tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

core: rework job_get_timeout() to use usec_t and handle USEC_INFINITY time events correctly

core: rework unit timeout handling, and add new setting RuntimeMaxSec= This clean-ups timeout handling in PID 1. Specifically, instead of storing 0 in internal timeout variables as indication for a disabled timeout, use USEC_INFINITY which is in-line with how we do this in the rest of our code (following the logic that 0 means "no", and USEC_INFINITY means "never"). This also replace all usec_t additions with invocations to usec_add(), so that USEC_INFINITY is properly propagated, and sd-event considers it has indication for turning off the event source. This also alters the deserialization of the units to restart timeouts from the time they were originally started from. Before this patch timeouts would be restarted beginning with the time of the deserialization, which could lead to artificially prolonged timeouts if a daemon reload took place. Finally, a new RuntimeMaxSec= setting is introduced for service units, that specifies a maximum runtime after which a specific service is forcibly terminated. This is useful to put time limits on time-intensive processing jobs. This also simplifies the various xyz_spawn() calls of the various types in that explicit distruction of the timers is removed, as that is done anyway by the state change handlers, and a state change is always done when the xyz_spawn() calls fail. Fixes: #2249

core: Do not bind a mount unit to a device, if it was from mountinfo If a mount unit is bound to a device, systemd tries to umount the mount point, if it thinks the device has gone away. Due to the uevent queue and inotify of /proc/self/mountinfo being two different sources, systemd can never get the ordering reliably correct. It can happen, that in the uevent queue ADD,REMOVE,ADD is queued and an inotify of mountinfo (or libmount event) happend with the device in question. systemd cannot know, at which point of time the mount happend in the ADD,REMOVE,ADD sequence. The real ordering might have been ADD,REMOVE,ADD,mount and systemd might think ADD,mount,REMOVE,ADD and would umount the mountpoint. A test script which triggered this behaviour is: rm -f test-efi-disk.img dd if=/dev/null of=test-efi-disk.img bs=1M seek=512 count=1 parted --script test-efi-disk.img \ "mklabel gpt" \ "mkpart ESP fat32 1MiB 511MiB" \ "set 1 boot on" LOOP=$(losetup --show -f -P test-efi-disk.img) udevadm settle mkfs.vfat -F32 ${LOOP}p1 mkdir -p mnt mount ${LOOP}p1 mnt ... <dostuffwith mnt> Without the "udevadm settle" systemd unmounted mnt while the script was operating on mnt. Of course the question is, why there was a REMOVE in the first place, but this is not part of this patch.

make sure all swap units are ordered before the swap target When shutting down the system, the swap devices can be disabled long time before the swap target is stopped. They're actually the first units systemd turns off on my system. This is incorrect and due to swap devices having multiple associated swap unit files. The main one is usually created by the fstab generator and is used to start the swap device. Once done, systemd creates some 'alias' units for the same swap device, one for each swap dev link. But those units are missing an ordering dependencies which was created by the fstab generator for the main swap unit. Therefore during shutdown those 'alias' units can be stopped at anytime before unmount.target target. This patch makes sure that all swap units are stopped after the swap.target target.

tree-wide: group include of libudev.h with sd-*

tree-wide: sort includes Sort the includes accoding to the new coding style.

core: simplify things a bit by checking default_dependencies boolean in callee, not caller It's nicer to hide the check away in the various xyz_add_default_dependencies() calls, rather than making it explicit in the caller, and thus require deeper nesing.

core: change return value of the unit's enumerate() call to void We cannot handle enumeration failures in a sensible way, hence let's try hard to continue without making such failures fatal, and log about it with precise error messages.

doc: correct punctuation and improve typography in documentation

core: all unit types that watch control PIDs should use the same logic When coldplugging the unit state, make sure to follow the same basic logic for all unit types: always verify whether the control PID is still a waitable process before proceeding.

process-util: move a couple of process-related calls over

util-lib: split out allocation calls into alloc-util.[ch]

util-lib: move string table stuff into its own string-table.[ch]

util-lib: split string parsing related calls from util.[ch] into parse-util.[ch]

util-lib: split out fd-related operations into fd-util.[ch] There are more than enough to deserve their own .c file, hence move them over.

util-lib: split our string related calls from util.[ch] into its own file string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.

util: split out escaping code into escape.[ch] This really deserves its own file, given how much code this is now.

core: add support for setting stdin/stdout/stderr for transient services When starting a transient service, allow setting stdin/stdout/stderr fds for it, by passing them in via the bus. This also simplifies some of the serialization code for units.

