summaryrefslogtreecommitdiff
path: root/src/core/execute.c
Commit message (Collapse)AuthorAge
...
* socket: introduce SELinuxLabelViaNet optionMichal Sekletar2014-08-19
| | | | | | | | | | This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
* time-util: add and use USEC/NSEC_INFINIYKay Sievers2014-07-29
|
* firstboot: add new component to query basic system settings on first boot, ↵Lennart Poettering2014-07-07
| | | | | | | | | | | | | | | | | | | | or when creating OS images offline A new tool "systemd-firstboot" can be used either interactively on boot, where it will query basic locale, timezone, hostname, root password information and set it. Or it can be used non-interactively from the command line when prepareing disk images for booting. When used non-inertactively the tool can either copy settings from the host, or take settings on the command line. $ systemd-firstboot --root=/path/to/my/new/root --copy-locale --copy-root-password --hostname=waldi The tool will be automatically invoked (interactively) now on first boot if /etc is found unpopulated. This also creates the infrastructure for generators to be notified via an environment variable whether they are running on the first boot, or not.
* machinectl: show /etc/os-release information of container in status outputLennart Poettering2014-07-03
|
* use more _cleanup_ macroRonny Chevalier2014-06-24
|
* core: rename ReadOnlySystem= to ProtectSystem= and add a third value for ↵Lennart Poettering2014-06-04
| | | | | | | | | | also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.
* core: add new ReadOnlySystem= and ProtectedHome= settings for service unitsLennart Poettering2014-06-03
| | | | | | | | | | | | | | ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for a service. ProtectedHome= uses fs namespaces to mount /home and /run/user inaccessible or read-only for a service. This patch also enables these settings for all our long-running services. Together they should be good building block for a minimal service sandbox, removing the ability for services to modify the operating system or access the user's private data.
* Remove unnecessary casts in printfsZbigniew Jędrzejewski-Szmek2014-05-15
| | | | No functional change expected :)
* core: remove tcpwrap supportLennart Poettering2014-03-24
| | | | | | | | | | | | tcpwrap is legacy code, that is barely maintained upstream. It's APIs are awful, and the feature set it exposes (such as DNS and IDENT access control) questionnable. We should not support this natively in systemd. Hence, let's remove the code. If people want to continue making use of this, they can do so by plugging in "tcpd" for the processes they start. With that scheme things are as well or badly supported as they were from traditional inetd, hence no functionality is really lost.
* util: replace close_pipe() with new safe_close_pair()Lennart Poettering2014-03-24
| | | | | | safe_close_pair() is more like safe_close(), except that it handles pairs of fds, and doesn't make and misleading allusion, as it works similarly well for socketpairs() as for pipe()s...
* util: replace close_nointr_nofail() by a more useful safe_close()Lennart Poettering2014-03-18
| | | | | | | | | | | | | | | safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
* missing: if RLIMIT_RTTIME is not defined by the libc, then we need a new ↵Lennart Poettering2014-03-05
| | | | define for the max number of rlimits, too
* core: introduce new RuntimeDirectory= and RuntimeDirectoryMode= unit settingsLennart Poettering2014-03-03
| | | | | As discussed on the ML these are useful to manage runtime directories below /run for services.
* execute: free directory path if we fail to remove it because we cannot ↵Lennart Poettering2014-03-03
| | | | allocate a thread
* exec: imply NoNewPriviliges= only when seccomp filters are used in user modeLennart Poettering2014-02-26
|
* core: add new RestrictAddressFamilies= switchLennart Poettering2014-02-26
| | | | | | | | | This new unit settings allows restricting which address families are available to processes. This is an effective way to minimize the attack surface of services, by turning off entire network stacks for them. This is based on seccomp, and does not work on x86-32, since seccomp cannot filter socketcall() syscalls on that platform.
* seccomp: we should control NO_NEW_PRIVS on our own, not let seccomp do this ↵Lennart Poettering2014-02-26
| | | | for us
* core: Add AppArmor profile switchingMichael Scherer2014-02-21
| | | | | | This permit to switch to a specific apparmor profile when starting a daemon. This will result in a non operation if apparmor is disabled. It also add a new build requirement on libapparmor for using this feature.
* execute: modernizationsLennart Poettering2014-02-19
|
* core: add Personality= option for units to set the personality for spawned ↵Lennart Poettering2014-02-19
| | | | processes
* seccomp: add helper call to add all secondary archs to a seccomp filterLennart Poettering2014-02-18
| | | | | And make use of it where appropriate for executing services and for nspawn.
* core: store and expose SELinuxContext field normalized as bool + stringLennart Poettering2014-02-17
|
* core: add SystemCallArchitectures= unit setting to allow disabling of non-nativeLennart Poettering2014-02-13
| | | | | | | architecture support for system calls Also, turn system call filter bus properties into complex types instead of concatenated strings.
* core: fix build without libseccompLennart Poettering2014-02-12
|
* core: rework syscall filterLennart Poettering2014-02-12
| | | | | | | | | | - Allow configuration of an errno error to return from blacklisted syscalls, instead of immediately terminating a process. - Fix parsing logic when libseccomp support is turned off - Only keep the actual syscall set in the ExecContext, and generate the string version only on demand.
