Package: systemd / 232-25+deb9u12
Metadata
| Package | Version | Patches format |
|---|---|---|
| systemd | 232-25+deb9u12 | 3.0 (quilt) |
Patch series
view the series file| Patch | File delta | Description |
|---|---|---|
| tree wide drop NULL sentinel from strjoin.patch | (download) |
coccinelle/strjoin.cocci |
16 16 + 0 - 0 ! |
tree-wide: drop null sentinel from strjoin This makes strjoin and strjoina more similar and avoids the useless final argument. spatch -I . -I ./src -I ./src/basic -I ./src/basic -I ./src/shared -I ./src/shared -I ./src/network -I ./src/locale -I ./src/login -I ./src/journal -I ./src/journal -I ./src/timedate -I ./src/timesync -I ./src/nspawn -I ./src/resolve -I ./src/resolve -I ./src/systemd -I ./src/core -I ./src/core -I ./src/libudev -I ./src/udev -I ./src/udev/net -I ./src/udev -I ./src/libsystemd/sd-bus -I ./src/libsystemd/sd-event -I ./src/libsystemd/sd-login -I ./src/libsystemd/sd-netlink -I ./src/libsystemd/sd-network -I ./src/libsystemd/sd-hwdb -I ./src/libsystemd/sd-device -I ./src/libsystemd/sd-id128 -I ./src/libsystemd-network --sp-file coccinelle/strjoin.cocci --in-place $(git ls-files src/*.c) git grep -e '\bstrjoin\b.*NULL' -l|xargs sed -i -r 's/strjoin\((.*), NULL\)/strjoin(\1)/' This might have missed a few cases (spatch has a really hard time dealing with _cleanup_ macros), but that's no big issue, they can always be fixed later. (cherry picked from commit 605405c6cc934466951b0c6bad5a9553620bcb08) |
| build sys link test seccomp against seccomp libs 4560.patch | (download) |
Makefile.am |
3 2 + 1 - 0 ! |
build-sys: link test-seccomp against seccomp libs (#4560) Fixes build error on recent toolchains: ../src/test/test-seccomp.c:35: error: undefined reference to 'seccomp_arch_native' collect2: error: ld returned 1 exit status |
| delta skip symlink paths when split usr is enabled 4591.patch | (download) |
src/delta/delta.c |
31 31 + 0 - 0 ! |
delta: skip symlink paths when split-usr is enabled (#4591) If systemd is built with --enable-split-usr, but the system is indeed a merged-usr system, then systemd-delta gets all confused and reports that all units and configuration files have been overridden. Skip any prefix paths that are symlinks in this case. Fixes: #4573 |
| nspawn fix exit code for help and version 4609.patch | (download) |
src/nspawn/nspawn.c |
2 1 + 1 - 0 ! |
nspawn: fix exit code for --help and --version (#4609) Commit b006762 inverted the initial exit code which is relevant for --help and --version without a particular reason. For these special options, parse_argv() returns 0 so that our main() immediately skips to the end without adjusting "ret". Otherwise, if an actual container is being started, ret is set on error in run(), which still provides the "non-zero exit on error" behaviour. Fixes #4605. |
| core don t use the unified hierarchy for the systemd cgro.patch | (download) |
src/basic/cgroup-util.c |
4 2 + 2 - 0 ! |
core: don't use the unified hierarchy for the systemd cgroup yet (#4628) Too many things don't get along with the unified hierarchy yet: * https://github.com/opencontainers/runc/issues/1175 * https://github.com/docker/docker/issues/28109 * https://github.com/lxc/lxc/issues/1280 So revert the default to the legacy hierarchy for now. Developers of the above software can opt into the unified hierarchy with "systemd.legacy_systemd_cgroup_controller=0". |
| fstab generator add x systemd.mount timeout 4603.patch | (download) |
man/systemd.mount.xml |
19 19 + 0 - 0 ! |
fstab-generator: add x-systemd.mount-timeout (#4603) This adds a new systemd fstab option x-systemd.mount-timeout. The option adds a timeout value that specifies how long systemd waits for the mount command to finish. It allows to mount huge btrfs volumes without issues. This is equivalent to adding option TimeoutSec= to [Mount] section in a mount unit file. fixes #4055 |
| build sys do not install ctrl alt del.target symlink twic.patch | (download) |
Makefile.am |
1 0 + 1 - 0 ! |
build-sys: do not install ctrl-alt-del.target symlink twice
It was a harmless but pointless duplication. Fixes #4655.
