tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

core: rework job_get_timeout() to use usec_t and handle USEC_INFINITY time events correctly

core: rework unit timeout handling, and add new setting RuntimeMaxSec= This clean-ups timeout handling in PID 1. Specifically, instead of storing 0 in internal timeout variables as indication for a disabled timeout, use USEC_INFINITY which is in-line with how we do this in the rest of our code (following the logic that 0 means "no", and USEC_INFINITY means "never"). This also replace all usec_t additions with invocations to usec_add(), so that USEC_INFINITY is properly propagated, and sd-event considers it has indication for turning off the event source. This also alters the deserialization of the units to restart timeouts from the time they were originally started from. Before this patch timeouts would be restarted beginning with the time of the deserialization, which could lead to artificially prolonged timeouts if a daemon reload took place. Finally, a new RuntimeMaxSec= setting is introduced for service units, that specifies a maximum runtime after which a specific service is forcibly terminated. This is useful to put time limits on time-intensive processing jobs. This also simplifies the various xyz_spawn() calls of the various types in that explicit distruction of the timers is removed, as that is done anyway by the state change handlers, and a state change is always done when the xyz_spawn() calls fail. Fixes: #2249

core: Do not bind a mount unit to a device, if it was from mountinfo If a mount unit is bound to a device, systemd tries to umount the mount point, if it thinks the device has gone away. Due to the uevent queue and inotify of /proc/self/mountinfo being two different sources, systemd can never get the ordering reliably correct. It can happen, that in the uevent queue ADD,REMOVE,ADD is queued and an inotify of mountinfo (or libmount event) happend with the device in question. systemd cannot know, at which point of time the mount happend in the ADD,REMOVE,ADD sequence. The real ordering might have been ADD,REMOVE,ADD,mount and systemd might think ADD,mount,REMOVE,ADD and would umount the mountpoint. A test script which triggered this behaviour is: rm -f test-efi-disk.img dd if=/dev/null of=test-efi-disk.img bs=1M seek=512 count=1 parted --script test-efi-disk.img \ "mklabel gpt" \ "mkpart ESP fat32 1MiB 511MiB" \ "set 1 boot on" LOOP=$(losetup --show -f -P test-efi-disk.img) udevadm settle mkfs.vfat -F32 ${LOOP}p1 mkdir -p mnt mount ${LOOP}p1 mnt ... <dostuffwith mnt> Without the "udevadm settle" systemd unmounted mnt while the script was operating on mnt. Of course the question is, why there was a REMOVE in the first place, but this is not part of this patch.

core: remove SmackFileSystemRootLabel= again Apparently, util-linux' mount command implicitly drops the smack-related options anyway before passing them to the kernel, if the kernel doesn't know SMACK, hence there's no point in duplicating this in systemd. Fixes #1696

core: simplify mount unit dependency generation a bit Let's make the code a bit more explicit. Should not change execution logic in any way.

core: simplify things a bit by checking default_dependencies boolean in callee, not caller It's nicer to hide the check away in the various xyz_add_default_dependencies() calls, rather than making it explicit in the caller, and thus require deeper nesing.

core: change return value of the unit's enumerate() call to void We cannot handle enumeration failures in a sensible way, hence let's try hard to continue without making such failures fatal, and log about it with precise error messages.

core: all unit types that watch control PIDs should use the same logic When coldplugging the unit state, make sure to follow the same basic logic for all unit types: always verify whether the control PID is still a waitable process before proceeding.

process-util: move a couple of process-related calls over

mount-util: move fstype_is_network() and name_to_handle_at() definitions over

util-lib: split out allocation calls into alloc-util.[ch]

util-lib: move string table stuff into its own string-table.[ch]

util: remove path_get_parent(), in favour of dirname_malloc() We don't need two functions that do essentialy the same, hence drop path_get_parent(), and stick to dirname_malloc(), but move it to path-util.[ch].

util-lib: split string parsing related calls from util.[ch] into parse-util.[ch]

core: rename SmackFileSystemRoot= to SmackFileSystemRootLabel= That way it's in sync with the other SMACK label settings. https://github.com/systemd/systemd/pull/1664#issuecomment-150891270

util-lib: split our string related calls from util.[ch] into its own file string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.

util: split out escaping code into escape.[ch] This really deserves its own file, given how much code this is now.

mount: add new SmackFileSystemRoot= setting for mount unit This option specifies the label to assign the root of the file system if it lacks the Smack extended attribute. Note that this option will be ignored if kernel does not support the Smack feature by runtime checking.

core: add support for setting stdin/stdout/stderr for transient services When starting a transient service, allow setting stdin/stdout/stderr fds for it, by passing them in via the bus. This also simplifies some of the serialization code for units.

