nspawn: mount a clean instance of sysfs

[elogind.git] / src / journal / journalctl.c

diff --git a/src/journal/journalctl.c b/src/journal/journalctl.c
index 36c3d2b6883c4bd27fa02578338179519e953cec..6aff1f1ba3432e12909418862f23e73717092552 100644 (file)
--- a/src/journal/journalctl.c
+++ b/src/journal/journalctl.c
@@ -681,11 +681,18 @@ static int verify(sd_journal *j) {
                         char a[FORMAT_TIMESTAMP_MAX], b[FORMAT_TIMESTAMP_MAX], c[FORMAT_TIMESPAN_MAX];
                         log_info("PASS: %s", f->path);
 
-                        if (arg_verify_key && JOURNAL_HEADER_SEALED(f->header))
-                                log_info("=> Validated from %s to %s, %s missing",
-                                         format_timestamp(a, sizeof(a), from),
-                                         format_timestamp(b, sizeof(b), to),
-                                         format_timespan(c, sizeof(c), total > to ? total - to : 0));
+                        if (arg_verify_key && JOURNAL_HEADER_SEALED(f->header)) {
+                                if (from > 0) {
+                                        log_info("=> Validated from %s to %s, final %s entries not sealed.",
+                                                 format_timestamp(a, sizeof(a), from),
+                                                 format_timestamp(b, sizeof(b), to),
+                                                 format_timespan(c, sizeof(c), total > to ? total - to : 0));
+                                } else if (total > 0)
+                                        log_info("=> No sealing yet, %s of entries not sealed.",
+                                                 format_timespan(c, sizeof(c), total));
+                                else
+                                        log_info("=> No sealing yet, no entries in file.");
+                        }
                 }
         }
 
@@ -740,8 +747,20 @@ int main(int argc, char *argv[]) {
         }
 
 #ifdef HAVE_ACL
+        if (access("/var/log/journal", F_OK) < 0 && geteuid() != 0 && in_group("adm") <= 0) {
+                log_error("Unprivileged users can't see messages unless persistent log storage is enabled. Users in the group 'adm' can always see messages.");
+                r = -EACCES;
+                goto finish;
+        }
+
         if (!arg_quiet && geteuid() != 0 && in_group("adm") <= 0)
-                log_warning("Showing user generated messages only. Users in the group 'adm' can see all messages. Pass -q to turn this message off.");
+                log_warning("Showing user generated messages only. Users in the group 'adm' can see all messages. Pass -q to turn this notice off.");
+#else
+        if (geteuid() != 0 && in_group("adm") <= 0) {
+                log_error("No access to messages. Only users in the group 'adm' can see messages.");
+                r = -EACCES;
+                goto finish;
+        }
 #endif
 
         r = add_this_boot(j);