diff options
| -rw-r--r-- | NEWS | 142 | ||||
| -rw-r--r-- | TODO | 17 | ||||
| -rw-r--r-- | catalog/systemd.pl.catalog.in | 9 | ||||
| -rw-r--r-- | hwdb/60-evdev.hwdb | 10 | ||||
| -rw-r--r-- | man/journald.conf.xml | 30 | ||||
| -rw-r--r-- | man/systemd-nspawn.xml | 16 | ||||
| -rw-r--r-- | man/systemd-sleep.conf.xml | 9 | ||||
| -rw-r--r-- | po/POTFILES.in | 1 | ||||
| -rw-r--r-- | po/ja.po | 111 | ||||
| -rw-r--r-- | src/analyze/analyze.c | 10 | ||||
| -rw-r--r-- | src/core/unit.c | 35 | ||||
| -rw-r--r-- | src/nspawn/nspawn-mount.c | 25 | ||||
| -rw-r--r-- | src/nspawn/nspawn.c | 37 | ||||
| -rw-r--r-- | src/shared/machine-image.c | 46 | ||||
| -rw-r--r-- | src/shared/sleep-config.c | 98 | ||||
| -rw-r--r-- | src/shared/sleep-config.h | 2 |
16 files changed, 448 insertions, 150 deletions
@@ -4,7 +4,7 @@ CHANGES WITH 243 in spe: * This release enables unprivileged programs (i.e. requiring neither setuid nor file capabilities) to send ICMP Echo (i.e. ping) requests - by turning on the net.ipv4.ping_group_range sysctl of the Linux + by turning on the "net.ipv4.ping_group_range" sysctl of the Linux kernel for the whole UNIX group range, i.e. all processes. This change should be reasonably safe, as the kernel support for it was specifically implemented to allow safe access to ICMP Echo for @@ -12,20 +12,21 @@ CHANGES WITH 243 in spe: disabled again by setting the parameter to "1 0". * Previously, filters defined with SystemCallFilter= would have the - effect that an calling an offending system call would terminate the - calling thread. This behaviour never made much sense, since killing - individual threads of unsuspecting processes is likely to create more - problems than it solves. With this release the default action changed - from killing the thread to killing the whole process. For this to - work correctly both a kernel version (>= 4.14) and a libseccomp - version (>= 2.4.0) supporting this new seccomp action is required. If - an older kernel or libseccomp is used the old behaviour continues to - be used. This change does not affect any services that have no system - call filters defined, or that use SystemCallErrorNumber= (and thus - see EPERM or another error instead of being killed when calling an - offending system call). Note that systemd documentation always - claimed that the whole process is killed. With this change behaviour - is thus adjusted to match the documentation. + effect that any calling of an offending system call would terminate + the calling thread. This behaviour never made much sense, since + killing individual threads of unsuspecting processes is likely to + create more problems than it solves. With this release the default + action changed from killing the thread to killing the whole + process. For this to work correctly both a kernel version (>= 4.14) + and a libseccomp version (>= 2.4.0) supporting this new seccomp + action is required. If an older kernel or libseccomp is used the old + behaviour continues to be used. This change does not affect any + services that have no system call filters defined, or that use + SystemCallErrorNumber= (and thus see EPERM or another error instead + of being killed when calling an offending system call). Note that + systemd documentation always claimed that the whole process is + killed. With this change behaviour is thus adjusted to match the + documentation. * The "kernel.pid_max" sysctl is now bumped to 4194304 by default, i.e. the full 22bit range the kernel allows, up from the old 16bit @@ -69,13 +70,13 @@ CHANGES WITH 243 in spe: * Man pages are not built by default anymore (html pages were already disabled by default), to make development builds quicker. When building systemd for a full installation with documentation, meson - should be called -Dman=true and/or -Dhtml=true as appropriate. The - default was changed based on the assumption that quick one-off or - repeated development builds are much more common than full optimized - builds for installation, and people need to pass various other - options to when doing "proper" builds anyway, so the gain from making - development builds quicker is bigger than the one time disruption for - packagers. + should be called with -Dman=true and/or -Dhtml=true as + appropriate. The default was changed based on the assumption that + quick one-off or repeated development builds are much more common + than full optimized builds for installation, and people need to pass + various other options to when doing "proper" builds anyway, so the + gain from making development builds quicker is bigger than the one + time disruption for packagers. Two scripts are created in the *build* directory to generate and preview man and html pages on demand, e.g.: @@ -126,11 +127,11 @@ CHANGES WITH 243 in spe: interfaces should really be matched. * A new setting NUMAPolicy= may be used to set process memory - allocation policy. Setting can be specified in system.conf and hence - will set the default policy for PID1. Default policy can be - overridden on per-service basis. Related setting NUMAMask= is used to - specify NUMA node mask that should be associated with the selected - policy. + allocation policy. This setting can be specified in + /etc/systemd/system.conf and hence will set the default policy for + PID1. The default policy can be overridden on a per-service + basis. The related setting NUMAMask= is used to specify NUMA node + mask that should be associated with the selected policy. * PID 1 will now listen to Out-Of-Memory (OOM) events the kernel generates when processes it manages are reaching