Move all unit states to basic/ and extend systemctl --state=help

tree-wide: take benefit of the fact that hashmap_free() returns NULL And set_free() too. Another Coccinelle patch.

util: introduce safe_fclose() and port everything over to it Adds a coccinelle script to port things over automatically.

tree-wide: use coccinelle to patch a lot of code to use mfree() This replaces this: free(p); p = NULL; by this: p = mfree(p); Change generated using coccinelle. Semantic patch is added to the sources.

basic: rework virtualization detection API Introduce a proper enum, and don't pass around string ids anymore. This simplifies things quite a bit, and makes virtualization detection more similar to architecture detection.

unit: unify how we assing slices to units This adds a new call unit_set_slice(), and simplifies unit_add_default_slice(). THis should make our code a bit more robust and simpler.

core: add unit_dbus_interface_from_type() to unit-name.h Let's add a way to get the type-specific D-Bus interface of a unit from either its type or name to src/basic/unit-name.[ch]. That way we can share it with the client side, where it is useful in tools like cgls or machinectl. Also ports over machinectl to make use of this.

core: remove generic job completion messages from unit vtables These units' message format strings are identical to the generic strings. Since we can always rely on the fallback, these are now redundant.

swap: use swapon -o This patch simplify swapon usage in systemd. The command swapon(8) since util-linux v2.26 supports "-o <list>". The idea is exactly the same like for mount(8). The -o specifies options in fstab-compatible way. For systemd it means that it does not have to care about things like "discard" or another swapon specific options. swapon -o <options-from-fstab> For backward compatibility the code cares about "Priority:" swap unit field (for a case when Priority: is set, but pri= in the Options: is missing). References: http://lists.freedesktop.org/archives/systemd-devel/2014-October/023576.html

core: rename SystemdRunningAs to ManagerRunningAs It's primarily just a property of the Manager object after all, and we try to refer to PID 1 as "manager" instead of "systemd", hence let's to stick to this here too.

core,network: major per-object logging rework This changes log_unit_info() (and friends) to take a real Unit* object insted of just a unit name as parameter. The call will now prefix all logged messages with the unit name, thus allowing the unit name to be dropped from the various passed romat strings, simplifying invocations drastically, and unifying log output across messages. Also, UNIT= vs. USER_UNIT= is now derived from the Manager object attached to the Unit object, instead of getpid(). This has the benefit of correcting the field for --test runs. Also contains a couple of other logging improvements: - Drops a couple of strerror() invocations in favour of using %m. - Not only .mount units now warn if a symlinks exist for the mount point already, .automount units do that too, now. - A few invocations of log_struct() that didn't actually pass any additional structured data have been replaced by simpler invocations of log_unit_info() and friends. - For structured data a new LOG_UNIT_MESSAGE() macro has been added, that works like LOG_MESSAGE() but prefixes the message with the unit name. Similar, there's now LOG_LINK_MESSAGE() and LOG_NETDEV_MESSAGE(). - For structured data new LOG_UNIT_ID(), LOG_LINK_INTERFACE(), LOG_NETDEV_INTERFACE() macros have been added that generate the necessary per object fields. The old log_unit_struct() call has been removed in favour of these new macros used in raw log_struct() invocations. In addition to removing one more function call this allows generated structured log messages that contain two object fields, as necessary for example for network interfaces that are joined into another network interface, and whose messages shall be indexed by both. - The LOG_ERRNO() macro has been removed, in favour of log_struct_errno(). The latter has the benefit of ensuring that %m in format strings is properly resolved to the specified error number. - A number of logging messages have been converted to use log_unit_info() instead of log_info() - The client code in sysv-generator no longer #includes core code from src/core/. - log_unit_full_errno() has been removed, log_unit_full() instead takes an errno now, too. - log_unit_info(), log_link_info(), log_netdev_info() and friends, now avoid double evaluation of their parameters

core: always initialize ExecParamters.bus_endpoint_fd to -1 Otherwise it might be passed in as 0, which is a valid fd, but usually does not refer to a real endpoint.

