tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

core: make the StartLimitXYZ= settings generic and apply to any kind of unit, not just services This moves the StartLimitBurst=, StartLimitInterval=, StartLimitAction=, RebootArgument= from the [Service] section into the [Unit] section of unit files, and thus support it in all unit types, not just in services. This way we can enforce the start limit much earlier, in particular before testing the unit conditions, so that repeated start-up failure due to failed conditions is also considered for the start limit logic. For compatibility the four options may also be configured in the [Service] section still, but we only document them in their new section [Unit]. This also renamed the socket unit failure code "service-failed-permanent" into "service-start-limit-hit" to express more clearly what it is about, after all it's only triggered through the start limit being hit. Finally, the code in busname_trigger_notify() and socket_trigger_notify() is altered to become more alike. Fixes: #2467

core: rework job_get_timeout() to use usec_t and handle USEC_INFINITY time events correctly

core: move service_unwatch_control_pid() call into service_enter_running() When we enter the running state we should forget about any control processes, in all cases, and not just when hit a reload timeout...

core: when a service's ExecStartPre= times out, skip ExecStop= This makes sure we never run two control processes at the same time, we cannot keep track off. This introduces a slight change of behaviour but cleans up the definition of ExecStop= and ExecStopPost=. The former is now invoked only if the service managed to start-up correctly. The latter is called even if start-up failed half-way. Thus, ExecStopPost= may be used as clean-up step for both successful and failed start-up attempts, but ExecStop='s purpose is clearly defined as being responsible for shutting down the service and nothing else. The precise behaviour of this was not documented yet. This commit adds the necessary docs. Fixes: #1254

core: no need to use unlink_noerrno()

core: rework unit timeout handling, and add new setting RuntimeMaxSec= This clean-ups timeout handling in PID 1. Specifically, instead of storing 0 in internal timeout variables as indication for a disabled timeout, use USEC_INFINITY which is in-line with how we do this in the rest of our code (following the logic that 0 means "no", and USEC_INFINITY means "never"). This also replace all usec_t additions with invocations to usec_add(), so that USEC_INFINITY is properly propagated, and sd-event considers it has indication for turning off the event source. This also alters the deserialization of the units to restart timeouts from the time they were originally started from. Before this patch timeouts would be restarted beginning with the time of the deserialization, which could lead to artificially prolonged timeouts if a daemon reload took place. Finally, a new RuntimeMaxSec= setting is introduced for service units, that specifies a maximum runtime after which a specific service is forcibly terminated. This is useful to put time limits on time-intensive processing jobs. This also simplifies the various xyz_spawn() calls of the various types in that explicit distruction of the timers is removed, as that is done anyway by the state change handlers, and a state change is always done when the xyz_spawn() calls fail. Fixes: #2249

core: don't reset /dev/console if stdin/stdout/stderr as passed as fd in a transient service Otherwise we might end resetting /dev/console all the time when a transient service starts or stops. Fixes #2377 Fixes #2198 Fixes #2061

core: fix bus name synchronization after daemon-reload During daemon-reload, PID1 temporarly loses its DBus connection, so there's a small window in which all signals sent by dbus-daemon are lost. This is a problem, since we rely on the NameOwnerChanged signals in order to consider a service with Type=dbus fully started or terminated, respectively. In order to fix this, a rewrite of bus_list_names() is necessary. We used to walk the current list of names on the bus, and blindly triggered the bus_name_owner_change() callback on each service, providing the actual name as current owner. This implementation has a number of problems: * We cannot detect if the the name was moved from one owner to the other while we were reloading * We don't notify services which missed the name loss signal * Providing the actual name as current owner is a hack, as the comment also admits. To fix this, this patch carries the following changes: * Track the name of the current bus name owner, and (de-)serialize it during reload. This way, we can detect changes. * In bus_list_names(), walk the list of bus names we're interested in first, and then see if the name is active on the bus. If it is, check it it's still the same as it used to be, and synthesize NameOwnerChanged signals for the name add and/or loss. This should fully synchronize the current name list with the internal state of all services.

journal-remote: split-mode=host, remove port from journal filename When constructing the journal filename to store logs from a remote host, remove the port of the tcp connection, as the port will change with every reboot/connection loss between sender/reveiver machines. Having the port in the filename will cause a new journal file to be created for every reboot or connection loss. For the implementation, a new argument "bool include_port" is added to the getpeername_pretty() function. This is passed to the sockaddr_pretty() function. The value of the include_port argument is set to true in all calls of getpeername_pretty(), except for 2 calls in journal-remote.c, where it is set to false.

tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy GLIB has recently started to officially support the gcc cleanup attribute in its public API, hence let's do the same for our APIs. With this patch we'll define an xyz_unrefp() call for each public xyz_unref() call, to make it easy to use inside a __attribute__((cleanup())) expression. Then, all code is ported over to make use of this. The new calls are also documented in the man pages, with examples how to use them (well, I only added docs where the _unref() call itself already had docs, and the examples, only cover sd_bus_unrefp() and sd_event_unrefp()). This also renames sd_lldp_free() to sd_lldp_unref(), since that's how we tend to call our destructors these days. Note that this defines no public macro that wraps gcc's attribute and makes it easier to use. While I think it's our duty in the library to make our stuff easy to use, I figure it's not our duty to make gcc's own features easy to use on its own. Most likely, client code which wants to make use of this should define its own: #define _cleanup_(function) __attribute__((cleanup(function))) Or similar, to make the gcc feature easier to use. Making this logic public has the benefit that we can remove three header files whose only purpose was to define these functions internally. See #2008.

core: drop "override" flag when building transactions Now that we don't have RequiresOverridable= and RequisiteOverridable= dependencies anymore, we can get rid of tracking the "override" boolean for jobs in the job engine, as it serves no purpose anymore. While we are at it, fix some error messages we print when invoking functions that take the override parameter.

core: fix typo

core: pull in dbus.socket from Type=dbus services Do so only on non-kdbus systems. And on non-kdbus systems don't bother with .busname units.

core: change default deps of services to require sysinit.target instead of basic.target With this change services by default will no longer require basic.target, but instead only after it it via After=basic.target. However, they will still Require= on sysinit.target. This has the benefit that when booting into emergency mode it is relatively safe to actviate individual services, as this will not pull the entirety of basic.target anymore, thus avoid everything listed in sockets.target and suchlike. However, during the usual boot no change should be noticed.