their memory limits, @@ -143,7 +144,7 @@ CHANGES WITH 243 in spe: the IO accounting data is included in the resource log message generated whenever a unit stops. - * units may now configure an explicit time-out to apply to when killed + * Units may now configure an explicit time-out to wait for when killed with SIGABRT, for example when a service watchdog is hit. Previously, the regular TimeoutStopSec= time-out was applied in this case too — now a separate time-out may be set using TimeoutAbortSec=. @@ -197,7 +198,7 @@ CHANGES WITH 243 in spe: only a boolean option was allowed (yes/no), having yes as the default. If this option is set to 'no-negative', negative answers are skipped from being cached while keeping the same cache heuristics - for positive answers. The default remains as "yes" (i. e. caching is + for positive answers. The default remains as "yes" (i.e. caching is enabled). * The predictable naming scheme for network devices now supports @@ -212,11 +213,11 @@ CHANGES WITH 243 in spe: associated with (AssociatedWith=). * systemd-networkd's DHCPv4 support now understands a new MaxAttempts= - option for configuring the maximum number of attempts to request a - DHCP lease. It also learnt a new BlackList= option for blacklisting - DHCP servers (a similar setting has also been added to the IPv6 RA - client), as well as a SendRelease= option for configuring whether to - send a DHCP RELEASE message when terminating. + option for configuring the maximum number of DHCP lease requests. It + also learnt a new BlackList= option for blacklisting DHCP servers (a + similar setting has also been added to the IPv6 RA client), as well + as a SendRelease= option for configuring whether to send a DHCP + RELEASE message when terminating. * systemd-networkd's DHCPv4 and DHCPv6 stacks can now be configured separately in the [DHCPv4] and [DHCPv6] sections. @@ -350,40 +351,71 @@ CHANGES WITH 243 in spe: (for exit code 255 or cases of abnormal termination). * A new service systemd-pstore.service has been added that pulls data - from from /sys/fs/pstore/ and saves it to /var/lib/pstore for later + from /sys/fs/pstore/ and saves it to /var/lib/pstore for later review. * timedatectl gained new verbs for configuring per-interface NTP service configuration for systemd-timesyncd. * "localectl list-locales" won't list non-UTF-8 locales anymore. It's - 2019. (You can set non-UTF-8 locales though, if you know there name.) + 2019. (You can set non-UTF-8 locales though, if you know their name.) * If variable assignments in sysctl.d/ files are prefixed with "-" any failures to apply them are now ignored. + * systemd-random-seed.service now optionally credits entropy when + applying the seed to the system. Set $SYSTEMD_RANDOM_SEED_CREDIT to + true for the service to enable this behaviour, but please consult the + documentation first, since this comes with a couple of caveats. + + * systemd-random-seed.service is now a synchronization point for the + point in time where the kernel's entropy pool is fully + initialized. Order services that require /dev/urandom to be correctly + initialized after this service. + + * The systemd-boot boot loader has been updated to optionally maintain + a random seed file in the EFI System Partition (ESP). During the boot + phase, this random seed is read and updated with a new seed + crytographically derived from it. Another derived seed is passed to + the OS. The latter seed is then credited to the kernel's entropy pool + very early during userspace initialization (from PID 1). This allows + systems to boot up with a fully initialized kernel entropy pool from + earliest boot on, and thus entirely removes all entropy pool + initialization delays from systems using systemd-boot. Special care + is taken to ensure different seeds are derived on system images + replicated to multiple systems. + + * bootctl gained a new verb "is-installed" that checks whether + systemd-boot is currently installed. + + * A new document has been added describing systemd's use and support + for the kernel's entropy pool subsystem: + + https://systemd.io/RANDOM_SEEDS + Contributions from: Aaron Barany, Adrian Bunk, Alan Jenkins, Andrej Valek, Anita Zhang, Arian van Putten, Balint Reczey, Bastien Nocera, Ben Boeckel, Benjamin Robin, camoz, Chen Qi, Chris Chiu, Chris Down, - Christian Kellner, Connor Reeder, Daniele Medri, Dan Streetman, Dave - Reisner, Dave Ross, David Art, David Tardon, Debarshi Ray, Dominick - Grift, Donald Buczek, Douglas Christman, Eric DeVolder, Evgeny - Vereshchagin, Feldwor, Felix Riemann, Florian Dollinger, Franck Bui, - Frantisek Sumsal, Franz Pletz, Hans de Goede, Insun Pyo, Ivan - Shapovalov, Iwan Timmer, Jack, Jakob Unterwurzacher, Jan Klötzke, Jan - Pokorný, Jan Synacek, Jeka Pats, Jérémy Rosen, Jiri Pirko, Joe Lin, - Joerg Behrmann, Joe Richey, Jóhann B. Guðmundsson, Johannes Schmitz, - Jonathan Rouleau, Jorge Niedbalski, Kai Lüke, Karel Zak, Kashyap - Chamarthy, Krayushkin Konstantin, Lennart Poettering, Lubomir Rintel, - Luca Boccassi, Luís Ferreira, Marc-André Lureau, Markus Felten, Martin - Pitt, Michael Biebl, Michael Olbrich, Michael Prokop, Michael - Stapelberg, Michael Zhivich, Michal Koutný, Michal Sekletar, Mike - Gilbert, Milan Broz, mpe85, Oliver Harley, pan93412, Paul Menzel, - pEJipE, Peter A. Bigot, Philip Withnall, Piotr Drąg, Rafael Fontenelle, - Roberto Santalla, root, RussianNeuroMancer, Sebastian Jennen, Simon - Schricker, Susant Sahani, Thadeu Lima de Souza Cascardo, Theo - Ouzhinski, Thomas Weißschuh, Tomas Mraz, Topi Miettinen, ven, Wieland - Hoffmann, Xi