v255 batch up to c5baa5d9d9d778aee25b751387c60f43a0a6fb74 #446
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In some cases (SUSE Tumbleweed) this is needed as a library (libz) is not in the default path, so it fails to run. (cherry picked from commit 1e17e48b96bb509754a0a11ea8bd0394965564c6) (cherry picked from commit a2c84836efc5216e99af4c3e4ba3f6c2be7e67e1)
…tover unit Force means force, we skip checks with PID1 for existing units, but then bail out with EEXIST if the files are actually there. Overwrite everything instead. (cherry picked from commit 1e2d1a7202400e08a00782f32804fdc503259806) (cherry picked from commit 2552348da2c961ac9732614eb129228bba4d51da)
Closes #34478. Co-authored-by: Mike Yuan <[email protected]> (cherry picked from commit 144fbbac235b6b89d5d31795be1cc0dca9852ccc) (cherry picked from commit 4bbd6f589ad97a0df6ab59e03c8c535d298d05eb)
(cherry picked from commit c07e10628b6add9ee9664956a28d3f727c9848f8) (cherry picked from commit 308c93c51f85f1b6a5e6a3def951fa8e5643048d)
(cherry picked from commit dbf5b09de40a9d22b67611524bea12feae657462) (cherry picked from commit f535bbea13d93028c30f64dfac22ddac6e705f9d)
(cherry picked from commit 755877f20a2e18d1a2c4149662c2caec80230879) (cherry picked from commit 7884db1b93754901750f21cf1c04e38be0e94f11)
…tate When a network is busy, an ARP may be received before the timer event source triggered first time. Fixes #34489. (cherry picked from commit 146b44d0a0001712ced2f22ca76d242eedac26ad) (cherry picked from commit 06eb9b14829f3a5819f6daefb09fdb855cd868f4)
(cherry picked from commit 0121b84e41cd187e44c275a23db1a656656ec37f) (cherry picked from commit efd5e357d7ed6b7def0d12631835efd6a5bf5f5a)
(cherry picked from commit f3b8e81f5443fefb1dd2bb62d6b41c2559dca475) (cherry picked from commit 08cf1c5ce525bcf52548a8b3713b71cda7545c20)
The concept is fairly well established and present in our docs in various places. Say that the exitrd is also marked by the presence of /etc/initrd-release. (cherry picked from commit ace26a511ff63dbc15f1b2b0b941cbd3294a288c) (cherry picked from commit b78f99e71b5ffa57caa5508e871ba17a6ff686d7)
We generally do _not_ want the same sysexts to be loaded in both initrd and exitrd phases. The environment is completely different and it's unlikely that the same code can be useful in both places. Nevertheless, it can be useful in _some_ cases, for example when the sysexts contains debugging tools. I think we don't need to differentiate between initrds and exitrds through SYSEXT_SCOPE, because the two types are made available in completely different locations and loaded through a different mechanism, with very little chance of an initrd being loaded as an exitrd without an explicit admin action (or the other way around). So let's not complicate our code or definitions by an explicit "exitrd" sysext designator, but just clarify that "initrd" also encompasses exitrds in this context. (cherry picked from commit 7352a0093f4ef96c361be22337cde3296d79da01) (cherry picked from commit 2cd8079efabb8f17e6e58f1fd6c051d388648146)
Different device paths may resolve to same device node
(lookup_block_device()), e.g.
IOReadBandwidthMax=/dev/sda1 18879
IOReadBandwidthMax=/dev/sda2 18878
where both partitions resolve to /dev/sda and when these values are
applied (they are associated with original paths, i.e. as if applied for
different device) in the order from io_device_limits.
The parsing code prepends, so they end up in reverse order wrt config
file. Switch the direction so that the order of application matches the
order of configuration -- i.e. semantics in all other unit file
directives.
Apply same change to all directives that use per-device lists. (The
question whether partitions should be resolved to base device is
independent.)
And apply the changes equally to DBus properties write handlers.