swap: avoid null pointer dereference CID#1297436

core: rework unit name validation and manipulation logic A variety of changes: - Make sure all our calls distuingish OOM from other errors if OOM is not the only error possible. - Be much stricter when parsing escaped paths, do not accept trailing or leading escaped slashes. - Change unit validation to take a bit mask for allowing plain names, instance names or template names or an combination thereof. - Refuse manipulating invalid unit name

core: simplify unit type detection logic Introduce a new call unit_type_supported() and make use of it everywhere. Also, drop Manager parameter from per-type supported method prototype.

core: annotate event sources

Revert "core: do not spawn jobs or touch other units during coldplugging" This reverts commit 6e392c9c45643d106673c6643ac8bf4e65da13c1. We really shouldn't invent external state keeping hashmaps, if we can keep this state in the units themselves.

shared: add formats-util.h

util: rework cunescape(), improve error handling Change cunescape() to return a normal error code, so that we can distuingish OOM errors from parse errors. This also adds a flags parameter to control whether "relaxed" or normal parsing shall be done. If set no parse failures are generated, and the only reason why cunescape() can fail is OOM.

core: print warning on invalid swap pri= field CID #1264371.

core: do not spawn jobs or touch other units during coldplugging Because the order of coldplugging is not defined, we can reference a not-yet-coldplugged unit and read its state while it has not yet been set to a meaningful value. This way, already active units may get started again. We fix this by deferring such actions until all units have been at least somehow coldplugged. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=88401

core: expose consumed CPU time per unit This adds support for showing the accumulated consumed CPU time per-unit in the "systemctl status" output. The property is also readable via the bus.

core: rework device state logic This change introduces a new state "tentative" for device units. Device units are considered "plugged" when udev announced them, "dead" when they are not available in the kernel, and "tentative" when they are referenced in /proc/self/mountinfo or /proc/swaps but not (yet) announced via udev. This should fix a race when device nodes (like loop devices) are created and immediately mounted. Previously, systemd might end up seeing the mount unit before the device, and would thus pull down the mount because its BindTo dependency on the device would not be fulfilled.

remove unused includes This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.

util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.

core: output unit status output strings to console, only if we actually are changing unit state Unit _start() and _stop() implementations can fail with -EAGAIN to delay execution temporarily. Thus, we should not output status messages before invoking these calls, but after, and only when we know that the invocation actually made a change.

core: if two start jobs for the same swap device node are queued, only dispatch one of them at a time If two start jobs for two seperate .swap device nodes are queued, which then turns out to be referring to the same device node, refuse dispatching more than one of them at the same time. This should solve an issue when the same swap partition is found via GPT auto-discovery and via /etc/fstab, where one uses a symlink path, and the other the raw devce node. So far we might have ended up invoking mkswap on the same node at the very same time with the two device node names. With this change only one mkswap should be executed at a time. THis mkswap should have immediate effect on the other swap unit, due to the state in /proc/swaps changing, and thus suppressing actual invocation of the second mkswap. http://lists.freedesktop.org/archives/systemd-devel/2015-January/027314.html

swap: simplify a few things by making use of new LIST_FOREACH_OTHERS macro

swap: properly specify errno when logging

Add new function to filter fstab options This fixes parsing of options in shared/generator.c. Existing code had some issues: - it would treate whitespace and semicolons as seperators. fstab(5) is pretty clear that only commas matter. And the syntax does not allow for spaces to be inserted in the field in fstab. Whitespace might be escaped, but then it should not seperate options. Treat whitespace and semicolons as any other character. - it assumed that x-systemd.device-timeout would always be followed by "=". But this is not guaranteed, hasmntopt will return this option even if there's no value. Uninitialized memory could be read. - some error paths would log, and inconsistently, some would just return an error code. Filtering is split out to a separate function and tests are added. Similar code paths in other places are adjusted to use the new function.

unit: handle nicely of certain unit types are not supported on specific systems Containers do not really support .device, .automount or .swap units; Systems compiled without support for swap do not support .swap units; Systems without kdbus do not support .busname units. With this change attempts to start a unsupported unit types will result in an immediate "unsupported" job result, which is a lot more descriptive then before. Also, attempts to start device units in containers will now immediately fail instead of causing jobs to be enqueued that never go away.

sd-bus: move common errors src/shared/bus-errors.h → src/libsystemd/sd-bus/bus-common-errors.h Stuff in src/shared/ should not use stuff from src/libsystemd/ really.

core: convert log_unit_*() to log_unit_*_errno() Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_unit_(debug|info|notice|warning|error|emergency)\(([^"]+), "(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_unit_\1_errno(\2, \5, "\3%m"\4);/'

treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.

