summaryrefslogtreecommitdiff
path: root/src/core/socket.c
Commit message (Collapse)AuthorAge
* treewide: introduce UID_INVALID (and friends) as macro for (uid_t) -1Lennart Poettering2014-11-28
|
* core: convert log_unit_*() to log_unit_*_errno()Michal Schmidt2014-11-28
| | | | | | Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_unit_(debug|info|notice|warning|error|emergency)\(([^"]+), "(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_unit_\1_errno(\2, \5, "\3%m"\4);/'
* treewide: no need to negate errno for log_*_errno()Michal Schmidt2014-11-28
| | | | It corrrectly handles both positive and negative errno values.
* treewide: auto-convert the simple cases to log_*_errno()Michal Schmidt2014-11-28
| | | | | | | | | | | | | As a followup to 086891e5c1 "log: add an "error" parameter to all low-level logging calls and intrdouce log_error_errno() as log calls that take error numbers", use sed to convert the simple cases to use the new macros: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\("(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_\1_errno(-\4, "\2%m"\3);/' Multi-line log_*() invocations are not covered. And we also should add log_unit_*_errno().
* log: rearrange log function namingLennart Poettering2014-11-27
| | | | | | | | | | - Rename log_meta() → log_internal(), to follow naming scheme of most other log functions that are usually invoked through macros, but never directly. - Rename log_info_object() to log_object_info(), simply because the object should be before any other parameters, to follow OO-style programming style.
* core: introduce new Delegate=yes/no property controlling creation of cgroup ↵Lennart Poettering2014-11-05
| | | | | | | | | | | | | | | | | | | | | | | | subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine.
* core: send sigabrt on watchdog timeout to get the stacktraceUmut Tezduyar Lindskog2014-10-28
| | | | | if sigabrt doesn't do the job, follow regular shutdown routine, sigterm > sigkill.
* socket: properly label socket symlinksLennart Poettering2014-10-23
|
* socket: fix error comparisonLennart Poettering2014-10-23
|
* selinux: clean up selinux label function namingLennart Poettering2014-10-23
|
* selinux: rework label query APIsLennart Poettering2014-10-23
| | | | | | | | APIs that query and return something cannot silently fail, they must either return something useful, or an error. Fix that. Also, properly rollback socket unit fd creation when something goes wrong with the security framework.
* smack: rework smack APIs a bitLennart Poettering2014-10-23
| | | | | | a) always return negative errno error codes b) always become a noop if smack is off c) always take a NULL label as a request to remove it
* mac: rename all calls that apply a label mac_{selinux|smack}_apply_xyz(), ↵Lennart Poettering2014-10-23
| | | | | | | and all that reset it to defaults mac_{selinux|smack}_fix() Let's clean up the naming schemes a bit and use the same one for SMACK and for SELINUX.
* mac: rename apis with mac_{selinux/smack}_ prefixWaLyong Cho2014-10-23
|
* socket: introduce SELinuxContextFromNet optionMichal Sekletar2014-09-19
| | | | | | | | | | This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_mls_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
* exec: factor out most function arguments of exec_spawn() to ExecParametersDaniel Mack2014-09-05
| | | | | | | | | | This way, the list of arguments to that function gets more comprehensive, and we can get around passing lots of NULL and 0 arguments from socket.c, swap.c and mount.c. It also allows for splitting up the code in exec_spawn(). While at it, make ExecContext const in execute.c.
* core: unify how we generate the prefix string when dumping unit stateLennart Poettering2014-08-21
|
* socket: suffix newly added TCP sockopt time properties with "Sec"Lennart Poettering2014-08-19
| | | | | | This is what we have done so far for all other time values, and hence we should do this here. This indicates the default unit of time values specified here, if they don't contain a unit.
* Revert "socket: introduce SELinuxLabelViaNet option"Lennart Poettering2014-08-19
| | | | | | This reverts commit cf8bd44339b00330fdbc91041d6731ba8aba9fec. Needs more discussion on the mailing list.