Remove snapshot unit type Snapshots were never useful or used for anything. Many systemd developers that I spoke to at systemd.conf2015, didn't even know they existed, so it is fairly safe to assume that this type can be deleted without harm. The fundamental problem with snapshots is that the state of the system is dynamic, devices come and go, users log in and out, timers fire... and restoring all units to some state from the past would "undo" those changes, which isn't really possible. Tested by creating a snapshot, running the new binary, and checking that the transition did not cause errors, and the snapshot is gone, and snapshots cannot be created anymore. New systemctl says: Unknown operation snapshot. Old systemctl says: Failed to create snapshot: Support for snapshots has been removed. IgnoreOnSnaphost settings are warned about and ignored: Support for option IgnoreOnSnapshot= has been removed and it is ignored http://lists.freedesktop.org/archives/systemd-devel/2015-November/034872.html

core: service: fix error message The directive is called FileDescriptorStoreMax=, not FDStoreMax=.

service: exiting early is nicer than deeply-indented code blocks

core: don't pass uninitialzed PIDs to pid_is_unwaited() Since 5fd9b2c5467b0a42ccdabc7eb8e516d512609a8e passing a pid of 0 to pid_is_unwaited() and pid_is_live() is considered as a request on the current process, similar how the other calls in process-util.c handle a PID of 0. This broke service.c, which passes a 0 PID and expects it to be considered an unwaited process. This fix make sure we can boot again.

process-util: rename get_parent_of_pid() → get_process_ppid() In order to match the other get_process_xyz() calls.

util-lib: split out allocation calls into alloc-util.[ch]

util-lib: move string table stuff into its own string-table.[ch]

util-lib: move a number of fs operations into fs-util.[ch]

util-lib: split string parsing related calls from util.[ch] into parse-util.[ch]

util-lib: split out fd-related operations into fd-util.[ch] There are more than enough to deserve their own .c file, hence move them over.

util-lib: split our string related calls from util.[ch] into its own file string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.

util: split out escaping code into escape.[ch] This really deserves its own file, given how much code this is now.

tree-wide: add more void casts for various syscall invocations

core: add support for setting stdin/stdout/stderr for transient services When starting a transient service, allow setting stdin/stdout/stderr fds for it, by passing them in via the bus. This also simplifies some of the serialization code for units.

service: fix memory leak in service_add_fd_store() fixes Coverity #1325767

core: add support for naming file descriptors passed using socket activation This adds support for naming file descriptors passed using socket activation. The names are passed in a new $LISTEN_FDNAMES= environment variable, that matches the existign $LISTEN_FDS= one and contains a colon-separated list of names. This also adds support for naming fds submitted to the per-service fd store using FDNAME= in the sd_notify() message. This also adds a new FileDescriptorName= setting for socket unit files to set the name for fds created by socket units. This also adds a new call sd_listen_fds_with_names(), that is similar to sd_listen_fds(), but also returns the names of the fds. systemd-activate gained the new --fdname= switch to specify a name for testing socket activation. This is based on #1247 by Maciej Wereski. Fixes #1247.

core: simplify fd collection code, return number of fds as return value Let's simplify the fd collection code a bit, and return the number of collected fds as positive integer, the way it's customary in our usual code.

core: don't unset reload result, unless we begin a start or reload operation Much like the result of the service itself we should not reset the reload result unless we actually start from the beginning, so that clients can query it at any time. Specifically, let's reset the result states only when we begin with a start operation (for both the main result, and the reload result), when we begin with a reload operation (only for the load result), or when the use explicitly asks for that via "systemctl reset-failed". This is a more generic fix for #1447. Fixes #1447.

Move all unit states to basic/ and extend systemctl --state=help

core: Add FFSDescriptors and FFSStrings service parameters By using these parameters functionfs service can specify ffs descriptors and strings which should be written to ep0.

core: kill processes started due to the ExecReload= on timeout

tree-wide: update empty-if coccinelle script to cover empty-while and more Let's also clean up single-line while and for blocks.

tree-wide: drop {} from one-line if blocks Patch via coccinelle.

tree-wide: use coccinelle to patch a lot of code to use mfree() This replaces this: free(p); p = NULL; by this: p = mfree(p); Change generated using coccinelle. Semantic patch is added to the sources.

