[systemd-commits] 3 commits - TODO src/core units/systemd-bus-driverd.service.in units/systemd-bus-proxyd at .service.in units/systemd-hostnamed.service.in units/systemd-journal-gatewayd.service.in units/systemd-localed.service.in units/systemd-machined.service.in units/systemd-networkd.service.in
Lennart Poettering
lennart at kemper.freedesktop.org
Wed Mar 19 15:31:26 PDT 2014
TODO | 4 --
src/core/manager.c | 46 ++++++++++++++++--------------
units/systemd-bus-driverd.service.in | 1
units/systemd-bus-proxyd at .service.in | 1
units/systemd-hostnamed.service.in | 1
units/systemd-journal-gatewayd.service.in | 3 +
units/systemd-localed.service.in | 1
units/systemd-machined.service.in | 1
units/systemd-networkd.service.in | 1
9 files changed, 35 insertions(+), 24 deletions(-)
New commits:
commit b5640d824565ac4e305714598d4828de21ceaea1
Author: Lennart Poettering <lennart at poettering.net>
Date: Wed Mar 19 23:25:41 2014 +0100
update TODO
diff --git a/TODO b/TODO
index 08c78c5..76236b1 100644
--- a/TODO
+++ b/TODO
@@ -27,7 +27,7 @@ External:
Features:
-* move notify sockets to the file system, so that PrivateNetwork= doesn't conflict with sd_notify() usage
+* make MountFlags= useful as a simple switch to disconnect mount propagation
* add bus api to query unit file's X fields.
@@ -49,8 +49,6 @@ Features:
* support transient mount units
-* Imply DevicePolicy=closed when PrivateDevices= is used
-
* add an "input" group to udev logic and add all input devices to it
* machined: provide calls GetMachineByAddress() on the manager
commit f21a71a907a1b1289faec94559f4a1c111ea1d13
Author: Lennart Poettering <lennart at poettering.net>
Date: Wed Mar 19 23:08:39 2014 +0100
core: enable PrivateNetwork= for a number of our long running services where this is useful
diff --git a/units/systemd-bus-driverd.service.in b/units/systemd-bus-driverd.service.in
index 5226486..5df2a95 100644
--- a/units/systemd-bus-driverd.service.in
+++ b/units/systemd-bus-driverd.service.in
@@ -15,3 +15,4 @@ WatchdogSec=1min
CapabilityBoundingSet=CAP_IPC_OWNER
PrivateTmp=yes
PrivateDevices=yes
+PrivateNetwork=yes
diff --git a/units/systemd-bus-proxyd at .service.in b/units/systemd-bus-proxyd at .service.in
index 1a6458a..fafd4ce 100644
--- a/units/systemd-bus-proxyd at .service.in
+++ b/units/systemd-bus-proxyd at .service.in
@@ -17,3 +17,4 @@ NotifyAccess=main
CapabilityBoundingSet=CAP_IPC_OWNER
PrivateTmp=yes
PrivateDevices=yes
+PrivateNetwork=yes
diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in
index c8bf848..4481259 100644
--- a/units/systemd-hostnamed.service.in
+++ b/units/systemd-hostnamed.service.in
@@ -17,3 +17,4 @@ CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE
WatchdogSec=1min
PrivateTmp=yes
PrivateDevices=yes
+PrivateNetwork=yes
diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in
index a01ce8d..e8e571e 100644
--- a/units/systemd-journal-gatewayd.service.in
+++ b/units/systemd-journal-gatewayd.service.in
@@ -14,6 +14,9 @@ ExecStart=@rootlibexecdir@/systemd-journal-gatewayd
User=systemd-journal-gateway
Group=systemd-journal-gateway
SupplementaryGroups=systemd-journal
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateNetwork=yes
[Install]
Also=systemd-journal-gatewayd.socket
diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in
index 6fb0565..ae1c5e5 100644
--- a/units/systemd-localed.service.in