treewide: auto-convert the simple cases to log_*_errno() As a followup to 086891e5c1 "log: add an "error" parameter to all low-level logging calls and intrdouce log_error_errno() as log calls that take error numbers", use sed to convert the simple cases to use the new macros: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\("(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_\1_errno(-\4, "\2%m"\3);/' Multi-line log_*() invocations are not covered. And we also should add log_unit_*_errno().

log: rearrange log function naming - Rename log_meta() → log_internal(), to follow naming scheme of most other log functions that are usually invoked through macros, but never directly. - Rename log_info_object() to log_object_info(), simply because the object should be before any other parameters, to follow OO-style programming style.

swap: restore support for nofail systemd stops adding automatic dependencies on swap.target to swap units. If a dependency is required, it has to be added by unit configuration. fstab-generator did that already, except that now it is modified to create a Requires or Wants type dependency, depending on whether nofail is specified in /etc/fstab. This makes .swap units obey the nofail/noauto options more or less the same as .mount units. Documentation is extended to clarify that, and to make systemd.mount(5) and system.swap(5) more similar. The gist is not changed, because current behaviour actually matches existing documentation. https://bugs.freedesktop.org/show_bug.cgi?id=86488

core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine.

core: send sigabrt on watchdog timeout to get the stacktrace if sigabrt doesn't do the job, follow regular shutdown routine, sigterm > sigkill.

swap: don't add too many deps for swap files form /proc/swap

swap: drop noauto/nofail bools from Swap structure We nowadays always set them to "false" anyway, hence let's get rid of them entirely.

swap: replace Discard= setting by a more generic Options= setting For now, it's systemd itself that parses the options string, but as soon as util-linux' swapon can take the option string directly with -o we should pass it on unmodified.

core/swap: only make configured units part of swap.target We used to make all .swap units either RequiredBy=swap.target or WantedBy=swap.target. But swap.target should be the "configured swap units", either through /etc/fstab or non-generated .swap units. It is surprising when systemd starts treating a swap device that was possibly temporarily enabled as a hard dependency for other units. So do not add dependencies with swap.target for units gleaned from /proc/swaps. Similarly, we added dependencies for all aliases of the device name, which clutters up the dependency graph but does not seem to bring any value, since the status of those following units is consistent with the main one anyway. This should be a fix for [1], and it seems the right thing to do anyway. [1] https://bugzilla.redhat.com/show_bug.cgi?id=1114786

core/swap: follow the configured unit by default Phenomenon: parameters configured in /etc/fstab for swap units are ignored. E.g. pri= settings have no effect when systemd starts swap units. What is even more confusing, .swap units for the name used in /etc/fstab initially show proper values for Priority=, but after starting them, they are re-initalized from /proc/swaps and show the -1 value from /proc/swaps. Change swap units to follow the original configured unit. This way proper settings are used when starting the swap.

fstab-generator: properly deal with discard as non-last option Previous code would only return correct results when discard was the last option. While at it, avoid incorrect behaviour for (invalid) 'pri' option not followed by '=...', and also do not return -1 as the error code.

swap: introduce Discard property Process possible "discard" values from /etc/fstab.

hashmap: introduce hash_ops to make struct Hashmap smaller It is redundant to store 'hash' and 'compare' function pointers in struct Hashmap separately. The functions always comprise a pair. Store a single pointer to struct hash_ops instead. systemd keeps hundreds of hashmaps, so this saves a little bit of memory.

exec: factor out most function arguments of exec_spawn() to ExecParameters This way, the list of arguments to that function gets more comprehensive, and we can get around passing lots of NULL and 0 arguments from socket.c, swap.c and mount.c. It also allows for splitting up the code in exec_spawn(). While at it, make ExecContext const in execute.c.

