cgroup: remove support for NetClass= directive Support for net_cls.class_id through the NetClass= configuration directive has been added in v227 in preparation for a per-unit packet filter mechanism. However, it turns out the kernel people have decided to deprecate the net_cls and net_prio controllers in v2. Tejun provides a comprehensive justification for this in his commit, which has landed during the merge window for kernel v4.5: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bd1060a1d671 As we're aiming for full support for the v2 cgroup hierarchy, we can no longer support this feature. Userspace tool such as nftables are moving over to setting rules that are specific to the full cgroup path of a task, which obsoletes these controllers anyway. This commit removes support for tweaking details in the net_cls controller, but keeps the NetClass= directive around for legacy compatibility reasons.

tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

core: make the StartLimitXYZ= settings generic and apply to any kind of unit, not just services This moves the StartLimitBurst=, StartLimitInterval=, StartLimitAction=, RebootArgument= from the [Service] section into the [Unit] section of unit files, and thus support it in all unit types, not just in services. This way we can enforce the start limit much earlier, in particular before testing the unit conditions, so that repeated start-up failure due to failed conditions is also considered for the start limit logic. For compatibility the four options may also be configured in the [Service] section still, but we only document them in their new section [Unit]. This also renamed the socket unit failure code "service-failed-permanent" into "service-start-limit-hit" to express more clearly what it is about, after all it's only triggered through the start limit being hit. Finally, the code in busname_trigger_notify() and socket_trigger_notify() is altered to become more alike. Fixes: #2467

treewide: fix typos and spacing

core: rework unit timeout handling, and add new setting RuntimeMaxSec= This clean-ups timeout handling in PID 1. Specifically, instead of storing 0 in internal timeout variables as indication for a disabled timeout, use USEC_INFINITY which is in-line with how we do this in the rest of our code (following the logic that 0 means "no", and USEC_INFINITY means "never"). This also replace all usec_t additions with invocations to usec_add(), so that USEC_INFINITY is properly propagated, and sd-event considers it has indication for turning off the event source. This also alters the deserialization of the units to restart timeouts from the time they were originally started from. Before this patch timeouts would be restarted beginning with the time of the deserialization, which could lead to artificially prolonged timeouts if a daemon reload took place. Finally, a new RuntimeMaxSec= setting is introduced for service units, that specifies a maximum runtime after which a specific service is forcibly terminated. This is useful to put time limits on time-intensive processing jobs. This also simplifies the various xyz_spawn() calls of the various types in that explicit distruction of the timers is removed, as that is done anyway by the state change handlers, and a state change is always done when the xyz_spawn() calls fail. Fixes: #2249

core: store for each unit when the last low-level unit state change took place This adds a new timestamp field to the Unit struct, storing when the last low-level state change took place, and make sure this is restored after a daemon reload. This new field is useful to allow restarting of per-state timers exactly where they originally started.

core: make sure "systemctl reload-or-try-restart is actually a noop if a unit is not running This makes sure we follow the same basic logic for try-restart if we have a try-reload. Fixes #688

tree-wide: use xsprintf() where applicable Also add a coccinelle receipt to help with such transitions.

capabilities: keep bounding set in non-inverted format. Change the capability bounding set parser and logic so that the bounding set is kept as a positive set internally. This means that the set reflects those capabilities that we want to keep instead of drop.

tree-wide: unify argument lists of IN_SET() The new implementation will not allow passing the same values more than once, so clean up first.

tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy GLIB has recently started to officially support the gcc cleanup attribute in its public API, hence let's do the same for our APIs. With this patch we'll define an xyz_unrefp() call for each public xyz_unref() call, to make it easy to use inside a __attribute__((cleanup())) expression. Then, all code is ported over to make use of this. The new calls are also documented in the man pages, with examples how to use them (well, I only added docs where the _unref() call itself already had docs, and the examples, only cover sd_bus_unrefp() and sd_event_unrefp()). This also renames sd_lldp_free() to sd_lldp_unref(), since that's how we tend to call our destructors these days. Note that this defines no public macro that wraps gcc's attribute and makes it easier to use. While I think it's our duty in the library to make our stuff easy to use, I figure it's not our duty to make gcc's own features easy to use on its own. Most likely, client code which wants to make use of this should define its own: #define _cleanup_(function) __attribute__((cleanup(function))) Or similar, to make the gcc feature easier to use. Making this logic public has the benefit that we can remove three header files whose only purpose was to define these functions internally. See #2008.

core: Do not bind a mount unit to a device, if it was from mountinfo If a mount unit is bound to a device, systemd tries to umount the mount point, if it thinks the device has gone away. Due to the uevent queue and inotify of /proc/self/mountinfo being two different sources, systemd can never get the ordering reliably correct. It can happen, that in the uevent queue ADD,REMOVE,ADD is queued and an inotify of mountinfo (or libmount event) happend with the device in question. systemd cannot know, at which point of time the mount happend in the ADD,REMOVE,ADD sequence. The real ordering might have been ADD,REMOVE,ADD,mount and systemd might think ADD,mount,REMOVE,ADD and would umount the mountpoint. A test script which triggered this behaviour is: rm -f test-efi-disk.img dd if=/dev/null of=test-efi-disk.img bs=1M seek=512 count=1 parted --script test-efi-disk.img \ "mklabel gpt" \ "mkpart ESP fat32 1MiB 511MiB" \ "set 1 boot on" LOOP=$(losetup --show -f -P test-efi-disk.img) udevadm settle mkfs.vfat -F32 ${LOOP}p1 mkdir -p mnt mount ${LOOP}p1 mnt ... <dostuffwith mnt> Without the "udevadm settle" systemd unmounted mnt while the script was operating on mnt. Of course the question is, why there was a REMOVE in the first place, but this is not part of this patch.

core: Minor cleaning up of unit/log status and log logic We only reorder a few things and modernize some constructs. No functional changes. - Move some if checks from the caller to the callee of a few functions. - Use IN_SE() where we can - Move status printing functions together

core: make unit_make_transient() more thorough Let's reset more stuff that does not apply to transient units. Also, let's readd the unito to all queues, because it's identity now changed.

core: move check whether a unit is suitable to become transient into unit.c Lets introduce unit_is_pristine() that verifies whether a unit is suitable to become a transient unit, by checking that it is no referenced yet and has no data on disk assigned.

core: now that .snapshot unit are gone, we don't need the per-type .no_gc bool anymore

core: add new DefaultTasksMax= setting for system.conf This allows initializing the TasksMax= setting of all units by default to some fixed value, instead of leaving it at infinity as before.

core: drop "override" flag when building transactions Now that we don't have RequiresOverridable= and RequisiteOverridable= dependencies anymore, we can get rid of tracking the "override" boolean for jobs in the job engine, as it serves no purpose anymore. While we are at it, fix some error messages we print when invoking functions that take the override parameter.

core: remove support for RequiresOverridable= and RequisiteOverridable= As discussed at systemd.conf 2015 and on also raised on the ML: http://lists.freedesktop.org/archives/systemd-devel/2015-November/034880.html This removes the two XyzOverridable= unit dependencies, that were basically never used, and do not enhance user experience in any way. Most folks looking for the functionality this provides probably opt for the "ignore-dependencies" job mode, and that's probably a good idea. Hence, let's simplify systemd's dependency engine and remove these two dependency types (and their inverses). The unit file parser and the dbus property parser will now redirect the settings/properties to result in an equivalent non-overridable dependency. In the case of the unit file parser we generate a warning, to inform the user. The dbus properties for this unit type stay available on the unit objects, but they are now hidden from usual introspection and will always return the empty list when queried. This should provide enough compatibility for the few unit files that actually ever made use of this.

