summaryrefslogtreecommitdiff
path: root/src/core/execute.c
Commit message (Collapse)AuthorAge
* core: execute - don't leak strvTom Gundersen2014-09-30
|
* swap: introduce Discard propertyJan Synacek2014-09-29
| | | | Process possible "discard" values from /etc/fstab.
* socket: introduce SELinuxContextFromNet optionMichal Sekletar2014-09-19
| | | | | | | | | | This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_mls_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
* execute: silence warningsThomas Hindoe Paaboel Andersen2014-09-08
| | | | Mark two function parameters as const
* service: hook up custom endpoint logicDaniel Mack2014-09-08
| | | | | | | | | | | | If BusPolicy= was passed, the parser function will have created an ExecContext->bus_endpoint object, along with policy information. In that case, create a kdbus endpoint, and pass its path name to the namespace logic, to it will be mounted over the actual 'bus' node. At endpoint creation time, no policy is updloaded. That is done after fork(), through a separate call. This is necessary because we don't know the real uid of the process earlier than that.
* namespace: add support for custom kdbus endpointDaniel Mack2014-09-08
| | | | | | | | | | If a path to a previously created custom kdbus endpoint is passed in, bind-mount a new devtmpfs that contains a 'bus' node, which in turn in bind-mounted with the custom endpoint. This tmpfs then mounted over the kdbus subtree that refers to the current bus. This way, we can fake the bus node in order to lock down services with a kdbus custom endpoint policy.
* bus: add kdbus endpoint typesDaniel Mack2014-09-08
| | | | | Add types to describe endpoints and associated policy entries, and add a BusEndpoint instace to ExecContext.
* exec: move code executed after fork into exec_child()Daniel Mack2014-09-05
| | | | | | This factors out one conditional branch that has grown way too big, and makes the code more readable by using return statements rather than jump labels.
* exec: factor out most function arguments of exec_spawn() to ExecParametersDaniel Mack2014-09-05
| | | | | | | | | | This way, the list of arguments to that function gets more comprehensive, and we can get around passing lots of NULL and 0 arguments from socket.c, swap.c and mount.c. It also allows for splitting up the code in exec_spawn(). While at it, make ExecContext const in execute.c.
* util: make use of newly added reset_signal_mask() call wherever appropriateLennart Poettering2014-08-26
|
* execute: explain in a comment, why close_all_fds() is invoked the second ↵Lennart Poettering2014-08-21
| | | | time differently
* core: unify how we generate the prefix string when dumping unit stateLennart Poettering2014-08-21
|
* Revert "socket: introduce SELinuxLabelViaNet option"Lennart Poettering2014-08-19
| | | | | | This reverts commit cf8bd44339b00330fdbc91041d6731ba8aba9fec. Needs more discussion on the mailing list.
* socket: introduce SELinuxLabelViaNet optionMichal Sekletar2014-08-19
| | | | | | | | | | This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
* time-util: add and use USEC/NSEC_INFINIYKay Sievers2014-07-29
|
* firstboot: add new component to query basic system settings on first boot, ↵Lennart Poettering2014-07-07
| | | | | | | | | | | | | | | | | | | | or when creating OS images offline A new tool "systemd-firstboot" can be used either interactively on boot, where it will query basic locale, timezone, hostname, root password information and set it. Or it can be used non-interactively from the command line when prepareing disk images for booting. When used non-inertactively the tool can either copy settings from the host, or take settings on the command line. $ systemd-firstboot --root=/path/to/my/new/root --copy-locale --copy-root-password --hostname=waldi The tool will be automatically invoked (interactively) now on first boot if /etc is found unpopulated. This also creates the infrastructure for generators to be notified via an environment variable whether they are running on the first boot, or not.
* machinectl: show /etc/os-release information of container in status outputLennart Poettering2014-07-03
|
* use more _cleanup_ macroRonny Chevalier2014-06-24
|
* core: rename ReadOnlySystem= to ProtectSystem= and add a third value for ↵Lennart Poettering2014-06-04
| | | | | | | | | | also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.
* core: add new ReadOnlySystem= and ProtectedHome= settings for service unitsLennart Poettering2014-06-03
| | | | | | | | | | | | | | ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for a service. ProtectedHome= uses fs namespaces to mount /home and /run/user inaccessible or read-only for a service. This patch also enables these settings for all our long-running services. Together they should be good building block for a minimal service sandbox, removing the ability for services to modify the operating system or access the user's private data.
* Remove unnecessary casts in printfsZbigniew Jędrzejewski-Szmek2014-05-15
| | | | No functional change expected :)
* core: remove tcpwrap supportLennart Poettering2014-03-24
| | | | | | | | | | | | tcpwrap is legacy code, that is barely maintained upstream. It's APIs are awful, and the feature set it exposes (such as DNS and IDENT access control) questionnable. We should not support this natively in systemd. Hence, let's remove the code. If people want to continue making use of this, they can do so by plugging in "tcpd" for the processes they start. With that scheme things are as well or badly supported as they were from traditional inetd, hence no functionality is really lost.
* util: replace close_pipe() with new safe_close_pair()Lennart Poettering2014-03-24
| | | | | | safe_close_pair() is more like safe_close(), except that it handles pairs of fds, and doesn't make and misleading allusion, as it works similarly well for socketpairs() as for pipe()s...
