summaryrefslogtreecommitdiff
path: root/man
Commit message (Collapse)AuthorAgeFilesLines
* logind-session-dbus: allow to set display name via dbusDavid Tardon2022-06-221-0/+8
| | | | | | | | Currently, the only way to set display name of a graphical session is to pass it to CreateSession(). But modern display managers like gdm start the display server as part of the user session, which means that the display name isn't known yet when the session is being created. Hence, let's make it possible to set it later.
* Merge pull request #23774 from yuwata/netlabel-nftset-follow-upsYu Watanabe2022-06-234-241/+0
|\ | | | | network, core: revert NFTSet and NetLabel features
| * Revert "networkd: NetLabel integration"Yu Watanabe2022-06-221-54/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts PR #23269 and its follow-up commit. Especially, 2299b1cae32c1fb8911da0ce26efced68032f4f8 (partially), and 3cf63830acdef9d8afdc9ef1cf25aa7e85a5e4d5. The PR was merged without final approval, and has several issues: - The NetLabel for static addresses are not assigned, as labels are stored in the Address objects managed by Network, instead of Link. - If NetLabel is specified for a static address, then the address section will be invalid and the address will not be configured, - It should be implemented with Request object, - There is no test about the feature.
| * Revert NFTSet featureYu Watanabe2022-06-224-187/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts PR #22587 and its follow-up commit. More specifically, 2299b1cae32c1fb8911da0ce26efced68032f4f8 (partially), e176f855278d5098d3fecc5aa24ba702147d42e0, ceb46a31a01b3d3d1d6095d857e29ea214a2776b, and 51bb9076ab8c050bebb64db5035852385accda35. The PR was merged without final approval, and has several issues: - OSS fuzz reported issues in the conf parser, - It calls synchrnous netlink call, it should not be especially in PID1, - The importance of NFTSet for CGroup and DynamicUser may be questionable, at least, there was no justification PID1 should support it. - For networkd, it should be implemented with Request object, - There is no test for the feature. Fixes #23711. Fixes #23717. Fixes #23719. Fixes #23720. Fixes #23721. Fixes #23759.
* | Merge pull request #23806 from keszybz/udevadm-info-pagerZbigniew Jędrzejewski-Szmek2022-06-221-0/+1
|\ \ | |/ |/| Pager for udevadm info
| * udevadm info: implement --no-pagerZbigniew Jędrzejewski-Szmek2022-06-221-0/+1
| |
* | cryptenroll: fix typo in manpageFoster Snowhill2022-06-181-1/+1
| |
* | tree-wide: fix typoYu Watanabe2022-06-151-1/+1
| |
* | man: Add some punctuation; remove double spaces.adrian52022-06-151-40/+40
|/
* boot: Drop use of MetaiMatchJan Janssen2022-06-091-1/+8
| | | | | | | | A future commit will add support for unicode collation protocol that allows case folding and comparing strings with locale awareness. But it only operates on whole strings, so fnmatch cannot use those without a heavy cost. Instead we just case fold the patterns instead (the IDs we try to match are already lower case).
* core: firewall integration with DynamicUserNFTSet=Topi Miettinen2022-06-082-0/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directive `DynamicUserNFTSet=` provides a method for integrating configuration of dynamic users into firewall rules with NFT sets. Example: ``` table inet filter { set u { typeof meta skuid } chain service_output { meta skuid != @u drop accept } } ``` ``` /etc/systemd/system/dunft.service [Service] DynamicUser=yes DynamicUserNFTSet=inet:filter:u ExecStart=/bin/sleep 1000 [Install] WantedBy=multi-user.target ``` ``` $ sudo nft list set inet filter u table inet filter { set u { typeof meta skuid elements = { 64864 } } } $ ps -n --format user,group,pid,command -p `pgrep sleep` USER GROUP PID COMMAND 64864 64864 55158 /bin/sleep 1000 ```
* core: firewall integration with ControlGroupNFTSet=Topi Miettinen2022-06-082-0/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directive `ControlGroupNFTSet=` provides a method for integrating services into firewall rules with NFT sets. Example: ``` table inet filter { ... set timesyncd { type cgroupsv2 } chain ntp_output { socket cgroupv2 != @timesyncd counter drop accept } ... } ``` /etc/systemd/system/systemd-timesyncd.service.d/override.conf ``` [Service] ControlGroupNFTSet=inet:filter:timesyncd ``` ``` $ sudo nft list set inet filter timesyncd table inet filter { set timesyncd { type cgroupsv2 elements = { "system.slice/systemd-timesyncd.service" } } } ```