Ruoyao, Yuri Chornoivan, Yu Watanabe, Zach Smith, Zbigniew + Christian Kellner, Clinton Roy, Connor Reeder, Daniele Medri, Dan + Streetman, Dave Reisner, Dave Ross, David Art, David Tardon, Debarshi + Ray, Dominick Grift, Donald Buczek, Douglas Christman, Eric DeVolder, + Evgeny Vereshchagin, Feldwor, Felix Riemann, Florian Dollinger, Franck + Bui, Frantisek Sumsal, Franz Pletz, Hans de Goede, Iago López Galeiras, + Insun Pyo, Ivan Shapovalov, Iwan Timmer, Jack, Jakob Unterwurzacher, + Jan Klötzke, Jan Pokorný, Jan Synacek, Jeka Pats, Jérémy Rosen, Jiri + Pirko, Joe Lin, Joerg Behrmann, Joe Richey, Jóhann B. Guðmundsson, + Johannes Schmitz, Jonathan Rouleau, Jorge Niedbalski, Kai Lüke, Karel + Zak, Kashyap Chamarthy, Krayushkin Konstantin, Lennart Poettering, + Lubomir Rintel, Luca Boccassi, Luís Ferreira, Marc-André Lureau, Markus + Felten, Martin Pitt, Michael Biebl, Michael Olbrich, Michael Prokop, + Michael Stapelberg, Michael Zhivich, Michal Koutný, Michal Sekletar, + Mike Gilbert, Milan Broz, mpe85, Network Silence, Oliver Harley, + pan93412, Paul Menzel, pEJipE, Peter A. Bigot, Philip Withnall, Piotr + Drąg, Rafael Fontenelle, Roberto Santalla, root, RussianNeuroMancer, + Sebastian Jennen, Shreyas Behera, Simon Schricker, Susant Sahani, + Thadeu Lima de Souza Cascardo, Theo Ouzhinski, Thomas Haller, Thomas + Weißschuh, Tomas Mraz, Topi Miettinen, ven, Wieland Hoffmann, Xi + Ruoyao, Yuri Chornoivan, Yu Watanabe, Zach Smith, Zbigniew Jędrzejewski-Szmek, Zhang Xianwei – Somewhere, SOME-TI-ME @@ -19,6 +19,21 @@ Janitorial Clean-ups: Features: +* beef up s2h to implement a battery watch loop: instead of entering + hibernation unconditionally after coming back from resume make a decision + based on the battery load level: if battery level is above a specific + threshold, go to suspend again, only hibernate if below it. This means we'd + stick to suspend usually, but fall back to hibernation only when battery runs + empty (well, subject to our sampling interval). Related to this, check if we + can make ACPI _BTP (i.e. /sys/class/power_supply/*/alarm) work for us too, + i.e. see if it can wake up machines from suspend, so that we could resume + automatically when the system is low on power and move automatically to + hibernation mode. (see + https://uefi.org/sites/default/files/resources/ACPI%206_2_A_Sept29.pdf + section 10.2.2.8 and + https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-wake-sources + at the end). + * add an explicit "vertical" mode to format-table, so that "systemctl status"-like outputs (i.e. with a series of field names left and values right) become genuine first class citizens, and we gain automatic, sane JSON @@ -623,8 +638,6 @@ Features: * transient units: - add field to transient units that indicate whether systemd or somebody else saves/restores its settings, for integration with libvirt -* Automatically configure swap partition to use for hibernation by looking for largest swap partition on the root disk? - * when we detect low battery and no AC on boot, show pretty splash and refuse boot * libsystemd-journal, libsystemd-login, libudev: add calls to easily attach these objects to sd-event event loops diff --git a/catalog/systemd.pl.catalog.in b/catalog/systemd.pl.catalog.in index b007ad1f05..1a6c2546e6 100644 --- a/catalog/systemd.pl.catalog.in +++ b/catalog/systemd.pl.catalog.in @@ -353,6 +353,15 @@ Support: %SUPPORT_URL% Jednostka @UNIT@ pomyślnie przeszła do stanu „dead” (martwego). +-- 0e4284a0caca4bfc81c0bb6786972673 +Subject: Pominięto jednostkę +Defined-By: systemd +Support: %SUPPORT_URL% + +Jednostka @UNIT@ została pominięta z powodu niepowodzenia +polecenia ExecCondition=, i przeszła do stanu „dead” (martwego) +z wynikiem „@UNIT_RESULT@”. + -- d9b373ed55a64feb8242e02dbe79a49c Subject: Jednostka się nie powiodła Defined-By: systemd diff --git a/hwdb/60-evdev.hwdb b/hwdb/60-evdev.hwdb index 7839798602..afde1dd447 100644 --- a/hwdb/60-evdev.hwdb +++ b/hwdb/60-evdev.hwdb @@ -318,11 +318,11 @@ evdev:name:SynPS/2 Synaptics TouchPad*:dmi:*svnHewlett-Packard:pnHPPaviliondm4* EVDEV_ABS_36=1269:4618:61 # HP Pavilion g6 -evdev:name:SynPS/2 Synaptics TouchPad:dmi:*svnHewlett-Packard:pnHPPaviliong6* - EVDEV_ABS_00=1284:5696:88 - EVDEV_ABS_01=1287:4838:39 - EVDEV_ABS_35=1284:5696:88 - EVDEV_ABS_36=1287:4838:39 +evdev:name:SynPS/2 Synaptics TouchPad:dmi:bvnHewlett-Packard:*svnHewlett-Packard:pnHPPaviliong6* + EVDEV_ABS_00=1255:5728:50 + EVDEV_ABS_01=1215:4761:71 + EVDEV_ABS_35=1255:5728:50 + EVDEV_ABS_36=1215:4761:71 # HP Pavilion dv7 evdev:name:SynPS/2 Synaptics TouchPad*:dmi:*svnHewlett-Packard:pnHPPaviliondv7* diff --git a/man/journald.conf.xml b/man/journald.conf.xml index 57c2256567..44fd0d2f3d 100644 --- a/man/journald.conf.xml +++ b/man/journald.conf.xml @@ -288,21 +288,25 @@ <term><varname>ForwardToConsole=</varname></term> <term><varname>ForwardToWall=</varname></term> - <listitem><para>Control whether log messages received by the journal daemon shall - be forwarded to a traditional syslog daemon, to the kernel log buffer (kmsg), to - the system console, or sent as wall messages to all logged-in users. These - options take boolean arguments. If forwarding to syslog is enabled but nothing - reads messages from the socket, forwarding to syslog has no effect. By default, - only forwarding to wall is enabled. These settings may be overridden at boot time - with the kernel command line options - <literal>systemd.journald.forward_to_syslog</literal>, + <listitem><para>Control whether log messages received by the journal daemon shall be forwarded to a + traditional