install: follow unit file symlinks in /usr, but not /etc when looking for [Install] data Some distributions use alias unit files via symlinks in /usr to cover for legacy service names. With this change we'll allow "systemctl enable" on such aliases. Previously, our rule was that symlinks are user configuration that "systemctl enable" + "systemctl disable" creates and removes, while unit files is where the instructions to do so are store. As a result of the rule we'd never read install information through symlinks, since that would mix enablement state with installation instructions. Now, the new rule is that only symlinks inside of /etc are configuration. Unit files, and symlinks in /usr are now valid for installation instructions. This patch is quite a rework of the whole install logic, and makes the following addional changes: - Adds a complete test "test-instal-root" that tests the install logic pretty comprehensively. - Never uses canonicalize_file_name(), because that's incompatible with operation relative to a specific root directory. - unit_file_get_state() is reworked to return a proper error, and returns the state in a call-by-ref parameter. This cleans up confusion between the enum type and errno-like errors. - The new logic puts a limit on how long to follow unit file symlinks: it will do so only for 64 steps at max. - The InstallContext object's fields are renamed to will_process and has_processed (will_install and has_installed) since they are also used for deinstallation and all kinds of other operations. - The root directory is always verified before use. - install.c is reordered to place the exported functions together. - Stricter rules are followed when traversing symlinks: the unit suffix must say identical, and it's not allowed to link between regular units and templated units. - Various modernizations - The "invalid" unit file state has been renamed to "bad", in order to avoid confusion between UNIT_FILE_INVALID and _UNIT_FILE_STATE_INVALID. Given that the state should normally not be seen and is not documented this should not be a problematic change. The new name is now documented however. Fixes #1375, #1718, #1706

Remove snapshot unit type Snapshots were never useful or used for anything. Many systemd developers that I spoke to at systemd.conf2015, didn't even know they existed, so it is fairly safe to assume that this type can be deleted without harm. The fundamental problem with snapshots is that the state of the system is dynamic, devices come and go, users log in and out, timers fire... and restoring all units to some state from the past would "undo" those changes, which isn't really possible. Tested by creating a snapshot, running the new binary, and checking that the transition did not cause errors, and the snapshot is gone, and snapshots cannot be created anymore. New systemctl says: Unknown operation snapshot. Old systemctl says: Failed to create snapshot: Support for snapshots has been removed. IgnoreOnSnaphost settings are warned about and ignored: Support for option IgnoreOnSnapshot= has been removed and it is ignored http://lists.freedesktop.org/archives/systemd-devel/2015-November/034872.html

core: try to continue if coldplugging of a unit fails

core: be more verbose when NameOwnerChanged subscriptions fail

core: set_unit_path overwrites SYSTEMD_UNIT_PATH

util-lib: split out allocation calls into alloc-util.[ch]

util-lib: split stat()/statfs()/stavfs() related calls into stat-util.[ch]

util: remove path_get_parent(), in favour of dirname_malloc() We don't need two functions that do essentialy the same, hence drop path_get_parent(), and stick to dirname_malloc(), but move it to path-util.[ch].

util-lib: split string parsing related calls from util.[ch] into parse-util.[ch]

util-lib: split out user/group/uid/gid calls into user-util.[ch]

util-lib: split our string related calls from util.[ch] into its own file string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.

util: split out escaping code into escape.[ch] This really deserves its own file, given how much code this is now.

tree-wide: remove unused functions

unit: allocate bus name match string on the stack Let's use strjoina() rather than strjoin() for construct dbus match strings. Also, while we are at it, fix parameter ordering, so that our functions always put the object first, like it is customary for OO-like programming.

Make sure the mount units pulled by 'RequiresMountsFor=' are loaded (if they exist) We should make sure that mount units involved by 'RequiresMountsFor=' directives are really loaded if not required by any others units so that Requires= dependencies on the mount units are applied and thus the mount unit dependencies are started.

core: add support for setting stdin/stdout/stderr for transient services When starting a transient service, allow setting stdin/stdout/stderr fds for it, by passing them in via the bus. This also simplifies some of the serialization code for units.

core: add a "Requires=" dependency between units and the slices they are located in We place the processes we fork off in the cgroup anyway, and we probably shouldn't be able to get that far if we couldn't set up the slice due to resource problems or unmet conditions. Hence upgrade the dependency between units and the slices they are located in from Wants= to Requires=.

Move UnitActiveState to basic/ Preparation to allow systemctl to query the list of unit states.

core: extend KillUnit() to return error when no unit was killed

cgroup: add support for net_cls controllers Add a new config directive called NetClass= to CGroup enabled units. Allowed values are positive numbers for fix assignments and "auto" for picking a free value automatically, for which we need to keep track of dynamically assigned net class IDs of units. Introduce a hash table for this, and also record the last ID that was given out, so the allocator can start its search for the next 'hole' from there. This could eventually be optimized with something like an irb. The class IDs up to 65536 are considered reserved and won't be assigned automatically by systemd. This barrier can be made a config directive in the future. Values set in unit files are stored in the CGroupContext of the unit and considered read-only. The actually assigned number (which may have been chosen dynamically) is stored in the unit itself and is guaranteed to remain stable as long as the unit is active. In the CGroup controller, set the configured CGroup net class to net_cls.classid. Multiple unit may share the same net class ID, and those which do are linked together.

core: allocate sets of startup and failed units on-demand There's a good chance we never needs these sets, hence allocate them only when needed.

core: refactor cpu shares/blockio weight cgroup logic Let's stop using the "unsigned long" type for weights/shares, and let's just use uint64_t for this, as that's what we expose on the bus. Unify parsers, and always validate the range for these fields. Correct the default blockio weight to 500, since that's what the kernel actually uses. When parsing the weight/shares settings from unit files accept the empty string as a way to reset the weight/shares value. When getting it via the bus, uniformly map (uint64_t) -1 to unset. Open up StartupCPUShares= and StartupBlockIOWeight= to transient units.

core: add support for the "pids" cgroup controller This adds support for the new "pids" cgroup controller of 4.3 kernels. It allows accounting the number of tasks in a cgroup and enforcing limits on it. This adds two new setting TasksAccounting= and TasksMax= to each unit, as well as a gloabl option DefaultTasksAccounting=. This also updated "cgtop" to optionally make use of the new kernel-provided accounting. systemctl has been updated to show the number of tasks for each service if it is available. This patch also adds correct support for undoing memory limits for units using a MemoryLimit=infinity syntax. We do the same for TasksMax= now and hence keep things in sync here.

tree-wide: take benefit of the fact that hashmap_free() returns NULL And set_free() too. Another Coccinelle patch.

tree-wide: make use of the fact that strv_free() returns NULL Another Coccinelle patch.

unit: move "not supported" check after condition check in unit_start() Make sure we always check conditions before checking whether the unit type is supported in unit_start(), since condition checks are "clean errors", while "not supported" errors are fatal. This cleans up the boot output of systemd in containers, where a lot of NOTSUPP lines were shown befor this fix. This partially reverts 8ff4d2ab0d4758e914aea6d86154d85f2b2c787f which reorder the checks.