Note: in general we try to install as little as possible in
/etc/systemd/{system,user}. We only install .wants links there for units which
are "user configurable", i.e. which have an [Install] section. Most our units
and aliases are not user configurable, do not have an [Install] section, and
must be symlinked statically during installation. A few units do have an
[Install] section, and are enabled through symlinks in /etc/ during
installation using GENERAL_ALIASES. It *would* be possible to not create those
symlinks, and instead require 'systemctl preset' to be invoked after
installation, but GENERAL_ALIASES works well enough.
|
| networkd allow networkd to start in early boot.patch | (download) |
units/systemd-networkd.service.m4.in |
5 2 + 3 - 0 ! |
networkd: allow networkd to start in early boot With the previous improvements, networkd.service's "After=dbus.service" can now be dropped. That ordering effectively forced networkd.service to run in late boot only (dbus.service was rejected to run in early boot in https://bugs.freedesktop.org/show_bug.cgi?id=98254). Fixes #4504 |
| parse_hwdb fix to work with pyparsing 2.1.10.patch | (download) |
hwdb/parse_hwdb.py |
2 1 + 1 - 0 ! |
parse_hwdb: fix to work with pyparsing 2.1.10 pyparsing 2.1.10 fixed the handling of LineStart to really just apply to line starts and not ignore whitespace and comments any more. Adjust EMPTYLINE to this. Many thanks to Paul McGuire for pointing this out! |
| hwdb parse_hwdb.py open files with UTF 8 mode.patch | (download) |
hwdb/parse_hwdb.py |
3 2 + 1 - 0 ! |
hwdb/parse_hwdb.py: open files with utf-8 mode pyparsing uses the system locale by default, which in the case of 'C' (in lots of build environment) will fail with a UnicodeDecodeError. Explicitly open it with UTF-8 encoding to guard against this. |
| networkd link_enter_configured remove assert 4800.patch | (download) |
src/network/networkd-link.c |
8 4 + 4 - 0 ! |
networkd: link_enter_configured remove assert (#4800) When we are in link_enter_configured we assume that the link->state should be LINK_STATE_SETTING_ROUTES but in some situation it's LINK_STATlE_SETTING_ADDRESSES. Just ignore the wrong state. Also since the return value not used any where make link_enter_configured return type void. Fixes: #4746 |
| doc clarify NoNewPrivileges 4562.patch | (download) |
man/systemd.exec.xml |
8 4 + 4 - 0 ! |
doc: clarify nonewprivileges (#4562) Setting no_new_privs does not stop UID changes, but rather blocks gaining privileges through execve(). Also fixes a small typo. |
| core rework logic to determine when we decide to add auto.patch | (download) |
src/basic/path-util.h |
12 12 + 0 - 0 ! |
core: rework logic to determine when we decide to add automatic deps for mounts This adds a concept of "extrinsic" mounts. If mounts are extrinsic we consider them managed by something else and do not add automatic ordering against umount.target, local-fs.target, remote-fs.target. Extrinsic mounts are considered: - All mounts if we are running in --user mode - API mounts such as everything below /proc, /sys, /dev, which exist from earliest boot to latest shutdown. - All mounts marked as initrd mounts, if we run on the host - The initrd's private directory /run/initrams that should survive until last reboot. |
| rules add persistent links for nbd devices 4785.patch | (download) |
rules/60-persistent-storage.rules |
2 1 + 1 - 0 ! |
rules: add persistent links for nbd devices (#4785) https://bugs.debian.org/837999 |
| core move specifier expansion out of service.c socket.c.patch | (download) |
src/core/load-fragment.c |
64 37 + 27 - 0 ! |
core: move specifier expansion out of service.c/socket.c This monopolizes unit file specifier expansion in load-fragment.c, and removes it from socket.c + service.c. This way expansion becomes an operation done exclusively at time of loading unit files. Previously specifiers were resolved for all settings during loading of unit files with the exception of ExecStart= and friends which were resolved in socket.c and service.c. With this change the latter is also moved to the loading of unit files. Fixes: #3061 (cherry picked from commit 5125e76243c56662d9d0d91385a01ae8cb271e71) |
| man drop reference to U being useless.patch | (download) |
man/systemd.unit.xml |
7 0 + 7 - 0 ! |