* network: firewall integration with NFT setsTopi Miettinen2022-06-081-0/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directives `NFTSet=`, `IPv4NFTSet=` and `IPv6NFTSet=` provide a method for integrating configuration of dynamic networks into firewall rules with NFT sets. /etc/systemd/network/eth.network ``` [DHCPv4] ... NFTSet=netdev:filter:eth_ipv4_address ``` ``` table netdev filter { set eth_ipv4_address { type ipv4_addr flags interval } chain eth_ingress { type filter hook ingress device "eth0" priority filter; policy drop; ip saddr != @eth_ipv4_address drop accept } } ``` ``` sudo nft list set netdev filter eth_ipv4_address table netdev filter { set eth_ipv4_address { type ipv4_addr flags interval elements = { 10.0.0.0/24 } } } ```
* networkd: NetLabel integrationTopi Miettinen2022-06-061-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directive `NetLabel=` provides a method for integrating dynamic network configuration into Linux NetLabel subsystem rules, used by Linux security modules (LSMs) for network access control. The option expects a whitespace separated list of NetLabel labels. The labels must conform to lexical restrictions of LSM labels. When an interface is configured with IP addresses, the addresses and subnetwork masks will be appended to the NetLabel Fallback Peer Labeling rules. They will be removed when the interface is deconfigured. Failures to manage the labels will be ignored. Example: ``` [DHCP] NetLabel=system_u:object_r:localnet_peer_t:s0 ``` With the above rules for interface `eth0`, when the interface is configured with an IPv4 address of 10.0.0.0/8, `systemd-networkd` performs the equivalent of `netlabelctl` operation ``` $ sudo netlabelctl unlbl add interface eth0 address:10.0.0.0/8 label:system_u:object_r:localnet_peer_t:s0 ``` Result: ``` $ sudo netlabelctl -p unlbl list ... interface: eth0 address: 10.0.0.0/8 label: "system_u:object_r:localnet_peer_t:s0" ... ```
* Merge pull request #23576 from yuwata/network-erspan-versionZbigniew Jędrzejewski-Szmek2022-06-021-3/+25
|\ | | | | network: support erspan version 0 and 2
| * network/erspan: support erspan version 0 and 2Yu Watanabe2022-06-011-3/+25
| | | | | | | | | | | | This also makes networkd accepts erspan index 0. Closes #23570.
* | man: add missing arguments to systemd-creds synopsisAntonio Alvarez Feijoo2022-06-021-0/+2
| |
* | Documents the AssertCPUFeature= flag (#23594)Steve Ramage2022-06-021-0/+1
| | | | | | Fixes #23593
* | Merge pull request #23575 from keszybz/logind-wall-message-cleanupZbigniew Jędrzejewski-Szmek2022-06-011-16/+14
|\ \ | |/ |/| Cleanup wall messages emitted by logind and systemctl
| * man/systemctl: improve grammar in description of --check-inhibitorsZbigniew Jędrzejewski-Szmek2022-06-011-16/+14
| |
* | man/nspawn: os-release is only checked for booted containersBenjamin Franzke2022-05-301-1/+1
| | | | | | | | | | | | /etc/os-release existence is only enforced in --boot mode, therefore the term "starting" (which also applies to chroot-like mode) is substituted with "booting" in this context.
* | man/nspawn: add a sentence-connecting adverb to machinectl noteBenjamin Franzke2022-05-301-1/+1
| | | | | | | | | | | | The recommendation to use machinectl login/shell instead of trying to combine two distinct container instances seemed a litte bit out of context and is now combined via "rather".
* | man/nspawn: fix boot-option related wordingBenjamin Franzke2022-05-301-4/+4
|/
* man: Fix minor typoJavkhlanbayar Khongorzul2022-05-281-1/+1
|
* sd-hwdb: add sd_hwdb_new_from_pathNick Rosbrook2022-05-271-2/+12
| | | | | | | | | | The existing sd_hwdb_new function always initializes the hwdb from the first successful hwdb.bin it finds from hwdb_bin_paths. This means there is currently no way to initialize a hwdb from an explicit path, which would be useful for systemd-hwdb query. Add sd_hwdb_new_from_path to allow a sd_hwdb to be initialized from a custom path outside of hwdb_bin_paths.