Move all unit states to basic/ and extend systemctl --state=help

mount: use libmount to monitor mountinfo & utab The current implementation directly monitor /proc/self/mountinfo and /run/mount/utab files. It's really not optimal because utab file is private libmount stuff without any official guaranteed semantic. The libmount since v2.26 provides API to monitor mount kernel & userspace changes and since v2.27 the monitor is usable for non-root users too. This patch replaces the current implementation with libmount based solution. Signed-off-by: Karel Zak <kzak@redhat.com>

util: introduce safe_fclose() and port everything over to it Adds a coccinelle script to port things over automatically.

tree-wide: use coccinelle to patch a lot of code to use mfree() This replaces this: free(p); p = NULL; by this: p = mfree(p); Change generated using coccinelle. Semantic patch is added to the sources.

unit: unify how we assing slices to units This adds a new call unit_set_slice(), and simplifies unit_add_default_slice(). THis should make our code a bit more robust and simpler.

core: add unit_dbus_interface_from_type() to unit-name.h Let's add a way to get the type-specific D-Bus interface of a unit from either its type or name to src/basic/unit-name.[ch]. That way we can share it with the client side, where it is useful in tools like cgls or machinectl. Also ports over machinectl to make use of this.

mount: remove obsolete -n It seems that systemd still uses legacy -n option. The option has been originally designed to avoid write to /etc/mtab during boot when root FS is not ready or read-only. This is not necessary for long time, because /etc/mtab is not a real file (it's symlink) and write to the file is impossible. All utils should be able to detect the symlink and ignore mtab. This concept is supported for very long time before systemd. The userspase mount options are currently maintained by libmount (mount(8) and mount.nfs) in /run/mount) which is tmpfs initialized during early boot.

core: remove generic job completion messages from unit vtables These units' message format strings are identical to the generic strings. Since we can always rely on the fallback, these are now redundant.

core: correct return value from reload methods Return 1 from *_reload() methods to signify "we did something", just like in *_start(). This causes "Reloading foo..." messages to be logged. "Reloaded foo." messages are already logged.

core/mount: skip incomplete mountinfo entries Skip /proc/mountinfo entries for which libmount returns a NULL pointer for 'source' or 'target'. This happened on Semaphore CI's build servers when the test suite is run.

mount: properly check for mounts currently in /proc/self/mountinfo http://lists.freedesktop.org/archives/systemd-devel/2015-May/032059.html

mount: don't claim a device is gone from /proc/self/mountinfo before it is gone from *all* lines Devices might be referenced by multiple mount points in /proc/self/mountinfo, hence we should consider them unmounted only after they disappeared from all lines, not just from one. http://lists.freedesktop.org/archives/systemd-devel/2015-May/032026.html

Default to /usr/bin/u?mount, configurable, rather than hard-coded /bin/u?mount.

core: never create device depencies for /dev/root mounts http://lists.freedesktop.org/archives/systemd-devel/2015-May/031658.html

core: rename SystemdRunningAs to ManagerRunningAs It's primarily just a property of the Manager object after all, and we try to refer to PID 1 as "manager" instead of "systemd", hence let's to stick to this here too.

unit: move unit_warn_if_dir_nonempty() and friend to unit.c The call is only used by the mount and automount unit types, but that's already enough to consider it generic unit functionality, hence move it out of mount.c and into unit.c.

core,network: major per-object logging rework This changes log_unit_info() (and friends) to take a real Unit* object insted of just a unit name as parameter. The call will now prefix all logged messages with the unit name, thus allowing the unit name to be dropped from the various passed romat strings, simplifying invocations drastically, and unifying log output across messages. Also, UNIT= vs. USER_UNIT= is now derived from the Manager object attached to the Unit object, instead of getpid(). This has the benefit of correcting the field for --test runs. Also contains a couple of other logging improvements: - Drops a couple of strerror() invocations in favour of using %m. - Not only .mount units now warn if a symlinks exist for the mount point already, .automount units do that too, now. - A few invocations of log_struct() that didn't actually pass any additional structured data have been replaced by simpler invocations of log_unit_info() and friends. - For structured data a new LOG_UNIT_MESSAGE() macro has been added, that works like LOG_MESSAGE() but prefixes the message with the unit name. Similar, there's now LOG_LINK_MESSAGE() and LOG_NETDEV_MESSAGE(). - For structured data new LOG_UNIT_ID(), LOG_LINK_INTERFACE(), LOG_NETDEV_INTERFACE() macros have been added that generate the necessary per object fields. The old log_unit_struct() call has been removed in favour of these new macros used in raw log_struct() invocations. In addition to removing one more function call this allows generated structured log messages that contain two object fields, as necessary for example for network interfaces that are joined into another network interface, and whose messages shall be indexed by both. - The LOG_ERRNO() macro has been removed, in favour of log_struct_errno(). The latter has the benefit of ensuring that %m in format strings is properly resolved to the specified error number. - A number of logging messages have been converted to use log_unit_info() instead of log_info() - The client code in sysv-generator no longer #includes core code from src/core/. - log_unit_full_errno() has been removed, log_unit_full() instead takes an errno now, too. - log_unit_info(), log_link_info(), log_netdev_info() and friends, now avoid double evaluation of their parameters

core: always initialize ExecParamters.bus_endpoint_fd to -1 Otherwise it might be passed in as 0, which is a valid fd, but usually does not refer to a real endpoint.

