[systemd-commits] 4 commits - TODO src/core src/systemctl
Lennart Poettering
lennart at kemper.freedesktop.org
Fri Oct 17 04:55:02 PDT 2014
TODO | 5
src/core/execute.c | 2
src/core/namespace.c | 6 -
src/core/namespace.h | 6 -
src/systemctl/systemctl.c | 256 ++++++++++++++++++++++++++++++++--------------
5 files changed, 190 insertions(+), 85 deletions(-)
New commits:
commit 8fa6cbe1a9f3f3353224116772619a4d3eb26f88
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Oct 17 13:54:27 2014 +0200
execute: downgrade namespace error to "warning"
Also, extend the printed warning a bit, explaining the situation more
verbosely.
diff --git a/src/core/execute.c b/src/core/execute.c
index 43f2764..4b0767a 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1547,7 +1547,7 @@ static int exec_child(ExecCommand *command,
context->mount_flags);
if (err == -EPERM)
- log_error_unit(params->unit_id, "Failed to setup namespace, ignoring: %s", strerror(-err));
+ log_warning_unit(params->unit_id, "Failed to set up file system namespace due to lack of privileges. Execution sandbox will not be in effect: %s", strerror(-err));
else if (err < 0) {
*error = EXIT_NAMESPACE;
return err;
commit 8a25e11e6c4b74b7e5299792601e352ee96b8207
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Oct 17 13:49:01 2014 +0200
update TODO
diff --git a/TODO b/TODO
index 7787d3c..6c0e3fe 100644
--- a/TODO
+++ b/TODO
@@ -1,4 +1,5 @@
Bugfixes:
+
* Re-enable "fsck -l" when it is ready:
https://bugs.freedesktop.org/show_bug.cgi?id=79576#c5
@@ -40,6 +41,8 @@ External:
Features:
+* PID 1 doesn't apply nspawns devices cgroup policy
+
* rework journal-send.c to use memfds for large blobs if they are available instead of unlinked files in /tmp. Also, if we detect that the kernel knows memfds, refuse anything but sealed memfds.
* maybe support a new very "soft" reboot mode, that simply kills all processes, disassembles everything, flushes /run and sysvipc, and then reexecs systemd again
@@ -95,8 +98,6 @@ Features:
* merge ~/.local/share and ~/.local/lib into one similar /usr/lib and /usr/share....
-* remove readahead in 217
-
* journald: allows specification of UID range for splitting up journal files
* systemd.show_status= should probably have a mode where only failed
commit a004cb4cb2271e04e87d4fd6f7353307038e83ea
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Oct 17 13:48:55 2014 +0200
namespace: add missing 'const' to parameters
diff --git a/src/core/namespace.c b/src/core/namespace.c
index c221509..ab03aeb 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -424,9 +424,9 @@ int setup_namespace(
char** read_write_dirs,
char** read_only_dirs,
char** inaccessible_dirs,
- char* tmp_dir,
- char* var_tmp_dir,
- char* bus_endpoint_path,
+ const char* tmp_dir,
+ const char* var_tmp_dir,
+ const char* bus_endpoint_path,
bool private_dev,
ProtectHome protect_home,
ProtectSystem protect_system,
diff --git a/src/core/namespace.h b/src/core/namespace.h
index 9cd420e..1f9d067 100644
--- a/src/core/namespace.h
+++ b/src/core/namespace.h
@@ -44,9 +44,9 @@ typedef enum ProtectSystem {
int setup_namespace(char **read_write_dirs,
char **read_only_dirs,
char **inaccessible_dirs,
- char *tmp_dir,
- char *var_tmp_dir,
- char *endpoint_path,
+ const char *tmp_dir,
+ const char *var_tmp_dir,
+ const char *endpoint_path,
bool private_dev,
ProtectHome protect_home,
ProtectSystem protect_system,
commit 342641fb47618b783aeb3cdb65733afdb85b2260
Author: Lennart Poettering <lennart at poettering.net>
Date: Mon Oct 13 17:44:37 2014 +0200
systemctl: by default interactively ask for polkit authorization, if possible
Also, allow using --no-ask-password to turn off ineractive polkit
authorization.