+++ b/units/systemd-localed.service.in
@@ -17,3 +17,4 @@ CapabilityBoundingSet=
WatchdogSec=1min
PrivateTmp=yes
PrivateDevices=yes
+PrivateNetwork=yes
diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in
index 2be1dcf..1a27c6e 100644
--- a/units/systemd-machined.service.in
+++ b/units/systemd-machined.service.in
@@ -19,3 +19,4 @@ CapabilityBoundingSet=CAP_KILL
WatchdogSec=1min
PrivateTmp=yes
PrivateDevices=yes
+PrivateNetwork=yes
diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in
index ca40691..793381f 100644
--- a/units/systemd-networkd.service.in
+++ b/units/systemd-networkd.service.in
@@ -20,6 +20,7 @@ Restart=always
RestartSec=0
ExecStart=@rootlibexecdir@/systemd-networkd
WatchdogSec=1min
+PrivateTmp=yes
[Install]
WantedBy=multi-user.target
commit 7181dbdb2e3112858d62bdaea4f0ad2ed685ccba
Author: Lennart Poettering <lennart at poettering.net>
Date: Wed Mar 19 22:46:45 2014 +0100
core: move notify sockets to /run and $XDG_RUNTIME_DIR
A service with PrivateNetwork= cannot access abstract namespace sockets
of the host anymore, hence let's better not use abstract namespace
sockets for this, since we want to make sure that PrivateNetwork=
is useful and doesn't break sd_notify().
diff --git a/src/core/manager.c b/src/core/manager.c
index 632ce74..fd22d48 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -84,9 +84,6 @@
#define JOBS_IN_PROGRESS_PERIOD_USEC (USEC_PER_SEC / 3)
#define JOBS_IN_PROGRESS_PERIOD_DIVISOR 3
-/* Where clients shall send notification messages to */
-#define NOTIFY_SOCKET "@/org/freedesktop/systemd1/notify"
-
#define TIME_T_MAX (time_t)((1UL << ((sizeof(time_t) << 3) - 1)) - 1)
static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
@@ -505,16 +502,17 @@ fail:
}
static int manager_setup_notify(Manager *m) {
- union {
- struct sockaddr sa;
- struct sockaddr_un un;
- } sa = {
- .sa.sa_family = AF_UNIX,
- };
- int one = 1, r;
+ int r;
if (m->notify_fd < 0) {
_cleanup_close_ int fd = -1;
+ union {
+ struct sockaddr sa;
+ struct sockaddr_un un;
+ } sa = {
+ .sa.sa_family = AF_UNIX,
+ };
+ int one = 1;
/* First free all secondary fields */
free(m->notify_socket);
@@ -527,13 +525,24 @@ static int manager_setup_notify(Manager *m) {
return -errno;
}
- if (getpid() != 1 || detect_container(NULL) > 0)
- snprintf(sa.un.sun_path, sizeof(sa.un.sun_path), NOTIFY_SOCKET "/%" PRIx64, random_u64());
- else
- strncpy(sa.un.sun_path, NOTIFY_SOCKET, sizeof(sa.un.sun_path));
- sa.un.sun_path[0] = 0;
+ if (m->running_as == SYSTEMD_SYSTEM)
+ m->notify_socket = strdup("/run/systemd/notify");
+ else {
+ const char *e;
+
+ e = getenv("XDG_RUNTIME_DIR");
+ if (!e) {
+ log_error("XDG_RUNTIME_DIR is not set: %m");
+ return -EINVAL;
+ }
- r = bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + 1 + strlen(sa.un.sun_path+1));
+ m->notify_socket = strappend(e, "/systemd/notify");
+ }
+ if (!m->notify_socket)
+ return log_oom();
+
+ strncpy(sa.un.sun_path, m->notify_socket, sizeof(sa.un.sun_path)-1);
+ r = bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
if (r < 0) {
log_error("bind() failed: %m");
return -errno;
@@ -545,11 +554,6 @@ static int manager_setup_notify(Manager *m) {
return -errno;
}
- sa.un.sun_path[0] = '@';
- m->notify_socket = strdup(sa.un.sun_path);
- if (!m->notify_socket)
- return log_oom();
-
m->notify_fd = fd;
fd = -1;
More information about the systemd-commits
mailing list