* syscallfilter: port to libseccompRonny Chevalier2014-02-12
|
* nspawn,man: use a common vocabulary when referring to selinux security contextsLennart Poettering2014-02-10
| | | | | | | | | | | Let's always call the security labels the same way: SMACK: "Smack Label" SELINUX: "SELinux Security Context" And the low-level encapsulation is called "seclabel". Now let's hope we stick to this vocabulary in future, too, and don't mix "label"s and "security contexts" and so on wildly.
* exec: Add support for ignoring errors on SELinuxContext by prefixing it with ↵Michael Scherer2014-02-10
| | | | | | | -, like for others settings. Also remove call to security_check_context, as this doesn't serve anything, since setexeccon will fail anyway.
* exec: Ignore the setting SELinuxContext if selinux is not enabledMichael Scherer2014-02-10
|
* exec: Add SELinuxContext configuration itemMichael Scherer2014-02-10
| | | | | | | | This permit to let system administrators decide of the domain of a service. This can be used with templated units to have each service in a différent domain ( for example, a per customer database, using MLS or anything ), or can be used to force a non selinux enabled system (jvm, erlang, etc) to start in a different domain for each service.
* exec: introduce PrivateDevices= switch to provide services with a private /devLennart Poettering2014-01-20
| | | | | | Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that sets up a private /dev with only the API pseudo-devices like /dev/null, /dev/zero, /dev/random, but not any physical devices in them.
* Introduce cleanup functions for cap_freeZbigniew Jędrzejewski-Szmek2014-01-02
| | | | | Unfortunately a different cleanup function is necessary per type, because cap_t** and char** are incompatible with void**.
* Use format patterns for usec_t, pid_t, nsec_t, usec_tZbigniew Jędrzejewski-Szmek2014-01-02
| | | | | | | | It is nicer to predefine patterns using configure time check instead of using casts everywhere. Since we do not need to use any flags, include "%" in the format instead of excluding it like PRI* macros.
* core: Forgot to dereference pointer when checking for NULLStefan Beller2013-12-30
| | | | | Actually we already checked for !rt before, now we'd like to examine the return value of the memory allocation.
* build-sys: minor fixes found with cppcheckLennart Poettering2013-12-25
|
* sd-daemon: introduce sd_watchdog_enabled() for parsing $WATCHDOG_USECLennart Poettering2013-12-22
| | | | | | | | Also, introduce a new environment variable named $WATCHDOG_PID which cotnains the PID of the process that is supposed to send the keep-alive events. This is similar how $LISTEN_FDS and $LISTEN_PID work together, and protects against confusing processes further down the process tree due to inherited environment.
* execute: set TERM even if we don't open the tty on our ownLennart Poettering2013-12-18
| | | | | This way, when a tty path is configured TERM is set, which is nice to set a useful term for gettys.
* execute: also set SO_SNDBUF when spawning a service with stdout/stderr ↵Lennart Poettering2013-12-16
| | | | connected to journald
* Get rid of our reimplementation of basenameZbigniew Jędrzejewski-Szmek2013-12-06
| | | | | | The only problem is that libgen.h #defines basename to point to it's own broken implementation instead of the GNU one. This can be fixed by #undefining basename.
* service: add the ability for units to join other unit's PrivateNetwork= and ↵Lennart Poettering2013-11-27
| | | | PrivateTmp= namespaces
* Remove dead code and unexport some callsLennart Poettering2013-11-08
| | | | | | "make check-api-unused" informs us about code that is not used anymore or that is exported but only used internally. Fix these all over the place.
* strv: introduce new strv_from_stdarg_alloca() macro to generate a string ↵Lennart Poettering2013-10-29
| | | | | | | array from stdarg function parameters This allows us to turn lists of strings passed in easily into string arrays without having to allocate memory.
* systemd: use unit name in PrivateTmp directoriesZbigniew Jędrzejewski-Szmek2013-10-22
| | | | | | | Unit name is used whole in the directory name, so that the unit name can be easily extracted from it, e.g. "/tmp/systemd-abcd.service-DEDBIF1". https://bugzilla.redhat.com/show_bug.cgi?id=957439
* macro: clean up usage of gcc attributesLennart Poettering2013-10-16
| | | | Always use our own macros, and name all our own macros the same style.
* list: make our list macros a bit easier to use by not requring type spec on ↵Lennart Poettering2013-10-14
| | | | | | | each invocation We can determine the list entry type via the typeof() gcc construct, and so we should to make the macros much shorter to use.
* execute: more debugging messagesZbigniew Jędrzejewski-Szmek2013-10-03
|
* execute.c: always set $SHELLZbigniew Jędrzejewski-Szmek2013-10-02
| | | | | In e6dca81 $SHELL was added to user@.service. Let's instead provide it to all units which have a user.
* execute.c: little modernizationZbigniew Jędrzejewski-Szmek2013-09-26
|
* cgroup: if we do a cgroup operation then do something on all supported ↵Lennart Poettering2013-09-25
| | | | | | | | | | | | | controllers Previously we did operations like attach, trim or migrate only on the controllers that were enabled for a specific unit. With this changes we will now do them for all supproted controllers, and fall back to all possible prefix paths if the specified paths do not exist. This fixes issues if a controller is being disabled for a unit where it was previously enabled, and makes sure that all processes stay as "far down" the tree as groups exist.
* Make tmpdir removal asynchronousZbigniew Jędrzejewski-Szmek2013-09-17
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=68232
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-12 01:27:08 +0000