man: drop reference to %u being useless This paragraph was a missed left-over from 79413b673b45adc98dfeaec882bbdda2343cb2f9. Drop it now. (cherry picked from commit 13e40f5a4cd2cbecd3d35e0d6b277749b1d21272) |
| core resolve more specifiers in unit_name_printf.patch | (download) |
src/core/unit-printf.c |
47 29 + 18 - 0 ! |
core: resolve more specifiers in unit_name_printf() unit_name_printf() is usually what we use when the resulting string shall qualify as unit name, and it hence avoids resolving specifiers that almost certainly won't result in valid unit names. Add a couple of more specifiers that unit_full_printf() resolves also to the list unit_name_printf() resolves, as they are likely to be useful in valid unit names too. (Note that there might be cases where this doesn't hold, but we should still permit this, as more often than not they are safe, and if people want to use them that way, they should be able to.) (cherry picked from commit b1801e6433c30cb0ab7d7c823c98c637edfe0720) |
| core use unit_full_printf at a couple of locations we use.patch | (download) |
src/core/load-fragment.c |
10 5 + 5 - 0 ! |
core: use unit_full_printf() at a couple of locations we used unit_name_printf() before For settings that are not taking unit names there's no reason to use unit_name_printf(). Use unit_full_printf() instead, as the names are validated anyway in one form or another after expansion. (cherry picked from commit 18913df9a2aa5ee53a1dfb6f3cf8cdddcc7f11a3) |
| core add specifier expansion to RequiresMountsFor.patch | (download) |
src/core/load-fragment.c |
12 9 + 3 - 0 ! |
core: add specifier expansion to requiresmountsfor= This might be useful for some people, for example to pull in mounts for paths including the machine ID or hostname. (cherry picked from commit 744bb5b1bea4d04363f7894e86701efdd75b8acb) |
| core add specifier expansion to ReadOnlyPaths and friends.patch | (download) |
src/core/load-fragment.c |
34 20 + 14 - 0 ! |
core: add specifier expansion to readonlypaths= and friends Expanding specifiers here definitely makes sense. Also simplifies the loop a bit, as there's no reason to keep "prev" around... (cherry picked from commit 7b07e99320586fa3baf3e6cbb374f06c6ddc47d8) |
| core deprecate c r R specifiers.patch | (download) |
man/systemd.unit.xml |
15 0 + 15 - 0 ! |
core: deprecate %c, %r, %r specifiers %c and %r rely on settings made in the unit files themselves and hence resolve |
| core add a note clarifying that we should be careful when.patch | (download) |
src/core/unit-printf.c |
4 4 + 0 - 0 ! |
core: add a note clarifying that we should be careful when adding new specifiers (cherry picked from commit 03fc9c723cfc59467a7fccc305f34273f8564b25) |
| core add new RestrictNamespaces unit file setting.patch | (download) |
Makefile.am |
4 3 + 1 - 0 ! |
core: add new restrictnamespaces= unit file setting This new setting permits restricting whether namespaces may be created and managed by processes started by a unit. It installs a seccomp filter blocking certain invocations of unshare(), clone() and setns(). RestrictNamespaces=no is the default, and does not restrict namespaces in any way. RestrictNamespaces=yes takes away the ability to create or manage any kind of namspace. "RestrictNamespaces=mnt ipc" restricts the creation of namespaces so that only mount and IPC namespaces may be created/managed, but no other kind of namespaces. This setting should be improve security quite a bit as in particular user namespacing was a major source of CVEs in the kernel in the past, and is accessible to unprivileged processes. With this setting the entire attack surface may be removed for system services that do not make use of namespaces. |
| seccomp rework seccomp code to improve compat with some a.patch | (download) |
src/core/execute.c |
466 123 + 343 - 0 ! |
