summaryrefslogtreecommitdiff
path: root/src/core/execute.h
Commit message (Collapse)AuthorAge
* service: hook up custom endpoint logicDaniel Mack2014-09-08
| | | | | | | | | | | | If BusPolicy= was passed, the parser function will have created an ExecContext->bus_endpoint object, along with policy information. In that case, create a kdbus endpoint, and pass its path name to the namespace logic, to it will be mounted over the actual 'bus' node. At endpoint creation time, no policy is updloaded. That is done after fork(), through a separate call. This is necessary because we don't know the real uid of the process earlier than that.
* bus: add kdbus endpoint typesDaniel Mack2014-09-08
| | | | | Add types to describe endpoints and associated policy entries, and add a BusEndpoint instace to ExecContext.
* exec: factor out most function arguments of exec_spawn() to ExecParametersDaniel Mack2014-09-05
| | | | | | | | | | This way, the list of arguments to that function gets more comprehensive, and we can get around passing lots of NULL and 0 arguments from socket.c, swap.c and mount.c. It also allows for splitting up the code in exec_spawn(). While at it, make ExecContext const in execute.c.
* Revert "socket: introduce SELinuxLabelViaNet option"Lennart Poettering2014-08-19
| | | | | | This reverts commit cf8bd44339b00330fdbc91041d6731ba8aba9fec. Needs more discussion on the mailing list.
* socket: introduce SELinuxLabelViaNet optionMichal Sekletar2014-08-19
| | | | | | | | | | This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
* core: rename ReadOnlySystem= to ProtectSystem= and add a third value for ↵Lennart Poettering2014-06-04
| | | | | | | | | | also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.
* core: add new ReadOnlySystem= and ProtectedHome= settings for service unitsLennart Poettering2014-06-03
| | | | | | | | | | | | | | ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for a service. ProtectedHome= uses fs namespaces to mount /home and /run/user inaccessible or read-only for a service. This patch also enables these settings for all our long-running services. Together they should be good building block for a minimal service sandbox, removing the ability for services to modify the operating system or access the user's private data.
* core: remove tcpwrap supportLennart Poettering2014-03-24
| | | | | | | | | | | | tcpwrap is legacy code, that is barely maintained upstream. It's APIs are awful, and the feature set it exposes (such as DNS and IDENT access control) questionnable. We should not support this natively in systemd. Hence, let's remove the code. If people want to continue making use of this, they can do so by plugging in "tcpd" for the processes they start. With that scheme things are as well or badly supported as they were from traditional inetd, hence no functionality is really lost.
* core: don't override NoNewPriviliges= from SystemCallFilter= if it is ↵Lennart Poettering2014-03-05
| | | | already explicitly set
* missing: if RLIMIT_RTTIME is not defined by the libc, then we need a new ↵Lennart Poettering2014-03-05
| | | | define for the max number of rlimits, too
* core: introduce new RuntimeDirectory= and RuntimeDirectoryMode= unit settingsLennart Poettering2014-03-03
| | | | | As discussed on the ML these are useful to manage runtime directories below /run for services.
* execute: no need to include seccomp.h from execute.hLennart Poettering2014-03-03
|
* core: add new RestrictAddressFamilies= switchLennart Poettering2014-02-26
| | | | | | | | | This new unit settings allows restricting which address families are available to processes. This is an effective way to minimize the attack surface of services, by turning off entire network stacks for them. This is based on seccomp, and does not work on x86-32, since seccomp cannot filter socketcall() syscalls on that platform.
* core: Add AppArmor profile switchingMichael Scherer2014-02-21
| | | | | | This permit to switch to a specific apparmor profile when starting a daemon. This will result in a non operation if apparmor is disabled. It also add a new build requirement on libapparmor for using this feature.
* core: add Personality= option for units to set the personality for spawned ↵Lennart Poettering2014-02-19
| | | | processes
* core: store and expose SELinuxContext field normalized as bool + stringLennart Poettering2014-02-17
|
* core: add SystemCallArchitectures= unit setting to allow disabling of non-nativeLennart Poettering2014-02-13
| | | | | | | architecture support for system calls Also, turn system call filter bus properties into complex types instead of concatenated strings.
* core: rework syscall filterLennart Poettering2014-02-12
| | | | | | | | | | - Allow configuration of an errno error to return from blacklisted syscalls, instead of immediately terminating a process. - Fix parsing logic when libseccomp support is turned off - Only keep the actual syscall set in the ExecContext, and generate the string version only on demand.
* syscallfilter: port to libseccompRonny Chevalier2014-02-12
|
* exec: Add SELinuxContext configuration itemMichael Scherer2014-02-10
| | | | | | | | This permit to let system administrators decide of the domain of a service. This can be used with templated units to have each service in a différent domain ( for example, a per customer database, using MLS or anything ), or can be used to force a non selinux enabled system (jvm, erlang, etc) to start in a different domain for each service.
* exec: introduce PrivateDevices= switch to provide services with a private /devLennart Poettering2014-01-20
| | | | | | Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that sets up a private /dev with only the API pseudo-devices like /dev/null, /dev/zero, /dev/random, but not any physical devices in them.
* sd-daemon: introduce sd_watchdog_enabled() for parsing $WATCHDOG_USECLennart Poettering2013-12-22
| | | | | | | | Also, introduce a new environment variable named $WATCHDOG_PID which cotnains the PID of the process that is supposed to send the keep-alive events. This is similar how $LISTEN_FDS and $LISTEN_PID work together, and protects against confusing processes further down the process tree due to inherited environment.