core: rework unit name validation and manipulation logic A variety of changes: - Make sure all our calls distuingish OOM from other errors if OOM is not the only error possible. - Be much stricter when parsing escaped paths, do not accept trailing or leading escaped slashes. - Change unit validation to take a bit mask for allowing plain names, instance names or template names or an combination thereof. - Refuse manipulating invalid unit name

core: annotate event sources

Revert "core: do not spawn jobs or touch other units during coldplugging" This reverts commit 6e392c9c45643d106673c6643ac8bf4e65da13c1. We really shouldn't invent external state keeping hashmaps, if we can keep this state in the units themselves.

automount: add expire support

shared: add formats-util.h

util: rework cunescape(), improve error handling Change cunescape() to return a normal error code, so that we can distuingish OOM errors from parse errors. This also adds a flags parameter to control whether "relaxed" or normal parsing shall be done. If set no parse failures are generated, and the only reason why cunescape() can fail is OOM.

mount: fix up wording in the comment

mount: don't run quotaon only for network filesystems If you have for example ext4 on iscsi devices it is possible to setup qoutas there. Unfortunately, because such fstab entry contains _netdev, systemd will not add dependency to quotaon.service.

core: do not spawn jobs or touch other units during coldplugging Because the order of coldplugging is not defined, we can reference a not-yet-coldplugged unit and read its state while it has not yet been set to a meaningful value. This way, already active units may get started again. We fix this by deferring such actions until all units have been at least somehow coldplugged. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=88401

core: expose consumed CPU time per unit This adds support for showing the accumulated consumed CPU time per-unit in the "systemctl status" output. The property is also readable via the bus.

core: rework device state logic This change introduces a new state "tentative" for device units. Device units are considered "plugged" when udev announced them, "dead" when they are not available in the kernel, and "tentative" when they are referenced in /proc/self/mountinfo or /proc/swaps but not (yet) announced via udev. This should fix a race when device nodes (like loop devices) are created and immediately mounted. Previously, systemd might end up seeing the mount unit before the device, and would thus pull down the mount because its BindTo dependency on the device would not be fulfilled.

remove unused includes This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.

util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.

core/mount: add dependencies to dynamically mounted mounts too Add unit dependencies for dynamic (i. e. not from fstab) mounts. With that, mount units properly bind to their underlying device, and thus get automatically stopped/unmounted when the underlying device goes away. This cleans up stale mounts from unplugged devices. Thanks to Lennart Poettering for pointing out the fix!

core: output unit status output strings to console, only if we actually are changing unit state Unit _start() and _stop() implementations can fail with -EAGAIN to delay execution temporarily. Thus, we should not output status messages before invoking these calls, but after, and only when we know that the invocation actually made a change.

core,shutdown: don't bother with unmounting any mounts below /sys, /proc, /dev when shutting down After all, mounts below these directories are pretty much guaranteed to be virtual, and it's hence unnecessary to unmount them during shutdown. Moreover, in less-priviliged containers we might lack the rights to unmount them, hence don't even try. http://lists.freedesktop.org/archives/systemd-devel/2015-January/027113.html

core/mount: remove "fail" again deb6120920 'man: there's actually no "fail" fstab option, but only "nofail" removed it from our documentation, which I missed. fstab(5) only mentions "auto", "noauto", and "nofail". Stick to those three.

core/mount: use isempty() to check for empty strings strempty() will return an empty string in case the input parameter is a NULL pointer. The correct test to check for an empty string is isempty(), so use that instead. This fixes a regression from commit 17a1c59 ("core/mount: filter out noauto,auto,nofail,fail options").

core/mount: filter out noauto,auto,nofail,fail options We passed the full option string from fstab to /bin/mount. It would in turn pass the full option string to its helper, if it needed to invoke one. Some helpers would ignore things like "nofail", but others would be confused. We could try to get all helpers to ignore those "meta-options", but it seems better to simply filter them out. In our model, /bin/mount simply has no business in knowing whether the mount was configured as fail or nofail, auto or noauto, in the fstab. If systemd tells invokes a command to mount something, and it fails, it should always return an error. It seems cleaner to filter out the option, since then there's no doubt how the command should behave. https://bugzilla.redhat.com/show_bug.cgi?id=1177823

Add new function to filter fstab options This fixes parsing of options in shared/generator.c. Existing code had some issues: - it would treate whitespace and semicolons as seperators. fstab(5) is pretty clear that only commas matter. And the syntax does not allow for spaces to be inserted in the field in fstab. Whitespace might be escaped, but then it should not seperate options. Treat whitespace and semicolons as any other character. - it assumed that x-systemd.device-timeout would always be followed by "=". But this is not guaranteed, hasmntopt will return this option even if there's no value. Uninitialized memory could be read. - some error paths would log, and inconsistently, some would just return an error code. Filtering is split out to a separate function and tests are added. Similar code paths in other places are adjusted to use the new function.