syslog daemon, to the kernel log buffer (kmsg), to the system console, or sent as wall + messages to all logged-in users. These options take boolean arguments. If forwarding to syslog is + enabled but nothing reads messages from the socket, forwarding to syslog has no effect. By default, + only forwarding to wall is enabled. These settings may be overridden at boot time with the kernel + command line options <literal>systemd.journald.forward_to_syslog</literal>, <literal>systemd.journald.forward_to_kmsg</literal>, <literal>systemd.journald.forward_to_console</literal>, and - <literal>systemd.journald.forward_to_wall</literal>. If the option name is - specified without <literal>=</literal> and the following argument, true is - assumed. Otherwise, the argument is parsed as a boolean. When forwarding to the - console, the TTY to log to can be changed with <varname>TTYPath=</varname>, - described below.</para></listitem> + <literal>systemd.journald.forward_to_wall</literal>. If the option name is specified without + <literal>=</literal> and the following argument, true is assumed. Otherwise, the argument is parsed + as a boolean.</para> + + <para>When forwarding to the console, the TTY to log to can be changed with + <varname>TTYPath=</varname>, described below.</para> + + <para>When forwarding to the kernel log buffer (kmsg), make sure to select a suitably large size for + the log buffer, and ensure the kernel's rate-limiting applied to userspace processes is turned + off. Specifically, add <literal>log_buf_len=8M</literal> and <literal>printk.devkmsg=on</literal> (or + similar) to the kernel command line.</para></listitem> </varlistentry> <varlistentry> diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index 8c1a1e6871..9f0be96b26 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -368,12 +368,16 @@ <citerefentry><refentrytitle>kernel-command-line</refentrytitle><manvolnum>7</manvolnum></citerefentry> for details.</para> - <para>Note that setting this option to <option>yes</option> or <option>state</option> will only work correctly - with operating systems in the container that can boot up with only <filename>/usr</filename> mounted, and are - able to automatically populate <filename>/var</filename>, and also <filename>/etc</filename> in case of - <literal>--volatile=yes</literal>. The <option>overlay</option> option does not require any particular - preparations in the OS, but do note that <literal>overlayfs</literal> behaviour differs from regular file - systems in a number of ways, and hence compatibility is limited.</para></listitem> + <para>Note that setting this option to <option>yes</option> or <option>state</option> will only work + correctly with operating systems in the container that can boot up with only + <filename>/usr/</filename> mounted, and are able to automatically populate <filename>/var/</filename> + (and <filename>/etc/</filename> in case of <literal>--volatile=yes</literal>). Specifically, this + means that operating systems that follow the historic split of <filename>/bin/</filename> and + <filename>/lib/</filename> (and related directories) from <filename>/usr/</filename> (i.e. where the + former are not symlinks into the latter) are not supported by <literal>--volatile=yes</literal> as + container payload. The <option>overlay</option> option does not require any particular preparations + in the OS, but do note that <literal>overlayfs</literal> behaviour differs from regular file systems + in a number of ways, and hence compatibility is limited.</para></listitem> </varlistentry> <varlistentry> diff --git a/man/systemd-sleep.conf.xml b/man/systemd-sleep.conf.xml index 3311a046ca..a6949b0c3b 100644 --- a/man/systemd-sleep.conf.xml +++ b/man/systemd-sleep.conf.xml @@ -168,11 +168,10 @@ <varlistentry> <term><varname>HibernateDelaySec=</varname></term> - <listitem><para>The amount of time in seconds - that will pass before the system is automatically - put into hibernate when using - <citerefentry><refentrytitle>systemd-suspend-then-hibernate.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>. - </para></listitem> + <listitem><para>The amount of time the system spends in suspend mode before the system is + automatically put into hibernate mode, when using + <citerefentry><refentrytitle>systemd-suspend-then-hibernate.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>. Defaults + to 2h.</para></listitem> </varlistentry> </variablelist> </refsect1> diff --git a/po/POTFILES.in b/po/POTFILES.in index 029261c154..983f346f11 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -4,6 +4,7 @@ src/import/org.freedesktop.import1.policy src/locale/org.freedesktop.locale1.policy src/login/org.freedesktop.login1.policy src/machine/org.freedesktop.machine1.policy +src/network/org.freedesktop.network1.policy src/portable/org.freedesktop.portable1.policy src/resolve/org.freedesktop.resolve1.policy src/timedate/org.freedesktop.timedate1.policy @@ -6,7 +6,7 @@ msgid "" msgstr "" "Project-Id-Version: systemd\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2019-04-01 11:27+0900\n" +"POT-Creation-Date: 2019-07-28 22:13+0900\n" "PO-Revision-Date: 2018-10-27 07:41+0900\n" "Last-Translator: Yu Watanabe <watanabe.yu+github@gmail.com>\n" "Language-Team: \n" @@ -549,6 +549,94 @@ msgid "" "images." msgstr "ローカルな仮想マシンやコンテナのイメージを管理するには認証が必要です。" +#: src/network/org.freedesktop.network1.policy:22 +msgid "Set NTP servers" +msgstr "NTPサーバの設定" + +#: src/network/org.freedesktop.network1.policy:23 +msgid "Authentication is required to set NTP servers." +msgstr "NTPサーバを設定するには認証が必要です。" + +#: src/network/org.freedesktop.network1.policy:33 +msgid "Set DNS servers" +msgstr "DNSサーバの設定" + +#: src/network/org.freedesktop.network1.policy:34 +msgid "Authentication is required to set DNS servers." +msgstr "DNSサーバを設定するには認証が必要です。" + +#: src/network/org.freedesktop.network1.policy:44 +msgid "Set domains" +msgstr "ドメインの設定" + +#: src/network/org.freedesktop.network1.policy:45 +msgid "Authentication is required to set domains." +msgstr "ドメインを設定するには認証が必要です。" + +#: src/network/org.freedesktop.network1.policy:55 +msgid "Set default route" +msgstr "デフォルトルートの設定" + +#: src/network/org.freedesktop.network1.policy:56 +msgid "Authentication is required to set default route." +msgstr "デフォルトルートを設定するには認証が必要です。" + +#: src/network/org.freedesktop.network1.policy:66 +msgid "Enable/disable LLMNR" +msgstr "LLMNRの有効化/無効化" + +#: src/network/org.freedesktop.network1.policy:67 +msgid "Authentication is required to enable or disable LLMNR." +msgstr "LLMNRを有効化もしくは無効化するには認証が必要です。" + +#: src/network/org.freedesktop.network1.policy:77 +msgid "Enable/disable multicast DNS" +msgstr "マルチキャストDNSの有効化/無効化" + +#: src/network/org.freedesktop.network1.policy:78 +msgid "Authentication is required to enable or disable multicast DNS." +msgstr "マルチキャストDNSを有効化もしくは無効化するには認証が必要です。" + +#: src/network/org.freedesktop.network1.policy:88 +msgid "Enable/disable DNS over TLS" +msgstr "DNS over TLSの有効化/無効化" + +#: src/network/org.freedesktop.network1.policy:89 +msgid "Authentication is required to enable or disable DNS over TLS." +msgstr "DNS over TLSを有効化もしくは無効化するには認証が必要です。" + +#: src/network/org.freedesktop.network1.policy:99 +msgid "Enable/disable DNSSEC" +msgstr "DNSSECの有効化/無効化" + +#: src/network/org.freedesktop.network1.policy:100 +msgid "Authentication is required to enable or disable DNSSEC." +msgstr "DNSSECを有効化もしくは無効化するには認証が必要です。" + +#: src/network/org.freedesktop.network1.policy:110 +msgid "Set DNSSEC Negative Trust Anchors" +msgstr "DNSSEC Negative Trust Anchorsの設定" + +#: src/network/org.freedesktop.network1.policy:111 +msgid "Authentication is required to set DNSSEC Negative Trust Anchros." +msgstr "DNSSEC Negative Trust Anchrosを設定するには認証が必要です。" + +#: src/network/org.freedesktop.network1.policy:121 +msgid "Revert NTP settings" +msgstr "NTPの設定の破棄" + +#: src/network/org.freedesktop.network1.policy:122 +msgid "Authentication is required to revert NTP settings." +msgstr "NTPの設定を破棄するには認証が必要です。" + +#: src/network/org.freedesktop.network1.policy:132 +msgid "Revert DNS settings" +msgstr "DNSの設定を破棄" + +#: src/network/org.freedesktop.network1.policy:133 +msgid "Authentication is required to revert DNS settings." +msgstr "DNSの設定を破棄するには認証が必要です。" + #: src/portable/org.freedesktop.portable1.policy:13 msgid "Inspect a portable service image" msgstr "ポータブルサービスイメージの読み込み" @@ -629,32 +717,39 @@ msgid "" "shall be enabled." msgstr "ネットワーク経由の時刻同期を有効もしくは無効にするには認証が必要です。" -#: src/core/dbus-unit.c:316 +#: src/core/dbus-unit.c:354 msgid "Authentication is required to start '$(unit)'." msgstr "'$(unit)'を開始するには認証が必要です。" -#: src/core/dbus-unit.c:317 +#: src/core/dbus-unit.c:355 msgid "Authentication is required to stop '$(unit)'." msgstr "'$(unit)'を停止するには認証が必要です。" -#: src/core/dbus-unit.c:318 +#: src/core/dbus-unit.c:356 msgid "Authentication is required to reload '$(unit)'." msgstr "'$(unit)'を再読込するには認証が必要です。" -#: src/core/dbus-unit.c:319 src/core/dbus-unit.c:320 +#: src/core/dbus-unit.c:357 src/core/dbus-unit.c:358 msgid "Authentication is required to restart '$(unit)'." msgstr "'$(unit)'を再起動するには認証が必要です。" -#: src/core/dbus-unit.c:492 +#: src/core/dbus-unit.c:530 msgid "" "Authentication is required to send a UNIX signal to the processes of " "'$(unit)'." msgstr "'$(unit)'のプロセスにUNIXシグナルを送るには認証が必要です。" -#: src/core/dbus-unit.c:523 +#: src/core/dbus-unit.c:561 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'." msgstr "'$(unit)'の「失敗」状態をリセットするには認証が必要です。" -#: src/core/dbus-unit.c:556 +#: src/core/dbus-unit.c:594 msgid "Authentication is required to set properties on '$(unit)'." msgstr "'$(unit)'のプロパティを設定するには認証が必要です。" + +#: src/core/dbus-unit.c:703 +msgid "" +"Authentication is required to delete files and directories associated with " +"'$(unit)'." +msgstr "" +"'$(unit)'に関連付けられたファイルやディレクトリの削除には認証が必要です。" diff --git a/src/analyze/analyze.c b/src/analyze/analyze.c index c8767e88c8..45e41fedee 100644 --- a/src/analyze/analyze.c +++ b/src/analyze/analyze.c @@ -2169,7 +2169,7 @@ static int do_security(int argc, char *argv[], void *userdata) { } static int help(int argc, char *argv[], void *userdata) { - _cleanup_free_ char *link = NULL; + _cleanup_free_ char *link = NULL, *dot_link = NULL; int r; (void) pager_open(arg_pager_flags); @@ -2178,6 +2178,11 @@ static int help(int argc, char *argv[], void *userdata) { if (r < 0) return log_oom(); + /* Not using terminal_urlify_man() for this, since we don't want the "man page" text suffix in this case. */ + r = terminal_urlify("man:dot(1)", "dot(1)", &dot_link); + if (r < 0) + return log_oom(); + printf("%s [OPTIONS...] {COMMAND} ...\n\n" "Profile systemd, show unit dependencies, check unit files.\n\n" " -h --help Show this help\n" @@ -2202,7 +2207,7 @@ static int help(int argc, char *argv[], void *userdata) { " blame Print list of running units ordered by time to init\n" " critical-chain [UNIT...] Print a tree of the time critical chain of units\n" " plot Output SVG graphic showing service initialization\n" - " dot [UNIT...] Output dependency graph in man:dot(1) format\n" + " dot [UNIT...] Output dependency graph in %s format\n" " log-level [LEVEL] Get/set logging threshold for manager\n" " log-target [TARGET] Get/set logging target for manager\n" " dump Output state serialization of service manager\n" @@ -2219,6 +2224,7 @@ static int help(int argc, char *argv[], void *userdata) { " security [UNIT...] Analyze security of unit\n" "\nSee the %s for details.