chiark / gitweb /
8 years agonspawn: introduce --capability=all for retaining all capabilities
Lennart Poettering [Thu, 13 Feb 2014 01:45:11 +0000 (02:45 +0100)]
nspawn: introduce --capability=all for retaining all capabilities

8 years agoseccomp: fix build again if libseccomp is missing
Lennart Poettering [Thu, 13 Feb 2014 01:25:45 +0000 (02:25 +0100)]
seccomp: fix build again if libseccomp is missing

8 years agoupdate TODO
Lennart Poettering [Thu, 13 Feb 2014 01:13:50 +0000 (02:13 +0100)]
update TODO

8 years agocore: make StopWhenUnneeded work in conjunction with units that fail
Lennart Poettering [Thu, 13 Feb 2014 01:12:27 +0000 (02:12 +0100)]
core: make StopWhenUnneeded work in conjunction with units that fail
during their start job

8 years agoupdate TODO
Lennart Poettering [Thu, 13 Feb 2014 00:41:24 +0000 (01:41 +0100)]
update TODO

8 years agocore: add a system-wide SystemCallArchitectures= setting
Lennart Poettering [Thu, 13 Feb 2014 00:35:27 +0000 (01:35 +0100)]
core: add a system-wide SystemCallArchitectures= setting

This is useful to prohibit execution of non-native processes on systems,
for example 32bit binaries on 64bit systems, this lowering the attack
service on incorrect syscall and ioctl 32→64bit mappings.

8 years agonetworkd: correctly handle manager_free(NULL)
Tom Gundersen [Thu, 13 Feb 2014 00:38:53 +0000 (01:38 +0100)]
networkd: correctly handle manager_free(NULL)

8 years agocore: add SystemCallArchitectures= unit setting to allow disabling of non-native
Lennart Poettering [Wed, 12 Feb 2014 23:24:00 +0000 (00:24 +0100)]
core: add SystemCallArchitectures= unit setting to allow disabling of non-native
architecture support for system calls

Also, turn system call filter bus properties into complex types instead
of concatenated strings.

8 years agocore: fix build without libseccomp
Lennart Poettering [Wed, 12 Feb 2014 17:44:40 +0000 (18:44 +0100)]
core: fix build without libseccomp

8 years agocore: rework syscall filter
Lennart Poettering [Wed, 12 Feb 2014 17:28:21 +0000 (18:28 +0100)]
core: rework syscall filter

- Allow configuration of an errno error to return from blacklisted
  syscalls, instead of immediately terminating a process.

- Fix parsing logic when libseccomp support is turned off

- Only keep the actual syscall set in the ExecContext, and generate the
  string version only on demand.

8 years agosyscallfilter: port to libseccomp
Ronny Chevalier [Wed, 12 Feb 2014 00:29:54 +0000 (01:29 +0100)]
syscallfilter: port to libseccomp

8 years agosd-dhcp: make sure client->secs > 0
Tom Gundersen [Wed, 12 Feb 2014 15:59:52 +0000 (16:59 +0100)]
sd-dhcp: make sure client->secs > 0

Some DHCP servers will not work correctly if secs == 0, so round up
to at least 1.

8 years agonetworkd: work inside containers
Tom Gundersen [Wed, 12 Feb 2014 15:40:24 +0000 (16:40 +0100)]
networkd: work inside containers

Udev does not run in containers, so instead of relying on it to tell us when a
network device is ready to be used by networkd, we simply assume that any
device was fully initialized before being added to the container.

8 years agoupdate TODO (add section for things to fix before 209)
Lennart Poettering [Wed, 12 Feb 2014 11:59:31 +0000 (12:59 +0100)]
update TODO (add section for things to fix before 209)

8 years agobuild-sys: make lxml required when generating indices
Zbigniew Jędrzejewski-Szmek [Wed, 12 Feb 2014 07:58:41 +0000 (02:58 -0500)]
build-sys: make lxml required when generating indices

Since the manpage indices generated without lxml would be missing some
parts, it doesn't make sense to keep lxml optional anymore.