Fixes #34126
(cherry picked from commit 0fa0dfa04465651a18107d503f9967f84bd761d1)
(cherry picked from commit 00dfa7964b5e48a37596207ad8b2862b157cffaf)
Verity= is an image build concept, not a first boot concept, whereas a partition designator is always available, so let's do the size stuff based on that. (cherry picked from commit e11745d000d7e9b3112bb336735c1bdfa77e9add) (cherry picked from commit 4143bc70ed7d131cda9f0aa2f86d4aedd38e0fce)
Fixes: systemd/systemd#34547 (cherry picked from commit 32951fe4de683f5d42cec2fb2e036f766b051e2b) (cherry picked from commit bc0ba0030b83cea3c5bf62695bb70f406fe6d12d)
I encountered this race condition while working on TEST-13-NSPAWN.varlinkctl.sh. The long-running machine's init script sometimes does not have time to start and register signals. As result, occasiounally failed tests. (cherry picked from commit e826a8bed447f3b3f9ad487f96ab7f8c7620c75b) (cherry picked from commit 0cd10d410b49303894c48521c0629b97e72b43bc)
(cherry picked from commit 543015a164c1fbf22c13c357efb180cf1adc5f03) (cherry picked from commit c1431b7eff6f8d6b0d571c1ec7bfc49cefbba1f4)
Somebody wrapped the text, but whitespace is preserved in <programlisting>, so the output was mangled. It also doesn't make sense to run systemd-path as root (as indicated by '#'), so drop that. Also, this chunk should be a separate paragraph. (cherry picked from commit 1ca81b2e005ccef6e9ddf06c3e3441bae0a6e1d5) (cherry picked from commit 53b5032ffdb4f619560d69d033ef309784c41f1f)
Every services and containers should be able to protect their users and limit the impact of security bugs thanks to the security syscalls provided by seccomp and Landlock. The goal of these syscalls is to improve security with additional restrictions. They are designed to be safely used by unprivileged (and then potentially malicious) users. Remove the now-redundant "seccomp" entry for nspawn. (cherry picked from commit e9966634754b8c9ee3f3c579f25d938e185c282e) (cherry picked from commit c53c1a0fac49645588409a0a4917b2f12a5d5910)
The type is a(ss), so a custom printer is required. Fixes systemd/systemd#33967. (cherry picked from commit 69c751c61cb2b386afe51f03b58f8f7ceeeb643e) (cherry picked from commit 28ced52894cf6921d1fe9831f2def29de164e189)
The man page is supposed to provide a "generalized, though minimal and modernized subset" (as per introductory pargapraghs), from a systemd perspective. But the thing is that /usr/include/ really doesn't matter to us. It's a development thing, and slightly weird (because it arguably would be better places in /usr/share/include/ or so). It's not going to be there on 95% of deployed systems, and we really don't want people to bother with it on such systems. We only define the skeleton of directories in this document, and it's expected that people extend it, and I think this really should be one of those dirs that is an extension of our skeleton, but not part of the skeleton, if that makes any sense. (cherry picked from commit 9e7b691073922433a71cf49dcaaf7f9f61f58e6d) (cherry picked from commit e5ac408af76ca1b6827de08a1960970a7d8db15d)
Today it seems this is mostly used by mail and printer servers, and it's not clear to me at all what the property is that makes /var/spool/<package> the better place for the relevant data than /var/lib/<package>. Hence, in the interest of shortening the spec, let's not mention the dir anymore. In particular as the dir really isn't used by us much, for example we do not have a counterpart for RuntimeDirectory=, StateDirectory=, … that would cover the spool. Since most systems these days we care about probably come *without* a printer or mail server, let's maybe no mention this in the man page that is supposed to discuss the rough skeleton how things are set up. After all, people are supposed to exend the skeleton with their stuff, and this sounds more like a case for an extension of the skeleton instead of being considered part of the skeleton itself. (cherry picked from commit b0201b36d2e0181d08530aaad496322812c4e77e) (cherry picked from commit 82783a3c5fd262c9006a5f9091a4875b1dad1c5a)
(And specifically mention /usr/include + /var/spool as not covered here, but being OK to add downstream) (cherry picked from commit fd6e079e7b296696028c161224d2a86fce70726f) (cherry picked from commit c14890f588745a87c7b4a9a7ed0991e03a7b91ea)
…M or similar Just to tighten the language a bit, why people should care about where they place their inodes. (cherry picked from commit 5b53894123b9d01f5738b02befd4189625c5451f) (cherry picked from commit 4bdbfb3dd4c45720357d066fa8e4f65bccc610f6)