seccomp: rework seccomp code, to improve compat with some archs This substantially reworks the seccomp code, to ensure better compatibility with some architectures, including i386. So far we relied on libseccomp's internal handling of the multiple syscall ABIs supported on Linux. This is problematic however, as it does not define clear semantics if an ABI is not able to support specific seccomp rules we install. This rework hence changes a couple of things: - We no longer use seccomp_rule_add(), but only seccomp_rule_add_exact(), and fail the installation of a filter if the architecture doesn't support it. - We no longer rely on adding multiple syscall architectures to a single filter, but instead install a separate filter for each syscall architecture supported. This way, we can install a strict filter for x86-64, while permitting a less strict filter for i386. - All high-level filter additions are now moved from execute.c to seccomp-util.c, so that we can test them independently of the service execution logic. - Tests have been added for all types of our seccomp filters. - SystemCallFilters= and SystemCallArchitectures= are now implemented in independent filters and installation logic, as they semantically are very much independent of each other. Fixes: #4575 |
| nfsflags drop useless include file seccomp util.h.patch | (download) |
src/shared/nsflags.c |
1 0 + 1 - 0 ! |
nfsflags: drop useless include file 'seccomp-util.h' This also fixes the build when seccomp is disabled. (cherry picked from commit 51b9bb4f8e88d420ae557c3ecf1922dd9ac95fcc) |
| gpt auto generator support LUKS encrypted root partitions.patch | (download) |
rules/60-persistent-storage.rules |
3 0 + 3 - 0 ! |
gpt-auto-generator: support luks encrypted root partitions Previously, we supported GPT auto-discovery for /home and /srv, but not for the root partition. Add that, too. Fixes: #859 (cherry picked from commit 01af8c019a33eb3882f17e3b65e30c4a924fed2a) |
| device Avoid calling unit_free NULL in device setup logic.patch | (download) |
src/core/device.c |
2 1 + 1 - 0 ! |
device: avoid calling unit_free(null) in device setup logic (#4748) Since a581e45ae8f9bb5c, there's a few function calls to unit_new_for_name which will unit_free on failure. Prior to this commit, a failure would result in calling unit_free with a NULL unit, and hit an assertion failure, seen at least via device_setup_unit: Assertion 'u' failed at src/core/unit.c:519, function unit_free(). Aborting. Fixes #4747 https://bugs.archlinux.org/task/51950 (cherry picked from commit d112eae7da77899be245ab52aa1747d4675549f1) |
| core make unit_free accept NULL pointers.patch | (download) |
src/core/device.c |
2 1 + 1 - 0 ! |
core: make unit_free() accept null pointers We generally try to make our destructors robust regarding NULL pointers, much in the same way as glibc's free(). Do this also for unit_free(). Follow-up for #4748. (cherry picked from commit c9d5c9c0e19eea79ca0f09fe58e5c0b76b8001e2) |
| journal make sure to initially populate the space info ca.patch | (download) |
src/journal/journald-server.c |
2 1 + 1 - 0 ! |
journal: make sure to initially populate the space info cache (#4807) Make sure to populate the cache in cache_space_refresh() at least once otherwise it's possible that the system boots fast enough (and the journal flush service is finished) before the invalidate cache timeout (30 us) has expired. Fixes: #4790 (cherry picked from commit 3099caf2b5bb9498b1d0227c40926435ca81f26f) |
| journald don t flush to var log journal before we get ask.patch | (download) |
src/journal/journald-server.c |
21 11 + 10 - 0 ! |
journald: don't flush to /var/log/journal before we get asked to This changes journald to not write to /var/log/journal until it received SIGUSR1 for the first time, thus having been requested to flush the runtime journal to disk. This makes the journal work nicer with systems which have the root file system writable early, but still need to rearrange /var before journald should start writing and creating files to it, for example because ACLs need to be applied first, or because /var is to be mounted from another file system, NFS or tmpfs (as is the case for systemd.volatile=state). Before this change we required setupts with /var split out to mount the root disk read-only early on, and ship an /etc/fstab that remounted it writable only after having placed /var at the right place. But even that was racy for various preparations as journald might end up accessing the file system before it was entirely set up, as soon as it was writable. With this change we make scheduling when to start writing to /var/log/journal explicit. This means persistent mode now requires systemd-journal-flush.service in the mix to work, as otherwise journald would never write to the directory. See: #1397 (cherry picked from commit f78273c8dacf678cc8fd7387f678e6344a99405c) |