core: unified cgroup hierarchy support This patch set adds full support the new unified cgroup hierarchy logic of modern kernels. A new kernel command line option "systemd.unified_cgroup_hierarchy=1" is added. If specified the unified hierarchy is mounted to /sys/fs/cgroup instead of a tmpfs. No further hierarchies are mounted. The kernel command line option defaults to off. We can turn it on by default as soon as the kernel's APIs regarding this are stabilized (but even then downstream distros might want to turn this off, as this will break any tools that access cgroupfs directly). It is possibly to choose for each boot individually whether the unified or the legacy hierarchy is used. nspawn will by default provide the legacy hierarchy to containers if the host is using it, and the unified otherwise. However it is possible to run containers with the unified hierarchy on a legacy host and vice versa, by setting the $UNIFIED_CGROUP_HIERARCHY environment variable for nspawn to 1 or 0, respectively. The unified hierarchy provides reliable cgroup empty notifications for the first time, via inotify. To make use of this we maintain one manager-wide inotify fd, and each cgroup to it. This patch also removes cg_delete() which is unused now. On kernel 4.2 only the "memory" controller is compatible with the unified hierarchy, hence that's the only controller systemd exposes when booted in unified heirarchy mode. This introduces a new enum for enumerating supported controllers, plus a related enum for the mask bits mapping to it. The core is changed to make use of this everywhere. This moves PID 1 into a new "init.scope" implicit scope unit in the root slice. This is necessary since on the unified hierarchy cgroups may either contain subgroups or processes but not both. PID 1 hence has to move out of the root cgroup (strictly speaking the root cgroup is the only one where processes and subgroups are still allowed, but in order to support containers nicey, we move PID 1 into the new scope in all cases.) This new unit is also used on legacy hierarchy setups. It's actually pretty useful on all systems, as it can then be used to filter journal messages coming from PID 1, and so on. The root slice ("-.slice") is now implicitly created and started (and does not require a unit file on disk anymore), since that's where "init.scope" is located and the slice needs to be started before the scope can. To check whether we are in unified or legacy hierarchy mode we use statfs() on /sys/fs/cgroup. If the .f_type field reports tmpfs we are in legacy mode, if it reports cgroupfs we are in unified mode. This patch set carefuly makes sure that cgls and cgtop continue to work as desired. When invoking nspawn as a service it will implicitly create two subcgroups in the cgroup it is using, one to move the nspawn process into, the other to move the actual container processes into. This is done because of the requirement that cgroups may either contain processes or other subgroups.

cgroup: drop "ignore_self" argument from cg_is_empty() In all cases where the function (or cg_is_empty_recursive()) ignoring the calling process is actually wrong, as a process keeps a cgroup busy regardless if its the current one or another. Hence, let's simplify things and drop the "ignore_self" parameter.

unit: suppress unnecessary cgroup empty check Rework the "service is good" check, to only check the cgroup state if we really need to instead of always. This allows us to suppress going to the cgroupfs for an empty check for the majority of services. No functional change.

unit: unify how we assing slices to units This adds a new call unit_set_slice(), and simplifies unit_add_default_slice(). THis should make our code a bit more robust and simpler.

core: add unit_dbus_interface_from_type() to unit-name.h Let's add a way to get the type-specific D-Bus interface of a unit from either its type or name to src/basic/unit-name.[ch]. That way we can share it with the client side, where it is useful in tools like cgls or machinectl. Also ports over machinectl to make use of this.

Revert "sd-bus: do not connect to dbus-1 socket when kdbus is available" This reverts commit d4d00020d6ad855d65d31020fefa5003e1bb477f. The idea of the commit is broken and needs to be reworked. We really cannot reduce the bus-addresses to a single address. We always will have systemd with native clients and legacy clients at the same time, so we also need both addresses at the same time.

sd-bus: do not connect to dbus-1 socket when kdbus is available We should not fall back to dbus-1 and connect to the proxy when kdbus returns an error that indicates that kdbus is running but just does not accept new connections because of quota limits or something similar. Using is_kdbus_available() in libsystemd/ requires it to move from shared/ to libsystemd/. Based on a patch from David Herrmann: https://github.com/systemd/systemd/pull/886

core: print a nicer warning when two units have the same BusName= setting This should make issues like #609 easier to debug.

core: remove generic job completion messages from unit vtables These units' message format strings are identical to the generic strings. Since we can always rely on the fallback, these are now redundant.

core: correct return value from reload methods Return 1 from *_reload() methods to signify "we did something", just like in *_start(). This causes "Reloading foo..." messages to be logged. "Reloaded foo." messages are already logged.

treewide: fix typos of let's

turn kdbus support into a runtime option ./configure --enable/disable-kdbus can be used to set the default behavior regarding kdbus. If no kdbus kernel support is available, dbus-dameon will be used. With --enable-kdbus, the kernel command line option "kdbus=0" can be used to disable kdbus. With --disable-kdbus, the kernel command line option "kdbus=1" is required to enable kdbus support.

core: Let two more booleans survive a daemon-reload Without the boolean bus_name_good services as well as cgroup_realized for units a unit of Type=dbus and ExecReload sending SIGHUP to $MAINPID will be terminated if systemd will be daemon reloaded. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746151 https://bugs.freedesktop.org/show_bug.cgi?id=78311 https://bugzilla.opensuse.org/show_bug.cgi?id=934077

util: split out signal-util.[ch] from util.[ch] No functional changes.

core: drop redundant logging about notification messages Before: May 12 17:11:22 tomegun-x2402 systemd[1]: systemd-udevd.service: Got notification message for unit. May 12 17:11:22 tomegun-x2402 systemd[1]: systemd-udevd.service: Got notification message from PID 195 (READY=1) May 12 17:11:22 tomegun-x2402 systemd[1]: systemd-udevd.service: Ggot READY=1 After: May 12 17:11:22 tomegun-x2402 systemd[1]: systemd-udevd.service: Got notification message from PID 195 (READY=1)

core: rename SystemdRunningAs to ManagerRunningAs It's primarily just a property of the Manager object after all, and we try to refer to PID 1 as "manager" instead of "systemd", hence let's to stick to this here too.