basic: rework virtualization detection API Introduce a proper enum, and don't pass around string ids anymore. This simplifies things quite a bit, and makes virtualization detection more similar to architecture detection.

unit: make unit_can_start() more accurate This funciton is exposed via CanStart on the bus, and should be as accurate as possible. Hence: make sure to return false for units of unit types not supported on the system, and for unit types where configuration failed to load. Also see #1105.

macro: introduce new PID_TO_PTR macros and make use of them This adds a new PID_TO_PTR() macro, plus PTR_TO_PID() and makes use of it wherever we maintain processes in a hash table. Previously we sometimes used LONG_TO_PTR() and other times ULONG_TO_PTR() for that, hence let's make this more explicit and clean up things.

core: unified cgroup hierarchy support This patch set adds full support the new unified cgroup hierarchy logic of modern kernels. A new kernel command line option "systemd.unified_cgroup_hierarchy=1" is added. If specified the unified hierarchy is mounted to /sys/fs/cgroup instead of a tmpfs. No further hierarchies are mounted. The kernel command line option defaults to off. We can turn it on by default as soon as the kernel's APIs regarding this are stabilized (but even then downstream distros might want to turn this off, as this will break any tools that access cgroupfs directly). It is possibly to choose for each boot individually whether the unified or the legacy hierarchy is used. nspawn will by default provide the legacy hierarchy to containers if the host is using it, and the unified otherwise. However it is possible to run containers with the unified hierarchy on a legacy host and vice versa, by setting the $UNIFIED_CGROUP_HIERARCHY environment variable for nspawn to 1 or 0, respectively. The unified hierarchy provides reliable cgroup empty notifications for the first time, via inotify. To make use of this we maintain one manager-wide inotify fd, and each cgroup to it. This patch also removes cg_delete() which is unused now. On kernel 4.2 only the "memory" controller is compatible with the unified hierarchy, hence that's the only controller systemd exposes when booted in unified heirarchy mode. This introduces a new enum for enumerating supported controllers, plus a related enum for the mask bits mapping to it. The core is changed to make use of this everywhere. This moves PID 1 into a new "init.scope" implicit scope unit in the root slice. This is necessary since on the unified hierarchy cgroups may either contain subgroups or processes but not both. PID 1 hence has to move out of the root cgroup (strictly speaking the root cgroup is the only one where processes and subgroups are still allowed, but in order to support containers nicey, we move PID 1 into the new scope in all cases.) This new unit is also used on legacy hierarchy setups. It's actually pretty useful on all systems, as it can then be used to filter journal messages coming from PID 1, and so on. The root slice ("-.slice") is now implicitly created and started (and does not require a unit file on disk anymore), since that's where "init.scope" is located and the slice needs to be started before the scope can. To check whether we are in unified or legacy hierarchy mode we use statfs() on /sys/fs/cgroup. If the .f_type field reports tmpfs we are in legacy mode, if it reports cgroupfs we are in unified mode. This patch set carefuly makes sure that cgls and cgtop continue to work as desired. When invoking nspawn as a service it will implicitly create two subcgroups in the cgroup it is using, one to move the nspawn process into, the other to move the actual container processes into. This is done because of the requirement that cgroups may either contain processes or other subgroups.

core: rework when we kill with which signal When the user wants to explicitly send our own PID a signal, then do so. Don't follow up SIGABRT with a SIGHUP if send_sighup is enabled. At that point the process should have segfaulted, hence there's no point in following up with a SIGHUP. Send only termination signals to ourselves, never KILL or ABRT signals.

core: don't allow changing the slice of a unit while it is active

unit: small clean-ups Always say when we ignore errors. Cast calls whose return value we knowingly ingore to (void). Use "bool" where we actually mean a boolean, even if we return it as an int later on.

units: enable waiting for unit termination in certain cases The legacy cgroup hierarchy does not support reliable empty notifications in containers and if there are left-over subgroups in a cgroup. This makes it hard to correctly wait for them running empty, and thus we previously disabled this logic entirely. With this change we explicitly check for the container case, and whether the unit is a "delegation" unit (i.e. one where programs may create their own subgroups). If we are neither in a container, nor operating on a delegation unit cgroup empty notifications become reliable and thus we start waiting for the empty notifications again. This doesn't really fix the general problem around cgroup notifications but reduces the effect around it. (This also reorders #include lines by their focus, as suggsted in CODING_STYLE. We have to add "virt.h", so let's do that at the right place.) Also see #317.

unit: minor simplification

unit: unify how we assing slices to units This adds a new call unit_set_slice(), and simplifies unit_add_default_slice(). THis should make our code a bit more robust and simpler.

unit: add new macros to test for unit contexts

core: don't generate stub unit file for transient units We store the properties for transient units in drop-ins anyway, and units don't have to have fragment files, hence don't bother with them, and don't create them.

core: unit: remove bus slot after calling unit_done() The ->done callback in the unit's vtable might call into unit_unwatch_bus_name() and corrupt memory by that. Move the call down, and clean up the bus slot in case it hasn't been done yet.

core: dbus: track bus names per unit Currently, PID1 installs an unfiltered NameOwnerChanged signal match, and dispatches the signals itself. This does not scale, as right now, PID1 wakes up every time a bus client connects. To fix this, install individual matches once they are requested by unit_watch_bus_name(), and remove the watches again through their slot in unit_unwatch_bus_name(). If the bus is not available during unit_watch_bus_name(), just store name in the 'watch_bus' hashmap, and let bus_setup_api() do the installing later.

core: unit_get_status_message_format() never returns NULL unit_get_status_message_format() is used only with one of JOB_START, JOB_STOP, JOB_RELOAD, all of which have fallback message strings defined, so the function may never return NULL.

core: always try harder to get unit status message format string The starting/stopping messages are printed to the console only if the corresponding format string is defined in the unit's vtable. To avoid excessive messages on the console, the unit types whose start/stop jobs are instantaneous had the format strings intentionally undefined. When logging the same event to the journal, a fallback to generic Starting/Stopping/Reloading messages is used. The problem of excessive console messages with instantaneous jobs is already resolved in a nicer way ("core: fix confusing logging of instantaneous jobs"), so there's no longer a need to have two ways of getting the format strings. Let's fold them into one function with the fallback to generic message strings.

core: fix confusing logging of instantaneous jobs For instantaneous jobs (e.g. starting of targets, sockets, slices, or Type=simple services) the log shows the job completion before starting: systemd[1]: Created slice -.slice. systemd[1]: Starting -.slice. systemd[1]: Created slice System Slice. systemd[1]: Starting System Slice. systemd[1]: Listening on Journal Audit Socket. systemd[1]: Starting Journal Audit Socket. systemd[1]: Reached target Timers. systemd[1]: Starting Timers. ... The reason is that the job completes before the ->start() method returns and only then does unit_start() print the "Starting ..." message. The same thing happens when stopping units. Rather than fixing the order of the messages, let's just not emit the Starting/Stopping message at all when the job completes instantaneously. The job completion message is sufficient in this case.

core: fix reversed dependency check in unit_check_unneeded This was introduced by commit be7d9ff730cb88d7c6a8 and breaks StopWhenUnneeded=true in the presence of a Requisite dependency.