Remove unnecessary casts in printfs No functional change expected :)

sd-event: rework API to support CLOCK_REALTIME_ALARM and CLOCK_BOOTTIME_ALARM, too

core: rework context initialization/destruction logic Let's automatically initialize the kill, exec and cgroup contexts of the various unit types when the object is constructed, instead of invididually in type-specific code. Also, when PrivateDevices= is set, set DevicePolicy= to closed.

core: introduce new RuntimeDirectory= and RuntimeDirectoryMode= unit settings As discussed on the ML these are useful to manage runtime directories below /run for services.

core: add global settings for enabling CPUAccounting=, MemoryAccounting=, BlockIOAccounting= for all units at once

api: in constructor function calls, always put the returned object pointer first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.

core: make sure to always go through both SIGTERM and SIGKILL states of units Given that we now have KillMode=mixed where SIGTERM might kill a smaller set than SIGKILL we need to make sure to always go explicitly throught the SIGKILL state to get the right end result.

core: add function to tell when job will time out Things will continue when either the job timeout or the unit timeout is reached. Add functionality to access that info.

swap: remove if/else with the same data path This was introduced in e1770af812 (2012-02-03, swap: replace failure boolean by result enum). This just removes unneeded lines of code, no functional change.

sd-daemon: introduce sd_watchdog_enabled() for parsing $WATCHDOG_USEC Also, introduce a new environment variable named $WATCHDOG_PID which cotnains the PID of the process that is supposed to send the keep-alive events. This is similar how $LISTEN_FDS and $LISTEN_PID work together, and protects against confusing processes further down the process tree due to inherited environment.

core: no need to list properties for PropertiesChanged messages anymore Since the vtable includes this information anyway, let's just use that

Remove some unused variables

service: add the ability for units to join other unit's PrivateNetwork= and PrivateTmp= namespaces

swap: always track the current real device node of all swap devices, even when not active This way, we can avoid executing two /bin/swapon jobs to be dispatched for the same swap device if it is configured for two different paths. Previously we were just tracking the device nodes of active swap devices, which would not allow us to recognize the identity of two swap devices before they are active. https://bugs.freedesktop.org/show_bug.cgi?id=69835

core: set some event source priorities to enforce dispatching order

swap: split state machine state ACTIVATING into two We expect the event on /proc/swaps before we expect the SIGCHILD, reflect this in the state machine.

core: convert PID 1 to libsystemd-bus This patch converts PID 1 to libsystemd-bus and thus drops the dependency on libdbus. The only remaining code using libdbus is a test case that validates our bus marshalling against libdbus' marshalling, and this dependency can be turned off. This patch also adds a couple of things to libsystem-bus, that are necessary to make the port work: - Synthesizing of "Disconnected" messages when bus connections are severed. - Support for attaching multiple vtables for the same interface on the same path. This patch also fixes the SetDefaultTarget() and GetDefaultTarget() bus calls which used an inappropriate signature. As a side effect we will now generate PropertiesChanged messages which carry property contents, rather than just invalidation information.

Configurable Timeouts/Restarts default values https://bugs.freedesktop.org/show_bug.cgi?id=71132 Patch adds DefaultTimeoutStartSec, DefaultTimeoutStopSec, DefaultRestartSec configuration options to manager configuration file.

list: make our list macros a bit easier to use by not requring type spec on each invocation We can determine the list entry type via the typeof() gcc construct, and so we should to make the macros much shorter to use.

core: rework how we match mount units against each other Previously to automatically create dependencies between mount units we matched every mount unit agains all others resulting in O(n^2) complexity. On setups with large amounts of mount units this might make things slow. This change replaces the matching code to use a hashtable that is keyed by a path prefix, and points to a set of units that require that path to be around. When a new mount unit is installed it is hence sufficient to simply look up this set of units via its own file system paths to know which units to order after itself. This patch also changes all unit types to only create automatic mount dependencies via the RequiresMountsFor= logic, and this is exposed to the outside to make things more transparent. With this change we still have some O(n) complexities in place when handling mounts, but that's currently unavoidable due to kernel APIs, and still substantially better than O(n^2) as before. https://bugs.freedesktop.org/show_bug.cgi?id=69740

cgroup: if we do a cgroup operation then do something on all supported controllers Previously we did operations like attach, trim or migrate only on the controllers that were enabled for a specific unit. With this changes we will now do them for all supproted controllers, and fall back to all possible prefix paths if the specified paths do not exist. This fixes issues if a controller is being disabled for a unit where it was previously enabled, and makes sure that all processes stay as "far down" the tree as groups exist.