8 years agobuild-sys: add less-variables.xml to EXTRA_DIST
Zbigniew Jędrzejewski-Szmek [Wed, 12 Feb 2014 07:05:06 +0000 (02:05 -0500)]
build-sys: add less-variables.xml to EXTRA_DIST

8 years agoman: use xinclude to de-deduplicate common text
Zbigniew Jędrzejewski-Szmek [Wed, 12 Feb 2014 05:55:38 +0000 (00:55 -0500)]
man: use xinclude to de-deduplicate common text

I only tested with python-lxml. I'm not sure if xml.etree should be

8 years agopager: support SYSTEMD_LESS environment variable
Jason A. Donenfeld [Wed, 12 Feb 2014 02:30:10 +0000 (03:30 +0100)]
pager: support SYSTEMD_LESS environment variable

This allows customization of the arguments used by less. The main
motivation is that some folks might not like having --no-init on every
invocation of less.

8 years agonspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use of this
Lennart Poettering [Wed, 12 Feb 2014 01:52:39 +0000 (02:52 +0100)]
nspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use of this

8 years agotest: fix "make check"
Lennart Poettering [Wed, 12 Feb 2014 01:09:32 +0000 (02:09 +0100)]
test: fix "make check"

Let's remove the tests for cg_path_get_machine_name(), since they no
longer operate solely on the cgroup path, but actually look up data in
/run. Since we have a test for cg_pid_get_machine_name() this shouldn't
be too much of a loss.

8 years agomachinectl: add new "machinectl reboot" call
Lennart Poettering [Wed, 12 Feb 2014 01:07:57 +0000 (02:07 +0100)]
machinectl: add new "machinectl reboot" call

8 years agologind: ignore PropertiesChanged signals for jobs
Zbigniew Jędrzejewski-Szmek [Sat, 8 Feb 2014 22:22:13 +0000 (17:22 -0500)]
logind: ignore PropertiesChanged signals for jobs

Otherwise we get a (harmless) message like:
systemd-logind[30845]: Failed to process message [type=signal sender=:1.36 path=/org/freedesktop/systemd1/job/4674 interface=org.freedesktop.DBus.Properties member=PropertiesChanged signature=sa{sv}as]: Invalid argument

8 years agologind: always kill session when termination is requested
Zbigniew Jędrzejewski-Szmek [Sun, 9 Feb 2014 01:29:56 +0000 (20:29 -0500)]
logind: always kill session when termination is requested

KillUserProcesses=yes/no should be ignored when termination is
explicitly requested.

8 years agojournald: log provenience of signals
Zbigniew Jędrzejewski-Szmek [Mon, 10 Feb 2014 01:08:55 +0000 (20:08 -0500)]
journald: log provenience of signals

8 years agounits: make use of nspawn's --keep-unit switch in systemd-nspawn@.service
Lennart Poettering [Tue, 11 Feb 2014 20:07:09 +0000 (21:07 +0100)]
units: make use of nspawn's --keep-unit switch in systemd-nspawn@.service

8 years agomachined: fix enumeration of existing machines on restart
Lennart Poettering [Tue, 11 Feb 2014 20:06:51 +0000 (21:06 +0100)]
machined: fix enumeration of existing machines on restart

8 years agoupdate TODO
Lennart Poettering [Tue, 11 Feb 2014 19:31:37 +0000 (20:31 +0100)]
update TODO

8 years agologind: use session_get_state() to get sessions state of the user
Djalal Harouni [Sat, 8 Feb 2014 19:51:57 +0000 (20:51 +0100)]
logind: use session_get_state() to get sessions state of the user

In function user_get_state() remove the session_is_active() check, just
count on the session_get_state() function to get the correct session

session_is_active() may return true before starting the session scope
and user service, this means it will return true even before the creation
of the session fifo_fd which will produce incorrect states.

So be consistent and just use session_get_state().

8 years agoefi: fix Undefined reference efi_loader_get_boot_usec when EFI support is disabled
Cristian Rodríguez [Tue, 11 Feb 2014 12:54:49 +0000 (09:54 -0300)]
efi: fix Undefined reference efi_loader_get_boot_usec when EFI support is disabled

8 years agomachined: optionally, allow registration of pre-existing units (scopes
Lennart Poettering [Tue, 11 Feb 2014 16:15:38 +0000 (17:15 +0100)]
machined: optionally, allow registration of pre-existing units (scopes
or services) as machine with machined

8 years agoutil: modernize readlink_malloc() a bit
Lennart Poettering [Tue, 11 Feb 2014 15:45:35 +0000 (16:45 +0100)]
util: modernize readlink_malloc() a bit

