| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
| |
The credential mounts should be managed singlehandedly by pid1.
Preparation for the future introduction of RefreshOnReload=credential,
where refreshing creds will be properly supported on reload.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This allows for "per-instance" credentials for units. The use case
is best explained with an example. Currently all our getty units
have the following stanzas in their unit file:
"""
ImportCredential=agetty.*
ImportCredential=login.*
"""
This means that setting agetty.autologin=root as a system credential
will make every instance of our all our getty units autologin as the
root user. This prevents us from doing autologin on /dev/hvc0 while
still requiring manual login on all other ttys.
To solve the issue, we introduce support for renaming credentials with
ImportCredential=. This will allow us to add the following to e.g.
serial-getty@.service:
"""
ImportCredential=tty.serial.%I.agetty.*:agetty.
ImportCredential=tty.serial.%I.login.*:login.
"""
which for serial-getty@hvc0.service will make the service manager read
all credentials of the form "tty.serial.hvc0.agetty.xxx" and pass them
to the service in the form "agetty.xxx" (same goes for login). We can
apply the same to each of the getty units to allow setting agetty and
login credentials for individual ttys instead of globally.
|
| |
|
|
|
| |
Make logging consistent, plus introduce helper function
for adding creds to ExecContext.set_credential too.
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
umount command"
This reverts commit 1e1225614ca1106116dcad9fb37aaeb6106408ab.
This was an incomplete workaround of the race. Now that
we stop generating mount units for credential mounts,
the logic could be dropped.
|
| |
|
|
| |
Also rename EXEC_WRITE_CREDENTIALS to EXEC_SETUP_CREDENTIALS.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
command
When a unit has credentials, stopping the service unmounts the credentials
directory. On shutdown, stopping the service and the corresponding mount
unit may be done mostly simultaneously, and if we invoke umount command soon
after umount() being called on stopping the service, the mount unit will
fail.
This makes Mount.invalidated_state flag set when umount() is called for a path,
and re-read /proc/self/mouninfo before invoking umount command if the flag is set.
Fixes #25527.
Replaces #26959.
|
| |
|
|
|
|
| |
helper function
No functional change, just refactoring.
|
|
|
Also rename setup_credentials() -> exec_setup_credentials().
Addresses the post-merge review
https://github.com/systemd/systemd/pull/28787#pullrequestreview-1592065048.
|
