9309aea242f502587662d1cc)
* bus-message: also properly copy struct signature when skippingZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | The change is similar to that in the previous commit, but I don't have a reproducer / test case case for this one, so I'm keeping it seperate. (cherry picked from commit 3d338a302f56c0ef0445660d9856794abe1af8b5)
* bus-message: fix skipping of array fields in !gvariant messagesZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | We copied part of the string into a buffer that was off by two. If the element signature had length one, we'd copy 0 bytes and crash when looking at the "first" byte. Otherwise, we would crash because strncpy would not terminate the string. (cherry picked from commit 73777ddba5100fe6c0791cd37a91f24a515f3202)
* bus-message: fix calculation of offsets table for arraysZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | | This is similar to the grandparent commit 'fix calculation of offsets table', except that now the change is for array elements. Same story as before: we need to make sure that the offsets increase enough taking alignment into account. While at it, rename 'p' to 'previous' to match similar code in other places. (cherry picked from commit f88214cf9d66c93f4d22c4c8980de9ee3ff45bab)
* bus-message: fix calculation of offsets tableZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | | | | | | | | | The offsets specify the ends of variable length data. We would trust the incoming data, putting the offsets specified in our message into the offsets tables after doing some superficial verification. But when actually reading the data we apply alignment, so we would take the previous offset, align it, making it bigger then current offset, and then we'd try to read data of negative length. In the attached example, the message specifies the following offsets: [1, 4] but the alignment of those items is [1, 8] so we'd calculate the second item as starting at 8 and ending at 4. (cherry picked from commit 12603b84d2fb07603e2ea94b240c6b78ad17510e)
* bus-message: do not crash on message with a string of zero lengthZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | We'd calculate the "real" length of the string as 'item_size - 1', which does not work out well when item_size == 0. (cherry picked from commit 81b6e63029eefcb0ec03a3a7c248490e38106073)
* bus-message: let's always use -EBADMSG when the message is badZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | -EINVAL means the arguments were somehow wrong, so translate the code we get internally into -EBADMSG when returning. (cherry picked from commit 69bd42ca072dfb2f7603b1f82053063293ab54b5)
* bus-message: avoid an infinite loop on empty structuresZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | | The alternative would be to treat gvariant and !gvariant messages differently. But this is a problem because we check signatures is variuos places before we have an actual message, for example in sd_bus_add_object_vtable(). It seems better to treat things consistent (i.e. follow the lowest common denominator) and disallow empty structures everywhere. (cherry picked from commit ec6bda56cbca9509b1abde1122645630caca877c)
* sd-bus: unify three code-paths which free struct bus_containerZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | | | | | | | | | | | | | | | | | | We didn't free one of the fields in two of the places. $ valgrind --show-leak-kinds=all --leak-check=full \ build/fuzz-bus-message \ test/fuzz/fuzz-bus-message/leak-c09c0e2256d43bc5e2d02748c8d8760e7bc25d20 ... ==14457== HEAP SUMMARY: ==14457== in use at exit: 3 bytes in 1 blocks ==14457== total heap usage: 509 allocs, 508 frees, 51,016 bytes allocated ==14457== ==14457== 3 bytes in 1 blocks are definitely lost in loss record 1 of 1 ==14457== at 0x4C2EBAB: malloc (vg_replace_malloc.c:299) ==14457== by 0x53AFE79: strndup (in /usr/lib64/libc-2.27.so) ==14457== by 0x4F52EB8: free_and_strndup (string-util.c:1039) ==14457== by 0x4F8E1AB: sd_bus_message_peek_type (bus-message.c:4193) ==14457== by 0x4F76CB5: bus_message_dump (bus-dump.c:144) ==14457== by 0x108F12: LLVMFuzzerTestOneInput (fuzz-bus-message.c:24) ==14457== by 0x1090F7: main (fuzz-main.c:34) ==14457== ==14457== LEAK SUMMARY: ==14457== definitely lost: 3 bytes in 1 blocks (cherry picked from commit 6d1e0f4fcba8d6f425da3dc91805db95399b3c8b)