mount: do not use -n when running in --user mode -n is only allowed for root. /etc/mtab is nowadays almost always a link to /proc/, so in practice this does not really matter too much, but should allow .mount units to work in --user mode. https://bugs.freedesktop.org/show_bug.cgi?id=87602

util: fix strict aliasing violations in use of struct inotify_event v5 There is alot of cleanup that will have to happen to turn on -fstrict-aliasing, but I think our code should be "correct" to the rule.

unit: handle nicely of certain unit types are not supported on specific systems Containers do not really support .device, .automount or .swap units; Systems compiled without support for swap do not support .swap units; Systems without kdbus do not support .busname units. With this change attempts to start a unsupported unit types will result in an immediate "unsupported" job result, which is a lot more descriptive then before. Also, attempts to start device units in containers will now immediately fail instead of causing jobs to be enqueued that never go away.

core: retry unmounting until we are done, in case of stacked mounts

sd-bus: move common errors src/shared/bus-errors.h → src/libsystemd/sd-bus/bus-common-errors.h Stuff in src/shared/ should not use stuff from src/libsystemd/ really.

mount: clarify that we really need to replace the utab inotify code with the native API for this in libmount, as soon as that's stable

core: unify how we iterate over inotify events Let's add some syntactic sugar for iterating through inotify events, and use it everywhere.

mount: use bools where appropriate

mount: use DEFINE_TRIVIAL_CLEANUP_FUNC

mount: constify MountParameters

mount: deal with inotify queue overflow Overflow is very unlikely, since we are watching a privileged directory, but could be triggered if thousands of mounts are suddently executed.

mount: create directory before adding watches on it

mount: be more careful about errors when parsing mtab Fixup for 4a3a9ef610.

mount: simplify mount_needs_network check

mount: check options as well as fstype for network mounts When creating a new mount unit after an event on /proc/self/mountinfo, check the mount options as well as the fstype to determine if this is a remote mount that requires network access.

mount: add remote-fs dependencies if needed after change This is an attempt to add it the remote-fs dependencies to a mount unit if the options change, like when the utab options are picked up after mountinfo has already been processed. It just adds the remote-fs dependencies, leaving the local-fs ones in place. With this change I always get mount units with proper remote-fs dependencies when mounted with the _netdev option.

mount: monitor for utab changes with inotify Parsing the mount table with libmount races against the mount command, which will handle the actual mounting before updating utab. This means the poll event on /proc/self/mountinfo can kick of a reparse in systemd before the utab information is available. This change adds in an additional event source using inotify to watch for changes to utab. It only watches for IN_MOVED_TO events, matching libmount behavior of always overwriting this file using rename(2). This does add a second pass through the mount table parsing when utab is updated.

mount: use libmount to enumerate /proc/self/mountinfo This lets libmount add in user options from /run/mount/utab, like _netdev which is needed to get proper ordering against remote-fs.target

treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.

treewide: auto-convert the simple cases to log_*_errno() As a followup to 086891e5c1 "log: add an "error" parameter to all low-level logging calls and intrdouce log_error_errno() as log calls that take error numbers", use sed to convert the simple cases to use the new macros: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\("(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_\1_errno(-\4, "\2%m"\3);/' Multi-line log_*() invocations are not covered. And we also should add log_unit_*_errno().

log: fix order of log_unit_struct() to match other logging calls Also, while we are at it, introduce some syntactic sugar for creating ERRNO= and MESSAGE= structured logging fields.

log: rearrange log function naming - Rename log_meta() → log_internal(), to follow naming scheme of most other log functions that are usually invoked through macros, but never directly. - Rename log_info_object() to log_object_info(), simply because the object should be before any other parameters, to follow OO-style programming style.

manager: only issue overmount warning when the check succeeded If for any reason the check failed (selinux?), we would still issue the warning. Check the return status.

core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine.

core: send sigabrt on watchdog timeout to get the stacktrace if sigabrt doesn't do the job, follow regular shutdown routine, sigterm > sigkill.

Revert "mount: order options before other arguments to mount" This reverts commit 141a1ceaa62578f1ed14f04cae2113dd0f49fd7f. People should fix their libc's getopt(), instead of us using a weird option ordering...

mount: order options before other arguments to mount

exec: factor out most function arguments of exec_spawn() to ExecParameters This way, the list of arguments to that function gets more comprehensive, and we can get around passing lots of NULL and 0 arguments from socket.c, swap.c and mount.c. It also allows for splitting up the code in exec_spawn(). While at it, make ExecContext const in execute.c.

core: Refuse mount on symlink

core: do not add default dependencies to /usr mount unit This makes no difference if /usr was mounted in the initrd, and brings the behaviour of legacy systems closer to those with a propper initrd.

