summaryrefslogtreecommitdiff
path: root/src/core/load-fragment.c
Commit message (Collapse)AuthorAge
* hashmap: introduce hash_ops to make struct Hashmap smallerMichal Schmidt2014-09-15
| | | | | | | | | It is redundant to store 'hash' and 'compare' function pointers in struct Hashmap separately. The functions always comprise a pair. Store a single pointer to struct hash_ops instead. systemd keeps hundreds of hashmaps, so this saves a little bit of memory.
* core: use correct function to free CalendarSpecDave Reisner2014-09-13
|
* core: fix a potential mem leakThomas Hindoe Paaboel Andersen2014-09-13
| | | | Found with Coverity. Fixes: CID#996438
* bus: parse BusPolicy directive in service filesDaniel Mack2014-09-08
| | | | | | Add a new directive called BusPolicy to define custom endpoint policies. If one such directive is given, an endpoint object in the service's ExecContext is created and the given policy is added to it.
* bus: factor out bus policy itemsDaniel Mack2014-09-08
| | | | | In order to re-use the policy definitions, factor them out into their own files.
* core/load-fragment.c: correct argument sign and split up long linesZbigniew Jędrzejewski-Szmek2014-07-31
| | | | With everything on one line they are just harder to read.
* Properly report invalid quoted stringsZbigniew Jędrzejewski-Szmek2014-07-31
| | | | | | | | $ systemd-analyze verify trailing-g.service [./trailing-g.service:2] Trailing garbage, ignoring. trailing-g.service lacks ExecStart setting. Refusing. Error: org.freedesktop.systemd1.LoadFailed: Unit trailing-g.service failed to load: Invalid argument. Failed to create trailing-g.service/start: Invalid argument
* Reject invalid quoted stringsZbigniew Jędrzejewski-Szmek2014-07-31
| | | | | | | | | | | | | | | | | | | | | | String which ended in an unfinished quote were accepted, potentially with bad memory accesses. Reject anything which ends in a unfished quote, or contains non-whitespace characters right after the closing quote. _FOREACH_WORD now returns the invalid character in *state. But this return value is not checked anywhere yet. Also, make 'word' and 'state' variables const pointers, and rename 'w' to 'word' in various places. Things are easier to read if the same name is used consistently. mbiebl_> am I correct that something like this doesn't work mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-passwd "Unlock EncFS"' mbiebl_> systemd seems to strip of the quotes mbiebl_> systemctl status shows mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-password Unlock EncFS $RootDir $MountPoint mbiebl_> which is pretty weird
* time-util: add and use USEC/NSEC_INFINIYKay Sievers2014-07-29
|
* Let config_parse open file where applicableZbigniew Jędrzejewski-Szmek2014-07-16
| | | | | | | | Special care is needed so that we get an error message if the file failed to parse, but not when it is missing. To avoid duplicating the same error check in every caller, add an additional 'warn' boolean to tell config_parse whether a message should be issued. This makes things both shorter and more robust wrt. to error reporting.
* Constify ConfigTableItem tablesZbigniew Jędrzejewski-Szmek2014-07-15
|
* exit-status: rename ExitStatusSet's "code" field to "status"Lennart Poettering2014-07-03
| | | | | We should follow the naming scheme waitid() uses, not come up with our own reversed one...
* kdbus: when uploading bus name policy, resolve users/groups out-of-processLennart Poettering2014-06-05
| | | | | It's not safe invoking NSS from PID 1, hence fork off worker processes that upload the policy into the kernel for busnames.
* core: rename ReadOnlySystem= to ProtectSystem= and add a third value for ↵Lennart Poettering2014-06-04
| | | | | | | | | | also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.
* socket: add new Symlinks= option for socket unitsLennart Poettering2014-06-04
| | | | | | | | | | | With Symlinks= we can manage one or more symlinks to AF_UNIX or FIFO nodes in the file system, with the same lifecycle as the socket itself. This has two benefits: first, this allows us to remove /dev/log and /dev/initctl from /dev, thus leaving only symlinks, device nodes and directories in the /dev tree. More importantly however, this allows us to move /dev/log out of /dev, while still making it accessible there, so that PrivateDevices= can provide /dev/log too.