core: Let two more booleans survive a daemon-reload Without the boolean bus_name_good services as well as cgroup_realized for units a unit of Type=dbus and ExecReload sending SIGHUP to $MAINPID will be terminated if systemd will be daemon reloaded. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746151 https://bugs.freedesktop.org/show_bug.cgi?id=78311 https://bugzilla.opensuse.org/show_bug.cgi?id=934077

unit: drop support for pre-v44 job serialization No distro ships that old systemd versions anyway, hence let's drop support for live-upgrades for them. Offline updates are still supported. And live-upgrades will only lose the job queue, hence basically still work...

core: also enforce ratelimiter if we stop a unit due to BindsTo= This extends on bea355dac94e82697aa98e25d80ee4248263bf92, and extends the ratelimiter to not only be used for StopWhenUnneeded=1 units but also for units that have BindsTo= on a unit that is dead. http://lists.freedesktop.org/archives/systemd-devel/2015-April/030224.html

core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 Otherwise we might end up in an endless stop loop. http://lists.freedesktop.org/archives/systemd-devel/2015-April/030224.html

unit: fix unit_check_unneeded() dependency iteration Fixes a regression introduced in be7d9ff730cb88d7c6a869dd5c47754c78ceaef2.

core: introduce seperate reverse dependencies for Requires= and Requisite= This allows us to ensure that Requisite= dependencies never cause propagation between units, while Requires= dependencies might. http://lists.freedesktop.org/archives/systemd-devel/2015-May/031742.html

core: rename SystemdRunningAs to ManagerRunningAs It's primarily just a property of the Manager object after all, and we try to refer to PID 1 as "manager" instead of "systemd", hence let's to stick to this here too.

unit: move unit_warn_if_dir_nonempty() and friend to unit.c The call is only used by the mount and automount unit types, but that's already enough to consider it generic unit functionality, hence move it out of mount.c and into unit.c.

core,network: major per-object logging rework This changes log_unit_info() (and friends) to take a real Unit* object insted of just a unit name as parameter. The call will now prefix all logged messages with the unit name, thus allowing the unit name to be dropped from the various passed romat strings, simplifying invocations drastically, and unifying log output across messages. Also, UNIT= vs. USER_UNIT= is now derived from the Manager object attached to the Unit object, instead of getpid(). This has the benefit of correcting the field for --test runs. Also contains a couple of other logging improvements: - Drops a couple of strerror() invocations in favour of using %m. - Not only .mount units now warn if a symlinks exist for the mount point already, .automount units do that too, now. - A few invocations of log_struct() that didn't actually pass any additional structured data have been replaced by simpler invocations of log_unit_info() and friends. - For structured data a new LOG_UNIT_MESSAGE() macro has been added, that works like LOG_MESSAGE() but prefixes the message with the unit name. Similar, there's now LOG_LINK_MESSAGE() and LOG_NETDEV_MESSAGE(). - For structured data new LOG_UNIT_ID(), LOG_LINK_INTERFACE(), LOG_NETDEV_INTERFACE() macros have been added that generate the necessary per object fields. The old log_unit_struct() call has been removed in favour of these new macros used in raw log_struct() invocations. In addition to removing one more function call this allows generated structured log messages that contain two object fields, as necessary for example for network interfaces that are joined into another network interface, and whose messages shall be indexed by both. - The LOG_ERRNO() macro has been removed, in favour of log_struct_errno(). The latter has the benefit of ensuring that %m in format strings is properly resolved to the specified error number. - A number of logging messages have been converted to use log_unit_info() instead of log_info() - The client code in sysv-generator no longer #includes core code from src/core/. - log_unit_full_errno() has been removed, log_unit_full() instead takes an errno now, too. - log_unit_info(), log_link_info(), log_netdev_info() and friends, now avoid double evaluation of their parameters

core: rework unit name validation and manipulation logic A variety of changes: - Make sure all our calls distuingish OOM from other errors if OOM is not the only error possible. - Be much stricter when parsing escaped paths, do not accept trailing or leading escaped slashes. - Change unit validation to take a bit mask for allowing plain names, instance names or template names or an combination thereof. - Refuse manipulating invalid unit name

core: simplify unit type detection logic Introduce a new call unit_type_supported() and make use of it everywhere. Also, drop Manager parameter from per-type supported method prototype.

unit: Drop unused variables src/core/unit.c: In function 'unit_coldplug': src/core/unit.c:2884:18: warning: unused variable 'i' [-Wunused-variable] Iterator i; ^ src/core/unit.c:2883:15: warning: unused variable 'other' [-Wunused-variable] Unit *other; ^

core: coldplug all units which participate in jobs during coldplugging This is yet another attempt to fix coldplugging order (more especially, the problem which happens when one creates a job during coldplugging and it references a not-yet-coldplugged unit). Now we forcibly coldplug all units which participate in jobs. This is a superset of previously implemented handling of the UNIT_TRIGGERS dependencies, so that handling is removed. http://lists.freedesktop.org/archives/systemd-devel/2015-April/031212.html https://bugs.freedesktop.org/show_bug.cgi?id=88401 (once again)

core: minor simplification

unit: don't add automatic dependencies on device units if they aren't supported http://lists.freedesktop.org/archives/systemd-devel/2015-April/031187.html

core: always coldplug units that are triggered by other units before those Let's make sure that we don't enqueue triggering jobs for units before those units are actually fully loaded. http://lists.freedesktop.org/archives/systemd-devel/2015-April/031176.html https://bugs.freedesktop.org/show_bug.cgi?id=88401

Revert "core: do not spawn jobs or touch other units during coldplugging" This reverts commit 6e392c9c45643d106673c6643ac8bf4e65da13c1. We really shouldn't invent external state keeping hashmaps, if we can keep this state in the units themselves.

core: make unit deserialization more defensive

core: fix spurious warning about cpuacct-usage-base deserialization The key was parsed properly, but the warning was still generated.

shared: add process-util.[ch]

shared: add formats-util.h

core: set_put never returns -EEXIST When the value is already there it returns 0. Also add a test to ensure this

tree-wide: there is no ENOTSUP on linux Replace ENOTSUP by EOPNOTSUPP as this is what linux actually uses.

core: do not spawn jobs or touch other units during coldplugging Because the order of coldplugging is not defined, we can reference a not-yet-coldplugged unit and read its state while it has not yet been set to a meaningful value. This way, already active units may get started again. We fix this by deferring such actions until all units have been at least somehow coldplugged. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=88401

core: expose consumed CPU time per unit This adds support for showing the accumulated consumed CPU time per-unit in the "systemctl status" output. The property is also readable via the bus.

core: rework device state logic This change introduces a new state "tentative" for device units. Device units are considered "plugged" when udev announced them, "dead" when they are not available in the kernel, and "tentative" when they are referenced in /proc/self/mountinfo or /proc/swaps but not (yet) announced via udev. This should fix a race when device nodes (like loop devices) are created and immediately mounted. Previously, systemd might end up seeing the mount unit before the device, and would thus pull down the mount because its BindTo dependency on the device would not be fulfilled.

core: emit changes for NFailedUnits property By notifying the clients when this property is changed it's possible to allow "system health monitor" tools to get transitions like running<->degraded. This is an alternative to send changes on the SystemState property since the latter is more difficult to derive.