8 years agoutil: drop parse_user_at_host() since its unused now
Lennart Poettering [Tue, 11 Feb 2014 15:45:15 +0000 (16:45 +0100)]
util: drop parse_user_at_host() since its unused now

8 years agonspawn: add --register=yes|no switch to optionally disable registration of the contai...
Lennart Poettering [Mon, 10 Feb 2014 14:36:32 +0000 (15:36 +0100)]
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined

8 years agosd-dhcp: split out packet handling from client
Tom Gundersen [Tue, 11 Feb 2014 12:11:18 +0000 (13:11 +0100)]
sd-dhcp: split out packet handling from client

8 years agosd-bus: export sd_bus_call{,_async,_async_cancel}
David Herrmann [Mon, 10 Feb 2014 15:42:52 +0000 (16:42 +0100)]
sd-bus: export sd_bus_call{,_async,_async_cancel}

The .sym file somehow lacks these declarations, so add these. You have to
run "make clean" to make sure the sym-test runs fine afterwards.

8 years agonetworkd: link - correctly skip state ENSLAVING when no vlans configured
Tom Gundersen [Mon, 10 Feb 2014 22:01:47 +0000 (23:01 +0100)]
networkd: link - correctly skip state ENSLAVING when no vlans configured

This fixes a regression introduced in 672682a6b

8 years agonetworkd: VLAN - allow multiple vlans to be created on a link
Tom Gundersen [Mon, 10 Feb 2014 17:41:54 +0000 (18:41 +0100)]
networkd: VLAN - allow multiple vlans to be created on a link

Also limit the range of vlan ids. Other implementations and
documentation use the ranges {0,1}-{4094,4095}, but we use
the one accepted by the kernel: 0-4094.

Reported-by: Oleksii Shevchuk <>
8 years agopam: use correct log level
Michal Sekletar [Mon, 10 Feb 2014 15:37:09 +0000 (16:37 +0100)]
pam: use correct log level

8 years agosd-rtnl: added support for a few more attributes
Susant Sahani [Fri, 7 Feb 2014 17:06:25 +0000 (22:36 +0530)]
sd-rtnl: added support for a few more attributes

8 years agosd-rtnl: test - improve test of MTU a bit
Tom Gundersen [Mon, 10 Feb 2014 12:28:39 +0000 (13:28 +0100)]
sd-rtnl: test - improve test of MTU a bit

We are more likely to catch errors if we don't use '0' as test value.

8 years agosd-rtnl: add test cases for link
Susant Sahani [Fri, 7 Feb 2014 04:57:41 +0000 (10:27 +0530)]
sd-rtnl: add test cases for link

8 years agonspawn: add new --share-system switch to run a container without PID/UTS/IPC namespacing
Lennart Poettering [Mon, 10 Feb 2014 12:15:42 +0000 (13:15 +0100)]
nspawn: add new --share-system switch to run a container without PID/UTS/IPC namespacing

8 years agoupdate TODO
Lennart Poettering [Mon, 10 Feb 2014 12:05:28 +0000 (13:05 +0100)]
update TODO

8 years agonspawn,man: use a common vocabulary when referring to selinux security contexts
Lennart Poettering [Mon, 10 Feb 2014 11:32:03 +0000 (12:32 +0100)]
nspawn,man: use a common vocabulary when referring to selinux security contexts

Let's always call the security labels the same way:

  SMACK: "Smack Label"
  SELINUX: "SELinux Security Context"

And the low-level encapsulation is called "seclabel". Now let's hope we
stick to this vocabulary in future, too, and don't mix "label"s and
"security contexts" and so on wildly.

8 years agoexec: Add support for ignoring errors on SELinuxContext by prefixing it with -, like...
Michael Scherer [Thu, 6 Feb 2014 09:05:18 +0000 (10:05 +0100)]
exec: Add support for ignoring errors on SELinuxContext by prefixing it with -, like for others settings.

Also remove call to security_check_context, as this doesn't serve anything, since
setexeccon will fail anyway.

8 years agoexec: Ignore the setting SELinuxContext if selinux is not enabled
Michael Scherer [Thu, 6 Feb 2014 09:05:17 +0000 (10:05 +0100)]
exec: Ignore the setting SELinuxContext if selinux is not enabled

8 years agoexec: Add SELinuxContext configuration item
Michael Scherer [Thu, 6 Feb 2014 09:05:16 +0000 (10:05 +0100)]
exec: Add SELinuxContext configuration item

This permit to let system administrators decide of the domain of a service.
This can be used with templated units to have each service in a différent
domain ( for example, a per customer database, using MLS or anything ),
or can be used to force a non selinux enabled system (jvm, erlang, etc)
to start in a different domain for each service.