* Merge pull request #23521 from keszybz/some-docsLuca Boccassi2022-05-276-68/+111
|\ | | | | Some docs
| * man/homectl: adjust man page to match codeZbigniew Jędrzejewski-Szmek2022-05-261-2/+7
| | | | | | | | | | Fixes #22966. Since there are competing conventions, let's not change our code, but make the docs match what is implemented.
| * man/sd-bus: discuss negative-return values and add exampleZbigniew Jędrzejewski-Szmek2022-05-262-21/+65
| | | | | | | | Fixes #22816.
| * man/shutdown: explain -h moreZbigniew Jędrzejewski-Szmek2022-05-261-18/+11
| | | | | | | | Fixes #23401
| * man/automount: say that automounts should not be nestedZbigniew Jędrzejewski-Szmek2022-05-261-0/+4
| | | | | | | | Fixes #21832.
| * man/systemd.automount: move the main description up and clarify depsZbigniew Jędrzejewski-Szmek2022-05-261-14/+10
| |
| * man: do not say "additional symlinks" for mount/automount aliasesZbigniew Jędrzejewski-Szmek2022-05-262-13/+14
| | | | | | | | | | "additional" implies that the unit itself is a symlink, which it is not. Also "link to the mount unit", not "link to the mount".
* | loader.conf: Clarify the default value of timeout.Eduard Tolosa2022-05-271-1/+1
| |
* | systemctl: make show/status honour --state and --typeZbigniew Jędrzejewski-Szmek2022-05-261-26/+22
|/ | | | | | | This makes the interface more flexible, by allowing the same filtering for show and status as is done for list-units. Fixes #23207.
* [sd-boot] improve documentation of beepRahil Bhimjiani2022-05-251-1/+1
|
* Merge pull request #23414 from keszybz/analyze-vercmpZbigniew Jędrzejewski-Szmek2022-05-231-2/+60
|\ | | | | systemd-analyze compare-versions
| * analyze: add compare-versionsZbigniew Jędrzejewski-Szmek2022-05-191-2/+60
| | | | | | | | | | | | | | | | | | | | | | The interface, output, and exit status convention are all taken directly from rpmdev-vercmp and dpkg --compare-versions. The implementation is different though. See test-string-util for a list of known cases where we compare strings incompatibly. The idea is that this string comparison function will be declared as "the" method to use for boot entry ordering in the specification and similar uses. Thus it's nice to allow users to compare strings.
* | Merge pull request #22550 from medhefgo/boot-mixedLuca Boccassi2022-05-211-0/+5
|\ \ | | | | | | boot: EFI mixed mode support
| * | bootctl: Add EFI arch detection supportJan Janssen2022-05-211-0/+5
| |/
* | tree-wide: Update homepage to systemd.ioBenjamin Franzke2022-05-211-1/+1
| |
* | tree-wide: replace obsolete wiki links with systemd.io/manpagesBenjamin Franzke2022-05-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | All wiki pages that contain a deprecation banner pointing to systemd.io or manpages are updated to point to their replacements directly. Helpful command for identification of available links: git grep freedesktop.org/wiki | \ sed "s#.*\(https://www.freedesktop.org/wiki[^ $<'\\\")]*\)\(.*\)#\\1#" | \ sort | uniq
* | tree-wide: streamline wiki linksBenjamin Franzke2022-05-217-9/+9
|/ | | | | | | | * Avoid traling slash as most links are defined without. * Always use https:// protocol and www. subdomain Allows for easier tree-wide linkvalidation for our migration to systemd.io.
* man: fix typoZbigniew Jędrzejewski-Szmek2022-05-161-1/+1
|
* man,mkosi: fedora 36 has been releasedZbigniew Jędrzejewski-Szmek2022-05-131-2/+2
|
* man: improve VtableExampleLuca Boccassi2022-05-111-9/+25
| | | | | | | | | | | | The methods published by the example have a reply in the signature, but the code was not sending any, so the client gets stuck waiting for a response that doesn't arrive. Echo back the input string. Update the object path to follow what would be the canonical format. Request a service name on the bus, so that the code can be dropped in a service and it can be dbus-activatable. It also makes it easier to see on busctl list.
* man: mention to Age parameter in C TypeKazuo Moriwaka2022-05-111-1/+3
|
* add missing cleanup-age to quickrefKazuo Moriwaka2022-05-101-6/+6
|
* core: annotate Reexecute() as NoReplyFrantisek Sumsal2022-05-101-0/+1
| | | | | So we're able to tell from the introspection data that the method doesn't reply.
* man: fix typoYu Watanabe2022-05-071-1/+1
|
* Merge pull request #23292 from alexhenrie/dhcpv6Yu Watanabe2022-05-071-10/+16
|\ | | | | network: clarify relationship between RA flags and DHCPv6 modes
View Lorry Controller Status