| seccomp don t ever try to add an ABI before removing the .patch | (download) |
src/shared/seccomp-util.c |
4 2 + 2 - 0 ! |
seccomp: don't ever try to add an abi before removing the default native ABI (#5230) https://github.com/systemd/systemd/issues/5215#issuecomment-277156262 libseccomp does not allow you to add architectures to a filter that doesn't match the byte ordering of the architectures already added to the filter (it would be a mess, not to mention largely pointless) and since systemd attempts to add an ABI before removing the default native ABI, you will always fail on Power (either due to ppc or ppc64le). The fix is to remove the native ABI before adding a new ABI so you don't run into problems with byte ordering. You would likely see the same failure on a MIPS system. Thanks @pcmoore! (cherry-picked from commit 1b52793d5d597e62c8e35009baca165f1408687e) |
| seccomp RestrictAddressFamilies is not supported on i386 .patch | (download) |
src/shared/seccomp-util.c |
3 3 + 0 - 0 ! |
seccomp: restrictaddressfamilies= is not supported on i386/s390/s390x, make it a NOP See: #5215 (cherry-picked from commit ad8f1479b46c72d103b7f4f7b8ff4f59f7455285) |
| man Document that RestrictAddressFamilies doesn t work on.patch | (download) |
man/systemd.exec.xml |
55 22 + 33 - 0 ! |
man: document that restrictaddressfamilies= doesn't work on s390/s390x/... We already say that it doesn't work on i386, but there are more archs like that apparently. (cherry-picked from commit 142bd808a1a1a4a7dc4e75b7a9d1bda6c1530dfd) |
| seccomp MemoryDenyWriteExecute should affect both mmap an.patch | (download) |
man/systemd.exec.xml |
27 14 + 13 - 0 ! |
seccomp: memorydenywriteexecute= should affect both mmap() and mmap2() (#5254) On i386 we block the old mmap() call entirely, since we cannot properly filter it. Thankfully it hasn't been used by glibc since quite some time. Fixes: #5240 (cherry-picked from commit 8a50cf6957f12dbb1f90411659da9b959a1983ff) |
| seccomp on s390 the clone parameters are reversed.patch | (download) |
man/systemd.exec.xml |
5 4 + 1 - 0 ! |
seccomp: on s390 the clone() parameters are reversed Add a bit of code that tries to get the right parameter order in place for some of the better known architectures, and skips restrict_namespaces for other archs. This also bypasses the test on archs where we don't know the right order. In this case I didn't bother with testing the case where no filter is applied, since that is hopefully just an issue for now, as there's nothing stopping us from supporting more archs, we just need to know which order is right. Fixes: #5241 (cherry picked from commit ae9d60ce4eb116eefb7c4102074ae1cc13fd3216) |
| seccomp disable RestrictAddressFamilies for the ABI we sh.patch | (download) |
src/shared/seccomp-util.c |
30 27 + 3 - 0 ! |
seccomp: disable restrictaddressfamilies= for the abi we shall block, not the one we are compiled for (#5272) |
| seccomp order seccomp ABI list so that our native ABI com.patch | (download) |
src/shared/seccomp-util.c |
67 54 + 13 - 0 ! |
seccomp: order seccomp abi list, so that our native ABI comes last (#5306) this way, we can still call seccomp ourselves, even if seccomp() is blocked by the filter we are installing. Fixes: #5300 |
| libudev util change util_replace_whitespace to return num.patch | (download) |
src/libudev/libudev-util.c |
2 1 + 1 - 0 ! |
libudev-util: change util_replace_whitespace to return number of chars in dest Instead of returning 0, which is unhelpful, return the number of chars copied into the dest string. This allows callers that care about that to easily use it, instead of having to calculate the strlen. No current users of the function check the return value, so this does not break any existing code; it is used in the following patch. |
| udev event add replace_whitespace param to udev_event_app.patch | (download) |
src/udev/udev-event.c |
39 35 + 4 - 0 ! |
udev-event: add replace_whitespace param to udev_event_apply_format
If replace_whitespace is true, each substitution value has all its
whitespace removed/replaced by util_replace_whitespace (except the
SUBST_RESULT substitution - $result{} or %c{} - which handles spaces
itself as field separators). All existing callers are updated to
pass false, so no functional change is made by this patch.
