tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy GLIB has recently started to officially support the gcc cleanup attribute in its public API, hence let's do the same for our APIs. With this patch we'll define an xyz_unrefp() call for each public xyz_unref() call, to make it easy to use inside a __attribute__((cleanup())) expression. Then, all code is ported over to make use of this. The new calls are also documented in the man pages, with examples how to use them (well, I only added docs where the _unref() call itself already had docs, and the examples, only cover sd_bus_unrefp() and sd_event_unrefp()). This also renames sd_lldp_free() to sd_lldp_unref(), since that's how we tend to call our destructors these days. Note that this defines no public macro that wraps gcc's attribute and makes it easier to use. While I think it's our duty in the library to make our stuff easy to use, I figure it's not our duty to make gcc's own features easy to use on its own. Most likely, client code which wants to make use of this should define its own: #define _cleanup_(function) __attribute__((cleanup(function))) Or similar, to make the gcc feature easier to use. Making this logic public has the benefit that we can remove three header files whose only purpose was to define these functions internally. See #2008.

tree-wide: sort includes Sort the includes accoding to the new coding style.

sd-bus: don't try to acquire connection selinux label unless selinux is actually enabled Otherwise we might end up mistaking a SMACK label for an selinux label. Also, fixes unexpect debug messages: http://lists.freedesktop.org/archives/systemd-devel/2015-November/034913.html

util-lib: split out allocation calls into alloc-util.[ch]

util-lib: split out printf() helpers to stdio-util.h

user-util: move UID/GID related macros from macro.h to user-util.h

src/basic: rename audit.[ch] → audit-util.[ch] and capability.[ch] → capability-util.[ch] The files are named too generically, so that they might conflict with the upstream project headers. Hence, let's add a "-util" suffix, to clarify that this are just our utility headers and not any official upstream headers.

util-lib: split our string related calls from util.[ch] into its own file string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.

Revert "sd-bus: do not connect to dbus-1 socket when kdbus is available" This reverts commit d4d00020d6ad855d65d31020fefa5003e1bb477f. The idea of the commit is broken and needs to be reworked. We really cannot reduce the bus-addresses to a single address. We always will have systemd with native clients and legacy clients at the same time, so we also need both addresses at the same time.

sd-bus: rename bloom-tag to arg0-has We use dashes in our bloom-tags. Make sure the newly introduced arg0has tag uses the same style. Note that the external dbus-tags don't use dashes, though. They are defined in the spec and we need to keep compatibility there.

sd-bus: introduce new match type "arg0has=" for matching arrays of strings Previously, sd-bus inofficially already supported bus matches that tested a string against an array of strings ("as"). This was done via an enhanced way to interpret "arg0=" matches. This is problematic however, since clients have no way to determine if their respective implementation understood strv matches or not, thus allowing invalid matches to be installed without a way to detect that. This patch changes the logic to only allow such matches with a new "arg0has=" syntax. This has the benefit that non-conforming implementations will return a parse error and a client application may thus efficiently detect support for the match type. Matches of this type are useful for "udev"-like systems that "tag" objects with a number of strings, and clients need to be able to match against any of these "tags". The name "has" takes inspiration from Python's ".has_key()" construct.

sd-bus: don't list activators as proper peers If a connection passed KDBUS_HELLO_ACTIVATOR, it cannot do I/O on the bus. Hence, we should not treat it as proper peer. To actually query it, you have to explicitly ask for activators. This makes kdbus in-line with what dbus-daemon does.

sd-bus: do not connect to dbus-1 socket when kdbus is available We should not fall back to dbus-1 and connect to the proxy when kdbus returns an error that indicates that kdbus is running but just does not accept new connections because of quota limits or something similar. Using is_kdbus_available() in libsystemd/ requires it to move from shared/ to libsystemd/. Based on a patch from David Herrmann: https://github.com/systemd/systemd/pull/886

sd-bus: fix parsing of KDBUS_CMD_LIST We *must not* assume that an entry returned by KDBUS_CMD_LIST only carries a single KDBUS_ITEM_OWNED_NAME. Similarly, we already parse multiple such items for message-metadata, so make sure we support the same on KDBUS_CMD_LIST. By relying on the kernel to return all names separately, we limit the kernel API significantly. Stop this and let the kernel decide how to return its data.

sd-bus: use isempty() consistently Instead of open-coding, use isempty() to check NULL or empty string for consistency.

sd-bus: properly match ID changes If the caller does not specify arg1 for NameOwnerChanged matches, we really must take the ID from arg2 or arg3, if provided. They are guaranteed to be identical to arg1 if either is supplied, but there is no strict requiredment that arg1 is supplied. Hence, make sure to always take the more restrictive match. Otherwise, we install rather wide matches without anyone requiring them.