Use first partition in /proc/swaps for hibernation test It seems that the kernel uses the first configured partition for hibernation. If it is too full, hibernation will fail. Test that directly.

swap: create .wants symlink to 'auto' swap devices As we load unit files lazily, we need to make sure something pulls in swap units that should be started automatically, otherwise the default dependencies will never be applied. This partially reinstates code removed in commit 64347fc2b983f33e7efb0fd2bb44e133fb9f30f4. Also don't order swap devices after swap.target when they are 'nofail'.

swap: fix reverse dependencies Make sure swap.target correctly requires/wants the swap units. This fixes https://bugs.freedesktop.org/show_bug.cgi?id=69291. Reported-by: Hussam Al-Tayeb

swap: handle nofail/noauto in core

swap: backing device should unconditionally want swap unit There is no need to restrict this to only the 'nofail' case. In the '!nofail' case the unit is already wanted by swap.target, so this is not a functional change.

dbus: hookup runtime property changes for mouns, services, sockets, swaps too

core: general cgroup rework Replace the very generic cgroup hookup with a much simpler one. With this change only the high-level cgroup settings remain, the ability to set arbitrary cgroup attributes is removed, so is support for adding units to arbitrary cgroup controllers or setting arbitrary paths for them (especially paths that are different for the various controllers). This also introduces a new -.slice root slice, that is the parent of system.slice and friends. This enables easy admin configuration of root-level cgrouo properties. This replaces DeviceDeny= by DevicePolicy=, and implicitly adds in /dev/null, /dev/zero and friends if DeviceAllow= is used (unless this is turned off by DevicePolicy=).

core: add new .slice unit type for partitioning systems In order to prepare for the kernel cgroup rework, let's introduce a new unit type to systemd, the "slice". Slices can be arranged in a tree and are useful to partition resources freely and hierarchally by the user. Each service unit can now be assigned to one of these slices, and later on login users and machines may too. Slices translate pretty directly to the cgroup hierarchy, and the various objects can be assigned to any of the slices in the tree.

Add __attribute__((const, pure, format)) in various places I'm assuming that it's fine if a _const_ or _pure_ function calls assert. It is assumed that the assert won't trigger, and even if it does, it can only trigger on the first call with a given set of parameters, and we don't care if the compiler moves the order of calls.

move _cleanup_ attribute in front of the type http://lists.freedesktop.org/archives/systemd-devel/2013-April/010510.html

Use initalization instead of explicit zeroing Before, we would initialize many fields twice: first by filling the structure with zeros, and then a second time with the real values. We can let the compiler do the job for us, avoiding one copy. A downside of this patch is that text gets slightly bigger. This is because all zero() calls are effectively inlined: $ size build/.libs/systemd text data bss dec hex filename before 897737 107300 2560 1007597 f5fed build/.libs/systemd after 897873 107300 2560 1007733 f6075 build/.libs/systemd … actually less than 1‰. A few asserts that the parameter is not null had to be removed. I don't think this changes much, because first, it is quite unlikely for the assert to fail, and second, an immediate SEGV is almost as good as an assert.

core: reuse the same /tmp, /var/tmp and inaccessible dir All Execs within the service, will get mounted the same /tmp and /var/tmp directories, if service is configured with PrivateTmp=yes. Temporary directories are cleaned up by service itself in addition to systemd-tmpfiles. Directory which is mounted as inaccessible is created at runtime in /run/systemd.

core: single unit_kill implementation for all unit types There are very few differences in the implementations of the kill method in the unit types that have one. Let's unify them. This does not yet unify unit_kill() with unit_kill_context().

core: unify kill code of mount, service, socket, swap units

unit: optionally allow making cgroup attribute changes persistent

systemd: use unit logging macros

timer: implement calendar time events

swap: fix swap behaviour with symlinks Starting a swap unit pointing to (What) a symlink (e.g. /dev/mapper/swap or /dev/disk/by-uuid/...) would have said unit marked active, following the one using the "actual" device (/dev/{dm-1,sda3}), but that new unit would be seen as inactive. Since all requests to stop swap units would follow/redirect to it, and it is seen inactive, nothing would be done (swapoff never called). This is because this unit would be treated twice in swap_process_new_swap, the second call to swap_add_one causing it to eventually be marked inactive.

swap: modernize style

swap: use automatic cleanup

swap: introduce helper variable Just for readability, no funcational change.

core/swap.c: Do not add Before=swap.target to swap units. The fstab generator adds Before=swap.target by default, and when creating a custom .swap unit, you can also add Before=swap.target to the unit. However, it is impossible to not have this ordering dependency right now. Virtually all existing setups likely use the fstab generator, so this change is unlikely to break anything.