Move x-systemd-device.timeout handling from core to fstab-generator Instead of adjusting job timeouts in the core, let fstab-generator write out a dropin snippet with the appropriate JobTimeout. x-systemd-device.timeout option is removed from Options= line in the generated unit. The functions to write dropins are moved from core/unit.c to shared/dropin.c, to make them available outside of core. generator.c is moved to libsystemd-label, because it now uses functions defined in dropin.c, which are in libsystemd-label.

mount: add new SloppyOptions= setting for mount units, mapping to mount(8)'s "-s" switch

mount: tell /bin/mount to never touch /etc/mtab /etc/mtab should die die die. It's sad enough util-linux still contains support for it, but we don't have to partake in that charade, so let's turn this off. This is in-line with the fact that since years we already have been "tainting" systemd if we detect /etc/mtab not being a symlink... Of course, util-linux is currently broken, and still touches /etc/mtab, weven if we pass "--no-mtab" to it: https://bugzilla.redhat.com/show_bug.cgi?id=1109367 But hey, let's hope that gets fixed quickly, even if total removal of /etc/mtab support from util-linux might not happen so quickly...

core: allow transient mount units For now only What=, Options=, Type= are supported, and Where= is deduced from the unit name.

sd-event: rework API to support CLOCK_REALTIME_ALARM and CLOCK_BOOTTIME_ALARM, too

core: rework context initialization/destruction logic Let's automatically initialize the kill, exec and cgroup contexts of the various unit types when the object is constructed, instead of invididually in type-specific code. Also, when PrivateDevices= is set, set DevicePolicy= to closed.

fstab-generator: merge /proc/cmdline parsing loops into one

core: introduce new RuntimeDirectory= and RuntimeDirectoryMode= unit settings As discussed on the ML these are useful to manage runtime directories below /run for services.

mount: don't fire PropertiesChanged signals for mounts that are stopped

mount: don't send out PropertiesChanged message if actually nothing got changed

mount: minor modernization

core: add global settings for enabling CPUAccounting=, MemoryAccounting=, BlockIOAccounting= for all units at once

api: in constructor function calls, always put the returned object pointer first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.

core: make sure to always go through both SIGTERM and SIGKILL states of units Given that we now have KillMode=mixed where SIGTERM might kill a smaller set than SIGKILL we need to make sure to always go explicitly throught the SIGKILL state to get the right end result.

core: add function to tell when job will time out Things will continue when either the job timeout or the unit timeout is reached. Add functionality to access that info.

mount: don't creat local-fs.target links for mount units when runnin in user mode

Use format patterns for usec_t, pid_t, nsec_t, usec_t It is nicer to predefine patterns using configure time check instead of using casts everywhere. Since we do not need to use any flags, include "%" in the format instead of excluding it like PRI* macros.

sd-daemon: introduce sd_watchdog_enabled() for parsing $WATCHDOG_USEC Also, introduce a new environment variable named $WATCHDOG_PID which cotnains the PID of the process that is supposed to send the keep-alive events. This is similar how $LISTEN_FDS and $LISTEN_PID work together, and protects against confusing processes further down the process tree due to inherited environment.

core: no need to list properties for PropertiesChanged messages anymore Since the vtable includes this information anyway, let's just use that

bus: add .busname unit type to implement kdbus-style bus activation

service: add the ability for units to join other unit's PrivateNetwork= and PrivateTmp= namespaces

core: set some event source priorities to enforce dispatching order

swap: split state machine state ACTIVATING into two We expect the event on /proc/swaps before we expect the SIGCHILD, reflect this in the state machine.

core: convert PID 1 to libsystemd-bus This patch converts PID 1 to libsystemd-bus and thus drops the dependency on libdbus. The only remaining code using libdbus is a test case that validates our bus marshalling against libdbus' marshalling, and this dependency can be turned off. This patch also adds a couple of things to libsystem-bus, that are necessary to make the port work: - Synthesizing of "Disconnected" messages when bus connections are severed. - Support for attaching multiple vtables for the same interface on the same path. This patch also fixes the SetDefaultTarget() and GetDefaultTarget() bus calls which used an inappropriate signature. As a side effect we will now generate PropertiesChanged messages which carry property contents, rather than just invalidation information.

Configurable Timeouts/Restarts default values https://bugs.freedesktop.org/show_bug.cgi?id=71132 Patch adds DefaultTimeoutStartSec, DefaultTimeoutStopSec, DefaultRestartSec configuration options to manager configuration file.

mount/service: drop FsckPassNo support We now treat passno as boleans in the generators, and don't need this any more. fsck itself is able to sequentialize checks on the same local media, so in the common case the ordering is redundant. It is still possible to force an order by using .d fragments, in case that is desired.

core: do not add "what" to RequiresMountsFor for network mounts For cifs mount like //server/share, we would get RequiresMountsFor=/server/share, which probably isn't harmful, but quite confusing. Unfortunately a bunch of static functions had to be moved up, but patch is really one line.