diff --git a/src/systemctl/systemctl.c b/src/systemctl/systemctl.c
index af3cc97..28eaa6a 100644
--- a/src/systemctl/systemctl.c
+++ b/src/systemctl/systemctl.c
@@ -1965,18 +1965,28 @@ static int set_default(sd_bus *bus, char **args) {
r = 0;
} else {
- _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
+ _cleanup_bus_message_unref_ sd_bus_message *reply = NULL, *m = NULL;
_cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
- r = sd_bus_call_method(
+ r = sd_bus_message_new_method_call(
bus,
+ &m,
"org.freedesktop.systemd1",
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- "SetDefaultTarget",
- &error,
- &reply,
- "sb", unit, true);
+ "SetDefaultTarget");
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_message_append(m, "sb", unit, 1);
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_call(bus, m, 0, &error, &reply);
if (r < 0) {
log_error("Failed to set default target: %s", bus_error_message(&error, -r));
return r;
@@ -2143,6 +2153,7 @@ static int list_jobs(sd_bus *bus, char **args) {
static int cancel_job(sd_bus *bus, char **args) {
_cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
char **name;
+ int r = 0;
assert(args);
@@ -2150,31 +2161,43 @@ static int cancel_job(sd_bus *bus, char **args) {
return daemon_reload(bus, args);
STRV_FOREACH(name, args+1) {
+ _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
uint32_t id;
- int r;
+ int q;
- r = safe_atou32(*name, &id);
- if (r < 0) {
- log_error("Failed to parse job id \"%s\": %s", *name, strerror(-r));
- return r;
+ q = safe_atou32(*name, &id);
+ if (q < 0) {
+ log_error("Failed to parse job id \"%s\": %s", *name, strerror(-q));
+ return q;
}
- r = sd_bus_call_method(
+ q = sd_bus_message_new_method_call(
bus,
+ &m,
"org.freedesktop.systemd1",
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- "CancelJob",
- &error,
- NULL,
- "u", id);
- if (r < 0) {
- log_error("Failed to cancel job %"PRIu32": %s", id, bus_error_message(&error, r));
- return r;
+ "CancelJob");
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (q < 0)
+ return bus_log_create_error(1);
+
+ q = sd_bus_message_append(m, "u", id);
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_call(bus, m, 0, &error, NULL);
+ if (q < 0) {
+ log_error("Failed to cancel job %"PRIu32": %s", id, bus_error_message(&error, q));
+ if (r == 0)
+ r = q;
}
}
- return 0;
+ return r;
}
static int need_daemon_reload(sd_bus *bus, const char *unit) {
@@ -2567,7 +2590,7 @@ static int start_unit_one(
sd_bus_error *error,
Set *s) {
- _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
+ _cleanup_bus_message_unref_ sd_bus_message *m = NULL, *reply = NULL;
const char *path;
int r;
@@ -2577,15 +2600,26 @@ static int start_unit_one(
assert(error);
log_debug("Calling manager for %s on %s, %s", method, name, mode);
- r = sd_bus_call_method(
+
+ r = sd_bus_message_new_method_call(
bus,
+ &m,
"org.freedesktop.systemd1",
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- method,
- error,
- &reply,
- "ss", name, mode);
+ method);
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_message_append(m, "ss", name, mode);
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_call(bus, m, 0, error, &reply);
if (r < 0) {
const char *verb;
@@ -2827,7 +2861,7 @@ static int reboot_with_logind(sd_bus *bus, enum action a) {
method,
&error,
NULL,
- "b", true);
+ "b", arg_ask_password);
if (r < 0)
log_error("Failed to execute operation: %s", bus_error_message(&error, r));
@@ -3050,18 +3084,29 @@ static int kill_unit(sd_bus *bus, char **args) {
log_error("Failed to expand names: %s", strerror(-r));
STRV_FOREACH(name, names) {
- q = sd_bus_call_method(
+ _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
+