sd-bus: destination-matches cannot match NameOwnerChanged Make sure we don't install NameOwnerChanged matches if the caller passed a destination='' match (except if it is the broadcast address). Per spec, all NameOwnerChanged signals are broadcasts. Only the NameLost/NameAcquired signals are unicasts, but those are never received through sd-bus. Instead, the bus-proxy synthesizes them and it already installs proper matches for them.

sd-bus: support matching on destination names Right now, we never install destination matches on kdbus as the kernel did not support MATCH rules on those. With the introduction of KDBUS_ITEM_DST_ID we can now match on destination IDs, so add explicit support for those. This requires a recent kdbus module to work. However, there seems to be no user-space that uses "Destination=''" matches, yet, so old kdbus modules still work fine (we couldn't find any real user). This is needed to match on unicast signals in bus-proxy. A followup will add support for this.

bus: we now support path_namespace=/ Our bloom-filters support root-path matching. Make sure we properly add the path_namespace= tag.

bus: fix arg0path= two-way matching DBus spec clearly defines arg0path= to be a two-way matching. That is, either the matcher or the matchee can be a prefix of the other to match. This is not possible to implement with bloom-filters. Instead, we'd have to add a separate filter for each prefix. This is non-trivial, though. Hence, just skip the match for now and match locally.

sd-bus: fix early exit when we lack all data in bus_get_owner_creds_dbus1()

sd-bus: store selinux context at connection time This appears to be the right time to do it for SOCK_STREAM unix sockets. Also: condition bus_get_owner_creds_dbus1 was reversed. Split it out to a separate variable for clarity and fix. https://bugzilla.redhat.com/show_bug.cgi?id=1224211

treewide: fix typos

sd-bus: properly handle creds that are known but undefined for a process A number of fields do not apply to all processes, including: there a processes without a controlling tty, without parent process, without service, user services or session. To distuingish these cases from the case where we simply don't have the data, always return ENXIO for them, while returning ENODATA for the case where we really lack the information. Also update the credentials dumping code to show this properly. Fields that are known but do not apply are now shown as "n/a". Note that this also changes some of the calls in process-util.c and cgroup-util.c to return ENXIO for these cases.

sd-bus: when bus operations are to be executed on direct connections always fail Also, don't consider this an loggable event, so that code that tries to read creds from a direct connection, doesn't generate logs.

sd-bus: expose ppid field kdbus has been passing us the ppid file for a while, actually make use of it.

tree-wide: there is no ENOTSUP on linux Replace ENOTSUP by EOPNOTSUPP as this is what linux actually uses.

sd-bus: sync kdbus.h (ABI break) After some reconsideration, we decided to move the binary protocol back to 64-bit wide UIDs and GIDs. After all, it should be possible to redefine [gu]id_t to uint64_t and things should continue to work. As we want to avoid such data types in kdbus.h, let's move back to 64-bit values and be safe. In sd-bus, we have to do a translation between uint64_t and gid_t now for supplementary gids. Some inline comments have also been updated in kdbus upstream.

sd-bus: sync kdbus.h Follow two small changes in the kdbus API: * Flags are now returned in cmd->return_flags by KDBUS_CMD_NAME_ACQUIRE * struct kdbus_item_list has been dropped. The information stored in this struct was redundant since awhile already, as all commands report their returned slice size anyway.

remove unused includes This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.

bus: sync with kdbus.git (ABI break) This syncs up the new KDBUS_CMD_CONN_INFO behavior: - attach-flags are passed in .attach_flags, instead of directly merged with the command flags.

sd-bus: initialize a few structs at time or declaration

bus: sync with kdbus (ABI break)

util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.

Add a snprinf wrapper which checks that the buffer was big enough If we scale our buffer to be wide enough for the format string, we should expect that the calculation was correct. char_array_0() invocations are removed, since snprintf nul-terminates the output in any case. A similar wrapper is used for strftime calls, but only in timedatectl.c.

Fix some format strings for enums, they are signed

bus: fix SD_BUS_CREDS_AUGMENT on kdbus queries If we set SD_BUS_CREDS_AUGMENT, we *need* the PID from the kernel so we can lookup further information from /proc. However, we *must* set SD_BUS_CREDS_PIDS in "mask", otherwise, our creds-collector will never actually copy the pid into "sd_bus_creds". Fix this, so SD_BUS_CREDS_AUGMENT works even if SD_BUS_CREDS_PID is not specified by the caller.

bus: fix typo Fix comment typo and clarify that this is not about privileges but can have rather arbitrary reasons.

