summaryrefslogtreecommitdiffstats
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* test-cpu-set-util.c: fix typo in comment (#6916)Jan Synacek2017-09-2668-526/+4197
|\
| * basic/log: fix return value from log_struct_iovec_internal()Zbigniew Jędrzejewski-Szmek2017-09-261-1/+1
| | | | | | | | | | This returned value so far wasn't used anywhere, so there's no change in behaviour.
| * bpf: set BPF_F_ALLOW_OVERRIDE when attaching a cgroup program if ↵Lennart Poettering2017-09-223-4/+13
| | | | | | | | | | | | | | | | | | | | Delegate=yes is set Let's permit installing BPF programs in cgroup subtrees if Delegeate=yes. Let's not document this precise behaviour for now though, as most likely the logic here should become recursive, but that's only going to happen if the kernel starts supporting that. Until then, support this in a non-recursive fashion.
| * main: bump RLIMIT_NOFILE for the root user substantiallyLennart Poettering2017-09-221-2/+26
| | | | | | | | | | | | | | | | | | | | On current kernels BPF_MAP_TYPE_LPM_TRIE bpf maps are charged against RLIMIT_MEMLOCK even for privileged users that have CAP_IPC_LOCK. Given that mlock() generally ignores RLIMIT_MEMLOCK if CAP_IPC_LOCK is set this appears to be an oversight in the kernel. Either way, until that's fixed, let's just bump RLIMIT_MEMLOCK for the root user considerably, as the default is quite limiting, and doesn't permit us to create more than a few TRIE maps.
| * rlimit: don't assume getrlimit() always succeedsLennart Poettering2017-09-221-1/+2
| | | | | | | | | | | | In times of seccomp it might very well fail, and given that we return failures from this function anyway, let's also propagate getrlimit() failures, just to be safe.
| * core: whenever a unit terminates, log its consumed resources to the journalLennart Poettering2017-09-224-17/+235
| | | | | | | | | | | | | | | | | | | | | | | | This adds a new recognizable log message for each unit invocation that contains structured information about consumed resources of the unit as a whole after it terminated. This is particular useful for apps that want to figure out what the resource consumption of a unit given a specific invocation ID was. The log message is only generated for units that have at least one XyzAccounting= property turned on, and currently only covers IP traffic and CPU time metrics.
| * nspawn: set up a new session keyring for the container processLennart Poettering2017-09-221-0/+25
| | | | | | | | | | | | | | | | keyring material should not leak into the container. So far we relied on seccomp to deny access to the keyring, but given that we now made the seccomp configurable, and access to keyctl() and friends may optionally be permitted to containers now let's make sure we disconnect the callers keyring from the keyring of PID 1 in the container.
| * io-util: add new IOVEC_INIT/IOVEC_MAKE macrosLennart Poettering2017-09-2216-206/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds IOVEC_INIT() and IOVEC_MAKE() for initializing iovec structures from a pointer and a size. On top of these IOVEC_INIT_STRING() and IOVEC_MAKE_STRING() are added which take a string and automatically determine the size of the string using strlen(). This patch removes the old IOVEC_SET_STRING() macro, given that IOVEC_MAKE_STRING() is now useful for similar purposes. Note that the old IOVEC_SET_STRING() invocations were two characters shorter than the new ones using IOVEC_MAKE_STRING(), but I think the new syntax is more readable and more generic as it simply resolves to a C99 literal structure initialization. Moreover, we can use very similar syntax now for initializing strings and pointer+size iovec entries. We canalso use the new macros to initialize function parameters on-the-fly or array definitions. And given that we shouldn't have so many ways to do the same stuff, let's just settle on the new macros. (This also converts some code to use _cleanup_ where dynamically allocated strings were using IOVEC_SET_STRING() before, to modernize things a bit)
| * job: change result field for log message about job result RESULT= → ↵Lennart Poettering2017-09-221-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | JOB_RESULT= So, currently, some of the structured log messages we generated based on jobs carry the result in RESULT=, and others in JOB_RESULT=. Let's streamline this, as stick to JOB_RESULT= in one place. This is kind of an API break, but given that currently most software has to check both fields anyway, I think we can get away with it. Why unify on JOB_RESULT= rather than RESULT=? Well, we manage different types of result codes in systemd. Most importanlty besides job results there are also service results, and we should be explicit in what we mean here.
| * core: make sure to log invocation ID of units also when doing structured loggingLennart Poettering2017-09-226-2/+15
| |
| * cgroup: refuse to return accounting data if accounting isn't turned onLennart Poettering2017-09-221-0/+35
| | | | | | | | | | | | | | | | | | | | We used to be a bit sloppy on this, and handed out accounting data even for units where accounting wasn't explicitly enabled. Let's be stricter here, so that we know the accounting data is actually fully valid. This is necessary, as the accounting data is no longer stored exclusively in cgroupfs, but is partly maintained external of that, and flushed during unit starts. We should hence only expose accounting data we really know is fully current.