mount: check for NULL before reading pm->what Since a57f7e2c828b85, a mount unit with garbage in it would cause systemd to crash on loading it. ref: https://bugs.freedesktop.org/show_bug.cgi?id=70148

systemd: order remote mounts from mountinfo before remote-fs.target Usually the network is stopped before filesystems are umounted. Ordering network filesystems before remote-fs.target means that their unmounting will be performed earlier, and can terminate sucessfully. https://bugs.freedesktop.org/show_bug.cgi?id=70002

core: rework how we match mount units against each other Previously to automatically create dependencies between mount units we matched every mount unit agains all others resulting in O(n^2) complexity. On setups with large amounts of mount units this might make things slow. This change replaces the matching code to use a hashtable that is keyed by a path prefix, and points to a set of units that require that path to be around. When a new mount unit is installed it is hence sufficient to simply look up this set of units via its own file system paths to know which units to order after itself. This patch also changes all unit types to only create automatic mount dependencies via the RequiresMountsFor= logic, and this is exposed to the outside to make things more transparent. With this change we still have some O(n) complexities in place when handling mounts, but that's currently unavoidable due to kernel APIs, and still substantially better than O(n^2) as before. https://bugs.freedesktop.org/show_bug.cgi?id=69740

cgroup: if we do a cgroup operation then do something on all supported controllers Previously we did operations like attach, trim or migrate only on the controllers that were enabled for a specific unit. With this changes we will now do them for all supproted controllers, and fall back to all possible prefix paths if the specified paths do not exist. This fixes issues if a controller is being disabled for a unit where it was previously enabled, and makes sure that all processes stay as "far down" the tree as groups exist.

mount: filesystems mounted in the initrd should not conflict with umount.target in the real root These mounts should be kept around and unmounted in the shutdown ramfs. Currently, we will still attempt to umount these in the final kill spree, but we should consider avoiding that too. Also, the should_umount function should be generalised and put into util.c or something like that, but we are still discussing precisely how.

mount: move device links handling from generator This makes mount units work like swap units: when the backing device appears the mount unit will be started. v2: the device should want the mount unconditionally, not only for DefaultDependencies=yes

mount: also exclude /usr from unmount at shutdown

core/mount.c:mount_dump(): don't segfault, if mount is not mounted anymore Don't segfault, if m->from_proc_self_mountinfo and m->from_fragment is false. https://bugzilla.redhat.com/show_bug.cgi?id=957783#c9

core: add transient units Transient units can be created via the bus API. They are configured via the method call parameters rather than on-disk files. They are subject to normal GC. Transient units currently may only be created for services (however, we will extend this), and currently only ExecStart= and the cgroup parameters can be configured (also to be extended). Transient units require a unique name, that previously had no configuration file on disk. A tool systemd-run is added that makes use of this functionality to run arbitrary command lines as transient services: $ systemd-run /bin/ping www.heise.de Will cause systemd to create a new transient service and run ping in it.

dbus: hookup runtime property changes for mouns, services, sockets, swaps too

core: general cgroup rework Replace the very generic cgroup hookup with a much simpler one. With this change only the high-level cgroup settings remain, the ability to set arbitrary cgroup attributes is removed, so is support for adding units to arbitrary cgroup controllers or setting arbitrary paths for them (especially paths that are different for the various controllers). This also introduces a new -.slice root slice, that is the parent of system.slice and friends. This enables easy admin configuration of root-level cgrouo properties. This replaces DeviceDeny= by DevicePolicy=, and implicitly adds in /dev/null, /dev/zero and friends if DeviceAllow= is used (unless this is turned off by DevicePolicy=).

core: add new .slice unit type for partitioning systems In order to prepare for the kernel cgroup rework, let's introduce a new unit type to systemd, the "slice". Slices can be arranged in a tree and are useful to partition resources freely and hierarchally by the user. Each service unit can now be assigned to one of these slices, and later on login users and machines may too. Slices translate pretty directly to the cgroup hierarchy, and the various objects can be assigned to any of the slices in the tree.

mount: when learning about the root mount from mountinfo, don't add conflicting dep for umount.target That way systemd won't try to umount it at shutdown.

Add __attribute__((const, pure, format)) in various places I'm assuming that it's fine if a _const_ or _pure_ function calls assert. It is assumed that the assert won't trigger, and even if it does, it can only trigger on the first call with a given set of parameters, and we don't care if the compiler moves the order of calls.

Use initalization instead of explicit zeroing Before, we would initialize many fields twice: first by filling the structure with zeros, and then a second time with the real values. We can let the compiler do the job for us, avoiding one copy. A downside of this patch is that text gets slightly bigger. This is because all zero() calls are effectively inlined: $ size build/.libs/systemd text data bss dec hex filename before 897737 107300 2560 1007597 f5fed build/.libs/systemd after 897873 107300 2560 1007733 f6075 build/.libs/systemd … actually less than 1‰. A few asserts that the parameter is not null had to be removed. I don't think this changes much, because first, it is quite unlikely for the assert to fail, and second, an immediate SEGV is almost as good as an assert.

util: rename parse_usec() to parse_sec() sinds the default unit is seconds Internally we store all time values in usec_t, however parse_usec() actually was used mostly to parse values in seconds (unless explicit units were specified to define a different unit). Hence, be clear about this and name the function about what we pass into it, not what we get out of it.