* bus-message: use structured initialization to avoid use of unitialized memoryZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | As far as I can see, we would either reuse some values from a previously exited container or just random bytes from the heap. Should fix #10127. (cherry picked from commit cf81c68e96aa29d0c28b5d3a26d1de9aa1b53b85)
* Introduce free_and_strndup and use it in bus-message.cZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | | | | | | | | v2: fix error in free_and_strndup() When the orignal and copied message were the same, but shorter than specified length l, memory read past the end of the buffer would be performed. A test case is included: a string that had an embedded NUL ("q\0") is used to replace "q". v3: Fix one more bug in free_and_strndup and add tests. v4: Some style fixed based on review, one more use of free_and_replace, and make the tests more comprehensive. (cherry picked from commit 7f546026abbdc56c453a577e52d57159458c3e9c)
* meson: use the host architecture compiler/linker for src/boot/efiHelmut Grohne2018-10-29
| | | | | | | | | | | cross building systemd to arm64 presently fails, because the build system uses plain gcc and plain ld (build architecture compiler and linker respectively) for building src/boot/efi. These values come from the efi-cc and efi-ld options respectively. It rather should be using host tools here. Fixes: b710072da441 ("add support for building efi modules") (cherry picked from commit df7cacae696ae3c1d13d2f9a4db24815e07e29a1)
* exec-util: add missing logging callLennart Poettering2018-10-29
| | | | | | | This function logs about all errors, but one case was forgotten. Fix that. (cherry picked from commit 653d469519f78d3931c0bc9fe5597d18454bef3d)
* exec-util: handle putenv() errorsLennart Poettering2018-10-29
| | | | | | | | | Just paranoia, as putenv() can fail and we should catch it, like we catch all other errors. Follow-up for #10073 (cherry picked from commit ed689f7894e56024a11bd02327b2bdfce5636dfd)
* Make bzip2 an optional dependency for systemd-importdThiago Macieira2018-10-29
| | | | | | | | Yes, there are still a lot of users of bzip2, but it's fallen out of favour after LZMA/xz, which can compress a lot more and often decompresses faster than bzip2 too. (cherry picked from commit 044c2c7a2b322b6561d7e3cc5a48a548fee887f9)
* exec-util: in execute_directories, support initial exec environmentDimitri John Ledkov2018-10-29
| | | | (cherry picked from commit 78ec1bb436fb18df3b56212c442cc4775a136d1a)
* detect-virt: do not try to read all of /proc/cpuinfoZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | | | | | | | | Quoting https://github.com/systemd/systemd/issues/10074: > detect_vm_uml() reads /proc/cpuinfo with read_full_file() > read_full_file() has a file max limit size of READ_FULL_BYTES_MAX=(4U*1024U*1024U) > Unfortunately, the size of my /proc/cpuinfo is bigger, approximately: > echo $(( 4* $(cat /proc/cpuinfo | wc -c))) > 9918072 > This causes read_full_file() to fail and the Condition test fallout. Let's just read line by line until we find an intersting line. This also helps if not running under UML, because we avoid reading as much data. (cherry picked from commit 6058516a14ada1748313af6783f5b4e7e3006654)