bus: use EUID over UID and fix unix-creds Whenever a process performs an action on an object, the kernel uses the EUID of the process to do permission checks and to apply on any newly created objects. The UID of a process is only used if someone *ELSE* acts on the process. That is, the UID of a process defines who owns the process, the EUID defines what privileges are used by this process when performing an action. Process limits, on the other hand, are always applied to the real UID, not the effective UID. This is, because a process has a user object linked, which always corresponds to its UID. A process never has a user object linked for its EUID. Thus, accounting (and limits) is always done on the real UID. This commit fixes all sd-bus users to use the EUID when performing privilege checks and alike. Furthermore, it fixes unix-creds to be parsed as EUID, not UID (as the kernel always takes the EUID on UDS). Anyone using UID (eg., to do user-accounting) has to fall back to the EUID as UDS does not transmit the UID.

sd-bus: fix copy-paste error

sd-bus: always catch name requests for the special names "org.freedesktop.DBus" and "org.freedesktop.DBus.Local" and refuse them

bus: drop creds->capability_size The number of available caps can be read from /proc/sys/kernel/cap_last_cap during runtime. Our helper cap_last_cap() does that, so there's no reason to remember the size of any capability cache. We can just pre-allocate arrays with a suitable size for all available caps and reject any higher caps. The kernel capability API uses u32 as base so make sure we do the same. Note that this is specified by POSIX, so it's unlikely to change.

bus: sync with kdbus.git Sync up with recent kdbus changed: * several ioctls gained .size and .items members (but still unused) * CMD_SEND gained its own ioctl structure * several members of kdbus_msg were dropped as they were only used during SEND, not during RECV etc. * CMD_RECV and CMD_SEND now share a kdbus_reply member which contains the offset and size of the returned message.

sd-bus: get rid of PID starttime concept As kdbus no longer exports this, remove all traces from sd-bus too

sd-bus: catch up with current kdbus, don't do matches on kdbus monitor connections

bus-proxy: fix compat with autostarted services

treewide: introduce UID_INVALID (and friends) as macro for (uid_t) -1

sd-bus: rework credential query logic Also, make the call to free kdbus slices generic and use it everywhere

sd-bus: when we get the list of well-known names back from kdbus we shouldn't confuse the empty list with unknown information

sd-bus: given that the kernel now passes the auxgroups list as 32bit array to us, no need to convert to uid_t manually This way, we can save one allocation and avoid copying the array unnecesarily.

sd-bus: add suppot for renegotiating message credential attach flags

sd-bus: use free_and_strdup() where appropriate This simplifies things a bit and makes sure we free any previously set creds component before writing in a new one.

sd-bus: add supplementary groups list to creds object

sd-bus: properly handle uninitialized audit creds from kdbus

sd-bus: don't fail when querying creds and dbus1 refuses to tell us the selinux context

sd-bus: update to current kernel version, by splitting off the extended KDBUS_ITEM_PIDS structure from KDBUS_ITEM_CREDS Also: - adds support for euid, suid, fsuid, egid, sgid, fsgid fields. - makes augmentation of creds with data from /proc explicitly controllable to give apps better control over this, given that this is racy. - enables augmentation for kdbus connections (previously we only did it for dbus1). This is useful since with recent kdbus versions it is possible for clients to control the metadata they want to send. - changes sd_bus_query_sender_privilege() to take the euid of the client into consideration, if known - when we don't have permissions to read augmentation data from /proc, don't fail, just don't add the data in

sd-bus: pass attach flags to BUS_CREATOR_INFO kdbus learned parsing the attach flags for the KDBUS_CMD_BUS_CREATOR_INFO ioctl. Bits not set in this mask will not be exported. Set that field to _KDBUS_ATTACH_ALL for now. Signed-off-by: Daniel Mack <daniel@zonque.org>

sd-bus: rename "connection name" to "description" for the sd-bus API too kdbus recently renamed this concept, and so should we in what we expose in userspace.

sd-bus: sync kdbus.h (ABI break) Catch up with some changes in kdbus.h: * KDBUS_{ITEM,ATTACH}_CONN_NAME were renamed to KDBUS_{ITEM,ATTACH}_CONN_DESCRIPTION, so the term 'name' is not overloaded as much. * The item types were re-ordered a little so they are lined up to the order of the corresponding KDBUS_ATTACH flags * A new item type KDBUS_ITEM_OWNED_NAME was introduced, designated to store a struct kdbus_name in item->name. KDBUS_ITEM_NAME soley stores data in item->str now * Some kerneldoc fixes

sd-bus: sync kdbus.h (ABI break) Some comment fixes and header cleanups in kdbus.h, and the task capability meta information has been factored out to its own struct.

sd-bus: fix transition left-overs in sd_bus_get_owner_creds() sd_bus_get_owner_creds() was only halfly ported over to _cleanup_bus_creds_unref_.

sd-bus: implement sd_bus_get_owner_creds() for kdbus kdbus learned a new ioctl to tell userspace about a bus creator's credentials, which is what we need to implement sd_bus_get_owner_creds() for kdbus. Move the function from sd-bus.c to bus-control.c to be able to reuse the bus_populate_creds_from_items() helper.