This is needed so the SYMLINK assignment can replace any spaces
introduced through variable substitution, becuase the SYMLINK value is
a space-separated list of symlinks to create. Any variables that
contain spaces will thus unexpectedly change the symlink value from
a single symlink to multiple incorrectly-named symlinks.
This is used in the next patch, which enables the whitespace
replacement for SYMLINK variable substitution.
|
| udev rules perform whitespace replacement for symlink sub.patch | (download) |
src/udev/udev-rules.c |
2 1 + 1 - 0 ! |
udev-rules: perform whitespace replacement for symlink subst values If the string_escape option is either unset or 'replace' (i.e. if it is not 'none'), then enable whitespace replacement in SYMLINK variable substitution values, as added in the last patch. This will keep any whitespace that is directly contained in a SYMLINK value, but will replace any whitespace that is added to the SYMLINK value as a result of variable substitution (except $result/%c). This fixes bug 4833. |
| core use a memfd for serialization.patch | (download) |
src/core/manager.c |
16 10 + 6 - 0 ! |
core: use a memfd for serialization If we can, use a memfd for serializing state during a daemon reload or reexec. Fall back to a file in /run/systemd or /tmp only if memfds are not available. See: #5016 (cherry picked from commit d53333d4b106423d4c281ad15aefe00e17a57893) |
| manager refuse reloading reexecing when run is overly ful.patch | (download) |
src/core/dbus-manager.c |
63 63 + 0 - 0 ! |
manager: refuse reloading/reexecing when /run is overly full Let's add an extra safety check: before entering a reload/reexec, let's verify that there's enough room in /run for it. Fixes: #5016 (cherry picked from commit ae57dad3f92d116c66c4ca0223b7e07b44041436) |
| dbus permit seeing process list of units whose unit files.patch | (download) |
src/core/dbus-manager.c |
10 3 + 7 - 0 ! |
dbus: permit seeing process list of units whose unit files are missing MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Previously, we'd refuse the GetUnitProcesses() bus call if the unit file couldn't be loaded. Which is wrong, as admins should be able to inspect services whose unit files was deleted. Change this logic, so that we permit introspecting the processes of any unit that is loaded, regardless if it has a unit file or not. (Note that we won't load unit files in GetUnitProcess(), but only operate on already loaded ones. That's because only loaded units can have processes as that's how our GC logic works and hence loading the unit just for the process tree is pointless, as it would be empty). See: #4995 |
| install never hit assert when we can t figure out where t.patch | (download) |
src/shared/install.c |
17 17 + 0 - 0 ! |
install: never hit assert() when we can't figure out where to write configuration symlinks Under specific circumstances it might happen that we can't figure out where to place our symlinks, for example because we are supposed to create them in the runtime directory but $XDG_RUNTIME_DIR is not set. In this case, return -ENXIO instead of hitting an assert(). (Yeah, the error isn't very descriptive, but for now this should at least be good enough to remove the assert() being hit.) |
| path lookup try harder acquiring them HOME of a user.patch | (download) |
src/shared/path-lookup.c |
20 11 + 9 - 0 ! |
path-lookup: try harder acquiring them $home of a user Let's use get_home_dir() for figuring out the home directory, so that there's a good chance we succeed figuring out unit locations even if $HOME isn't set. Fixes: #5260 |
| path lookup if HOME can be determined but XDG_RUNTIME_DIR.patch | (download) |
src/shared/path-lookup.c |
32 24 + 8 - 0 ! |