* socket-util: attempt SO_RCVBUFFORCE/SO_SNDBUFFORCE only if ↵Franck Bui2018-10-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | SO_RCVBUF/SO_SNDBUF fails Both SO_SNDBUFFORCE and SO_RCVBUFFORCE requires capability 'net_admin'. If this capability is not granted to the service the first attempt to increase the recv/snd buffers (via sd_notify()) with SO_RCVBUFFORCE/SO_SNDBUFFORCE will fail, even if the requested size is lower than the limit enforced by the kernel. If apparmor is used, the DENIED logs for net_admin will show up. These log entries are seen as red warning light, because they could indicate that a program has been hacked and tries to compromise the system. It would be nicer if they can be avoided without giving services (relying on sd_notify) net_admin capability or dropping DENIED logs for all such services via their apparmor profile. I'm not sure if sd_notify really needs to forcibly increase the buffer sizes, but at least if the requested size is below the kernel limit, the capability (hence the log entries) should be avoided. Hence let's first ask politely for increasing the buffers and only if it fails then ignore the kernel limit if we have sufficient privileges. (cherry picked from commit 10ce2e0681ac16e7bb3619b7bb1a72a6f98a2f2c)
* pam_systemd: support use in PID namespacesJürg Billeter2018-10-29
| | | | | | | Pass 0 as leader PID to CreateSession to let logind use the PID from the D-Bus credentials. This allows use of pam_systemd in PID namespaces. (cherry picked from commit da0da5eccf5f20874111e0681b111704bf9a1c92)
* build-sys: disable -Wmaybe-uninitializedFilipe Brandenburger2018-10-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Compiler flag -Wmaybe-uninitialized is quite noisy and produces many false positives, especially when optimization flags are enabled (tested gcc 8.2.1), so let's just disable it in systemd build. For example, with CFLAGS=-O2, the build produces 11 such warnings and the default CFLAGS of Fedora's rpmbuild warns about it in 176 places. A look at a sample of those shows that most are false positives, where the compiler just can't figure it out correctly. (While fixing those would be nice, I'm not sure it's a good use of our time.) The noisy [-Wmaybe-uninitialized] warnings are not just an annoyance, since they make it harder to spot warnings that indicate actual problems (such as variable declared but not used.) Silencing those is beneficial, so that contributors would see warnings where there are actually actionable problems, so there's a better chance of having those issues addressed before a PR is pushed. Tested: $ CFLAGS='-O2 -Wp,-D_FORTIFY_SOURCE=2' meson build/ $ ninja -C build/ (NOTE: -Wp,-D_FORTIFY_SOURCE=2 prevents [-Wstringop-truncation] warnings.) With the commands above, the build will not produce any [-Wmaybe-uninitialized] warnings (or any other warnings), which is not really the case before this commit. Also tested with rpmbuild on Fedora, after this commit there are no warnings produced in the build step. (cherry picked from commit 8794164fed5f0142c34358613f92f4f761af4edd)
* importd, basic/string-util: use case-insensitive comparison for HTTP headersDongsu Park2018-10-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to RFC2616[1], HTTP header names are case-insensitive. So it's totally valid to have a header starting with either `Date:` or `date:`. However, when systemd-importd pulls an image from an HTTP server, it parses HTTP headers by comparing header names as-is, without any conversion. That causes failures when some HTTP servers return headers with different combinations of upper-/lower-cases. An example: https://alpha.release.flatcar-linux.net/amd64-usr/current/flatcar_developer_container.bin.bz2 returns `Etag: "pe89so9oir60"`, while https://alpha.release.core-os.net/amd64-usr/current/coreos_developer_container.bin.bz2 returns `ETag: "f03372edea9a1e7232e282c346099857"`. Since systemd-importd expects to see `ETag`, the etag for the Container Linux image is correctly interpreted as a part of the hidden file name. However, it cannot parse etag for Flatcar Linux, so the etag the Flatcar Linux image is not appended to the hidden file name. ``` $ sudo ls -al /var/lib/machines/ -r--r--r-- 1 root root 3303014400 Aug 21 20:07 '.raw-https:\x2f\x2falpha\x2erelease\x2ecore-os\x2enet\x2famd64-usr\x2fcurrent\x2fcoreos_developer_container\x2ebin\x2ebz2.