* socket: introduce SELinuxLabelViaNet optionMichal Sekletar2014-08-19
| | | | | | | | | | This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>
* socket: Add support for TCP defer acceptSusant Sahani2014-08-14
| | | | | | | | | | | TCP_DEFER_ACCEPT Allow a listener to be awakened only when data arrives on the socket. If TCP_DEFER_ACCEPT set on a server-side listening socket, the TCP/IP stack will not to wait for the final ACK packet and not to initiate the process until the first packet of real data has arrived. After sending the SYN/ACK, the server will then wait for a data packet from a client. Now, only three packets will be sent over the network, and the connection establishment delay will be significantly reduced.
* socket: Add Support for TCP keep alive variablesSusant Sahani2014-08-14
| | | | | | | | | | | | | | The tcp keep alive variables now can be configured via conf parameter. Follwing variables are now supported by this patch. tcp_keepalive_intvl: The number of seconds between TCP keep-alive probes tcp_keepalive_probes: The maximum number of TCP keep-alive probes to send before giving up and killing the connection if no response is obtained from the other end. tcp_keepalive_time: The number of seconds a connection needs to be idle before TCP begins sending out keep-alive probes.
* Revert "socket: add support for TCP fast Open"Lennart Poettering2014-08-14
| | | | | | | | This reverts commit 9528592ff8d7ff361da430285deba8196e8984d5. Apparently TFO is actually the default at least for the server side now. Also the setsockopt doesn't actually take a bool, but a qlen integer.
* socket: add support for TCP fast OpenSusant Sahani2014-08-14
| | | | | | | | | | TCP Fast Open (TFO) speeds up the opening of successiveTCP) connections between two endpoints.It works by using a TFO cookie in the initial SYN packet to authenticate a previously connected client. It starts sending data to the client before the receipt of the final ACK packet of the three way handshake is received, skipping a round trip and lowering the latency in the start of transmission of data.
* socket: add support for tcp nagleSusant Sahani2014-08-14
| | | | | | | This patch adds support for TCP TCP_NODELAY socket option. This can be configured via NoDelay conf parameter. TCP Nagle's algorithm works by combining a number of small outgoing messages, and sending them all at once. This controls the TCP_NODELAY socket option.
* systemd-verify: a simple tool for offline unit verificationZbigniew Jędrzejewski-Szmek2014-07-20
| | | | | | | | This tool will warn about misspelt directives, unknown sections, and non-executable commands. It will also catch the common mistake of using Accept=yes with a non-template unit and vice versa. https://bugs.freedesktop.org/show_bug.cgi?id=56607
* socket: check return from exec_spawnThomas Hindoe Paaboel Andersen2014-06-18
|
* Remove sysv parser from service.cThomas Hindoe Paaboel Andersen2014-06-07
| | | | | | | | | | | Parsing sysv files was moved to the sysv-generator in the previous commit. This patch removes the sysv parsing from serivce.c. Note that this patch drops the following now unused sysv-specific info from service dump: "SysV Init Script has LSB Header: (yes/no)" "SysVEnabled: (yes/no)" "SysVRunLevels: (levels)"
* fix warningsThomas Hindoe Paaboel Andersen2014-06-06
| | | | | Prevent use of uninitialized variable and removed a now unused cleanup function for freeaddrinfo
* kdbus: when uploading bus name policy, resolve users/groups out-of-processLennart Poettering2014-06-05
| | | | | It's not safe invoking NSS from PID 1, hence fork off worker processes that upload the policy into the kernel for busnames.
* socket: add SocketUser= and SocketGroup= for chown()ing sockets in the file ↵Lennart Poettering2014-06-05
| | | | | | | system This is relatively complex, as we cannot invoke NSS from PID 1, and thus need to fork a helper process temporarily.
* socket: add new Symlinks= option for socket unitsLennart Poettering2014-06-04
| | | | | | | | | | | With Symlinks= we can manage one or more symlinks to AF_UNIX or FIFO nodes in the file system, with the same lifecycle as the socket itself. This has two benefits: first, this allows us to remove /dev/log and /dev/initctl from /dev, thus leaving only symlinks, device nodes and directories in the /dev tree. More importantly however, this allows us to move /dev/log out of /dev, while still making it accessible there, so that PrivateDevices= can provide /dev/log too.