On upgrades, only the %postun scriptlets of the old package version run. This means that any changes related to restarting daemons require two releases before they're actually used. %postun is used because it runs after the old package has been removed, which is important as it means any lingering dropins from the old package will have been removed as well. To allow deploying fixes in just a single release while still running after the old package has been removed, let's introduce %posttrans versions of these scriptlets as %posttrans of the new package runs on upgrade and install after the old package has been removed. (cherry picked from commit 9fd8a9dffe9b8f29da52e4e1481926bceed5ce6c) (cherry picked from commit d1f11d909f673ade60a4e66a4733c200f9013be3)
fix pointer constness in documentation (cherry picked from commit fec09ff094670a6903b12b1c599b00b39a2b0c88) (cherry picked from commit 072ea04e26c84ac25419316c659f4d89d8002f34)
For compiling bpf code, the system include directory needs to be constructed. On Debian-like systems, this requires passing a multiarch directory. Since clang's -dump-machine prints something other that the multiarch triplet, gcc was interrogated earlier, but that also yields a wrong result for cross compilation and was thus skipped resulting in clang not finding asm/types.h. Rather than, -dump-machine we should ask for -print-multiarch (which rarely differs). Whenever gcc is in use, this is right (even for cross building). Since clang does not support -print-multiarch and its -dump-machine never matches Debian's multiarch, we resort to asking gcc when building natively. For cross builds using clang, we are out of luck. (cherry picked from commit 608009dc6218f7c41420f665586f2449b64a08f7) (cherry picked from commit 1bd02a6e04270e6f01909cdc8b4e968f95ce5d4b)
Let's systematically use RTL_NOW|RLTD_NODELETE as flags passed to dlopen(), across our codebase. Various distros build with "-z now" anyway, hence it's weird to specify RTLD_LAZY trying to override that (which it doesn't). Hence, let's follow suit, and just do what everybody else does. Also set RTLD_NODELETE, which is apparently what distros will probably end up implying sooner or later anyway. Given that for pretty much all our dlopen() calls we never call dlclose() anyway, let's just set this everywhere too, to make things systematic. This way, the flags we use by default match what distros such as fedora do, there are no surprises, and read-only relocations can be a thing. Fixes: #34537 (cherry picked from commit bd4beaa2ebfbbec0a1263a7091a91e528ce8cf13) (cherry picked from commit e012eedd727a38bd18c9a540b92b95aa880d2b42)
…in ExecStart=
So far we supported this syntax:
ExecStart=foo ; bar
as equivalent to:
ExecStart=foo
ExecStart=bar
With this change we'll "soft" deprecate the first syntax. i.e. it's
still supported in code, but not documented anymore.
The concept was originally added to make things easier for 3rd party
.ini readers, as it allowed writing unit files with a .ini framework
that doesn't allow multiple assignments for the same key. But frankly,
this is kinda pointless, as so many other of our knobs require the
double assignment.
Hence, let's just stop advertising the concept, let's simplify the docs,
by removing one entirely redundant feature from it.
Replaces: #34570
(cherry picked from commit 225f18b9a9d39331ea862478ab2ff893678e249d)
(cherry picked from commit aeda397aedc02d32672cb10402b0b63e64b7a17e)
We don't support "split /usr" systems anymore, hence no point in mentioning /bin/ anymore as being part of the binary search path. (cherry picked from commit f39e66b85a4a97818a618758e34019d052aeb772) (cherry picked from commit 96c0549bda0c2fc682a9dee308ad1a90d2ebd422)
The latest clang has started catching more integer promotions which cause us to pass the wrong type to printf() format specifiers so let's fix those. (cherry picked from commit c73d14c43e7998ca54011875ad25afc634d57498) (cherry picked from commit e129e3a8618b1b56f70978cb1db1d66a0fdcd573)
We had several users, that wrote their unit files with WantedBy=default.target because it should be started "every time". But for example in Fedora/CentOS/RHEL, this often breaks for example selinux relabels (where we just want to do a relabel and reboot). (cherry picked from commit 67b6404b80cf8078f3d9ec6d4c2f34ac25b15077) (cherry picked from commit adc57cd81c02e5afc8efcbc64eb3a6305a97c62c)
Avoids the need to maintain the same list over and over again, and link it to the defition table in the implementation as a reminder too (cherry picked from commit 3509fe124d3a4fe2934028f83ae156ade050c8fe) (cherry picked from commit 1075727f7fe9436d2e468147cf663aaa1be867fd)
(cherry picked from commit 56f32d9e782f8ba43f17cb04687c915a7e41d10e) (cherry picked from commit 5b5f5666b2fd32950325387a3e0bc0b60f0b1808)
If the source is a file, don't copy the mode and such from it to the root directory, even if the target is /. (cherry picked from commit 413d3ce1b76b42ba691eea54cd1704b14602442e) (cherry picked from commit 52fa3b52bd7bda59912136916c91f3487b1924cc)