core,network: major per-object logging rework This changes log_unit_info() (and friends) to take a real Unit* object insted of just a unit name as parameter. The call will now prefix all logged messages with the unit name, thus allowing the unit name to be dropped from the various passed romat strings, simplifying invocations drastically, and unifying log output across messages. Also, UNIT= vs. USER_UNIT= is now derived from the Manager object attached to the Unit object, instead of getpid(). This has the benefit of correcting the field for --test runs. Also contains a couple of other logging improvements: - Drops a couple of strerror() invocations in favour of using %m. - Not only .mount units now warn if a symlinks exist for the mount point already, .automount units do that too, now. - A few invocations of log_struct() that didn't actually pass any additional structured data have been replaced by simpler invocations of log_unit_info() and friends. - For structured data a new LOG_UNIT_MESSAGE() macro has been added, that works like LOG_MESSAGE() but prefixes the message with the unit name. Similar, there's now LOG_LINK_MESSAGE() and LOG_NETDEV_MESSAGE(). - For structured data new LOG_UNIT_ID(), LOG_LINK_INTERFACE(), LOG_NETDEV_INTERFACE() macros have been added that generate the necessary per object fields. The old log_unit_struct() call has been removed in favour of these new macros used in raw log_struct() invocations. In addition to removing one more function call this allows generated structured log messages that contain two object fields, as necessary for example for network interfaces that are joined into another network interface, and whose messages shall be indexed by both. - The LOG_ERRNO() macro has been removed, in favour of log_struct_errno(). The latter has the benefit of ensuring that %m in format strings is properly resolved to the specified error number. - A number of logging messages have been converted to use log_unit_info() instead of log_info() - The client code in sysv-generator no longer #includes core code from src/core/. - log_unit_full_errno() has been removed, log_unit_full() instead takes an errno now, too. - log_unit_info(), log_link_info(), log_netdev_info() and friends, now avoid double evaluation of their parameters

core: always initialize ExecParamters.bus_endpoint_fd to -1 Otherwise it might be passed in as 0, which is a valid fd, but usually does not refer to a real endpoint.

core: annotate event sources

service: make restart logic a bit easier to understand

exit-status: introduce common exit_status_set_test() call for testing exit status set membership

Revert "core: do not spawn jobs or touch other units during coldplugging" This reverts commit 6e392c9c45643d106673c6643ac8bf4e65da13c1. We really shouldn't invent external state keeping hashmaps, if we can keep this state in the units themselves.

service: improve readability, by reducing line-breaks

service: transition through SIGKILL states only when SIGKILL is enabled If there's no remaining process to kill, skip the SIGKILL states if SIGKILL is disabled. Effectively this doesn't change much since if there's nothing to kill with SIGTERM or SIGABRT then there's also nothing to kill with SIGKILL. However, this avoids confusion with the state engine jumping through SIGKILL states for no reason...

service: timeout on SIGABRT should also be considered an error to remember

service: make more use of IN_SET() macro

service: list states always in the same order

service: make kill operation mapping explicit

shared: add process-util.[ch]

shared: add formats-util.h

service: don't add After= dependencies on .busname units if kdbus support is disabled

add REMOTE_ADDR and REMOTE_PORT for Accept=yes

core: do not spawn jobs or touch other units during coldplugging Because the order of coldplugging is not defined, we can reference a not-yet-coldplugged unit and read its state while it has not yet been set to a meaningful value. This way, already active units may get started again. We fix this by deferring such actions until all units have been at least somehow coldplugged. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=88401

core: expose consumed CPU time per unit This adds support for showing the accumulated consumed CPU time per-unit in the "systemctl status" output. The property is also readable via the bus.

remove unused includes This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.

util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.

core: output unit status output strings to console, only if we actually are changing unit state Unit _start() and _stop() implementations can fail with -EAGAIN to delay execution temporarily. Thus, we should not output status messages before invoking these calls, but after, and only when we know that the invocation actually made a change.

service: automatically create After= dependency from services to their .busname units, if BusName= is set

core: implement serialization/deserialization of fd store elements

core: add new logic for services to store file descriptors in PID 1 With this change it is possible to send file descriptors to PID 1, via sd_pid_notify_with_fds() which PID 1 will store individually for each service, and pass via the usual fd passing logic on next invocation. This is useful for enable daemon reload schemes where daemons serialize their state to /run, push their fds into PID 1 and terminate, restoring their state on next start from the data in /run and passed in from PID 1. The fds are kept by PID 1 as long as no POLLHUP or POLLERR is seen on them, and the service they belong to are either not dead or failed, or have a job queued.

core: rename unit_destroy_cgroup() to unit_destroy_cgroup_if_empty() since it's not quite as destructive as it sounds nowadays

core: warn and ignore SysVStartPriority= Option was being parsed but not used for anything.

core: convert log_unit_*() to log_unit_*_errno() Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_unit_(debug|info|notice|warning|error|emergency)\(([^"]+), "(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_unit_\1_errno(\2, \5, "\3%m"\4);/'

log: fix order of log_unit_struct() to match other logging calls Also, while we are at it, introduce some syntactic sugar for creating ERRNO= and MESSAGE= structured logging fields.

log: rearrange log function naming - Rename log_meta() → log_internal(), to follow naming scheme of most other log functions that are usually invoked through macros, but never directly. - Rename log_info_object() to log_object_info(), simply because the object should be before any other parameters, to follow OO-style programming style.

core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine.

service: add missing state table entry

core: send sigabrt on watchdog timeout to get the stacktrace if sigabrt doesn't do the job, follow regular shutdown routine, sigterm > sigkill.

sd-bus: rename sd_bus_get_owner_uid(), sd_bus_get_owner_machine_id() and sd_bus_get_peer_creds() Clean up the function namespace by renaming the following: sd_bus_get_owner_uid() → sd_bus_get_name_creds_uid() sd_bus_get_owner_machine_id() → sd_bus_get_name_machine_id() sd_bus_get_peer_creds() → sd_bus_get_owner_creds()

Set $NOTIFY_SOCKET for control procs if NotifyAccess=all

service: enter SERVICE_STOP_SIGTERM state after getting "STOPPING=1" SERVICE_STOP would mean we're running the ExecStop command. That's not the case with "STOPPING=1". Instead we should enter the same state as if we just told the service to stop, i.e. SERVICE_STOP_SIGTERM. This fixes a bug where voluntarily exiting services would hang around in deactivating state until timeout.