| * core: when coming back from reload/reexec, reapply all cgroup propertiesLennart Poettering2017-09-222-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | With this change we'll invalidate all cgroup settings after coming back from a daemon reload/reexec, so that the new settings are instantly applied. This is useful for the BPF case, because we don't serialize/deserialize the BPF program fd, and hence have to install a new, updated BPF program when coming back from the reload/reexec. However, this is also useful for the rest of the cgroup settings, as it ensures that user configuration really takes effect wherever we can.
| * core: serialize/deserialize IP accounting across daemon reload/reexecLennart Poettering2017-09-223-2/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure the current IP accounting counters aren't lost during reload/reexec. Note that we destroy all BPF file objects during a reload: the BPF programs, the access and the accounting maps. The former two need to be regenerated anyway with the newly loaded configuration data, but the latter one needs to survive reloads/reexec. In this implementation I opted to only save/restore the accounting map content instead of the map itself. While this opens a (theoretic) window where IP traffic is still accounted to the old map after we read it out, and we thus miss a few bytes this has the benefit that we can alter the map layout between versions should the need arise.
| * core: when creating the socket fds for a socket unit, join socket's cgroup firstLennart Poettering2017-09-223-51/+248
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's make sure that a socket unit's IPAddressAllow=/IPAddressDeny= settings are in effect on all socket fds associated with it. In order to make this happen we need to make sure the cgroup the fds are associated with are the socket unit's cgroup. The only way to do that is invoking socket()+accept() in them. Since we really don't want to migrate PID 1 around we do this by forking off a helper process, which invokes socket()/accept() and sends the newly created fd to PID 1. Ugly, but works, and there's apparently no better way right now. This generalizes forking off per-unit helper processes in a new function unit_fork_helper_process(), which is then also used by the NSS chown() code of socket units.
| * socket-label: let's use IN_SET, so that we have to call ↵Lennart Poettering2017-09-221-1/+1
| | | | | | | | socket_address_family() only once
| * core: warn loudly if IP firewalling is configured but not in effectLennart Poettering2017-09-222-0/+20
| |
| * Add test for eBPF firewall codeDaniel Mack2017-09-222-0/+173
| |
| * ip-address-access: minimize IP address listsLennart Poettering2017-09-225-0/+71
| | | | | | | | | | Let's drop redundant items from the IP address list after parsing. Let's also mask out redundant bits hidden by the prefixlength.
| * core: support IP firewalling to be configured for transient unitsLennart Poettering2017-09-222-7/+295
| |
| * cgroup: dump the newly added IP settings in the cgroup contextLennart Poettering2017-09-221-0/+17
| |
| * systemctl: report accounted network traffic in "systemctl status"Daniel Mack2017-09-221-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This hooks up the eposed D-Bus values and displays them like this: -bash-4.3# systemctl status httpd ● httpd.service - The Apache HTTP Server Loaded: loaded (/etc/systemd/system/httpd.service; enabled; vendor preset: disabled) Active: active (running) since Fri 2016-11-11 20:10:36 CET; 1min 29s ago Main PID: 33 (httpd) Status: "Total requests: 22514; Idle/Busy workers 92/7;Requests/sec: 259; Bytes served/sec: 87KB/sec" Network: 15.8M in, 51.1M out ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ CGroup: /system.slice/httpd.service ├─ 33 /usr/sbin/httpd -DFOREGROUND ├─ 37 /usr/sbin/httpd -DFOREGROUND ├─112 /usr/sbin/httpd -DFOREGROUND └─119 /usr/sbin/httpd -DFOREGROUND
| * manager: hook up IP accounting defaultsDaniel Mack2017-09-224-0/+6
| |
| * cgroup, unit, fragment parser: make use of new firewall functionsDaniel Mack2017-09-2216-42/+280
| |
| * Add firewall eBPF compilerDaniel Mack2017-09-223-0/+706
| |
| * cgroup: add fields to accommodate eBPF related detailsDaniel Mack2017-09-226-1/+45
| | | | | | | | | | Add pointers for compiled eBPF programs as well as list heads for allowed and denied hosts for both directions.
| * Add IP address address ACL representation and parserDaniel Mack2017-09-223-87/+290
| | | | | | | | | | | | | | Add a config directive parser that takes multiple space separated IPv4 or IPv6 addresses with optional netmasks in CIDR notation rvalue and puts a parsed version of it to linked list of IPAddressAccessItem objects. The code actually using this will be added later.
| * Add abstraction model for BPF programsDaniel Mack2017-09-224-9/+280
| | | | | | | | | | This object takes a number of bpf_insn members and wraps them together with the in-kernel reference id. Will be needed by the firewall code.
| * build-sys: add new kernel bpf.h drop-inDaniel Mack2017-09-223-0/+926
| | | | | | | | | | The defines we need are pretty comprehensive and new, hence copy in the full header from the kernel.
| * in-addr-util: add new helper call in_addr_prefix_from_string_auto()Lennart Poettering2017-09-224-14/+153
| | | | | | | | | | | | This is much like in_addr_prefix_from_string(), but automatically determines whether IPv4 or IPv6 addresses are specified. Also adds a test for it.