* util: replace close_nointr_nofail() by a more useful safe_close()Lennart Poettering2014-03-18
| | | | | | | | | | | | | | | safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
* missing: if RLIMIT_RTTIME is not defined by the libc, then we need a new ↵Lennart Poettering2014-03-05
| | | | define for the max number of rlimits, too
* core: introduce new RuntimeDirectory= and RuntimeDirectoryMode= unit settingsLennart Poettering2014-03-03
| | | | | As discussed on the ML these are useful to manage runtime directories below /run for services.
* execute: free directory path if we fail to remove it because we cannot ↵Lennart Poettering2014-03-03
| | | | allocate a thread
* exec: imply NoNewPriviliges= only when seccomp filters are used in user modeLennart Poettering2014-02-26
|
* core: add new RestrictAddressFamilies= switchLennart Poettering2014-02-26
| | | | | | | | | This new unit settings allows restricting which address families are available to processes. This is an effective way to minimize the attack surface of services, by turning off entire network stacks for them. This is based on seccomp, and does not work on x86-32, since seccomp cannot filter socketcall() syscalls on that platform.
* seccomp: we should control NO_NEW_PRIVS on our own, not let seccomp do this ↵Lennart Poettering2014-02-26
| | | | for us
* core: Add AppArmor profile switchingMichael Scherer2014-02-21
| | | | | | This permit to switch to a specific apparmor profile when starting a daemon. This will result in a non operation if apparmor is disabled. It also add a new build requirement on libapparmor for using this feature.
* execute: modernizationsLennart Poettering2014-02-19
|
* core: add Personality= option for units to set the personality for spawned ↵Lennart Poettering2014-02-19
| | | | processes
* seccomp: add helper call to add all secondary archs to a seccomp filterLennart Poettering2014-02-18
| | | | | And make use of it where appropriate for executing services and for nspawn.
* core: store and expose SELinuxContext field normalized as bool + stringLennart Poettering2014-02-17
|
* core: add SystemCallArchitectures= unit setting to allow disabling of non-nativeLennart Poettering2014-02-13
| | | | | | | architecture support for system calls Also, turn system call filter bus properties into complex types instead of concatenated strings.
* core: fix build without libseccompLennart Poettering2014-02-12
|
* core: rework syscall filterLennart Poettering2014-02-12
| | | | | | | | | | - Allow configuration of an errno error to return from blacklisted syscalls, instead of immediately terminating a process. - Fix parsing logic when libseccomp support is turned off - Only keep the actual syscall set in the ExecContext, and generate the string version only on demand.
* syscallfilter: port to libseccompRonny Chevalier2014-02-12
|
* nspawn,man: use a common vocabulary when referring to selinux security contextsLennart Poettering2014-02-10
| | | | | | | | | | | Let's always call the security labels the same way: SMACK: "Smack Label" SELINUX: "SELinux Security Context" And the low-level encapsulation is called "seclabel". Now let's hope we stick to this vocabulary in future, too, and don't mix "label"s and "security contexts" and so on wildly.
* exec: Add support for ignoring errors on SELinuxContext by prefixing it with ↵Michael Scherer2014-02-10
| | | | | | | -, like for others settings. Also remove call to security_check_context, as this doesn't serve anything, since setexeccon will fail anyway.
* exec: Ignore the setting SELinuxContext if selinux is not enabledMichael Scherer2014-02-10
|
* exec: Add SELinuxContext configuration itemMichael Scherer2014-02-10
| | | | | | | | This permit to let system administrators decide of the domain of a service. This can be used with templated units to have each service in a différent domain ( for example, a per customer database, using MLS or anything ), or can be used to force a non selinux enabled system (jvm, erlang, etc) to start in a different domain for each service.
* exec: introduce PrivateDevices= switch to provide services with a private /devLennart Poettering2014-01-20
| | | | | | Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that sets up a private /dev with only the API pseudo-devices like /dev/null, /dev/zero, /dev/random, but not any physical devices in them.
* Introduce cleanup functions for cap_freeZbigniew Jędrzejewski-Szmek2014-01-02
| | | | | Unfortunately a different cleanup function is necessary per type, because cap_t** and char** are incompatible with void**.
* Use format patterns for usec_t, pid_t, nsec_t, usec_tZbigniew Jędrzejewski-Szmek2014-01-02
| | | | | | | | It is nicer to predefine patterns using configure time check instead of using casts everywhere. Since we do not need to use any flags, include "%" in the format instead of excluding it like PRI* macros.
* core: Forgot to dereference pointer when checking for NULLStefan Beller2013-12-30
| | | | | Actually we already checked for !rt before, now we'd like to examine the return value of the memory allocation.
* build-sys: minor fixes found with cppcheckLennart Poettering2013-12-25
|
* sd-daemon: introduce sd_watchdog_enabled() for parsing $WATCHDOG_USECLennart Poettering2013-12-22
| | | | | | | | Also, introduce a new environment variable named $WATCHDOG_PID which cotnains the PID of the process that is supposed to send the keep-alive events. This is similar how $LISTEN_FDS and $LISTEN_PID work together, and protects against confusing processes further down the process tree due to inherited environment.
* execute: set TERM even if we don't open the tty on our ownLennart Poettering2013-12-18
| | | | | This way, when a tty path is configured TERM is set, which is nice to set a useful term for gettys.
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-02 16:41:52 +0000