socket: introduce SELinuxContextFromNet option This makes possible to spawn service instances triggered by socket with MLS/MCS SELinux labels which are created based on information provided by connected peer. Implementation of label_get_child_mls_label derived from xinetd. Reviewed-by: Paul Moore <pmoore@redhat.com>

service: hook up custom endpoint logic If BusPolicy= was passed, the parser function will have created an ExecContext->bus_endpoint object, along with policy information. In that case, create a kdbus endpoint, and pass its path name to the namespace logic, to it will be mounted over the actual 'bus' node. At endpoint creation time, no policy is updloaded. That is done after fork(), through a separate call. This is necessary because we don't know the real uid of the process earlier than that.

exec: factor out most function arguments of exec_spawn() to ExecParameters This way, the list of arguments to that function gets more comprehensive, and we can get around passing lots of NULL and 0 arguments from socket.c, swap.c and mount.c. It also allows for splitting up the code in exec_spawn(). While at it, make ExecContext const in execute.c.

core: add support for a configurable system-wide start-up timeout When this system-wide start-up timeout is hit we execute one of the failure actions already implemented for services that fail. This should not only be useful on embedded devices, but also on laptops which have the power-button reachable when the lid is closed. This devices, when in a backpack might get powered on by accident due to the easily reachable power button. We want to make sure that the system turns itself off if it starts up due this after a while. When the system manages to fully start-up logind will suspend the machine by default if the lid is closed. However, in some cases we don't even get as far as logind, and the boot hangs much earlier, for example because we ask for a LUKS password that nobody ever enters. Yeah, this is a real-life problem on my Yoga 13, which has one of those easily accessible power buttons, even if the device is closed.

service: allow services of Type=oneshot that specify no ExecStart= commands This is useful for services that simply want to run something on shutdown, but not at bootup. They should only set ExecStop= but leave ExecStart= unset.

service: use the right timeout for stop processes we fork

core: allow informing systemd about service status changes with RELOADING=1 and STOPPING=1 sd_notify() messages

service,strv: introduce strv_find_startswith() and make use of it Unlike strv_find_prefix() the new call will return a pointer to the suffix of the item we found, instead of the whole item. This is more closer inline with what startswith() does, and allows us to simplify a couple of invocations.

service: don't invoke functions at the same time as declaring variables

service: remove some pointless linebreaks, to make things more readable

service: asynchronous_close() already checks for negative parameters, no need to duplicate that

core: unify how we generate the prefix string when dumping unit state

core: show timeouts when watchdog howls

service: flush status text and errno values each time a service is started We shouldn't show status texts from previous service starts

service: don't accept negative ERRNO= notification messages

service: minor modernization

core: Added support for ERRNO NOTIFY_SOCKET message parsing, and added StatusErrno dbus property along StatusText to allow notification of numeric status condition while degraded service operation or any other special situation.

core: introduce exit_status_set_is_empty() to make things a bit easier to read

exit-status: rename ExitStatusSet's "code" field to "status" We should follow the naming scheme waitid() uses, not come up with our own reversed one...

core: introduce new RestartForceExitStatus= service setting This does the inverse of RestartPreventExitStatus=: it forces a restart of a service when a certain exit status is returned by a service process.

Remove sysv parser from service.c Parsing sysv files was moved to the sysv-generator in the previous commit. This patch removes the sysv parsing from serivce.c. Note that this patch drops the following now unused sysv-specific info from service dump: "SysV Init Script has LSB Header: (yes/no)" "SysVEnabled: (yes/no)" "SysVRunLevels: (levels)"

core: introduce new Restart=on-abnormal setting Restart=on-abnormal is similar to Restart=on-failure, but avoids restarts on unclean exit codes (but still doing restarts on all obviously unclean exits, such as timeouts, signals, coredumps, watchdog timeouts). Also see: https://fedorahosted.org/fpc/ticket/191

core: close socket fds asynchronously http://lists.freedesktop.org/archives/systemd-devel/2014-April/018928.html

core: sysvcompat - avoid repeated function call

core: sysvcompat - $network should be equivalent to network-online, rather than network target Most likely the facility needed is actual connectivity, rather than whether or not the network managment daemon is running. We also need to explicitly pull in the network-online.target, as it is not active by default. This means {systemd-networkd,NetworkManager}-wait-online.service, can be enabled by default as part of network-online.target, and only delay boot when some service actively pulls it in. See: <https://bugzilla.gnome.org/show_bug.cgi?id=728965> Cc: Pavel Šimerda <psimerda@redhat.com> Cc: Michal Sekletar <msekleta@redhat.com>

service: rename StartLimitAction enum to FailureAction It's used for the FailureAction property as well.

service: add FailureAction= option It has the same possible values as StartLimitAction= and is executed immediately if a service fails.

service: add support for reboot argument when triggered by StartLimitAction= When rebooting with systemctl, an optional argument can be passed to the reboot system call. This makes it possible the specify the argument in a service file and use it when the service triggers a restart. This is useful to distinguish between manual reboots and reboots caused by failing services.

service: don't take chkconfig priority into account Given that native services do not carry a sysv priority anyway it is pointless reading them from chkconfig headers, and pretend they'd work. So let's drop this.

sd-event: rework API to support CLOCK_REALTIME_ALARM and CLOCK_BOOTTIME_ALARM, too

core: rework context initialization/destruction logic Let's automatically initialize the kill, exec and cgroup contexts of the various unit types when the object is constructed, instead of invididually in type-specific code. Also, when PrivateDevices= is set, set DevicePolicy= to closed.

util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.

core, libsystemd, systemd, timedate, udev: spelling fixes

Use strlen even for constant strings GCC optimizes strlen("string constant") to a constant, even with -O0. Thus, replace patterns like sizeof("string constant")-1 with strlen("string constant") where possible, for clarity. In particular, for expressions intended to add up the lengths of components going into a string, this often makes it clearer that the expression counts the trailing '\0' exactly once, by putting the +1 for the '\0' at the end of the expression, rather than hidden in a sizeof in the middle of the expression.

core: introduce new RuntimeDirectory= and RuntimeDirectoryMode= unit settings As discussed on the ML these are useful to manage runtime directories below /run for services.