8 years agoincludes: remove duplicate includes
Tom Gundersen [Mon, 10 Feb 2014 12:06:09 +0000 (13:06 +0100)]
includes: remove duplicate includes

Found by the new check-includes make target.

8 years agobuild-sys: move python helpers to tools directory
Karel Zak [Mon, 10 Feb 2014 09:37:10 +0000 (10:37 +0100)]
build-sys: move python helpers to tools directory

Note that is missing in EXTRA_DIST=, this patch
fixes this mistake too.

8 years agobuild-sys: add check-includes build target and script
Karel Zak [Mon, 10 Feb 2014 09:37:11 +0000 (10:37 +0100)]
build-sys: add check-includes build target and script

8 years agofstab-generator: Create fsck-root symlink with correct path
Colin Guthrie [Sun, 9 Feb 2014 12:07:11 +0000 (12:07 +0000)]
fstab-generator: Create fsck-root symlink with correct path

This was noticed in Brussels at the hackfest. The fstab-generator currently
creates a broken symlink pointing to itself in
/run/systemd/generator/ for systemd-fsck-root.service

8 years agonspawn: require /etc/os-release only for init
Vincent Batts [Mon, 10 Feb 2014 10:57:53 +0000 (11:57 +0100)]
nspawn: require /etc/os-release only for init

/etc/os-release is expected for the case for booting a full system, and
need not be required for thin container execution.

8 years agonetworkd: fix setting dns from dhcp
Tom Gundersen [Mon, 10 Feb 2014 10:53:16 +0000 (11:53 +0100)]
networkd: fix setting dns from dhcp

8 years agoman: fix another reference in systemd-inhibit(1)
Zbigniew Jędrzejewski-Szmek [Sun, 9 Feb 2014 06:34:20 +0000 (01:34 -0500)]
man: fix another reference in systemd-inhibit(1)

8 years agoman: fix reference in systemd-inhibit(1)
Zbigniew Jędrzejewski-Szmek [Sun, 9 Feb 2014 06:34:20 +0000 (01:34 -0500)]
man: fix reference in systemd-inhibit(1)

8 years agomanager: fix initialization of plymouth socket
Zbigniew Jędrzejewski-Szmek [Sat, 8 Feb 2014 20:09:55 +0000 (15:09 -0500)]
manager: fix initialization of plymouth socket

I'm not sure why this makes a difference...

8 years agocryptsetup-generator: auto add deps for device as password
Dave Reisner [Sat, 8 Feb 2014 17:54:58 +0000 (12:54 -0500)]
cryptsetup-generator: auto add deps for device as password

If the password is a device file, we can add Requires/After dependencies
on the device rather than requiring the user to do so.

8 years agocore: use automatic cleanup in two functions
Zbigniew Jędrzejewski-Szmek [Sun, 12 Jan 2014 20:55:10 +0000 (15:55 -0500)]
core: use automatic cleanup in two functions

8 years agocore: do not print invalid utf-8 in error messages
Zbigniew Jędrzejewski-Szmek [Sat, 18 Jan 2014 02:28:41 +0000 (21:28 -0500)]
core: do not print invalid utf-8 in error messages

8 years agopam-module: avoid (null) in debug message
Zbigniew Jędrzejewski-Szmek [Sat, 8 Feb 2014 17:12:20 +0000 (12:12 -0500)]
pam-module: avoid (null) in debug message

8 years agocore: fix crashes if locale.conf contains invalid utf-8 string
Goffredo Baroncelli [Thu, 6 Feb 2014 18:09:59 +0000 (19:09 +0100)]
core: fix crashes if locale.conf contains invalid utf-8 string

In the parse_env_file_push() and load_env_file_push() functions, there
are two assert() call to check if the key or value parameters are utf8 valid.

If the strings aren't utf8 valid, assert does abort.

These function are used early by systemd to parse some files. For
example '/etc/locale.conf'. In my case this file contained a not utf8
sequence, which is bad, but systemd crashed during the boot, which
is even worse!