path-lookup: if $home can be determined but $xdg_runtime_dir can't, is it So far, if either $HOME or $XDG_RUNTIME_DIR is not set we wouldn't use either, and fail acquire_config_dirs() and acquire_control_dirs() in their entireties. With this change, let's make use of the variables we can acquire, and don't bother with the other. Specifically this means: in both acquire_config_dirs() and acquire_control_dirs() handle ENXIO from user_config_dir() and user_runtime_dir() directly, instead of propagating it up and handling it in the caller. |
| resolved follow CNAMES for DNS stub replies.patch | (download) |
src/resolve/resolved-dns-query.c |
1 1 + 0 - 0 ! |
resolved: follow cnames for dns stub replies Clients expect us to follow CNAMEs for them, hence do so. On the first iteration start putting together a packet, and then keep adding data we acquire through CNAMEs to it, until we finally send it off. Fixes: #3826 |
| logind Don t try to emit a change signal for the Sessions.patch | (download) |
src/login/logind-seat.c |
2 0 + 2 - 0 ! |
logind: don't try to emit a change signal for the 'sessions' property (#5211) The 'Sessions' property for both org.freedesktop.login1.User and org.freedesktop.login1.Seat is marked as EmitsChangedSignal(false). Trying to emit a change signal that includes the 'Sessions' property leads to the signal not being sent at all. Fixes #5210. |
| resolved fix NSEC proofs for missing TLDs.patch | (download) |
src/resolve/resolved-dns-dnssec.c |
8 6 + 2 - 0 ! |
resolved: fix nsec proofs for missing tlds For the wildcard NSEC check we need to generate an "asterisk" domain, by prepend the common ancestor with "*.". So far we did that with a simple strappenda() which is fine for most domains, but doesn't work if the common ancestor is the root domain as we usually write that as "." in normalized form, and "*." joined with "." is "*.." and not "*." as it should be. Hence, use the clean way out, let's just use dns_name_concat() which only exists precisely for this reason, to properly concatenate labels. There's a good chance this actually fixes #5029, as this NSEC proof is triggered by lookups in the TLD "example", which doesn't exist in the Internet. |
| automount if an automount unit is masked don t react to a.patch | (download) |
src/core/automount.c |
78 50 + 28 - 0 ! |
automount: if an automount unit is masked, don't react to activation anymore (#5445) Otherwise we'll hit an assert sooner or later. This requires us to initialize ->where even if we come back in "masked" mode, as otherwise we don't know how to operate on the automount and detach it. Fixes: #5441 (cherry picked from commit e350ca3f1ecb6672b74cd25d09ef23c7b309aa5a) |
| resolved add the new KSK to the built in resolved trust a.patch | (download) |
src/resolve/resolved-dns-trust-anchor.c |
72 51 + 21 - 0 ! |
resolved: add the new ksk to the built-in resolved trust anchor (#5486) Fixes: #5482 |
| zsh completion _journalctl fixes 5165.patch | (download) |
shell-completion/zsh/_journalctl |
4 2 + 2 - 0 ! |
zsh-completion: _journalctl fixes (#5165) allow _journalctl to work when the rcquotes option is set, broken in ba89f80620d619867b4838973785d529c5a959f6. allow the completion of --file multiple times, which ba89f80620d619867b4838973785d529c5a959f6 claims is true. Fixes #4842 |
| udev Use parent bus id for virtio disk builtin path id 55.patch | (download) |
rules/60-persistent-storage.rules |
4 4 + 0 - 0 ! |
udev: use parent bus id for virtio disk builtin path-id (#5500) The builtin path id for virtio block devices has been changed to use the bus id without a prefix "virtio-pci" to be compatible with all virtio transport types. In order to not break existing setups, the by-path symlinks for virtio block devices on the PCI bus are reintroduced by udev rules. The virtio-pci symlinks are considered to be deprecated and should be replaced by the native PCI symlinks. Example output for a virtio disk in PCI slot 7: $ ls /dev/disk/by-path pci-0000:00:07.0 pci-0000:00:07.0-part1 virtio-pci-0000:00:07.0 virtio-pci-0000:00:07.0-part1 See also [1] https://lists.freedesktop.org/archives/systemd-devel/2017-February/038326.html [2] https://lists.freedesktop.org/archives/systemd-devel/2017-March/038397.html This reverts f073b1b but keeps the same symlinks for compatibility. |