Remove dead lines in various places As pointed-out by clang -Wunreachable-code. No behaviour changes.

core: add global settings for enabling CPUAccounting=, MemoryAccounting=, BlockIOAccounting= for all units at once

manager: be more precise in message about restart

api: in constructor function calls, always put the returned object pointer first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.

util: generalize code that checks whether PIDs are alive or unwaited for

core: check for return value from get_process_state Fix for commit e10c9985bb.

core: fix detection of dead processes Commit 5ba6985b moves the UNIT_VTABLE(u)->sigchld_event before systemd actually reaps the zombie. Which leads to service_load_pid_file accepting zombie as a valid pid. This fixes timeouts like: [ 2746.602243] systemd[1]: chronyd.service stop-sigterm timed out. Killing. [ 2836.852545] systemd[1]: chronyd.service still around after SIGKILL. Ignoring. [ 2927.102187] systemd[1]: chronyd.service stop-final-sigterm timed out. Killing. [ 3017.352560] systemd[1]: chronyd.service still around after final SIGKILL. Entering failed mode.

service: when we complain about a notify message we cannot map to main pid because we don't know anything about the main pid, do so at debug level

service: if we don't know the main pid of a service, we cannot accept any notification messages

core: watch SIGCHLD more closely to track processes of units with no reliable cgroup empty notifier When a process dies that we can associate with a specific unit, start watching all other processes of that unit, so that we can associate those processes with the unit too. Also, for service units start doing this as soon as we get the first SIGCHLD for either control or main process, so that we can follow the processes of the service from one to the other, as long as process that remain are processes of the ones we watched that died and got reassigned to us as parent. Similar, for scope units start doing this as soon as the scope controller abandons the unit, and thus management entirely reverts to systemd. To abandon a unit introduce a new Abandon() scope unit method call.

core: make sure to always go through both SIGTERM and SIGKILL states of units Given that we now have KillMode=mixed where SIGTERM might kill a smaller set than SIGKILL we need to make sure to always go explicitly throught the SIGKILL state to get the right end result.

service: allow KillMode=mixed in conjunction with PAMName=

core: add function to tell when job will time out Things will continue when either the job timeout or the unit timeout is reached. Add functionality to access that info.

core: do not add implicit dbus.socket dependency Sockets are ordered before sockets.target anyway, and sockets.target is ordered before basic.target, and hence all bus services end up being ordered after dbus.socket anyway. Since for kdbus clients dbus.socket is obsolete, let's not add this dependency explicitly. Also, it's hot in Australia and we are going for breakfast now.

core: --user -- add basic.target an sort against it like --system does

Use format patterns for usec_t, pid_t, nsec_t, usec_t It is nicer to predefine patterns using configure time check instead of using casts everywhere. Since we do not need to use any flags, include "%" in the format instead of excluding it like PRI* macros.

core/service: check if mainpid matches only if it is set https://bugzilla.redhat.com/show_bug.cgi?id=1047304

core/service: tweak messages on operation timeouts

unit: include peer identity in description of per-connection socket-activated services

sd-daemon: introduce sd_watchdog_enabled() for parsing $WATCHDOG_USEC Also, introduce a new environment variable named $WATCHDOG_PID which cotnains the PID of the process that is supposed to send the keep-alive events. This is similar how $LISTEN_FDS and $LISTEN_PID work together, and protects against confusing processes further down the process tree due to inherited environment.

core: no need to list properties for PropertiesChanged messages anymore Since the vtable includes this information anyway, let's just use that

service: don't send out PropertiesChanged message for each watchdog notification

service: watch main pid even in final states In some circumstances, for example when start-up times out we immediately jump into the final state, at which point we still should try to watch the main pid so that the SIGCHLD allows us to quickly move into dead state.

systemctl: properly initialize and free sd_bus_error in "systemctl cat" We need to properly initialize all error structs before use and free them after use. Also, there's no point in flushing stdout if we output a \n anyway...

service: process watchdog timeouts with lowest priority

service: actually leave watchdog enabled in the states where it matters

service: clean up watchdog logic a bit

Get rid of our reimplementation of basename The only problem is that libgen.h #defines basename to point to it's own broken implementation instead of the GNU one. This can be fixed by #undefining basename.

service: remove unneccesary Socket.got_socket_fd

bus: include unique and well known names in credentials object

bus: merge sd_bus_get_owner() and sd_bus_get_owner_creds() into one call Since the backing ioctl for this on kdbus is the same we retain atomicity this way.

bus: add new sd_bus_creds object to encapsulate process credentials This way we can unify handling of credentials that are attached to messages, or can be queried for bus name owners or connection peers. This also adds the ability to extend incomplete credential information with data from /proc, Also, provide a convenience call that will automatically determine the most appropriate credential object for an incoming message, by using the the attached information if possible, the sending name information if available and otherwise the peer's credentials.

service: add the ability for units to join other unit's PrivateNetwork= and PrivateTmp= namespaces

tree-wide usage of %m specifier instead of strerror(errno) Also for log_error() except where a specific error is specified e.g. errno ? strerror(errno) : "Some user specified message"

service: fix handling of PID file inotify events

service: honour that for services RestartSec=0 means immediate restarts but TimeoutSec= means no timing out at all

core: convert PID 1 to libsystemd-bus This patch converts PID 1 to libsystemd-bus and thus drops the dependency on libdbus. The only remaining code using libdbus is a test case that validates our bus marshalling against libdbus' marshalling, and this dependency can be turned off. This patch also adds a couple of things to libsystem-bus, that are necessary to make the port work: - Synthesizing of "Disconnected" messages when bus connections are severed. - Support for attaching multiple vtables for the same interface on the same path. This patch also fixes the SetDefaultTarget() and GetDefaultTarget() bus calls which used an inappropriate signature. As a side effect we will now generate PropertiesChanged messages which carry property contents, rather than just invalidation information.