Modernization Use _cleanup_ and wrap lines to ~80 chars and such.

unit: replace remote-fs-setup.target by network-online.target https://bugzilla.redhat.com/show_bug.cgi?id=787314

units: automatically order all mount units after network.target Previously it was necessary to pull in remote-fs-pre.target to order the mount units against network.target since the ordering was done transitively via remote-fs-pre.target. As network implementations shouldn't need to know about the specific use-case of network mounts we instead now simply order network.target against all mounts too. This should make it unnecessary for network managing services to import remote-fs-pre.target explicitly, as network.target will now suffice.

units: introduce remote-fs-setup.target to pull in dependencies from remote mounts This introduces remote-fs-setup.target independently of remote-fs-pre.target. The former is only for pulling things in, the latter only for ordering. The new semantics: remote-fs-setup.target: is pulled in automatically by all remote mounts. Shall be used to pull in other units that want to run when at least one remote mount is set up. Is not ordered against the actual mount units, in order to allow activation of its dependencies even 'a posteriori', i.e. when a mount is established outside of systemd and is only picked up by it. remote-fs-pre.target: needs to be pulled in automatically by the implementing service, is otherwise not part of the initial transaction. This is ordered before all remote mount units. A service that wants to be pulled in and run before all remote mounts should hence have: a) WantedBy=remote-fs-setup.target -- so that it is pulled in b) Wants=remote-fs-pre.target + Before=remote-fs-pre.target -- so that it is ordered before the mount point, normally.

core: reuse the same /tmp, /var/tmp and inaccessible dir All Execs within the service, will get mounted the same /tmp and /var/tmp directories, if service is configured with PrivateTmp=yes. Temporary directories are cleaned up by service itself in addition to systemd-tmpfiles. Directory which is mounted as inaccessible is created at runtime in /run/systemd.

core: keep mountinfo .mounts until late shutdown .mount units coming from /proc/self/mountinfo file are unmounted after local-fs.target is reached during shutdown. Problem: .mount units popping up in mountinfo file are added to systemd without any dependency. For that reason, they are the first one to be unmounted during shutdown. Whichever program mounted the file system deserves a chance to also unmount it. This patch ensures that /proc/self/mountinfo units will be unmounted after local-fs.target during shutdown (if they haven't been unmounted already)

core: single unit_kill implementation for all unit types There are very few differences in the implementations of the kill method in the unit types that have one. Let's unify them. This does not yet unify unit_kill() with unit_kill_context().

core: fix getting information about mount unit We should not try to get information about mount unit from fragment if the unit was created because of /proc/self/mountinfo event.

fstab,mount: detect rbind as bind mount Correctly detect rbind mount option as bind mount. Fixes https://bugzilla.novell.com/show_bug.cgi?id=804575.

core: do not overwrite existing units source Only set source for freshly created .mounts coming from mountinfo file.

core: unify kill code of mount, service, socket, swap units

core: Set source for mountinfo .mount units

unit: optionally allow making cgroup attribute changes persistent

core: log USER_UNIT instead of UNIT if in user session

tabs to spaces Skipped bootchart and various files that looked like they should be kept in sync with external sources.

systemd: use unit logging macros

core/mount: modernize style

core: add catalog entry and MESSAGE_ID for overmounting

timer: implement calendar time events

mount: make sure m->where is set before unit_add_exec_dependencies() If you enter unit_add_exec_dependencies with m->where = NULL, you'll very likely end up aborting somewhere under socket_needs_mount. (When systemd goes to check to see if the journald socket requires your mount, it'll do path_startswith(path, m->where)... *kaboom*) This patch should ensure that: a) both branches in mount_add_one() set m->where, and b) mount_add_extras() calls unit_add_exec_dependencies() *after* setting m->where.

mount: don't try to initialize extra deps for mount units before initializing their basic fields Under some circumstances this could lead to a segfault since we we half-initialized a mount unit, then tried to hook it into the network of things and while doing that recursively ended up looking at our half-initialized mount unit again assuming it was fully initialized.

mount: simplify device node conditions a bit

mount: only run fsck for actual device nodes

mount: reword directory empty warning a bit

core: move ManagerRunningAs to shared Note: I did s/MANAGER/SYSTEMD/ everywhere, even though it makes the patch quite verbose. Nevertheless, keeping MANAGER prefix in some places, and SYSTEMD prefix in others would just lead to confusion down the road. Better to rip off the band-aid now.

mount: notify the user if we over-mount a non-empty directory https://bugzilla.redhat.com/show_bug.cgi?id=858266

unit-printf: before resolving exec context specifiers check whether the object actually has an exec context

service: add options RestartPreventExitStatus and SuccessExitStatus In some cases, like wrong configuration, restarting after error does not help, so administrator can specify statuses by RestartPreventExitStatus which will not cause restart of a service. Sometimes you have non-standart exit status, so this can be specified by SuccessfulExitStatus.