* execute.h: remove redefinition of UnitThomas Hindoe Paaboel Andersen2013-12-05
| | | | | | | | | Unit is typedef'ed in both unit.h and execute.h. The typedef existed first in unit.h and was later added to execute.h in c17ec25e4d9bd6c8e8617416f813e25b2ebbafc5 It is no longer needed so let's just keep the one in unit.h to avoid redefining it.
* service: add the ability for units to join other unit's PrivateNetwork= and ↵Lennart Poettering2013-11-27
| | | | PrivateTmp= namespaces
* Remove dead code and unexport some callsLennart Poettering2013-11-08
| | | | | | "make check-api-unused" informs us about code that is not used anymore or that is exported but only used internally. Fix these all over the place.
* core: general cgroup reworkLennart Poettering2013-06-27
| | | | | | | | | | | | | | | | Replace the very generic cgroup hookup with a much simpler one. With this change only the high-level cgroup settings remain, the ability to set arbitrary cgroup attributes is removed, so is support for adding units to arbitrary cgroup controllers or setting arbitrary paths for them (especially paths that are different for the various controllers). This also introduces a new -.slice root slice, that is the parent of system.slice and friends. This enables easy admin configuration of root-level cgrouo properties. This replaces DeviceDeny= by DevicePolicy=, and implicitly adds in /dev/null, /dev/zero and friends if DeviceAllow= is used (unless this is turned off by DevicePolicy=).
* Add __attribute__((const, pure, format)) in various placesZbigniew Jędrzejewski-Szmek2013-05-02
| | | | | | | | I'm assuming that it's fine if a _const_ or _pure_ function calls assert. It is assumed that the assert won't trigger, and even if it does, it can only trigger on the first call with a given set of parameters, and we don't care if the compiler moves the order of calls.
* core: reuse the same /tmp, /var/tmp and inaccessible dirMichal Sekletar2013-03-15
| | | | | | | | All Execs within the service, will get mounted the same /tmp and /var/tmp directories, if service is configured with PrivateTmp=yes. Temporary directories are cleaned up by service itself in addition to systemd-tmpfiles. Directory which is mounted as inaccessible is created at runtime in /run/systemd.
* core/execute: determine if ExecContext may fiddle with /dev/consoleMichal Schmidt2013-02-28
| | | | | There is some guesswork, but it should work satisfactorily for the purpose of knowing when to suppress printing of status messages.
* unit: split off KillContext from ExecContext containing only kill definitionsLennart Poettering2012-07-20
|
* use #pragma once instead of foo*foo #define guardsShawn Landden2012-07-19
| | | | | | | | | | | | | | | | | #pragma once has been "un-deprecated" in gcc since 3.3, and is widely supported in other compilers. I've been using and maintaining (rebasing) this patch for a while now, as it annoyed me to see #ifndef fooblahfoo, etc all over the place, almost arrogant about the annoyance of having to define all these names to perform a commen but neccicary functionality, when a completely superior alternative exists. I havn't sent it till now, cause its kindof a style change, and it is bad voodoo to mess with style that has been established by more established editors. So feel free to lambast me as a crazy bafoon. v2 - preserve externally used headers
* execute: support syscall filtering using seccomp filtersLennart Poettering2012-07-17
|
* journal: set the _SYSTEMD_UNIT field for messages from terminated processesEelco Dolstra2012-06-22
| | | | | | | | | | | | | | | | | | | | | | | | As described in https://bugs.freedesktop.org/show_bug.cgi?id=50184 the journal currently doesn't set fields such as _SYSTEMD_UNIT properly for messages coming from processes that have already terminated. This means among other things that "systemctl status" may not show some of the output of services that wrote messages just before they exited. This patch fixes this by having processes that log to the journal write their unit identifier to journald when the connection to /run/systemd/journal/stdout is opened. Journald stores the unit ID and uses it to fill in _SYSTEMD_UNIT when it cannot be obtained normally (i.e. from the cgroup). To prevent impersonating another unit, this information is only used when the caller is root. This doesn't fix the general problem of getting metadata about messages from terminated processes (which requires some kernel support), but it allows "systemctl status" and similar queries to do the Right Thing for units that log via stdout/stderr.
* util: introduce a proper nsec_t and make use of it where appropriateLennart Poettering2012-05-31
|
* service: introduce Type=idle and use it for gettysLennart Poettering2012-04-24
| | | | | | | | | | | | | Type=idle is much like Type=simple, however between the fork() and the exec() in the child we wait until PID 1 informs us that no jobs are left. This is mostly a cosmetic fix to make gettys appear only after all boot output is finished and complete. Note that this does not impact the normal job logic as we do not delay the completion of any jobs. We just delay the invocation of the actual binary, and only for services that otherwise would be of Type=simple.
* service: place control command in subcgroup control/Lennart Poettering2012-04-13
| | | | | | | | | | | | | | | | | | Previously, we were brutally and onconditionally killing all processes in a service's cgroup before starting the service anew, in order to ensure that StartPre lines cannot be misused to spawn long-running processes. On logind-less systems this has the effect that restarting sshd necessarily calls all active ssh sessions, which is usually not desirable. With this patch control processes for a service are placed in a sub-cgroup called "control/". When starting a service anew we simply kill this cgroup, but not the main cgroup, in order to avoid killing any long-running non-control processes from previous runs. https://bugzilla.redhat.com/show_bug.cgi?id=805942
* relicense to LGPLv2.1 (with exceptions)Lennart Poettering2012-04-12
| | | | | | | | | | | | | | We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
* move libsystemd_core.la sources into core/Kay Sievers2012-04-11
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-26 14:12:06 +0000