Fix RemainAfterExit services keeping a hold on console When a service exits succesfully and has RemainAfterExit set, its hold on the console (in m->n_on_console) wasn't released since the unit state didn't change.

manager: configurable StartLimit default values https://bugzilla.redhat.com/show_bug.cgi?id=821723

Configurable Timeouts/Restarts default values https://bugs.freedesktop.org/show_bug.cgi?id=71132 Patch adds DefaultTimeoutStartSec, DefaultTimeoutStopSec, DefaultRestartSec configuration options to manager configuration file.

mount/service: drop FsckPassNo support We now treat passno as boleans in the generators, and don't need this any more. fsck itself is able to sequentialize checks on the same local media, so in the common case the ordering is redundant. It is still possible to force an order by using .d fragments, in case that is desired.

core: unify the way we denote serialization attributes

systemd: serialize/deserialize forbid_restart value The Service type's forbid_restart field was not preserved by serialization/deserialization, so the fact that the service should not be restarted after stopping was lost. If a systemctl stop foo command has been given, but the foo service has not yet stopped, and then the systemctl --system daemon-reload was given, then when the foo service eventually stopped, systemd would restart it. https://bugs.freedesktop.org/show_bug.cgi?id=69800

core: whenever a new PID is passed to us, make sure we watch it

cgroup: if we do a cgroup operation then do something on all supported controllers Previously we did operations like attach, trim or migrate only on the controllers that were enabled for a specific unit. With this changes we will now do them for all supproted controllers, and fall back to all possible prefix paths if the specified paths do not exist. This fixes issues if a controller is being disabled for a unit where it was previously enabled, and makes sure that all processes stay as "far down" the tree as groups exist.

specifier: rework specifier calls to return proper error message Previously the specifier calls could only indicate OOM by returning NULL. With this change they will return negative errno-style error codes like everything else.

core: notify triggered by socket of a service

service: Implement 'on-watchdog' restart option Services using the watchdog option might want to be restarted only if the watchdog triggers.

service: remove pidfile after exit of a service

service: prohibit Restart= set when Type=oneshot

service: always unwatch PIDs before forgetting old ones

service: don't enter a second SIGTERM/SIGKILL cycle if no ExecStopPost= process is defined It won't help if the main process is still there and there is no new process to kill.

core: add new "scope" unit type for making a unit of pre-existing processes "Scope" units are very much like service units, however with the difference that they are created from pre-existing processes, rather than processes that systemd itself forks off. This means they are generated programmatically via the bus API as transient units rather than from static configuration read from disk. Also, they do not provide execution-time parameters, as at the time systemd adds the processes to the scope unit they already exist and the parameters cannot be applied anymore. The primary benefit of this new unit type is to create arbitrary cgroups for worker-processes forked off an existing service. This commit also adds a a new mode to "systemd-run" to run the specified processes in a scope rather then a transient service.

core: add transient units Transient units can be created via the bus API. They are configured via the method call parameters rather than on-disk files. They are subject to normal GC. Transient units currently may only be created for services (however, we will extend this), and currently only ExecStart= and the cgroup parameters can be configured (also to be extended). Transient units require a unique name, that previously had no configuration file on disk. A tool systemd-run is added that makes use of this functionality to run arbitrary command lines as transient services: $ systemd-run /bin/ping www.heise.de Will cause systemd to create a new transient service and run ping in it.

dbus: hookup runtime property changes for mouns, services, sockets, swaps too

core: general cgroup rework Replace the very generic cgroup hookup with a much simpler one. With this change only the high-level cgroup settings remain, the ability to set arbitrary cgroup attributes is removed, so is support for adding units to arbitrary cgroup controllers or setting arbitrary paths for them (especially paths that are different for the various controllers). This also introduces a new -.slice root slice, that is the parent of system.slice and friends. This enables easy admin configuration of root-level cgrouo properties. This replaces DeviceDeny= by DevicePolicy=, and implicitly adds in /dev/null, /dev/zero and friends if DeviceAllow= is used (unless this is turned off by DevicePolicy=).

logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.

core: add new .slice unit type for partitioning systems In order to prepare for the kernel cgroup rework, let's introduce a new unit type to systemd, the "slice". Slices can be arranged in a tree and are useful to partition resources freely and hierarchally by the user. Each service unit can now be assigned to one of these slices, and later on login users and machines may too. Slices translate pretty directly to the cgroup hierarchy, and the various objects can be assigned to any of the slices in the tree.

service: don't report alien child as alive when it's not When a sigchld is received from an alien child, main_pid is set to 0 then service_enter_running calls main_pid_good to check if the child is running. This incorrectly returned true because kill(main_pid, 0) would return >= 0. This fixes an error where a service would die and the cgroup would become empty but the service would still report as active (running).

service: execute ExecStopPost= commands when the watchdog timeout hits We can assume that a service for which a watchdog timeout was triggered is unresponsive to a clean shutdown. However, it still makes sense to execute the post-stop cleanup commands that can be configured with ExecStopPost=. Hence, when the timeout is hit enter STOP_SIGKILL rather than FINAL_SIGKILL.

service: kill processes with SIGKILL on watchdog failure Just calling service_enter_dead() does not kill any processes. As a result, the old process may still be running when the new one is started. After a watchdog failure the service is in an undefined state. Using the normal shutdown mechanism makes no sense. Instead all processes are just killed and the service can try to restart.

Add __attribute__((const, pure, format)) in various places I'm assuming that it's fine if a _const_ or _pure_ function calls assert. It is assumed that the assert won't trigger, and even if it does, it can only trigger on the first call with a given set of parameters, and we don't care if the compiler moves the order of calls.

man: clarify what Restart= means Related to https://bugzilla.redhat.com/show_bug.cgi?id=957135.

move _cleanup_ attribute in front of the type http://lists.freedesktop.org/archives/systemd-devel/2013-April/010510.html

Move bus_error to dbus-common and remove bus_error_message_or_strerror bus_error and bus_error_message_or_strerror dit almost exactly the same, so use only one of them and place it in dbus-common.