\n" , program_invocation_short_name + , dot_link , link ); diff --git a/src/core/unit.c b/src/core/unit.c index 8fe02462be..d783e5c867 100644 --- a/src/core/unit.c +++ b/src/core/unit.c @@ -57,6 +57,16 @@ #include "user-util.h" #include "virt.h" +/* Thresholds for logging at INFO level about resource consumption */ +#define MENTIONWORTHY_CPU_NSEC (1 * NSEC_PER_SEC) +#define MENTIONWORTHY_IO_BYTES (1024 * 1024ULL) +#define MENTIONWORTHY_IP_BYTES (0ULL) + +/* Thresholds for logging at INFO level about resource consumption */ +#define NOTICEWORTHY_CPU_NSEC (10*60 * NSEC_PER_SEC) /* 10 minutes */ +#define NOTICEWORTHY_IO_BYTES (10 * 1024 * 1024ULL) /* 10 MB */ +#define NOTICEWORTHY_IP_BYTES (128 * 1024 * 1024ULL) /* 128 MB */ + const UnitVTable * const unit_vtable[_UNIT_TYPE_MAX] = { [UNIT_SERVICE] = &service_vtable, [UNIT_SOCKET] = &socket_vtable, @@ -2138,10 +2148,19 @@ void unit_trigger_notify(Unit *u) { UNIT_VTABLE(other)->trigger_notify(other, u); } +static int raise_level(int log_level, bool condition_info, bool condition_notice) { + if (condition_notice && log_level > LOG_NOTICE) + return LOG_NOTICE; + if (condition_info && log_level > LOG_INFO) + return LOG_INFO; + return log_level; +} + static int unit_log_resources(Unit *u) { struct iovec iovec[1 + _CGROUP_IP_ACCOUNTING_METRIC_MAX + _CGROUP_IO_ACCOUNTING_METRIC_MAX + 4]; bool any_traffic = false, have_ip_accounting = false, any_io = false, have_io_accounting = false; _cleanup_free_ char *igress = NULL, *egress = NULL, *rr = NULL, *wr = NULL; + int log_level = LOG_DEBUG; /* May be raised if resources consumed over a treshold */ size_t n_message_parts = 0, n_iovec = 0; char* message_parts[1 + 2 + 2 + 1], *t; nsec_t nsec = NSEC_INFINITY; @@ -2187,6 +2206,10 @@ static int unit_log_resources(Unit *u) { } message_parts[n_message_parts++] = t; + + log_level = raise_level(log_level, + nsec > NOTICEWORTHY_CPU_NSEC, + nsec > MENTIONWORTHY_CPU_NSEC); } for (CGroupIOAccountingMetric k = 0; k < _CGROUP_IO_ACCOUNTING_METRIC_MAX; k++) { @@ -2227,6 +2250,11 @@ static int unit_log_resources(Unit *u) { goto finish; } } + + if (IN_SET(k, CGROUP_IO_READ_BYTES, CGROUP_IO_WRITE_BYTES)) + log_level = raise_level(log_level, + value > MENTIONWORTHY_IO_BYTES, + value > NOTICEWORTHY_IO_BYTES); } if (have_io_accounting) { @@ -2287,6 +2315,11 @@ static int unit_log_resources(Unit *u) { goto finish; } } + + if (IN_SET(m, CGROUP_IP_INGRESS_BYTES, CGROUP_IP_EGRESS_BYTES)) + log_level = raise_level(log_level, + value > MENTIONWORTHY_IP_BYTES, + value > NOTICEWORTHY_IP_BYTES); } if (have_ip_accounting) { @@ -2343,7 +2376,7 @@ static int unit_log_resources(Unit *u) { t = strjoina(u->manager->invocation_log_field, u->invocation_id_string); iovec[n_iovec + 3] = IOVEC_MAKE_STRING(t); - log_struct_iovec(LOG_INFO, iovec, n_iovec + 4); + log_struct_iovec(log_level, iovec, n_iovec + 4); r = 0; finish: diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c index 31f7f3e445..140df4e16b 100644 --- a/src/nspawn/nspawn-mount.c +++ b/src/nspawn/nspawn-mount.c @@ -1007,14 +1007,33 @@ static int setup_volatile_yes( bool tmpfs_mounted = false, bind_mounted = false; char template[] = "/tmp/nspawn-volatile-XXXXXX"; - _cleanup_free_ char *buf = NULL; + _cleanup_free_ char *buf = NULL, *bindir = NULL; const char *f, *t, *options; + struct stat st; int r; assert(directory); - /* --volatile=yes means we mount a tmpfs to the root dir, and the original /usr to use inside it, and that - read-only. */ + /* --volatile=yes means we mount a tmpfs to the root dir, and the original /usr to use inside it, and + * that read-only. Before we start setting this up let's validate if the image has the /usr merge + * implemented, and let's output a friendly log message if it hasn't. */ + + bindir = path_join(directory, "/bin"); + if (!bindir) + return log_oom(); + if (lstat(bindir, &st) < 0) { + if (errno != ENOENT) + return log_error_errno(errno, "Failed to stat /bin directory below image: %m"); + + /* ENOENT is fine, just means the image is probably just a naked /usr and we can create the + * rest. */ + } else if (S_ISDIR(st.st_mode)) + return log_error_errno(SYNTHETIC_ERRNO(EISDIR), + "Sorry, --volatile=yes mode is not supported with OS images that have not merged /bin/, /sbin/, /lib/, /lib64/ into /usr/. " + "Please work with your distribution and help them adopt the merged /usr scheme."); + else if (!S_ISLNK(st.st_mode)) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), + "Error starting image: if --volatile=yes is used /bin must be a symlink (for merged /usr support) or non-existent (in which case a symlink is created automatically)."); if (!mkdtemp(template)) return log_error_errno(errno, "Failed to create temporary directory: %m"); diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index fed5c651ce..2aec8041f0 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -3264,8 +3264,24 @@ static int outer_child( "Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range); } - if (!dissected_image) { - /* Turn directory into bind mount */ + if (path_equal(directory, "/")) { + /* If the directory we shall boot is the host, let's operate on a bind mount at a different + * place, so that we can make changes to its mount structure (for example, to implement + * --volatile=) without this interfering with our ability to access files such as + * /etc/localtime to copy into the container. Note that we use a fixed place for this + * (instead of a temporary directory, since we are living in our own mount namspace here + * already, and thus don't need to be afraid of colliding with anyone else's mounts).