unit: When stopping due to BindsTo=, log which unit caused it I'm trying to track down a relatively recent change in systemd which broke OSTree; see https://bugzilla.gnome.org/show_bug.cgi?id=743891 Systemd started to stop sysroot.mount, and this patch should help me debug why at least. While we're here, "break" on the first unit we find that will deactivate, as there's no point in further iteration.

unit: use weaker dependencies between mount and device units in --user mode When running in user mode unmounting of mount units when a device vanishes is unlikely to work, and even if it would work is already done by PID 1 anyway. HEnce, when creating implicit dependencies between mount units and their backing devices, created a Wants= type dependency in --user mode, but leave a BindsTo= dependency in --system mode.

remove unused includes This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.

include <poll.h> instead of <sys/poll.h> include-what-you-use automatically does this and it makes finding unnecessary harder to spot. The only content of poll.h is a include of sys/poll.h so should be harmless.

core: don't fail to run services in --user instances if $HOME is missing Otherwise we cannot even invoke systemd-exit.service anymore, thus not even exit. https://bugs.freedesktop.org/show_bug.cgi?id=83100 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759320

core: correct a log message The log message talks specifically about services, though it actually applies to any kind of unit.

util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.

Add a snprinf wrapper which checks that the buffer was big enough If we scale our buffer to be wide enough for the format string, we should expect that the calculation was correct. char_array_0() invocations are removed, since snprintf nul-terminates the output in any case. A similar wrapper is used for strftime calls, but only in timedatectl.c.

core: output unit status output strings to console, only if we actually are changing unit state Unit _start() and _stop() implementations can fail with -EAGAIN to delay execution temporarily. Thus, we should not output status messages before invoking these calls, but after, and only when we know that the invocation actually made a change.

core: add new logic for services to store file descriptors in PID 1 With this change it is possible to send file descriptors to PID 1, via sd_pid_notify_with_fds() which PID 1 will store individually for each service, and pass via the usual fd passing logic on next invocation. This is useful for enable daemon reload schemes where daemons serialize their state to /run, push their fds into PID 1 and terminate, restoring their state on next start from the data in /run and passed in from PID 1. The fds are kept by PID 1 as long as no POLLHUP or POLLERR is seen on them, and the service they belong to are either not dead or failed, or have a job queued.

core: rework counting of running jobs Let's unify the code that counts the running jobs a bit, in order to make sure we are less likely to miss one. This is related to this bug: https://bugs.freedesktop.org/show_bug.cgi?id=87349 However, it probably won't fix it fully, and I cannot reproduce the issue. The change also adds an explicit assert change when the counter is off.

tree-wide: spelling fixes https://github.com/vlajos/misspell_fixer https://github.com/torstehu/systemd/commit/b6fdeb618cf2f3ce1645b3315f15f482710c7ffa Thanks to Torstein Husebo <torstein@huseboe.net>.

Move dropin listing to shared No functional change. This is in preparation for using this in systemctl in the future.

unit: handle nicely of certain unit types are not supported on specific systems Containers do not really support .device, .automount or .swap units; Systems compiled without support for swap do not support .swap units; Systems without kdbus do not support .busname units. With this change attempts to start a unsupported unit types will result in an immediate "unsupported" job result, which is a lot more descriptive then before. Also, attempts to start device units in containers will now immediately fail instead of causing jobs to be enqueued that never go away.

sd-bus: move common errors src/shared/bus-errors.h → src/libsystemd/sd-bus/bus-common-errors.h Stuff in src/shared/ should not use stuff from src/libsystemd/ really.

unit: update unit dropin paths and time when dropin file is written. If a unit is set property by "systemctl set-property", a new dropin file is generated. But the unit's dropin_paths and dropin_mtime are not updated. So the unit is shown as need daemon reload. Update unit dropin_paths and dropin_mtime also when dropin file is written.

core: rename unit_destroy_cgroup() to unit_destroy_cgroup_if_empty() since it's not quite as destructive as it sounds nowadays

systemctl: show unit file preset state in "systemctl status" output"

core: convert log_unit_*() to log_unit_*_errno() Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_unit_(debug|info|notice|warning|error|emergency)\(([^"]+), "(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_unit_\1_errno(\2, \5, "\3%m"\4);/'

log: fix order of log_unit_struct() to match other logging calls Also, while we are at it, introduce some syntactic sugar for creating ERRNO= and MESSAGE= structured logging fields.

log: rearrange log function naming - Rename log_meta() → log_internal(), to follow naming scheme of most other log functions that are usually invoked through macros, but never directly. - Rename log_info_object() to log_object_info(), simply because the object should be before any other parameters, to follow OO-style programming style.

core: get rid of condition.c and move the remaining call into util.c That way only one file with condition code remaining, in src/shared/, rather than src/core/. Next step: dropping the "-util" suffix from condition-util.[ch].

core: introduce the concept of AssertXYZ= similar to ConditionXYZ=, but fatal for a start job if not met

Convert the rest to sd_bus_errnomap I tried to preserve most errno values, but in some cases they were inconsistent (different errno values for the same error name) or just mismatched.

core: send sigabrt on watchdog timeout to get the stacktrace if sigabrt doesn't do the job, follow regular shutdown routine, sigterm > sigkill.

manager: convert ephemeral to enum In preparation for subsequent changes.

job: optionally, when a job timeout is hit, also execute a failure action

unit: adjust for the possibility of set_move() failing

unit: place reservations before merging other's dependencies With the hashmap implementation that uses chaining the reservations merely ensure that the merging won't result in long bucket chains. With a future alternative implementation it will additionally reserve memory to make sure the merging won't fail.

unit: move UnitDependency to unit-name

Rename user_runtime to user_runtime_dir This makes this function name similar to user_config_home() and makes it match the name of the environment variable.

add a transient user unit directory This patch adds a transient user unit directory under `$XDG_RUNTIME_DIR/systemd/user/` and stores transient user-instance units (such as those created by `systemd-run --user`) under there instead of putting them in $XDG_CONFIG_HOME/systemd/user/. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=67331

hashmap: introduce hash_ops to make struct Hashmap smaller It is redundant to store 'hash' and 'compare' function pointers in struct Hashmap separately. The functions always comprise a pair. Store a single pointer to struct hash_ops instead. systemd keeps hundreds of hashmaps, so this saves a little bit of memory.

Fix a few more typos

core: unify how we generate the prefix string when dumping unit state

core: minor modernizations

units: fix BindsTo= logic when applied relative to services with Type=oneshot Start jobs for Type=oneshot units are successful when the unit state transition activating → inactive took place. In such a case all units that BindsTo= on it previously would continue to run, even though the unit they dependet on was actually already gone.

core: warn when merged units have conflicting dependencies A unit should not Conflict with itself. It also does not make much sense for a unit to be After or Before itself, or to trigger itself in some way. If one of those dependency types is encountered, warn, instead of dropping it silently like other dependency types. % build/systemd-analyze verify test/loopy3.service ... Dependency Conflicts dropped when merging unit loopy4.service into loopy3.service Dependency ConflictedBy dropped when merging unit loopy4.service into loopy3.service

core: do not add dependencies to self Adds a pair of files which cause a segfault (also with systemd-analyze verify). https://bugzilla.redhat.com/show_bug.cgi?id=1124843

path-lookup: make SYSTEMD_UNIT_PATH more flexible It can now contain more than one directory, and can be used to only prepend, not totally override, the normal load path.

cryptsetup: allow x-systemd.device-timeout https://bugs.freedesktop.org/show_bug.cgi?id=54210

Move x-systemd-device.timeout handling from core to fstab-generator Instead of adjusting job timeouts in the core, let fstab-generator write out a dropin snippet with the appropriate JobTimeout. x-systemd-device.timeout option is removed from Options= line in the generated unit. The functions to write dropins are moved from core/unit.c to shared/dropin.c, to make them available outside of core. generator.c is moved to libsystemd-label, because it now uses functions defined in dropin.c, which are in libsystemd-label.