| * in-addr-util: prefix return parameters with ret_Lennart Poettering2017-09-222-6/+6
| |
| * in-addr-util: be more systematic with naming our functionsLennart Poettering2017-09-227-20/+20
| | | | | | | | | | | | | | | | | | Let's rename all our functions that process IPv4 in_addr structures in4_addr_xyz(), following the already establishing naming logic for this. Leave the in_addr_xyz() prefix for functions that process the IPv4/IPv6 in_addr_union union instead.
| * manager: initialize timeouts when allocating a naked Manager objectLennart Poettering2017-09-221-0/+3
| | | | | | | | | | | | | | This way we can safely run manager objects from tests and good timeouts apply. Without this all timeouts are set 0, which means they fire instantly, when run from tests which do not explicitly configure them (the way main.c does).
| * manager: watching the cgroup2 inotify fd is safe in test runs tooLennart Poettering2017-09-221-54/+48
| | | | | | | | | | Less deviation between test runs and normal runs is always a good idea, hence enable more stuff that is safe in test runs
| * cgroup: always invalidate "cpu" and "cpuacct" togetherLennart Poettering2017-09-221-0/+3
| | | | | | | | | | | | | | This doesn't really matter, as we never invalidate cpuacct explicitly, and there's no real reason to care for it explicitly, however it's prettier if we always treat cpu and cpuacct as belonging together, the same way we conisder "io" and "blkio" to belong together.
| * cgroup-util: minor coding style adjustmentLennart Poettering2017-09-221-3/+6
| |
| * core: make sure to dump cgroup context when unit_dump() is called for all ↵Lennart Poettering2017-09-224-0/+6
| | | | | | | | | | | | | | | | unit types For some reason we didn't dump the cgroup context for a number of unit types, including service units. Not sure how this wasn't noticed before... Add this in.
* | test-cpu-set-util.c: fix typo in comment (#6916)Jan Synacek2017-09-261-1/+1
| |
* | journal-verfiy: add a couple of missing le64toh() calls (#6888)Lennart Poettering2017-09-251-21/+21
| | | | | | | | | | Apparently BE users don't verify their journals... Noticed as result of #6887
* | string-util: use size_t for strjoina macro (#6914)Jonathan Lebon2017-09-251-1/+1
| | | | | | `strlen` returns a `size_t` and `alloca` expects a `size_t`.
* | install: drop left-over debug message (#6913)Zbigniew Jędrzejewski-Szmek2017-09-251-1/+0
| |
* | Merge pull request #6893 from poettering/cgroup-delegate-yayZbigniew Jędrzejewski-Szmek2017-09-243-20/+46
|\ \ | | | | | | cgroup delegation fixes, as well as socket unit slice assignment
| * | socket: assign socket units to a default slice unconditionallyLennart Poettering2017-09-221-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to the chown() logic socket units might end up with processes even if no explicit command is defined for them, hence let's make sure these processes are in the right cgroup, and that means within a slice. Mount, swap and service units unconditionally are assigned to a slice already, let's do the same here, too. (This becomes more important as soon as the ebpf/firewall stuff is merged, as there'll be another reason to fork off processes then)
| * | cgroup: make use of unit_cgroup_delegate() where usefulLennart Poettering2017-09-221-9/+5
| | | | | | | | | | | | It's an easy-to-use wrapper, so let's take benefit of it.
| * | cgroup: rework which files we chown() on delegationLennart Poettering2017-09-221-5/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On cgroupsv2 we should also chown()/chmod() the subtree_control file, so that children can use controllers the way they like. On cgroupsv1 we should also chown()/chmod() cgroups.clone_children, as not setting this for new cgroups makes little sense, and hence delegated clients should be able to write to it. Note that error handling for both cases is different. subtree_control matters so we check for errors, but the clone_children/tasks stuff doesn't really, as it's legacy stuff. Hence we only log errors and proceed. Fixes: #6216
| * | cgroup-util: downgrade log messages from library code to LOG_DEBUGLennart Poettering2017-09-221-2/+4
| | | | | | | | | | | | | | | | | | | | | These errors don't really matter, that's why we log and proceed in the current code. However, we currently log at LOG_WARNING, but we really shouldn't given that this is library code. Hence downgrade this to LOG_DEBUG.
* | | Merge pull request #6891 from poettering/read-lineZbigniew Jędrzejewski-Szmek2017-09-247-37/+329
|\ \ \ | | | | | | | | add read_line() helper as bounded getline() and make use of it at some places
| * | | fileio: return 0 from read_one_line_file on successZbigniew Jędrzejewski-Szmek2017-09-241-1/+3
| | | | | | | | | | | | | | | | Fixup for f4b51a2d09. Suggested by Evgeny Vereshchagin.
| * | | test-fileio: also test read_line() with actual filesZbigniew Jędrzejewski-Szmek2017-09-241-13/+51
| | | | | | | | | | | | | | | | | | | | Just in case the real FILE and the one from fmemopen weren't exactly the same.
| * | | test-fileio: close two leaked file handlesZbigniew Jędrzejewski-Szmek2017-09-241-2/+2
| | | |
| * | | test-conf-parser: add tests for the new long lines, including overflow handlingZbigniew Jędrzejewski-Szmek2017-09-231-1/+40
| | | |
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-19 17:52:21 +0100