units: apply default resource limits to socket/mount/swap processes too

core: drop KillMode parameter from KillUnit() bus call It made no sense, and since we are documenting the bus calls now and want to include them in our stability promise we really should get it cleaned up sooner, not later.

unit: split off KillContext from ExecContext containing only kill definitions

unit: set default working directory to the user's home directory when running in user mode

util: rename join() to strjoin() This is to match strappend() and the other string related functions.

mount: fix for complex automounts If accessing an automount point triggers more changes to /proc/self/mountinfo than just to add the directly wanted mount, these changes can lead to spurious -ENODEV notifications on the automount unit causing the request to fail when in fact the mount will be setup right afterwards.

unit: get rid of UnitVTable.suffix, which is now unused

mount: load only if we there's mountinfo or fragment Having information from /proc/self/mountinfo is sufficient to consider a mount unit loaded. When there's no mountinfo, the loading of the fragment for the mount unit is not optional. No extra dependency links must be added when the loading fails. https://bugzilla.redhat.com/show_bug.cgi?id=835848

mount: split adding of extras from mount_load()

units: rename fsck@.service to systemd-fsck@.service The rule is that units that encapsulate our own code are prefixed with "systemd-". Since the fsck units invoke our own code, hence add the missing prefix. Since a long long time the fsck units didn't invoke the naked fsck binaries anymore, and it is unlikely that this well ever change. On the opposite: the code in systemd-fsck will probably get more complex over time to handle fsck progress to plymouth forwarding. Same for quotacheck (but not quotaon!)

journal: set the _SYSTEMD_UNIT field for messages from terminated processes As described in https://bugs.freedesktop.org/show_bug.cgi?id=50184 the journal currently doesn't set fields such as _SYSTEMD_UNIT properly for messages coming from processes that have already terminated. This means among other things that "systemctl status" may not show some of the output of services that wrote messages just before they exited. This patch fixes this by having processes that log to the journal write their unit identifier to journald when the connection to /run/systemd/journal/stdout is opened. Journald stores the unit ID and uses it to fill in _SYSTEMD_UNIT when it cannot be obtained normally (i.e. from the cgroup). To prevent impersonating another unit, this information is only used when the caller is root. This doesn't fix the general problem of getting metadata about messages from terminated processes (which requires some kernel support), but it allows "systemctl status" and similar queries to do the Right Thing for units that log via stdout/stderr.

mkdir: append _label to all mkdir() calls that explicitly set the selinux context

mount: drop unused function

mount: replace PID1 internal fstab parser with generator Bit by bit we should remove non-unit parsing from PID 1 and move into generators, to clean up our code base a bit and clearly separate parsers.

mount: use the same fstab extension option syntax everywhere The man page and the actual code differed, and this is now corrected

cryptsetup: a few simplifications

unit: unit type dependent status messages Instead of generic "Starting..." and "Started" messages for all unit use type-dependent messages. For example, mounts will announce "Mounting..." and "Mounted". Add status messages to units of types that used to be entirely silent (automounts, sockets, targets, devices). For unit types whose jobs are instantaneous, report only the job completion, not the starting event. Socket units with non-instantaneous jobs are rare (Exec*= is not used often in socket units), so I chose not to print the starting messages for them either. This will hopefully give people better understanding of the boot.

util: split-out path-util.[ch]

service: explicitly remove control/ subcgroup after each control command The kernel will only notify us of cgroups running empty if no subcgroups exist anymore. Hence make sure we don't leave our own control/ subcgroup around longer than necessary. https://bugzilla.redhat.com/show_bug.cgi?id=818381

unit: add new dependency type RequiresMountsFor= RequiresMountsFor= is a shortcut for adding requires and after dependencies to all mount units neeed for the specified paths. This solves a couple of issues regarding dep loop cycles for encrypted swap.

service: introduce Type=idle and use it for gettys Type=idle is much like Type=simple, however between the fork() and the exec() in the child we wait until PID 1 informs us that no jobs are left. This is mostly a cosmetic fix to make gettys appear only after all boot output is finished and complete. Note that this does not impact the normal job logic as we do not delay the completion of any jobs. We just delay the invocation of the actual binary, and only for services that otherwise would be of Type=simple.

manager: drop MountAuto= and SwapAuto= options The ability to set MountAuto=no and SwapAuto=no was useful during the adoption phase of systemd, so that distributions could stick to their classic mount scripts a bit longer. It is about time to get rid of it now.

mount: don't fail if fstab doesn't exist

service: place control command in subcgroup control/ Previously, we were brutally and onconditionally killing all processes in a service's cgroup before starting the service anew, in order to ensure that StartPre lines cannot be misused to spawn long-running processes. On logind-less systems this has the effect that restarting sshd necessarily calls all active ssh sessions, which is usually not desirable. With this patch control processes for a service are placed in a sub-cgroup called "control/". When starting a service anew we simply kill this cgroup, but not the main cgroup, in order to avoid killing any long-running non-control processes from previous runs. https://bugzilla.redhat.com/show_bug.cgi?id=805942

relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.

move libsystemd_core.la sources into core/