Fix several small typos

cgroups: simplify CPUQuota= logic Only accept cpu quota values in percentages, get rid of period definition. It's not clear whether the CFS period controllable per-cgroup even has a future in the kernel, hence let's simplify all this, hardcode the period to 100ms and only accept percentage based quota values.

cgroup: rework startup logic Introduce a (unsigned long) -1 as "unset" state for cpu shares/block io weights, and keep the startup unit set around all the time.

core: add startup resource control option Similar to CPUShares= and BlockIOWeight= respectively. However only assign the specified weight during startup. Each control group attribute is re-assigned as weight by CPUShares=weight and BlockIOWeight=weight after startup. If not CPUShares= or BlockIOWeight= be specified, then the attribute is re-assigned to each default attribute value. (default cpu.shares=1024, blkio.weight=1000) If only CPUShares=weight or BlockIOWeight=weight be specified, then that implies StartupCPUShares=weight and StartupBlockIOWeight=weight.

core: make sure to serialize jobs for all units Previously we wouldn't serialize jobs for units that themselves have nothing to serialize. http://lists.freedesktop.org/archives/systemd-devel/2014-May/019051.html

Make sure that keys are properly removed from hashmap This is a speculative fix for https://bugzilla.redhat.com/show_bug.cgi?id=1088865. Even though I cannot find a code path that where this would be an issue, for consistency, if we assume that cgroup_path might have been set before we got to unit_deserialize, we should make sure that the unit is removed from the hashmap before we free the key. This seems to be the only place where the key could be prematurely freed, leading to hashmap corruption.

core: expose CFS CPU time quota as high-level unit properties

core: rework context initialization/destruction logic Let's automatically initialize the kill, exec and cgroup contexts of the various unit types when the object is constructed, instead of invididually in type-specific code. Also, when PrivateDevices= is set, set DevicePolicy= to closed.

core: when PrivateTmp= is set for a unit, make sure to order it after /tmp and /var/tmp are mounted

core: drop CAP_MKNOD when PrivateDevices= is set

core, libsystemd, systemd, timedate, udev: spelling fixes

core: introduce system state enum The system state knows the states starting → running/degraded/maintenance → stopping, where: starting = system startup running = normal operation degraded = at least one unit is currently in failed state maintenance = rescue/emergency mode is active or queued stopping = system shutdown

Make tables for DEFINE_STRING_TABLE_LOOKUP consistent Bring some arrays that are used for DEFINE_STRING_TABLE_LOOKUP() in the same order than the enums they reference. Also, pass the corresponding _MAX value to the array initalizer where appropriate.

core: correctly unregister PIDs from PID hashtables

missing: if RLIMIT_RTTIME is not defined by the libc, then we need a new define for the max number of rlimits, too

Introduce strv_consume which takes ownership This mirrors set_consume and makes the common use a bit nicer.

bus: add sd_bus_track object for tracking peers, and port core over to it This is primarily useful for services that need to track clients which reference certain objects they maintain, or which explicitly want to subscribe to certain events. Something like this is done in a large number of services, and not trivial to do. Hence, let's unify this at one place. This also ports over PID 1 to use this to ensure that subscriptions to job and manager events are correctly tracked. As a side-effect this makes sure we properly serialize and restore the track list across daemon reexec/reload, which didn't work correctly before. This also simplifies how we distribute messages to broadcast to the direct busses: we only track subscriptions for the API bus and implicitly assume that all direct busses are subscribed. This should be a pretty OK simplification since clients connected via direct bus connections are shortlived anyway.

exec: imply NoNewPriviliges= only when seccomp filters are used in user mode

core: add global settings for enabling CPUAccounting=, MemoryAccounting=, BlockIOAccounting= for all units at once

core: gc half-created stub units

macro: introduce a nice macro for disabling -Wformat-nonliteral temporarily

core/unit: fix unit_add_target_dependencies() for units with no dependencies For units without any dependencies, r needs to be initialized to 0. Otherwise, the return value of unit_add_target_dependencies() is unspecified.

util: generalize code that checks whether PIDs are alive or unwaited for

core: fix property changes in transient units

unit: slice dependencies should not be subject to DefaultDependencies

core: rework cgroup mask propagation Previously a cgroup setting down tree would result in cgroup membership additions being propagated up the tree and to the siblings, however a unit could never lose cgroup memberships again. With this change we'll make sure that both cgroup additions and removals propagate properly.

core: make StopWhenUnneeded work in conjunction with units that fail during their start job https://bugzilla.redhat.com/show_bug.cgi?id=997031

core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it

core: allow PIDs to be watched by two units at the same time In some cases it is interesting to map a PID to two units at the same time. For example, when a user logs in via a getty, which is reexeced to /sbin/login that binary will be explicitly referenced as main pid of the getty service, as well as implicitly referenced as part of the session scope.

core: don't send duplicate SIGCONT when killing units

core: watch SIGCHLD more closely to track processes of units with no reliable cgroup empty notifier When a process dies that we can associate with a specific unit, start watching all other processes of that unit, so that we can associate those processes with the unit too. Also, for service units start doing this as soon as we get the first SIGCHLD for either control or main process, so that we can follow the processes of the service from one to the other, as long as process that remain are processes of the ones we watched that died and got reassigned to us as parent. Similar, for scope units start doing this as soon as the scope controller abandons the unit, and thus management entirely reverts to systemd. To abandon a unit introduce a new Abandon() scope unit method call.

core: only send SIGHUP when doing first kill, not when doing final sigkill

core: don't wait for non-control/non-main processes when killing processes on the host either Since the current kernel cgroup notification logic is easily confused by existing subgroups, let's do the same thing as in containers before. and just not wait for non-control and non-main processes. This should be corrected as soon as we have sane cgroup notifications from the kernel.

core: in containers, don't wait for cgroup empty notifications which will never come

core: use a bit more PID_FMT

core: introduce new KillMode=mixed which sends SIGTERM only to the main process, but SIGKILL to all daemon processes This should fix some race with terminating systemd --user, where the system systemd instance might race against the user systemd instance when sending SIGTERM.

core: require mounts for the root and working directories We know that launching a unit will fail if some required directories haven't been mounted yet. There's no point in starting it just to have it fail even before it gets a chance to run.

core: simplify check for path absoluteness Just a microopt.

Use enums to make it obvious what boolean params mean Suggested-by: Russ Allbery <rra@debian.org>

Add more _printf_'s for format-nonliterals Clang is a bit more strict wrt format-nonliterals: http://clang.llvm.org/docs/LanguageExtensions.html#format-string-checking Adding these extra printf attributes also makes gcc able to find more problems. E.g. this patch uncovers a format issue in udev-builtin-path_id.c Some parts looked intetional about breaking the format-nonliteral check. I added some supression for warnings there.