Use initalization instead of explicit zeroing Before, we would initialize many fields twice: first by filling the structure with zeros, and then a second time with the real values. We can let the compiler do the job for us, avoiding one copy. A downside of this patch is that text gets slightly bigger. This is because all zero() calls are effectively inlined: $ size build/.libs/systemd text data bss dec hex filename before 897737 107300 2560 1007597 f5fed build/.libs/systemd after 897873 107300 2560 1007733 f6075 build/.libs/systemd … actually less than 1‰. A few asserts that the parameter is not null had to be removed. I don't think this changes much, because first, it is quite unlikely for the assert to fail, and second, an immediate SEGV is almost as good as an assert.

units: introduce new timers.target and paths.target to hook timer/path units into for boot

core: ensure LSB Provides are handled correctly Let's say you have two initscripts, A and B: A contains in its LSB header: Required-Start: C and B contains in its LSB header: Provides: C When systemd is parsing /etc/rc.d/, depending on the file order, you can end up with either: - B is parsed first. An unit "C.service" will be "created" and will be added as additional name to B.service, with unit_add_name. No bug. - A is parsed first. An unit "C.service" is created for the "Required-Start" dependency (it will have no file attached, since nothing provides this dependency yet). Then B is parsed and when trying to handle "Provides: C", unit_add_name is called but will fail, because "C.service" already exists in manager->units. Therefore, a merge should occur for that case.

service: no need to drop rc. prefix anymore This reverts commit f5c88ec1330b61787441156de7d764a140774bd2. It is no longer necessary, and adds unnecessary magic.

core: reuse the same /tmp, /var/tmp and inaccessible dir All Execs within the service, will get mounted the same /tmp and /var/tmp directories, if service is configured with PrivateTmp=yes. Temporary directories are cleaned up by service itself in addition to systemd-tmpfiles. Directory which is mounted as inaccessible is created at runtime in /run/systemd.

core: single unit_kill implementation for all unit types There are very few differences in the implementations of the kill method in the unit types that have one. Let's unify them. This does not yet unify unit_kill() with unit_kill_context().

service: sysv - properly handle init scripts with .sh suffix Dropping the distribution specific #ifdefs in 88516c0c952b9502e8ef1d6a1481af61b0fb422d broke the .sh suffix stripping since we now always used the else clause of the rc. check. We eventually want to drop the rc. prefix stripping, but for now we assume that no sysv init script uses both an rc. prefix and .sh suffix, so make the check for the .sh suffix and rc. prefix mutually exclusive.

core/path: install inotify watches top-down instead of bottom-up When watches are installed from the bottom, it is always possible to race, and miss a file creation event. The race can be avoided if a watch is first established for a parent directory, and then for the file in the directory. If the file is created in the time between, the watch on the parent directory will fire. Some messages (mostly at debug level) are added to help diagnose pidfile issues. Should fix https://bugzilla.redhat.com/show_bug.cgi?id=917075.

core/service: use cleanup functions, wrap lines

honor SELinux labels, when creating and writing config files Also split out some fileio functions to fileio.c and provide a SELinux aware pendant in fileio-label.c see https://bugzilla.redhat.com/show_bug.cgi?id=881577

env: considerably beef up environment cleaning logic Now, actually check if the environment variable names and values used are valid, before accepting them. With this in place are at some places more rigid than POSIX, and less rigid at others. For example, this code allows lower-case environment variables (which POSIX suggests not to use), but it will not allow non-UTF8 variable values. All in all this should be a good middle ground of what to allow and what not to allow as environment variables. (This also splits out all environment related calls into env-util.[ch])

core: unify kill code of mount, service, socket, swap units

service: make sure the watchdog timer is not restarted while stopping A watchdog notification may be handled after the watchdog timer was stopped while stopping the service. As a result the timer is restarted and the service may be restarted as well. The watchdog timestamp is initially set during startup in service_enter_start_post() and cleared when the timer is stopped. Therefore it can be used as an indication if the timer should be reset.

service: really stop watchdog timer when stopping For services without ExecStop= the state SERVICE_STOP is never entered. as a result the watchdog timer is not stopped and the service is restarted (if it is configuered to restart). Stopping the watchdog timer for SERVICE_STOP_SIGTERM as well fixes this.

unit: optionally allow making cgroup attribute changes persistent

core: log USER_UNIT instead of UNIT if in user session

service: properly signal permanent failure of a service to its socket This makes sure that a service is not indefinitely restarted in a tight loop if it fails before it is able to process its socket. This corrects the breakage introduced with 8d1b002a2e389e79a2414491523de549783abf73. Shame on me.

service: ignore dependencies on $syslog and $local_fs in LSB scripts We no longer allow early-boot init scripts, however in late boot the syslog socket and local mounts are established anyway, so let's simplify our dep graph a bit. If $syslog doesn't resolve to syslog.target anymore there's no reason to keep syslog.target around anymore. Let's remove it. Note that many 3rd party service unit files order themselves after syslog.target. These will be dangling dependencies now, which should be unproblematic, however.

service: sysv - remove distribution specific targets Systemd should not introduce any new facilities. Distributions which still need to support their non-standard/legacy facilities should add them as patches to their packaging. The following facilities are no longer recognized: $x-display-manager $mail-transfer-agent $mail-transport-agent $mail-transfer-agent $smtp $null This target is no longer available: mail-transfer-agent.target

service: for Type=forking services, ignore exit status of main process depending on ExecStart's ignore setting https://bugzilla.redhat.com/show_bug.cgi?id=860464

service: remove distribution specific comments, the code runs unconditional now

service: remove distribution specific comments, the code run unconditional now

systemd: use unit logging macros