The enclosed patch removes the assert and return -EINVAL if the
sequence is invalid. This is possible because the caller of these
function [1] checks the errors.
So the check of an invalid utf8 sequence is still performed, but
systemd doesn't crash anymore and logs the error.

[1] parse_env_file_internal(), invoked by load_env_file() and

8 years agoremove unused variables
Thomas Hindoe Paaboel Andersen [Fri, 7 Feb 2014 22:09:40 +0000 (23:09 +0100)]
remove unused variables

8 years agonspawn: rename --file-label to --apifs-label since it's really just about the API...
Lennart Poettering [Fri, 7 Feb 2014 18:29:28 +0000 (19:29 +0100)]
nspawn: rename --file-label to --apifs-label since it's really just about the API file systems, nothing else

8 years agocore: when an already abandoned unit gets abandoned again generate a clean error
Lennart Poettering [Fri, 7 Feb 2014 16:59:27 +0000 (17:59 +0100)]
core: when an already abandoned unit gets abandoned again generate a clean error

8 years agologind: order all scopes after both systemd-logind.service and
Lennart Poettering [Fri, 7 Feb 2014 15:42:03 +0000 (16:42 +0100)]
logind: order all scopes after both systemd-logind.service and

This way at shutdown we can be sure that the sessions go away before the

8 years agonetworkd: netdev - rename Netdev to NetDev
Tom Gundersen [Fri, 7 Feb 2014 16:03:23 +0000 (17:03 +0100)]
networkd: netdev - rename Netdev to NetDev

Both in the configuration file format and everywhere else in the code.

8 years agologind: add function session_jobs_reply() to unify the create reply
Djalal Harouni [Thu, 6 Feb 2014 20:37:14 +0000 (21:37 +0100)]
logind: add function session_jobs_reply() to unify the create reply

The session_send_create_reply() function which notifies clients about
session creation is used for both session and user units. Unify the
shared code in a new function session_jobs_reply().

The session_save() will be called unconditionally on sessions since it
does not make sense to only call it if '!session->started', this will
also allow to update the session state as soon as possible.

8 years agocore: one step back again, for nspawn we actually can't wait for cgroups running...
Lennart Poettering [Fri, 7 Feb 2014 15:12:09 +0000 (16:12 +0100)]
core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it

8 years agomachined: since we can now somewhat reliable get notifications for dying
Lennart Poettering [Fri, 7 Feb 2014 14:44:10 +0000 (15:44 +0100)]
machined: since we can now somewhat reliable get notifications for dying
scopes we don't need to lower the stop timeout anymore

8 years agoman: cryptsetup-1.6.3 now allows partition device file in system mode
Jan Janssen [Fri, 7 Feb 2014 11:47:20 +0000 (12:47 +0100)]
man: cryptsetup-1.6.3 now allows partition device file in system mode

8 years agobuild-sys: autogen - enable compat libs by default
Tom Gundersen [Fri, 7 Feb 2014 14:48:07 +0000 (15:48 +0100)]
build-sys: autogen - enable compat libs by default

8 years agosd-dhcp-client: split sd_dhcp_lease from sd_dhcp_client
Tom Gundersen [Tue, 4 Feb 2014 22:13:52 +0000 (23:13 +0100)]
sd-dhcp-client: split sd_dhcp_lease from sd_dhcp_client

This allows us users of the library to keep copies of old leases. This is
used by networkd to know what addresses to drop (if any) when the lease

In the future this may be used by DNAv4 and sd-dhcp-server.

8 years agozsh-completions: kernel-install - only show existing kernels for 'remove'
Tom Gundersen [Thu, 6 Feb 2014 17:15:47 +0000 (18:15 +0100)]
zsh-completions: kernel-install - only show existing kernels for 'remove'

When we remove a kernel, we don't remove the modules, so don't look at the modules directory to find installed kernels.