We can't shortcut chaseat() if CHASE_PARENT is set. (cherry picked from commit 87333bd1dc69195b93e9aee9b91c06fb167b152e) (cherry picked from commit 83f7bced66041624a16a7b13a1405b9f9684c257)
Reported in #34126 (cherry picked from commit 321637743313f896e275fd038996b8cfb5a070b3) (cherry picked from commit 84cd501ae4d2689ac39e510d1d33b7e3234f5199)
boot loader specification states: architecture: refers to the architecture this entry is for. The argument should be an architecture identifier, using the architecture vocabulary defined by the EFI specification (i.e. IA32, x64, IA64, ARM, AA64, …). If specified and it does not match the local system architecture this entry should be hidden. The comparison should be done case-insensitively. Example: architecture aa64 https://uapi-group.org/specifications/specs/boot_loader_specification/#type-1-boot-loader-entry-keys (cherry picked from commit f819a516dbbddb16724f33dcef5badcb6fe8b80b) (cherry picked from commit d65b7426e93e50c470173614c2eaca094f318ab5)
The disk/by-diskseq symlink should not be shared with multiple block devices. Hence, it is not necessary to create stack directory for the symlink that manages which device owns the symlink. This is not just a optimization. If a service unit tries to mount a disk image but the service fails, then the diskseq of the loop device for the image may be continuously increased during restart, and inodes in /run may increase rapidly, as the stack directories are cleaned up only when udev queue is empty. Fixes #34637. (cherry picked from commit 09373c1a50297079e6b0447ea97af4e9a60f77fa) (cherry picked from commit 02a5e5a32338869cc0ac352da81cf6d83da5c9e9)
(cherry picked from commit 88d186e4829bc7ef4a4253fe2bf4857903bca830) (cherry picked from commit 7b9e412d8aba8f415f35d02da5e5fa5bd92632cc)
... because that is obviously a security risk. (cherry picked from commit da32cac8a014ddf048fc7bad84dafdbc204d4dc8) (cherry picked from commit 7ac58949a37db3ddb662908d3aadaf5934fec222)
laccess is our own macro that uses RET_NERRNO. (cherry picked from commit 7c1dd9e288047a69d4a6a6dd6585725410cfdadd) (cherry picked from commit 4296a567d48ee43917b4f338fa1e927ffd53b36b)
Otherwise an invalid specifier iterates over uninitialized data. Fixes a bug introduced by 0b40688 (v254). (cherry picked from commit 32b8065e876c6f89f55b1bb30eeb442d3921fb3a) (cherry picked from commit 5dc97968d6ef732508311ecff555b305a05b6fe5)
- avoid stripping debug symbols and creating dbgsym packages - avoid LTO, slows down build a lot - avoid compressing packages, they are thrown out immediately after use - avoid building udeb packages, not needed (cherry picked from commit 7eedcb4)
Instead of fixing the commit, we can workaround the adduser issue by simply creating a user manually beforehand, which means the broken codepath in autopkgtest is not taken. We can remove it once it's fixed upstream, which is in progress: https://salsa.debian.org/ci-team/autopkgtest/-/merge_requests/297 (cherry picked from commit 8b7485c)
Offending commit has been reverted, so it's no longer necessary: https://salsa.debian.org/ci-team/autopkgtest/-/commit/90167696914889efa782aac3f1f44ab68498c529 Follow-up for 8b7485c (cherry picked from commit 2bbe5ca)
Builds have been failing as we run out of space in /tmp/, move to /var/tmp (cherry picked from commit 0c7b5dad33ee01b7ff6b7a8c583a7e2c27ac0673) (cherry picked from commit bc0102b0caacb97041ada0b0dbca40da09eab453)
This slows down the build, which is often near the 1hr limit. There are other jobs running the extra unit tests. (cherry picked from commit 3bc5480bac474263881e4c5919d5cce0debf3c40) (cherry picked from commit 52afaa8034f59dda44ec181e79604a9a222e60ad)
There are other CI runs that build manpages, speed up build which is close to 1hr limit (cherry picked from commit d58a904d35d3abcb7265b28b14aac596631e27d6) (cherry picked from commit 966d8a90ca44659123c15e3a7e7d498aa2b50510)
bluca
force-pushed
the
v255-stable
branch
3 times, most recently
from
415e936
to
47d6294
Compare
This feature has been deprecated since QEMU 5.0 and finally removed in QEMU 9.1 [0] which now causes issues when running the storage tests on latest Arch: ------ testcase_long_sysfs_path: BEGIN ------ ... qemu-system-x86_64: -device virtio-blk-pci,drive=drive0,scsi=off,bus=pci_bridge25: Property 'virtio-blk-pci.scsi' not found E: qemu failed with exit code 1 [0] qemu/qemu@a271b8d (cherry picked from commit cd57920fbf6a8f7769a82cfc9bebc12965de0199) (cherry picked from commit c5baa5d9d9d778aee25b751387c60f43a0a6fb74)
On jammy it started to fail, it's not really needed and we install an empty stub anyway, so just mask the generator
bluca
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.