core: move ManagerRunningAs to shared Note: I did s/MANAGER/SYSTEMD/ everywhere, even though it makes the patch quite verbose. Nevertheless, keeping MANAGER prefix in some places, and SYSTEMD prefix in others would just lead to confusion down the road. Better to rip off the band-aid now.

unit-printf: before resolving exec context specifiers check whether the object actually has an exec context

swap: don't try to shutdown swaps on shutdown in a container

swap: refuse start/stop of swaps in container

service: add options RestartPreventExitStatus and SuccessExitStatus In some cases, like wrong configuration, restarting after error does not help, so administrator can specify statuses by RestartPreventExitStatus which will not cause restart of a service. Sometimes you have non-standart exit status, so this can be specified by SuccessfulExitStatus.

units: apply default resource limits to socket/mount/swap processes too

core: drop KillMode parameter from KillUnit() bus call It made no sense, and since we are documenting the bus calls now and want to include them in our stability promise we really should get it cleaned up sooner, not later.

unit: split off KillContext from ExecContext containing only kill definitions

unit: set default working directory to the user's home directory when running in user mode

unit: get rid of UnitVTable.suffix, which is now unused

journal: set the _SYSTEMD_UNIT field for messages from terminated processes As described in https://bugs.freedesktop.org/show_bug.cgi?id=50184 the journal currently doesn't set fields such as _SYSTEMD_UNIT properly for messages coming from processes that have already terminated. This means among other things that "systemctl status" may not show some of the output of services that wrote messages just before they exited. This patch fixes this by having processes that log to the journal write their unit identifier to journald when the connection to /run/systemd/journal/stdout is opened. Journald stores the unit ID and uses it to fill in _SYSTEMD_UNIT when it cannot be obtained normally (i.e. from the cgroup). To prevent impersonating another unit, this information is only used when the caller is root. This doesn't fix the general problem of getting metadata about messages from terminated processes (which requires some kernel support), but it allows "systemctl status" and similar queries to do the Right Thing for units that log via stdout/stderr.

swap: avoid bad memory access

mount: replace PID1 internal fstab parser with generator Bit by bit we should remove non-unit parsing from PID 1 and move into generators, to clean up our code base a bit and clearly separate parsers.

unit: unit type dependent status messages Instead of generic "Starting..." and "Started" messages for all unit use type-dependent messages. For example, mounts will announce "Mounting..." and "Mounted". Add status messages to units of types that used to be entirely silent (automounts, sockets, targets, devices). For unit types whose jobs are instantaneous, report only the job completion, not the starting event. Socket units with non-instantaneous jobs are rare (Exec*= is not used often in socket units), so I chose not to print the starting messages for them either. This will hopefully give people better understanding of the boot.

util: split-out path-util.[ch]

service: explicitly remove control/ subcgroup after each control command The kernel will only notify us of cgroups running empty if no subcgroups exist anymore. Hence make sure we don't leave our own control/ subcgroup around longer than necessary. https://bugzilla.redhat.com/show_bug.cgi?id=818381

remount: consolidate remount-api-vfs and remount-rootfs into one This has the advantage of removing a confusing warning by mount if the root directory is not listed in fstab.

service: introduce Type=idle and use it for gettys Type=idle is much like Type=simple, however between the fork() and the exec() in the child we wait until PID 1 informs us that no jobs are left. This is mostly a cosmetic fix to make gettys appear only after all boot output is finished and complete. Note that this does not impact the normal job logic as we do not delay the completion of any jobs. We just delay the invocation of the actual binary, and only for services that otherwise would be of Type=simple.

manager: drop MountAuto= and SwapAuto= options The ability to set MountAuto=no and SwapAuto=no was useful during the adoption phase of systemd, so that distributions could stick to their classic mount scripts a bit longer. It is about time to get rid of it now.

service: place control command in subcgroup control/ Previously, we were brutally and onconditionally killing all processes in a service's cgroup before starting the service anew, in order to ensure that StartPre lines cannot be misused to spawn long-running processes. On logind-less systems this has the effect that restarting sshd necessarily calls all active ssh sessions, which is usually not desirable. With this patch control processes for a service are placed in a sub-cgroup called "control/". When starting a service anew we simply kill this cgroup, but not the main cgroup, in order to avoid killing any long-running non-control processes from previous runs. https://bugzilla.redhat.com/show_bug.cgi?id=805942

relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.

move libsystemd_core.la sources into core/