8 years agologind: given that we can now relatively safely shutdown sessions copes
Lennart Poettering [Thu, 6 Feb 2014 18:04:51 +0000 (19:04 +0100)]
logind: given that we can now relatively safely shutdown sessions copes
without working cgroup empty notifications there's no need to set the
stop timeout of sessions scopes low

8 years agocore: allow PIDs to be watched by two units at the same time
Lennart Poettering [Fri, 7 Feb 2014 10:58:25 +0000 (11:58 +0100)]
core: allow PIDs to be watched by two units at the same time

In some cases it is interesting to map a PID to two units at the same
time. For example, when a user logs in via a getty, which is reexeced to
/sbin/login that binary will be explicitly referenced as main pid of the
getty service, as well as implicitly referenced as part of the session

8 years agocore: don't send duplicate SIGCONT when killing units
Lennart Poettering [Thu, 6 Feb 2014 18:46:46 +0000 (19:46 +0100)]
core: don't send duplicate SIGCONT when killing units

8 years agocgroup: make sure to properly send SIGCONT to all processes of a cgroup if that's...
Lennart Poettering [Thu, 6 Feb 2014 18:27:59 +0000 (19:27 +0100)]
cgroup: make sure to properly send SIGCONT to all processes of a cgroup if that's requested

8 years agologind: rework session shutdown logic
Lennart Poettering [Thu, 6 Feb 2014 17:32:14 +0000 (18:32 +0100)]
logind: rework session shutdown logic

Simplify the shutdown logic a bit:

- Keep the session FIFO around in the PAM module, even after the session
  shutdown hook has been finished. This allows logind to track precisely
  when the PAM handler goes away.

- In the ReleaseSession() call start a timer, that will stop terminate
  the session when elapsed.

- Never fiddle with the KillMode of scopes to configure whether user
  processes should be killed or not. Instead, simply leave the scope
  units around when we terminate a session whose processes should not be

- When killing is enabled, stop the session scope on FIFO EOF or after
  the ReleaseSession() timeout. When killing is disabled, simply tell
  PID 1 to abandon the scope.

Because the scopes stay around and hence all processes are always member
of a scope, the system shutdown logic should be more robust, as the
scopes can be shutdown as part of the usual shutdown logic.

8 years agocore: watch SIGCHLD more closely to track processes of units with no reliable cgroup...
Lennart Poettering [Thu, 6 Feb 2014 16:17:51 +0000 (17:17 +0100)]
core: watch SIGCHLD more closely to track processes of units with no reliable cgroup empty notifier

When a process dies that we can associate with a specific unit, start
watching all other processes of that unit, so that we can associate
those processes with the unit too.

Also, for service units start doing this as soon as we get the first
SIGCHLD for either control or main process, so that we can follow the
processes of the service from one to the other, as long as process that
remain are processes of the ones we watched that died and got reassigned
to us as parent.

Similar, for scope units start doing this as soon as the scope
controller abandons the unit, and thus management entirely reverts to
systemd. To abandon a unit introduce a new Abandon() scope unit method

8 years agocore: fix warning
Thomas Hindoe Paaboel Andersen [Thu, 6 Feb 2014 23:01:19 +0000 (00:01 +0100)]
core: fix warning

introduced in c7040b5d1c2c148f12b6a5eef3dfce1661805131

8 years agoshell-completion: fix completion of localectl set-locale
Zbigniew Jędrzejewski-Szmek [Thu, 6 Feb 2014 16:59:33 +0000 (11:59 -0500)]
shell-completion: fix completion of localectl set-locale

8 years agonspawn: fix HAVE_SELINUX ifdef
Tom Gundersen [Wed, 5 Feb 2014 16:07:20 +0000 (17:07 +0100)]
nspawn: fix HAVE_SELINUX ifdef

8 years agotransaction: print more information about conflicting jobs
Zbigniew Jędrzejewski-Szmek [Thu, 6 Feb 2014 05:37:18 +0000 (00:37 -0500)]
transaction: print more information about conflicting jobs

Also remove some debug statement that should not have been committed.

8 years agobash-completion: fix completion of complete verbs
Zbigniew Jędrzejewski-Szmek [Thu, 6 Feb 2014 05:31:22 +0000 (00:31 -0500)]
bash-completion: fix completion of complete verbs

When doing 'command verb<TAB>', the arguments for verb would be
proposed, but it is too early. We should complete verb first.

8 years agocore: only send SIGHUP when doing first kill, not when doing final sigkill
Lennart Poettering [Thu, 6 Feb 2014 00:50:41 +0000 (01:50 +0100)]
core: only send SIGHUP when doing first kill, not when doing final sigkill

8 years agoudev: add zram to the list of devices inappropriate for symlinks
Jóhann B. Guðmundsson [Sun, 2 Feb 2014 13:29:19 +0000 (13:29 +0000)]
udev: add zram to the list of devices inappropriate for symlinks

udev seems to have a race condition with swapon to see which can open
/dev/zram0 first, causing swapon to fail. Seems to be most noticeable
on arm devices one out of every 7 times or something.