* core: add new ReadOnlySystem= and ProtectedHome= settings for service unitsLennart Poettering2014-06-03
| | | | | | | | | | | | | | ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for a service. ProtectedHome= uses fs namespaces to mount /home and /run/user inaccessible or read-only for a service. This patch also enables these settings for all our long-running services. Together they should be good building block for a minimal service sandbox, removing the ability for services to modify the operating system or access the user's private data.
* cgroups: simplify CPUQuota= logicLennart Poettering2014-05-22
| | | | | | | | | Only accept cpu quota values in percentages, get rid of period definition. It's not clear whether the CFS period controllable per-cgroup even has a future in the kernel, hence let's simplify all this, hardcode the period to 100ms and only accept percentage based quota values.
* cgroup: rework startup logicLennart Poettering2014-05-22
| | | | | Introduce a (unsigned long) -1 as "unset" state for cpu shares/block io weights, and keep the startup unit set around all the time.
* core: add startup resource control optionWaLyong Cho2014-05-22
| | | | | | | | | | | Similar to CPUShares= and BlockIOWeight= respectively. However only assign the specified weight during startup. Each control group attribute is re-assigned as weight by CPUShares=weight and BlockIOWeight=weight after startup. If not CPUShares= or BlockIOWeight= be specified, then the attribute is re-assigned to each default attribute value. (default cpu.shares=1024, blkio.weight=1000) If only CPUShares=weight or BlockIOWeight=weight be specified, then that implies StartupCPUShares=weight and StartupBlockIOWeight=weight.
* fix spelling of privilegeNis Martensen2014-05-19
|
* load-fragment: minor cleanupLennart Poettering2014-05-06
|
* core: expose CFS CPU time quota as high-level unit propertiesLennart Poettering2014-04-25
|
* service: rename StartLimitAction enum to FailureActionMichael Olbrich2014-04-24
| | | | It's used for the FailureAction property as well.
* core: remove tcpwrap supportLennart Poettering2014-03-24
| | | | | | | | | | | | tcpwrap is legacy code, that is barely maintained upstream. It's APIs are awful, and the feature set it exposes (such as DNS and IDENT access control) questionnable. We should not support this natively in systemd. Hence, let's remove the code. If people want to continue making use of this, they can do so by plugging in "tcpd" for the processes they start. With that scheme things are as well or badly supported as they were from traditional inetd, hence no functionality is really lost.
* timer: support timers that can resume the system from suspendLennart Poettering2014-03-24
|
* unit: turn off mount propagation for udevdLennart Poettering2014-03-20
| | | | | Keep mounts done by udev rules private to udevd. Also, document how MountFlags= may be used for this.
* util: replace close_nointr_nofail() by a more useful safe_close()Lennart Poettering2014-03-18
| | | | | | | | | | | | | | | safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
* busname: add parser for bus name policiesDaniel Mack2014-03-07
| | | | | | | | | | | | | | | | | There are three directives to specify bus name polices in .busname files: * AllowUser [username] [access] * AllowGroup [groupname] [access] * AllowWorld [access] Where [access] is one of * 'see': The user/group/world is allowed to see a name on the bus * 'talk': The user/group/world is allowed to talk to a name * 'own': The user/group/world is allowed to own a name There is no user added yet in this commit.
* core: don't override NoNewPriviliges= from SystemCallFilter= if it is ↵Lennart Poettering2014-03-05
| | | | already explicitly set
* Do not print invalid UTF-8 in error messagesZbigniew Jędrzejewski-Szmek2014-03-04
| | | | | Inexplicably, 550a40ec ('core: do not print invalid utf-8 in error messages') only fixed two paths. Convert all of them now.
* conf-parser: config_parse_path_strv() is not generic, so let's move it into ↵Lennart Poettering2014-03-03
| | | | | | | load-fragment.c The parse code actually checked for specific lvalue names, which is really wrong for supposedly generic parsers...
* core: move config_parse_set_status() into load-fragment.cLennart Poettering2014-03-03
| | | | | Let's keep specific config parsers close to where they are needed. Only the really generic ones should be defined in conf-parser.[ch].
