tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

journald: fix LOG_AUTH facility in audit code Fixes: #2304

util-lib: split out allocation calls into alloc-util.[ch]

io-util.h: move iovec stuff from macro.h to io-util.h

util-lib: split out hex/dec/oct encoding/decoding into its own file

util-lib: split out fd-related operations into fd-util.[ch] There are more than enough to deserve their own .c file, hence move them over.

util-lib: split our string related calls from util.[ch] into its own file string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.

tree-wide: drop {} from one-line if blocks Patch via coccinelle.

journald: handle more gracefully when bind() fails on audit sockets

journal: use audit event names instead of numbers <audit-1400> is replaced by AVC, etc. A fallback mechanism is provided for unlisted event types. Occasionally new types are added to the kernel, but not too often. Add a simple "test", which simply prints the mapping.

journald: add syslog fields for audit messages Audit messages would be displayed as "unknown[1]". Also specify AUTH as facility... This seems to be the closest match (/* security/authorization messages */).

Assorted format fixes Types used for pids and uids in various interfaces are unpredictable. Too bad.

journald: prefix exported calls with "server_", unexport unnecessary calls

tree-wide: spelling fixes https://github.com/vlajos/misspell_fixer https://github.com/torstehu/systemd/commit/b6fdeb618cf2f3ce1645b3315f15f482710c7ffa Thanks to Torstein Husebo <torstein@huseboe.net>.

treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".

treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.

treewide: more log_*_errno + return simplifications

treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.

treewide: auto-convert the simple cases to log_*_errno() As a followup to 086891e5c1 "log: add an "error" parameter to all low-level logging calls and intrdouce log_error_errno() as log calls that take error numbers", use sed to convert the simple cases to use the new macros: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\("(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_\1_errno(-\4, "\2%m"\3);/' Multi-line log_*() invocations are not covered. And we also should add log_unit_*_errno().

journal: adjust audit log messages a bit

journald: include audit message type number in MESSAGE= string

journal: also consider audit fields with '-' valid

journald: don't pass around SO_TIMESTAMP timestamp for audit, which we don't have anyway

journald: suppress low-level audit text prefix in MESSAGE= field Let's make the log output more readable, and the header can be reconstructed in full from the other fields

journald: properly decode audit's proctitle= field

journald: enable audit in the kernel when initializing Similar to auditd actually turn on auditing as we are starting. This way we can operate entirely without auditd around.

journald: there's no point in turning on SO_TIMESTAMP for audit sockets, audit doesn't support timestamps anyway

journald: if available pull audit messages from the kernel into journal logs