8 years agoUpdate some message formats
Zbigniew Jędrzejewski-Szmek [Tue, 4 Feb 2014 00:31:53 +0000 (19:31 -0500)]
Update some message formats

Use PID_FMT/USEC_FMT/... in more places.

Also update logind error messages to print the full path to a file that
failed. This should make debugging easier for people who do not know
off the top of their head where logind stores it state.

8 years agonspawn: add --quiet switch for turning off any output noise
Lennart Poettering [Wed, 5 Feb 2014 23:43:14 +0000 (00:43 +0100)]
nspawn: add --quiet switch for turning off any output noise

8 years agonspawn: always use default bus
Lennart Poettering [Wed, 5 Feb 2014 22:06:34 +0000 (23:06 +0100)]
nspawn: always use default bus

8 years agobus: properly unset default bus pointer when destroying last reference
Lennart Poettering [Wed, 5 Feb 2014 22:06:13 +0000 (23:06 +0100)]
bus: properly unset default bus pointer when destroying last reference

8 years agoman: introduce new "Desktop" property for sessions
Lennart Poettering [Wed, 5 Feb 2014 19:34:11 +0000 (20:34 +0100)]
man: introduce new "Desktop" property for sessions

This is initialized from XDG_SESSION_DESKTOP and is useful for GNOME
to recognize its own sessions. It's supposed to be set to a short string
identifying the session, such as "kde" or "gnome".

8 years agologind: make session type and class settable via the same ways
Lennart Poettering [Wed, 5 Feb 2014 17:55:18 +0000 (18:55 +0100)]
logind: make session type and class settable via the same ways

If the session type/class is set via environment variables, use that,
and otherwise fallback to something that is set via the PAM module
command line.

8 years agologind: add new "wayland" session type
Lennart Poettering [Wed, 5 Feb 2014 17:27:43 +0000 (18:27 +0100)]
logind: add new "wayland" session type

8 years agocore: don't wait for non-control/non-main processes when killing processes on the...
Lennart Poettering [Wed, 5 Feb 2014 01:22:11 +0000 (02:22 +0100)]
core: don't wait for non-control/non-main processes when killing processes on the host either

Since the current kernel cgroup notification logic is easily confused by
existing subgroups, let's do the same thing as in containers before. and
just not wait for non-control and non-main processes.

This should be corrected as soon as we have sane cgroup notifications
from the kernel.

8 years agokill: fix error return
Lennart Poettering [Wed, 5 Feb 2014 01:11:18 +0000 (02:11 +0100)]
kill: fix error return

8 years agocore: allow User=, Group=, Nice=, Environment=, Type= to be passed when creating...
Lennart Poettering [Wed, 5 Feb 2014 01:02:00 +0000 (02:02 +0100)]
core: allow User=, Group=, Nice=, Environment=, Type= to be passed when creating a transient service

8 years agoAdded attribute support for sd-rtnl
Susant Sahani [Tue, 4 Feb 2014 08:49:20 +0000 (14:19 +0530)]
Added attribute support for sd-rtnl

  Added sd_rtnl_message_append_u8 and
  few attribute support in sd_rtnl_message_append_u32

8 years agonspawn: various fixes in selinux hookup
Lennart Poettering [Tue, 4 Feb 2014 21:56:07 +0000 (22:56 +0100)]
nspawn: various fixes in selinux hookup

- As suggested, prefix argument variables with "arg_" how we do this

- As suggested, don't involve memory allocations when storing command
  line arguments.

- Break --help text at 80 chars

- man: explain that this is about SELinux

- don't do unnecessary memory allocations when putting together mount
  option string

8 years agoAdd SELinux support to systemd-nspawn
Dan Walsh [Thu, 30 Jan 2014 21:28:02 +0000 (16:28 -0500)]
Add SELinux support to systemd-nspawn

This patch adds to new options:


This specifies the process label to run on processes run within the container.


The file label to assign to memory file systems created within the container.

For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following

chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh

8 years agojournal: Drop pkgconfig reference to libsystemd-id128.
Colin Guthrie [Thu, 30 Jan 2014 12:58:24 +0000 (13:58 +0100)]
journal: Drop pkgconfig reference to libsystemd-id128.

This is now part of libsystemd.