* conf-parse: rename config_parse_level() to config_parse_log_level()Lennart Poettering2014-03-03
| | | | | "level" is a bit too generic, let's clarify what kind of level we are referring to here.
* core: introduce new RuntimeDirectory= and RuntimeDirectoryMode= unit settingsLennart Poettering2014-03-03
| | | | | As discussed on the ML these are useful to manage runtime directories below /run for services.
* core: add new RestrictAddressFamilies= switchLennart Poettering2014-02-26
| | | | | | | | | This new unit settings allows restricting which address families are available to processes. This is an effective way to minimize the attack surface of services, by turning off entire network stacks for them. This is based on seccomp, and does not work on x86-32, since seccomp cannot filter socketcall() syscalls on that platform.
* core: clean up some confusing regarding SI decimal and IEC binary suffixes ↵Lennart Poettering2014-02-23
| | | | | | | | | | | for sizes According to Wikipedia it is customary to specify hardware metrics and transfer speeds to the basis 1000 (SI decimal), while software metrics and physical volatile memory (RAM) sizes to the basis 1024 (IEC binary). So far we specified everything in IEC, let's fix that and be more true to what's otherwise customary. Since we don't want to parse "Mi" instead of "M" we document each time what the context used is.
* cgroup: Extend DeviceAllow= syntax to whitelist groups of devices, not just ↵Lennart Poettering2014-02-22
| | | | particular devices nodes
* core: Add AppArmor profile switchingMichael Scherer2014-02-21
| | | | | | This permit to switch to a specific apparmor profile when starting a daemon. This will result in a non operation if apparmor is disabled. It also add a new build requirement on libapparmor for using this feature.
* core: add Personality= option for units to set the personality for spawned ↵Lennart Poettering2014-02-19
| | | | processes
* core: warn when unit files with unsupported options are parsedLennart Poettering2014-02-17
|
* core: store and expose SELinuxContext field normalized as bool + stringLennart Poettering2014-02-17
|
* core: add a system-wide SystemCallArchitectures= settingLennart Poettering2014-02-13
| | | | | | This is useful to prohibit execution of non-native processes on systems, for example 32bit binaries on 64bit systems, this lowering the attack service on incorrect syscall and ioctl 32→64bit mappings.
* core: add SystemCallArchitectures= unit setting to allow disabling of non-nativeLennart Poettering2014-02-13
| | | | | | | architecture support for system calls Also, turn system call filter bus properties into complex types instead of concatenated strings.
* core: rework syscall filterLennart Poettering2014-02-12
| | | | | | | | | | - Allow configuration of an errno error to return from blacklisted syscalls, instead of immediately terminating a process. - Fix parsing logic when libseccomp support is turned off - Only keep the actual syscall set in the ExecContext, and generate the string version only on demand.
* syscallfilter: port to libseccompRonny Chevalier2014-02-12
|
* Use enums to make it obvious what boolean params meanZbigniew Jędrzejewski-Szmek2013-12-26
| | | | Suggested-by: Russ Allbery <rra@debian.org>
* bus: when connecting to a container's kdbus instance, enter namespace firstLennart Poettering2013-12-14
| | | | | | | | | | | | | | | | Previously we'd open the connection in the originating namespace, which meant most peers of the bus would not be able to make sense of the PID/UID/... identity of us since we didn't exist in the namespace they run in. However they require this identity for privilege decisions, hence disallowing access to anything from the host. Instead, when connecting to a container, create a temporary subprocess, make it join the container's namespace and then connect from there to the kdbus instance. This is similar to how we do it for socket conections already. THis also unifies the namespacing code used by machinectl and the bus APIs.
* Get rid of our reimplementation of basenameZbigniew Jędrzejewski-Szmek2013-12-06
| | | | | | The only problem is that libgen.h #defines basename to point to it's own broken implementation instead of the GNU one. This can be fixed by #undefining basename.
* bus: add .busname unit type to implement kdbus-style bus activationLennart Poettering2013-12-02
|
* service: add the ability for units to join other unit's PrivateNetwork= and ↵Lennart Poettering2013-11-27
| | | | PrivateTmp= namespaces
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-16 02:32:26 +0000