*/ + (void) mkdir_p("/run/systemd/nspawn-root", 0755); + + r = mount_verbose(LOG_ERR, "/", "/run/systemd/nspawn-root", NULL, MS_BIND|MS_REC, NULL); + if (r < 0) + return r; + + directory = "/run/systemd/nspawn-root"; + + } else if (!dissected_image) { + /* Turn directory into bind mount (we need that so that we can move the bind mount to root + * later on). */ r = mount_verbose(LOG_ERR, directory, directory, NULL, MS_BIND|MS_REC, NULL); if (r < 0) return r; @@ -4018,7 +4034,7 @@ static int load_settings(void) { p = file_in_same_dir(arg_image, fn); if (!p) return log_oom(); - } else if (arg_directory) { + } else if (arg_directory && !path_equal(arg_directory, "/")) { p = file_in_same_dir(arg_directory, fn); if (!p) return log_oom(); @@ -4740,8 +4756,12 @@ static int run(int argc, char *argv[]) { if (arg_directory) { assert(!arg_image); - if (path_equal(arg_directory, "/") && !arg_ephemeral) { - log_error("Spawning container on root directory is not supported. Consider using --ephemeral."); + /* Safety precaution: let's not allow running images from the live host OS image, as long as + * /var from the host will propagate into container dynamically (because bad things happen if + * two systems write to the same /var). Let's allow it for the special cases where /var is + * either copied (i.e. --ephemeral) or replaced (i.e. --volatile=yes|state). */ + if (path_equal(arg_directory, "/") && !(arg_ephemeral || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_STATE))) { + log_error("Spawning container on root directory is not supported. Consider using --ephemeral, --volatile=yes or --volatile=state."); r = -EINVAL; goto finish; } @@ -4770,7 +4790,9 @@ static int run(int argc, char *argv[]) { goto finish; } - r = image_path_lock(np, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock); + /* We take an exclusive lock on this image, since it's our private, ephemeral copy + * only owned by us and noone else. */ + r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock); if (r < 0) { log_error_errno(r, "Failed to lock %s: %m", np); goto finish; @@ -4890,7 +4912,8 @@ static int run(int argc, char *argv[]) { goto finish; } - r = image_path_lock(np, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock); + /* Always take an exclusive lock on our own ephemeral copy. */ + r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock); if (r < 0) { r = log_error_errno(r, "Failed to create image lock: %m"); goto finish; diff --git a/src/shared/machine-image.c b/src/shared/machine-image.c index 07744b34b4..7007374192 100644 --- a/src/shared/machine-image.c +++ b/src/shared/machine-image.c @@ -989,28 +989,52 @@ int image_path_lock(const char *path, int operation, LockFile *global, LockFile _cleanup_free_ char *p = NULL; LockFile t = LOCK_FILE_INIT; struct stat st; + bool exclusive; int r; assert(path); assert(global); assert(local); - /* Locks an image path. This actually creates two locks: one - * "local" one, next to the image path itself, which might be - * shared via NFS. And another "global" one, in /run, that - * uses the device/inode number. This has the benefit that we - * can even lock a tree that is a mount point, correctly. */ + /* Locks an image path. This actually creates two locks: one "local" one, next to the image path + * itself, which might be shared via NFS. And another "global" one, in /run, that uses the + * device/inode number. This has the benefit that we can even lock a tree that is a mount point, + * correctly. */ if (!path_is_absolute(path)) return -EINVAL; + switch (operation & (LOCK_SH|LOCK_EX)) { + case LOCK_SH: + exclusive = false; + break; + case LOCK_EX: + exclusive = true; + break; + default: + return -EINVAL; + } + if (getenv_bool("SYSTEMD_NSPAWN_LOCK") == 0) { *local = *global = (LockFile) LOCK_FILE_INIT; return 0; } - if (path_equal(path, "/")) - return -EBUSY; + /* Prohibit taking exclusive locks on the host image. We can't allow this, since we ourselves are + * running off it after all, and we don't want any images to manipulate the host image. We make an + * exception for shared locks however: we allow those (and make them NOPs since there's no point in + * taking them if there can't be exclusive locks). Strictly speaking these are questionable as well, + * since it means changes made to the host might propagate to the container as they happen (and a + * shared lock kinda suggests that no changes happen at all while it is in place), but it's too + * useful not to allow read-only containers off the host root, hence let's support this, and trust + * the user to do the right thing with this. */ + if (path_equal(path, "/")) { + if (exclusive) + return -EBUSY; + + *local = *global = (LockFile) LOCK_FILE_INIT; + return 0; + } if (stat(path, &st) >= 0) { if (S_ISBLK(st.st_mode)) @@ -1024,12 +1048,12 @@ int image_path_lock(const char *path, int operation, LockFile *global, LockFile return -ENOMEM; } - /* For block devices we don't need the "local" lock, as the major/minor lock above should be sufficient, since - * block devices are device local anyway. */ - if (!path_startswith(path, "/dev")) { + /* For block devices we don't need the "local" lock, as the major/minor lock above should be + * sufficient, since block devices are host local anyway. */ + if (!path_startswith(path, "/dev/")) { r = make_lock_file_for(path, operation, &t); if (r < 0) { - if ((operation & LOCK_SH) && r == -EROFS) + if (!exclusive && r == -EROFS) log_debug_errno(r, "Failed to create shared lock for '%s', ignoring: %m", path); else return r; diff --git a/src/shared/sleep-config.c b/src/shared/sleep-config.c index 0efbd7c7be..26ed4776b9 100644 --- a/src/shared/sleep-config.c +++ b/src/shared/sleep-config.c @@ -82,7 +82,7 @@ int parse_sleep_config(SleepConfig **ret_sleep_config) { if (!sc->hybrid_states) sc->hybrid_states = strv_new("disk"); if (sc->hibernate_delay_sec == 0) - sc->hibernate_delay_sec = 180 * USEC_PER_MINUTE; + sc->hibernate_delay_sec = 2 * USEC_PER_HOUR; /* ensure values set for all required fields */ if (!sc->suspend_states || !sc->hibernate_modes @@ -165,8 +165,30 @@ int can_sleep_disk(char **types) { #define HIBERNATION_SWAP_THRESHOLD 0.98 -int find_hibernate_location(char **device, char **type, size_t *size, size_t *used) { +/* entry in /proc/swaps */ +typedef struct SwapEntry { + char *device; + char *type; + uint64_t size; + uint64_t used; + int priority; +} SwapEntry; + +static SwapEntry* swap_entry_free(SwapEntry *se) { + if (!se) + return NULL; + + free(se->device); + free(se->type); + + return mfree(se); +} + +DEFINE_TRIVIAL_CLEANUP_FUNC(SwapEntry*, swap_entry_free); + +int find_hibernate_location(char **device, char **type, uint64_t *size, uint64_t *used) { _cleanup_fclose_ FILE *f; + _cleanup_(swap_entry_freep) SwapEntry *selected_swap = NULL; unsigned i; f = fopen("/proc/swaps", "re"); @@ -178,62 +200,76 @@ int find_hibernate_location(char **device, char **type, size_t *size, size_t *us (void) fscanf(f, "%*s %*s %*s %*s %*s\n"); - // TODO: sort swaps in priority order rather than using first successful option for (i = 1;; i++) { - _cleanup_free_ char *dev_field = NULL, *type_field = NULL; - size_t size_field, used_field; + _cleanup_(swap_entry_freep) SwapEntry *swap = NULL; int k; + swap = new0(SwapEntry, 1); + if (!swap) + return log_oom(); + k = fscanf(f, - "%ms " /* device/file */ - "%ms " /* type of swap */ - "%zu " /* swap size */ - "%zu " /* used */ - "%*i\n", /* priority */ - &dev_field, &type_field, &size_field, &used_field); + "%ms " /* device/file */ + "%ms " /* type of swap */ + "%" PRIu64 /* swap size */ + "%" PRIu64 /* used */ + "%i\n", /* priority */ + &swap->device, &swap->type, &swap->size, &swap->used, &swap->priority); if (k == EOF) break; - if (k != 4) { + if (k != 5) { log_warning("Failed to parse /proc/swaps:%u", i); continue; } - if (streq(type_field, "file")) { + if (streq(swap->type, "file")) { - if (endswith(dev_field, "\\040(deleted)")) { - log_warning("Ignoring deleted swap file '%s'.", dev_field); + if (endswith(swap->device, "\\040(deleted)")) { + log_warning("Ignoring deleted swap file '%s'.", swap->device); continue; } - } else if (streq(type_field, "partition")) { + } else if (streq(swap->type, "partition")) { const char *fn; - fn = path_startswith(dev_field, "/dev/"); + fn = path_startswith(swap->device, "/dev/"); if (fn && startswith(fn, "zram")) { - log_debug("Ignoring compressed RAM swap device '%s'.", dev_field); + log_debug("Ignoring compressed RAM swap device '%s'.", swap->device); continue; } } - if (device) - *device = TAKE_PTR(dev_field); - if (type) - *type = TAKE_PTR(type_field); - if (size) - *size = size_field; - if (used) - *used = used_field; - return 0; + /* prefer highest priority or swap with most remaining space when same priority */ + if (!selected_swap || swap->priority > selected_swap->priority + || ((swap->priority == selected_swap->priority) + && (swap->size - swap->used) > (selected_swap->size - selected_swap->used))) { + selected_swap = swap_entry_free(selected_swap); + selected_swap = TAKE_PTR(swap); + } } - return log_debug_errno(SYNTHETIC_ERRNO(ENOSYS), - "No swap partitions were found."); + if (!selected_swap) + return log_debug_errno(SYNTHETIC_ERRNO(ENOSYS), "No swap partitions or files were found."); + + /* use the swap entry with the highest priority */ + if (device) + *device = TAKE_PTR(selected_swap->device); + if (type) + *type = TAKE_PTR(selected_swap->type); + if (size) + *size = selected_swap->size; + if (used) + *used = selected_swap->used; + + log_debug("Highest priority swap entry found %s: %i", selected_swap->device, selected_swap->priority); + + return 0; } static bool enough_swap_for_hibernation(void) { _cleanup_free_ char *active = NULL; unsigned long long act = 0; - size_t size = 0, used = 0; + uint64_t size = 0, used = 0; int r; if (getenv_bool("SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK") > 0) @@ -256,7 +292,7 @@ static bool enough_swap_for_hibernation(void) { } r = act <= (size - used) * HIBERNATION_SWAP_THRESHOLD; - log_debug("%s swap for hibernation, Active(anon)=%llu kB, size=%zu kB, used=%zu kB, threshold=%.2g%%", + log_debug("%s swap for hibernation, Active(anon)=%llu kB, size=%" PRIu64 " kB, used=%" PRIu64 " kB, threshold=%.2g%%", r ? "Enough" : "Not enough", act, size, used, 100*HIBERNATION_SWAP_THRESHOLD); return r; diff --git a/src/shared/sleep-config.h b/src/shared/sleep-config.h index 965fde93a2..c1cbf43326 100644 --- a/src/shared/sleep-config.h +++ b/src/shared/sleep-config.h @@ -27,7 +27,7 @@ int sleep_settings(const char *verb, const SleepConfig *sleep_config, bool *ret_ int read_fiemap(int fd, struct fiemap **ret); int parse_sleep_config(SleepConfig **sleep_config); -int find_hibernate_location(char **device, char **type, size_t *size, size_t *used); +int find_hibernate_location(char **device, char **type, uint64_t *size, uint64_t *used); int can_sleep(const char *verb); int can_sleep_disk(char **types); |