sd-bus: rename sd_bus_get_owner_uid(), sd_bus_get_owner_machine_id() and sd_bus_get_peer_creds() Clean up the function namespace by renaming the following: sd_bus_get_owner_uid() → sd_bus_get_name_creds_uid() sd_bus_get_owner_machine_id() → sd_bus_get_name_machine_id() sd_bus_get_peer_creds() → sd_bus_get_owner_creds()

sd-bus: factor out creds item iterator We will re-use the code to walk items in order to populate a creds object, so let's factor it out first.

sd-bus: sync kdbus.h kdbus learned a new command to query a bus creator's credentials. Sync kdbus.h first, which also renames some struct to more generic terms. That is, however, not an ABI break this time.

sd-bus: sync kdbus.h (ABI break) In kdbus.h, the following details changed: * All commands gained a 'kernel_flags' field to report the flags supported by the driver. Before, this was done in the 'flags' field in a bidirectional way, which turned out to be a problem for the code in sd-bus, as many parts of it reuse the same ioctl struct more than once and consider them to be owned by userspace. * Name listings are now returned by a new struct instead of reusing struct kdbus_cmd_name for that matter. This way, we don't add more unneeded fields to it and make the API cleaner. * 'conn_flags' was renamed to 'flags' in struct kdbus_cmd_hello to make the API a bit more unified.

kdbus: free returned buffer when the memory is no longer needed

sd-bus: sync kdbus.h (ABI break) In kdbus.h, the 'features' field has been dropped again. Instead of negotiating features that way, we decided to make the kernel return the set of supported flags in each ioctl struct's .flags field, in both the success and error cases.

kdbus: fix buffer overflow in bus_get_owner_kdbus() function Commit 710fc9779b7c (kdbus repo) introduced attaching items[] instead of name[] in kdbus_cmd_conn_info struct. Commit 581fe6c81 (systemd repo) caught up with this change, but item size was not properly calculated.

sd-bus: sync kdbus.h (ABI break) The KDBUS_CMD_FREE ioctl now uses a struct rather than a direct pointer to the offset to free. The KDBUS_CMD_MSG_CANCEL ioctl has also changes, but there's no user of it yet in systemd.

sd-bus: sync kdbus.h (ABI break) struct kdbus_cmd_conn_info takes a list of items now instead of a string. Fix the only user in SD of that ioctl.

sd-bus: clean up string length calculation Move the +1 calculus onto the definition of the variable, just to make the code a little easier to read. No functional change.

sd-bus: sync kdbus.h (API break) Just a rename of two struct members to make the header file c++ compatible.

sd-bus: sync kdbus.h (API+ABI break) The kdbus logic name registry logic was changed to transport the actual name to acquire, release or report in a kdbus item. This brings the name API a little more in line with other calls, and allows for later augmentation. Follow that change on the systemd side.

bus: align kdbus ioctl parameters to 8byte All kdbus ioctl arguments must be 8byte aligned. Make sure we use alloca_align() and _alignas_(8) in all situations where gcc doesn't guarantee 8-byte alignment. Note that objects on the stack are always 8byte aligned as we put _alignas_(8) into the structure definition in kdbus.h.

bus-control: Fix cgroup handling On systems without properly setup systemd, cg_get_root_path returns -ENOENT. This means that busctl doesn't display much information. busctl monitor also fails whenever it intercepts messages. This fix fakes creates a fake "/" root cgroup which lets busctl work on such systems.

sd-bus: fix an assert when running in kdbus mode

sd-bus: don't hit assert when installing match

bus: remove "on behalf" kdbus logic (ABI break)

bus: catch up with kdbus changes (ABI break)

sd-bus: don't use assert_return() to check for disconnected bus connections A terminated connection is a runtime error and not a developer mistake, hence don't use assert_return() to check for it.

sd-bus: add proper monitoring API

Introduce strv_consume which takes ownership This mirrors set_consume and makes the common use a bit nicer.

api: in constructor function calls, always put the returned object pointer first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.

make gcc shut up If -flto is used then gcc will generate a lot more warnings than before, among them a number of use-without-initialization warnings. Most of them without are false positives, but let's make them go away, because it doesn't really matter.

bus: rework bloom filter logic to operate with variable bloom filter sizes and numbers of hash functions In order to make the bloom filter logic more future proof communicate bloom filter parameters from the original bus creator to the clients, and allow them to be variable within certain ranges.

bus: update kdbus.h (ABI break)

bus: change API to expose "inverted" no_reply and no_auto_start message flags non-inverted

bus: include connection name in credentials structure

libsystemd: split up into subdirs We still only produce on .so, but let's keep the sources separate to make things a bit less messy.