+ q = sd_bus_message_new_method_call(
bus,
+ &m,
"org.freedesktop.systemd1",
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- "KillUnit",
- &error,
- NULL,
- "ssi", *names, arg_kill_who, arg_signal);
+ "KillUnit");
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_message_append(m, "ssi", *names, arg_kill_who, arg_signal);
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_call(bus, m, 0, &error, NULL);
if (q < 0) {
- log_error("Failed to kill unit %s: %s",
- *names, bus_error_message(&error, r));
+ log_error("Failed to kill unit %s: %s", *names, bus_error_message(&error, q));
if (r == 0)
r = q;
}
@@ -4561,6 +4606,10 @@ static int set_property(sd_bus *bus, char **args) {
if (r < 0)
return bus_log_create_error(r);
+ r = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (r < 0)
+ return bus_log_create_error(r);
+
n = unit_name_mangle(args[1], MANGLE_NOGLOB);
if (!n)
return log_oom();
@@ -4602,7 +4651,7 @@ static int set_property(sd_bus *bus, char **args) {
static int snapshot(sd_bus *bus, char **args) {
_cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
- _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
+ _cleanup_bus_message_unref_ sd_bus_message *m = NULL, *reply = NULL;
_cleanup_free_ char *n = NULL, *id = NULL;
const char *path;
int r;
@@ -4614,15 +4663,25 @@ static int snapshot(sd_bus *bus, char **args) {
if (!n)
return log_oom();
- r = sd_bus_call_method(
+ r = sd_bus_message_new_method_call(
bus,
+ &m,
"org.freedesktop.systemd1",
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- "CreateSnapshot",
- &error,
- &reply,
- "sb", n, false);
+ "CreateSnapshot");
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_message_append(m, "sb", n, false);
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_call(bus, m, 0, &error, &reply);
if (r < 0) {
log_error("Failed to create snapshot: %s", bus_error_message(&error, r));
return r;
@@ -4655,7 +4714,7 @@ static int delete_snapshot(sd_bus *bus, char **args) {
_cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
_cleanup_strv_free_ char **names = NULL;
char **name;
- int r, q;
+ int r;
assert(args);
@@ -4664,18 +4723,30 @@ static int delete_snapshot(sd_bus *bus, char **args) {
log_error("Failed to expand names: %s", strerror(-r));
STRV_FOREACH(name, names) {
- q = sd_bus_call_method(
+ _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
+ int q;
+
+ q = sd_bus_message_new_method_call(
bus,
+ &m,
"org.freedesktop.systemd1",
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- "RemoveSnapshot",
- &error,
- NULL,
- "s", *name);
+ "RemoveSnapshot");
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_message_append(m, "s", *name);
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_call(bus, m, 0, &error, NULL);
if (q < 0) {
- log_error("Failed to remove snapshot %s: %s",
- *name, bus_error_message(&error, r));
+ log_error("Failed to remove snapshot %s: %s", *name, bus_error_message(&error, q));
if (r == 0)
r = q;
}
@@ -4686,6 +4757,7 @@ static int delete_snapshot(sd_bus *bus, char **args) {
static int daemon_reload(sd_bus *bus, char **args) {
_cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
+ _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
const char *method;
int r;
@@ -4709,16 +4781,21 @@ static int daemon_reload(sd_bus *bus, char **args) {
/* "daemon-reload" */ "Reload";
}
- r = sd_bus_call_method(
+ r = sd_bus_message_new_method_call(
bus,
+ &m,
"org.freedesktop.systemd1",
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- method,
- &error,
- NULL,
- NULL);
+ method);
+ if (r < 0)
+ return bus_log_create_error(r);
+ r = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_call(bus, m, 0, &error, NULL);
if (r == -ENOENT && arg_action != ACTION_SYSTEMCTL)