\x22f03372edea9a1e7232e282c346099857\x22.raw' -r--r--r-- 1 root root 3303014400 Aug 17 06:15 '.raw-https:\x2f\x2falpha\x2erelease\x2eflatcar-linux\x2enet\x2famd64-usr\x2fcurrent\x2fflatcar_developer_container\x2ebin\x2ebz2.raw' ``` As a result, when the Flatcar image is removed and downloaded again, systemd-importd is not able to determine if the file has been already downloaded, so it always download it again. Then it fails to rename it to an expected name, because there's already a hidden file. To fix this issue, let's introduce a new helper function `memory_startswith_no_case()`, which compares memory regions in a case-insensitive way. Use this function in `curl_header_strdup()`. See also https://github.com/kinvolk/kube-spawn/issues/304 [1]: https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 (cherry picked from commit 21224070e802878f81c342835364880ef1a63e88)
* user-runtime-dir: fix selinux regressionAlan Jenkins2018-10-29
| | | | | | | | | | Fix #9993. When this code was split out to user-runtime-dir, it forgot to include the call to mac_selinux_init(). So mkdir_label() stopped working. Fixes: a9f0f5e50104 ("logind: split %t directory creation to a helper unit") (cherry picked from commit 81375d802672f34205bef9f301c58854af5fc568)
* tools: use print function in Python 3 codeLucas Werkmeister2018-10-29
| | | | | | | | | | | This GDB script was converted to use Python 3 along with all other Python scripts in commit b95f5528cc, but still used the Python 2 print statement syntax instead of the Python 3 print function. Fix that. We also add the Python 2 compatibility statement, just in case some GDB still uses Python 2 instead of Python 3. (cherry picked from commit e12f39768344e2dd8540ddcd9aa186b7e68ca780)
* util: do not use stack frame for parsing arbitrary inputsYu Watanabe2018-10-29
| | | | | | | | | | This replaces strndupa() by strndup() in socket_address_parse(), as input string may be too long. Fixes issue 10007 by ClusterFuzz-External: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10007 (cherry picked from commit 8d30fcb9b51b1d102a589171b6e28f5f370236f6)
* resolve: treat some icmp errors as disconnectedYu Watanabe2018-10-29
| | | | | | Fixes #9773. (cherry picked from commit 68c597e9e4bb36ade966d9df54dfaa9f956230e9)
* user-runtime-dir: downgrade a few log messages to LOG_DEBUG that we ignoreLennart Poettering2018-10-29
| | | | | | | | | | | As the comments already say it might be quite likely that $XDG_RUNTIME_DIR is not set up as mount, and we shouldn't complain about that. Moreover, let's make this idempotent, so that a runtime dir that is already gone and is removed again doesn't cause failure. (cherry picked from commit 3a13442bbf72e7ebdd0b4d60c2922ea7c5cc9496)
* sd-bus: verify destination and sender values when settingZbigniew Jędrzejewski-Szmek2018-10-29
| | | | | | | | We would verify destination e.g. in sd_bus_message_new_call, but allow setting any value later on with sd_bus_message_set_destination. I assume this check was omitted not on purpose. (cherry picked from commit 3d51a011f11523694f03c74cdd011c89beba05cc)
* void call of page_size guarantees that sysconf is not called from signal handlerDaniel2018-10-29
| | | | (cherry picked from commit 1595b257df98b361d178b3ce3e4ca5ac463be0cd)
* sleep-config: partitions can't be deleted, only files canLennart Poettering2018-10-29
| | | | | | | This fixes something I think was basically a typo introduced in db69869f264af2d1afcdd3e573e0e9fdd5bef065. (cherry picked from commit 3dea6886c20a32d832971e589cbc1807c549b66f)
* shared/sleep-config: exclude zram devices from hibernation candidatesAndrew Jorgensen2018-10-29
| | | | | | | | On a host with sufficiently large zram but with no actual swap, logind will respond to CanHibernate() with yes. With this patch, it will correctly respond no, unless there are other swap devices to consider. (cherry picked from commit 411ae92b407bd7b4549b205ad754bcd0e3dfd81f)
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-25 12:31:32 +0000