Get rid of our reimplementation of basename The only problem is that libgen.h #defines basename to point to it's own broken implementation instead of the GNU one. This can be fixed by #undefining basename.

systemd: treat reload failure as failure systemctl reload "suceeded" on stopped units, but it is documented to fail in this case. https://bugzilla.redhat.com/show_bug.cgi?id=1036845

bus: add .busname unit type to implement kdbus-style bus activation

core: initialize variable

service: add the ability for units to join other unit's PrivateNetwork= and PrivateTmp= namespaces

core: replace OnFailureIsolate= setting by a more generic OnFailureJobMode= setting and make use of it where applicable

core: include following set data in dump

cgroups: Cache controller masks and optimize queues.

core: convert PID 1 to libsystemd-bus This patch converts PID 1 to libsystemd-bus and thus drops the dependency on libdbus. The only remaining code using libdbus is a test case that validates our bus marshalling against libdbus' marshalling, and this dependency can be turned off. This patch also adds a couple of things to libsystem-bus, that are necessary to make the port work: - Synthesizing of "Disconnected" messages when bus connections are severed. - Support for attaching multiple vtables for the same interface on the same path. This patch also fixes the SetDefaultTarget() and GetDefaultTarget() bus calls which used an inappropriate signature. As a side effect we will now generate PropertiesChanged messages which carry property contents, rather than just invalidation information.

Fix RemainAfterExit services keeping a hold on console When a service exits succesfully and has RemainAfterExit set, its hold on the console (in m->n_on_console) wasn't released since the unit state didn't change.

core: some more _cleanup_free_

Only disable output on console during boot if needed If there are no more jobs on console, no need/we shouldn't disable output.

Remove dead code and unexport some calls "make check-api-unused" informs us about code that is not used anymore or that is exported but only used internally. Fix these all over the place.

list: make our list macros a bit easier to use by not requring type spec on each invocation We can determine the list entry type via the typeof() gcc construct, and so we should to make the macros much shorter to use.

drop-ins: check return value If the function failed, nothing serious would happen because unlink would probably return EFAULT, but this would obscure the real error and is a bit sloppy.

core: rework how we match mount units against each other Previously to automatically create dependencies between mount units we matched every mount unit agains all others resulting in O(n^2) complexity. On setups with large amounts of mount units this might make things slow. This change replaces the matching code to use a hashtable that is keyed by a path prefix, and points to a set of units that require that path to be around. When a new mount unit is installed it is hence sufficient to simply look up this set of units via its own file system paths to know which units to order after itself. This patch also changes all unit types to only create automatic mount dependencies via the RequiresMountsFor= logic, and this is exposed to the outside to make things more transparent. With this change we still have some O(n) complexities in place when handling mounts, but that's currently unavoidable due to kernel APIs, and still substantially better than O(n^2) as before. https://bugs.freedesktop.org/show_bug.cgi?id=69740

Do not realloc strings, which are already in the hashmap as keys This prevents corruption of the hashmap, because we would free() the keys in the hashmap, if the unit is already in there, with the same cgroup path.

dbus: use _cleanup_free_ instead of freeing ourself

core: optionally send SIGHUP in addition to the configured kill signal This is useful to fake session ends for processes like shells.

systemd,systemctl: export condition status and show failing condition $ systemctl --user status hoohoo hoohoo.service Loaded: loaded (/home/zbyszek/.config/systemd/user/hoohoo.service; static) Active: inactive (dead) start condition failed at Tue 2013-06-25 18:08:42 EDT; 1s ago ConditionPathExists=/tmp/hoo was not met Full information is exported over D-Bus: [(condition, trigger, negate, param, state),...] where state is one of "failed" (<0), "untested" (0), "OK" (>0). I've decided to use 0 for "untested", because it might be useful to differentiate different types of failure later on, without breaking compatibility. systemctl shows the failing condition, if there was a non-trigger failing condition, or says "none of the trigger conditions were met", because there're often many trigger conditions, and they must all fail for the condition to fail, so printing them all would consume a lot of space, and bring unnecessary attention to something that is quite low-level.

systemd: log failed conditions ConditionPathExists=/tmp/nosuchpath failed for nosuchpath.service.

systemd: do not output status messages once gettys are running Make Type=idle communication bidirectional: when bootup is finished, the manager, as before, signals idling Type=idle jobs to continue. However, if the boot takes too long, idling jobs signal the manager that they have had enough, wait a tiny bit more, and continue, taking ownership of the console. The manager, when signalled that Type=idle jobs are done, makes a note and will not write to the console anymore. This is a cosmetic issue, but quite noticable, so let's just fix it. Based on Harald Hoyer's patch. https://bugs.freedesktop.org/show_bug.cgi?id=54247 http://unix.stackexchange.com/questions/51805/systemd-messages-after-starting-login/

unit: check correct variable after strdup

core: simplify drop-in writing logic a bit let's make use of some format string magic!

cgroup: simplify how instantiated units are mapped to cgroups Previously for an instantiated unit foo@bar.service we created a cgroup foo@.service/foo@bar.service, in order to place all instances of the same template inside the same subtree. As we now implicitly add all instantiated units into one per-template slice we don't need this complexity anymore, and instance units can map directly to the cgroups of their full name.

core: implicitly create a per-template slice for all instantiated units by default If no explicit slice is configured for an instantiated unit, create an implicit one for all instances of the same template.

unit: when deserializing cgroup path add it back into cgroup hashmap Also, properly remove cgroup path from hashmap when freeing unit.

core: serialize/deserialize bus subscribers

core: make GC more aggressive Since we should allow registering/unregistering transient units with the same name in a tight-loop, we need to make the GC more aggressive, so that dead units are cleaned up immediately instead of later. hence, execute the GC sweep on every event loop iteration and clean up units. This of course, means we need to be careful with adding units to the GC queue, which we already are since we execute check_gc() of each unit type already when adding something to the queue.

machined: sync to /run after job completed

core: add new "scope" unit type for making a unit of pre-existing processes "Scope" units are very much like service units, however with the difference that they are created from pre-existing processes, rather than processes that systemd itself forks off. This means they are generated programmatically via the bus API as transient units rather than from static configuration read from disk. Also, they do not provide execution-time parameters, as at the time systemd adds the processes to the scope unit they already exist and the parameters cannot be applied anymore. The primary benefit of this new unit type is to create arbitrary cgroups for worker-processes forked off an existing service. This commit also adds a a new mode to "systemd-run" to run the specified processes in a scope rather then a transient service.

core: add transient units Transient units can be created via the bus API. They are configured via the method call parameters rather than on-disk files. They are subject to normal GC. Transient units currently may only be created for services (however, we will extend this), and currently only ExecStart= and the cgroup parameters can be configured (also to be extended). Transient units require a unique name, that previously had no configuration file on disk. A tool systemd-run is added that makes use of this functionality to run arbitrary command lines as transient services: $ systemd-run /bin/ping www.heise.de Will cause systemd to create a new transient service and run ping in it.