/* There's always a fallback possible for
* legacy actions. */
@@ -4747,18 +4824,29 @@ static int reset_failed(sd_bus *bus, char **args) {
log_error("Failed to expand names: %s", strerror(-r));
STRV_FOREACH(name, names) {
- q = sd_bus_call_method(
+ _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
+
+ q = sd_bus_message_new_method_call(
bus,
+ &m,
"org.freedesktop.systemd1",
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- "ResetFailedUnit",
- &error,
- NULL,
- "s", *name);
+ "ResetFailedUnit");
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_message_append(m, "s", *name);
+ if (q < 0)
+ return bus_log_create_error(q);
+
+ q = sd_bus_call(bus, m, 0, &error, NULL);
if (q < 0) {
- log_error("Failed to reset failed state of unit %s: %s",
- *name, bus_error_message(&error, r));
+ log_error("Failed to reset failed state of unit %s: %s", *name, bus_error_message(&error, q));
if (r == 0)
r = q;
}
@@ -4889,6 +4977,10 @@ static int set_environment(sd_bus *bus, char **args) {
if (r < 0)
return bus_log_create_error(r);
+ r = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (r < 0)
+ return bus_log_create_error(r);
+
r = sd_bus_message_append_strv(m, args + 1);
if (r < 0)
return bus_log_create_error(r);
@@ -4920,6 +5012,10 @@ static int import_environment(sd_bus *bus, char **args) {
if (r < 0)
return bus_log_create_error(r);
+ r = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (r < 0)
+ return bus_log_create_error(r);
+
if (strv_isempty(args + 1))
r = sd_bus_message_append_strv(m, environ);
else {
@@ -5231,6 +5327,10 @@ static int enable_unit(sd_bus *bus, char **args) {
if (r < 0)
return bus_log_create_error(r);
+ r = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (r < 0)
+ return bus_log_create_error(r);
+
r = sd_bus_message_append_strv(m, names);
if (r < 0)
return bus_log_create_error(r);
@@ -5346,23 +5446,15 @@ static int add_dependency(sd_bus *bus, char **args) {
if (r < 0)
return bus_log_create_error(r);
- r = sd_bus_message_append_strv(m, names);
- if (r < 0)
- return bus_log_create_error(r);
-
- r = sd_bus_message_append(m, "s", target);
- if (r < 0)
- return bus_log_create_error(r);
-
- r = sd_bus_message_append(m, "s", unit_dependency_to_string(dep));
+ r = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
if (r < 0)
return bus_log_create_error(r);
- r = sd_bus_message_append(m, "b", arg_runtime);
+ r = sd_bus_message_append_strv(m, names);
if (r < 0)
return bus_log_create_error(r);
- r = sd_bus_message_append(m, "b", arg_force);
+ r = sd_bus_message_append(m, "ssbb", target, unit_dependency_to_string(dep), arg_runtime, arg_force);
if (r < 0)
return bus_log_create_error(r);
@@ -5404,21 +5496,33 @@ static int preset_all(sd_bus *bus, char **args) {
r = 0;
} else {
- _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
+ _cleanup_bus_message_unref_ sd_bus_message *m = NULL, *reply = NULL;
_cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
- r = sd_bus_call_method(
+ r = sd_bus_message_new_method_call(
bus,
+ &m,
"org.freedesktop.systemd1",
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- "PresetAllUnitFiles",
- &error,
- &reply,
+ "PresetAllUnitFiles");
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_message_set_allow_interactive_authorization(m, arg_ask_password);
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_message_append(
+ m,
"sbb",
unit_file_preset_mode_to_string(arg_preset_mode),
arg_runtime,
arg_force);
+ if (r < 0)
+ return bus_log_create_error(r);
+
+ r = sd_bus_call(bus, m, 0, &error, &reply);
if (r < 0) {
log_error("Failed to execute operation: %s", bus_error_message(&error, r));
return r;
More information about the systemd-commits
mailing list