* socket: optionally remove sockets/FIFOs in the file system after useLennart Poettering2014-06-04
|
* build-sys: use glibc's xattr support instead of requiring libattrKay Sievers2014-05-28
|
* socket: properly handle if our service vanished during runtimeLennart Poettering2014-05-22
|
* Remove unnecessary casts in printfsZbigniew Jędrzejewski-Szmek2014-05-15
| | | | No functional change expected :)
* Handle Unix domain socket connections from outside our namespace v2Zbigniew Jędrzejewski-Szmek2014-04-19
| | | | | This is a second attempt at 9754d56, reverted in 2f20a8e, because I lost a 'break;' when moving chunks around.
* Revert "Handle Unix domain socket connections from outside our namespace"Kay Sievers2014-04-19
| | | | | | | | | | This reverts commit 9754d56e9b21bfe89fc18f47987d6bef491b8521. It causes a crash in PID1: Apr 19 13:49:32 lon systemd[1]: Code should not be reached 'Unhandled socket type.' at src/core/socket.c:684, function instance_from_socket(). Aborting. Apr 19 13:49:32 lon systemd[1]: Caught <ABRT>, dumped core as pid 336. Apr 19 13:49:32 lon systemd[1]: Freezing execution.
* Handle Unix domain socket connections from outside our namespaceEelco Dolstra2014-04-16
| | | | | | | | | | | | | | | | | | NixOS uses Unix domain sockets for certain host <-> container interaction; i.e. the host connects to a socket visible in the container's directory tree, where the container uses a .socket unit to spawn the handler program on demand. This worked in systemd 203, but in 212 fails with "foo.socket failed to queue service startup job (Maybe the service file is missing or not a template unit?): No data available". The reason is that getpeercred() now returns ENODATA if it can't get the PID of the client, which happens in this case because the client is not in the same PID namespace. Since getpeercred() is only used to generate the instance name, this patch simply handles ENODATA by creating an instance name "<nr>-unknown". [zj: reorder clauses and remove (unsigned long) casts.]
* sd-event: rework API to support CLOCK_REALTIME_ALARM and ↵Lennart Poettering2014-03-24
| | | | CLOCK_BOOTTIME_ALARM, too
* core: rework context initialization/destruction logicLennart Poettering2014-03-19
| | | | | | | | Let's automatically initialize the kill, exec and cgroup contexts of the various unit types when the object is constructed, instead of invididually in type-specific code. Also, when PrivateDevices= is set, set DevicePolicy= to closed.
* util: replace close_nointr_nofail() by a more useful safe_close()Lennart Poettering2014-03-18
| | | | | | | | | | | | | | | safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
* Do not return -1 (EINVAL) on allocation errorZbigniew Jędrzejewski-Szmek2014-03-14
|
* socket.c: make use of union sockaddr_unionDaniel Buch2014-03-12
|
* core: introduce new RuntimeDirectory= and RuntimeDirectoryMode= unit settingsLennart Poettering2014-03-03
| | | | | As discussed on the ML these are useful to manage runtime directories below /run for services.
* core: add global settings for enabling CPUAccounting=, MemoryAccounting=, ↵Lennart Poettering2014-02-24
| | | | BlockIOAccounting= for all units at once
* api: in constructor function calls, always put the returned object pointer ↵Lennart Poettering2014-02-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.
* core: make sure to always go through both SIGTERM and SIGKILL states of unitsLennart Poettering2014-01-29
| | | | | | Given that we now have KillMode=mixed where SIGTERM might kill a smaller set than SIGKILL we need to make sure to always go explicitly throught the SIGKILL state to get the right end result.
* core: add function to tell when job will time outZbigniew Jędrzejewski-Szmek2014-01-27
| | | | | | Things will continue when either the job timeout or the unit timeout is reached. Add functionality to access that info.
* make socket_instantiate_service use cleanup gcc attributeMichael Scherer2014-01-11
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-28 00:15:46 +0000