| udev fix id_net_name_path for virtio ccw interfaces 5357.patch | (download) |
src/udev/udev-builtin-net_id.c |
58 39 + 19 - 0 ! |
udev: fix id_net_name_path for virtio-ccw interfaces (#5357) The CCW id_net_name_path detection didn't account for virtio interfaces on the CCW bus. As a result the default interface names for virtio-ccw interfaces would use the old eth<x> format instead of enc<busid>. Since virtio-pci interface naming follows the naming rules of the parent bus, the names_ccw() logic was changed to apply the CCW interface naming rules to virtio interfaces as well, e.g. enc2000 for an interface with a CCW bus id 0.0.2000. As virtio interfaces are apt to get the otherwise unusual CCW bus id 0.0.0000, the last '0' is now preserved in this case. The virtio subsystem skipping loop has been moved from names_pci() into a function skip_virtio() that can be reused for all bus types with virtio network devices. Since virtio-ccw interfaces use single CCW addresses the ccwgroup requirement was relaxed and the C definitions were changed accordingly. |
| Avoid strict DM interface version dependencies 5519.patch | (download) |
Makefile.am |
1 1 + 0 - 0 ! |
avoid strict dm interface version dependencies (#5519) Compiling against the dm-ioctl.h header as provided by the Linux kernel will embed the DM interface version number. Running an older kernel can result in an error like this on shutdown: Could not detach DM dm-11: ioctl mismatch, kernel(4.34.4), user(4.35.4) Work around this by shipping a local copy of dm-ioctl.h. We need at least the version from 3.13 for DM_DEFERRED_REMOVE [1], so bump the requirements in README accordingly. [1] https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2c140a246dc0bc085b98eddde978060fcec1080c Fixes: #5492 (cherry picked from commit dcce98a4bdc302a5efeb3a5c35b6cbf6d16a3efc) |
| networkd fix size of MTUBytes so that it does not overwri.patch | (download) |
src/network/networkd-network.h |
2 1 + 1 - 0 ! |
networkd: fix size of mtubytes so that it does not overwrites arp (#4707) config_parse_iec_size overwrites the next varible that is ARP. Now the mtu is unsigned . Make it size_t . Fixes #4644 (cherry picked from commit b8b40317d0355bc70bb23a6240a36f3630c4952b) |
| resolved downgrade processing query. message to debug 523.patch | (download) |
src/resolve/resolved-dns-stub.c |
2 1 + 1 - 0 ! |
resolved: downgrade "processing query..." message to debug (#5233) It doesn't really add much value in normal operation and just spams the log. (cherry picked from commit 52e634271fe96ec23a22705ffb87df59a09d1618) |
| units do not throw a warning in emergency mode if plymout.patch | (download) |
units/emergency.service.in |
2 1 + 1 - 0 ! |
units: do not throw a warning in emergency mode if plymouth is not installed (#5528) Ideally, plymouth should only be referenced via dependencies, not ExecStartPre's. This at least avoids the confusing error message on minimal installations that do not carry plymouth. (cherry picked from commit 7e3ba389191dbc241e05f4d134460bbb832ed60c) |
| units apply plymouth warning fix to in rescue mode as wel.patch | (download) |
units/rescue.service.in |
2 1 + 1 - 0 ! |
units: apply plymouth warning fix to in rescue mode as well (#5615) Follow up for #5528. (cherry picked from commit 03bf096ba283bfcba0725375f152a823e998cdbc) |
| rules allow SPARC vdisk devices when identifying CD drive.patch | (download) |
rules/60-cdrom_id.rules |
2 1 + 1 - 0 ! |
rules: allow sparc vdisk devices when identifying cd drives (#5599) (cherry picked from commit 7c1ebe99b68ef232bc50e99f2350ebf5f4e846e7) |