unit: make sure the dropins we write are high-priority

dbus: make more cgroup attributes runtime settable

dbus: add infrastructure for changing multiple properties at once on units and hook some cgroup attributes up to it This introduces two bus calls to make runtime changes to selected bus properties, optionally with persistence. This currently hooks this up only for three cgroup atributes, but this brings the infrastructure to add more changable attributes. This allows setting multiple attributes at once, and takes an array rather than a dictionary of properties, in order to implement simple resetting of lists using the same approach as when they are sourced from unit files. This means, that list properties are appended to by this call, unless they are first reset via assigning the empty list.

core: general cgroup rework Replace the very generic cgroup hookup with a much simpler one. With this change only the high-level cgroup settings remain, the ability to set arbitrary cgroup attributes is removed, so is support for adding units to arbitrary cgroup controllers or setting arbitrary paths for them (especially paths that are different for the various controllers). This also introduces a new -.slice root slice, that is the parent of system.slice and friends. This enables easy admin configuration of root-level cgrouo properties. This replaces DeviceDeny= by DevicePolicy=, and implicitly adds in /dev/null, /dev/zero and friends if DeviceAllow= is used (unless this is turned off by DevicePolicy=).

logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.

core: unref slice ref after use

core: add new .slice unit type for partitioning systems In order to prepare for the kernel cgroup rework, let's introduce a new unit type to systemd, the "slice". Slices can be arranged in a tree and are useful to partition resources freely and hierarchally by the user. Each service unit can now be assigned to one of these slices, and later on login users and machines may too. Slices translate pretty directly to the cgroup hierarchy, and the various objects can be assigned to any of the slices in the tree.

core: unit_inactive_or_pending() should actually do as it claims

Add __attribute__((const, pure, format)) in various places I'm assuming that it's fine if a _const_ or _pure_ function calls assert. It is assumed that the assert won't trigger, and even if it does, it can only trigger on the first call with a given set of parameters, and we don't care if the compiler moves the order of calls.

cgroup: do not allow manipulating the cgroup path of units within the systemd:/system subtree

core: remove duplicate MESSAGE= from log message This was needed with log_struct_unit() but log_notice_unit() adds it anyway.

Add some extra __attribute__ ((format)) s

unit: rework stop pending logic When a trigger unit wants to know if a stop is queued for it, we should just check precisely that and do not check whether it is actually stopped already. This is because we use these checks usually from state change calls where the state variables are not updated yet. This change splits unit_pending_inactive() into two calls unit_inactive_or_pending() and unit_stop_pending(). The former checks state and pending jobs, the latter only pending jobs.

cgroup: always validate cgroup controller names Let's better be safe than sorry.

unit: rework trigger dependency logic Instead of having explicit type-specific callbacks that inform the triggering unit when a triggered unit changes state, make this generic so that state changes are forwarded betwee any triggered and triggering unit. Also, get rid of UnitRef references from automount, timer, path units, to the units they trigger and rely exclsuively on UNIT_TRIGGER type dendencies.

cgroup: make sure all our cgroup objects have a suffix and are properly escaped Session objects will now get the .session suffix, user objects the .user suffix, nspawn containers the .nspawn suffix. This also changes the user cgroups to be named after the numeric UID rather than the username, since this allows us the parse these paths standalone without requiring access to the cgroup file system. This also changes the mapping of instanced units to cgroups. Instead of mapping foo@bar.service to the cgroup path /user/foo@.service/bar we will now map it to /user/foo@.service/foo@bar.service, in order to ensure that all our objects are properly suffixed in the tree.

core: log a few more things under UNIT=...

core: let's make our log messages proper sentences with full stops

Use initalization instead of explicit zeroing Before, we would initialize many fields twice: first by filling the structure with zeros, and then a second time with the real values. We can let the compiler do the job for us, avoiding one copy. A downside of this patch is that text gets slightly bigger. This is because all zero() calls are effectively inlined: $ size build/.libs/systemd text data bss dec hex filename before 897737 107300 2560 1007597 f5fed build/.libs/systemd after 897873 107300 2560 1007733 f6075 build/.libs/systemd … actually less than 1‰. A few asserts that the parameter is not null had to be removed. I don't think this changes much, because first, it is quite unlikely for the assert to fail, and second, an immediate SEGV is almost as good as an assert.

util: make time formatting a bit smarter Instead of outputting "5h 55s 50ms 3us" we'll now output "5h 55.050003s". Also, while outputting the accuracy is configurable. Basically we now try use "dot notation" for all time values > 1min. For >= 1s we use 's' as unit, otherwise for >= 1ms we use 'ms' as unit, and finally 'us'. This should give reasonably values in most cases.

util: rename write_one_line_file() to write_string_file() You can write much more than just one line with this call (and we frequently do), so let's correct the naming.

Replace s/Dropin/DropIn/

Introspect and monitor dropin configuration

unit: never retroactively start requisites Requesites are not supposed to be auto-started afterall, they are just checks, so don't try to be smarter here than appropriate. Based on a patch from Michal Schmidt.

exec: Assigning the empty string to CapabilityBoundSet= should drop all caps Previously, it would set all caps, but it should drop them all, anything else makes little sense. Also, document that this works as it does, and what to do in order to assign all caps to the bounding set. https://bugzilla.redhat.com/show_bug.cgi?id=914705

core: single unit_kill implementation for all unit types There are very few differences in the implementations of the kill method in the unit types that have one. Let's unify them. This does not yet unify unit_kill() with unit_kill_context().

unit: count deserialized job only after it's definitely installed Installation of a deserialized job may fail (though purely in theory), so increase the running job counter only when succeeding.

core: fix running jobs counters after reload/reexec All active units will call unit_notify() during coldplug, so we just make sure we're counting from zero again and get the correct result for n_on_console. For n_running_jobs we likewise reset it to zero and then count the running jobs as we encounter them in deserialization.

unit: fix the race in deserialization. unit_notify is fired in deserelization code (particulary in service_set_state). Units passed in random order, and there is possibility, that unit with StopWhenUnneeded=yes passed before it actual dependecies. In that case unit will be stopped as unneeded, because deps in UNIT_INACTIVE state yet. So, reuse similar logic (unit.c:1421) to avoid this race

core: count active units that may mind our printing to /dev/console

core/unit: use a temp variable for manager pointer in unit_notify()

core: redefine unit_status_printf() Take advantage of the fact that almost all callers want to pass unit description as the last parameter. Those who don't can use the more flexible manager_status_printf().

core: add manager_status_printf() unit_status_printf() checks the state of the manager, not of the unit as such. Move it to manager.c and rename it to manager_status_printf(). Temporarily keep unit_status_printf as a wrapper macro.

unit: rework resource management API This introduces a new static list of known attributes and their special semantics. This means that cgroup attribute values can now be automatically translated from user to kernel notation for command line set settings, too. This also adds proper support for multi-line attributes.

unit: don't Require systemd-journald.socket from units It is not really necessary to have a hard requirement dependency on systemd-journald.socket in almost every unit. The socket gets pulled into boot via at least two ways: sockets.target -> systemd-journald.socket sysinit.target -> systemd-journald.service -> systemd-journald.socket So just assume something pulled the socket in and drop the automatic requirement dependencies on it. "systemctl stop systemd-journald.socket" will now not take the whole system down with it.

honor SELinux labels, when creating and writing config files Also split out some fileio functions to fileio.c and provide a SELinux aware pendant in fileio-label.c see https://bugzilla.redhat.com/show_bug.cgi?id=881577