tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

machine: fix typo: MS_MOUNT does not exist

tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy GLIB has recently started to officially support the gcc cleanup attribute in its public API, hence let's do the same for our APIs. With this patch we'll define an xyz_unrefp() call for each public xyz_unref() call, to make it easy to use inside a __attribute__((cleanup())) expression. Then, all code is ported over to make use of this. The new calls are also documented in the man pages, with examples how to use them (well, I only added docs where the _unref() call itself already had docs, and the examples, only cover sd_bus_unrefp() and sd_event_unrefp()). This also renames sd_lldp_free() to sd_lldp_unref(), since that's how we tend to call our destructors these days. Note that this defines no public macro that wraps gcc's attribute and makes it easier to use. While I think it's our duty in the library to make our stuff easy to use, I figure it's not our duty to make gcc's own features easy to use on its own. Most likely, client code which wants to make use of this should define its own: #define _cleanup_(function) __attribute__((cleanup(function))) Or similar, to make the gcc feature easier to use. Making this logic public has the benefit that we can remove three header files whose only purpose was to define these functions internally. See #2008.

util-lib: split out allocation calls into alloc-util.[ch]

user-util: move UID/GID related macros from macro.h to user-util.h

util-lib: move a number of fs operations into fs-util.[ch]

util-lib: split out fd-related operations into fd-util.[ch] There are more than enough to deserve their own .c file, hence move them over.

machined: when opening a shell via machined, pass tty fds in With this change we'll open the shell's tty right from machined and then pass it to the transient unit we create. This way we make sure the pty is opened exactly as long as the transient service is around, and no longer, and vice versa. This way pty forwarders do not have to deal with EIO problems due to vhangup, as the pty is open all the time from the point we set things up to the point where the service goes away.

core: allow setting WorkingDirectory= to the special value ~ If set to ~ the working directory is set to the home directory of the user configured in User=. This change also exposes the existing switch for the working directory that allowed making missing working directories non-fatal. This also changes "machinectl shell" to make use of this to ensure that the invoked shell is by default in the user's home directory. Fixes #1268.

nspawn, machined: fix comments and error messages A bunch of "Client -> Child" fixes and one barrier-enumerator fix. (David: rebased on master)

tree-wide: never use the off_t unless glibc makes us use it off_t is a really weird type as it is usually 64bit these days (at least in sane programs), but could theoretically be 32bit. We don't support off_t as 32bit builds though, but still constantly deal with safely converting from off_t to other types and back for no point. Hence, never use the type anymore. Always use uint64_t instead. This has various benefits, including that we can expose these values directly as D-Bus properties, and also that the values parse the same in all cases.

machined: improve error message when trying to get a bus in bus-less containers Now that we get useful error messages from sd-bus for container connections, let's make use of this and report better errors back to machined clients. Fixes #685.

bus-util: support details in CheckAuthorization calls Extra details for an action can be supplied when calling polkit's CheckAuthorization method. Details are a list of key/value string pairs. Custom policy can use these details when making authorization decisions.

machined: introduce a ptsname_namespace() call and make use of it The call is like ptsname() but does not assume the pty path was accessible in the local namespace. It uses the same internal ioctl though.

machined: call unlockpt() in container, not host It makes assumptions about the pty path, hence better call it in the container namespace rather than the host.

machined: beef up PolicyKit actions Introduce separate actions for creating login or shell sessions for the local host or a local container. By default allow local unprivileged clients to create new login sessions (which is safe, since getty will ask for username and authentication). Also, imply login privs from shell privs, as well as shell and login privs from manage privs.

machined: introduce pseudo-machine ".host" refererring to the host system Some of the operations machined/machinectl implement are also very useful when applied to the host system (such as machinectl login, machinectl shell or machinectl status), hence introduce a pseudo-machine by the name of ".host" in machined that refers to the host system, and may be used top execute operations on the host system with. This copies the pseudo-image ".host" machined already implements for image related commands. (This commit also adds a PK privilege for opening a PTY in a container, which was previously not accessible for non-root.)

machined: add new OpenShell() bus call This new bus call opens an interactive shell in a container. It works like the existing OpenLogin() call, but does not involve getty, and instead opens an arbitrary command line. This is similar to "systemd-run -t -M" but is controlled by a specific PolicyKit privilege.

namespace helpers: Allow entering a UID namespace To be able to use `systemd-run` or `machinectl login` on a container that is in a private user namespace, the sub-process must have entered the user namespace before connecting to the container's D-Bus, otherwise the UID and GID in the peer credentials are garbage. So we extend namespace_open and namespace_enter to support UID namespaces, and we enter the UID namespace in bus_container_connect_{socket,kernel}. namespace_open will degrade to a no-op if user namespaces are not enabled in the kernel. Special handling is required for the setns call in namespace_enter with a user namespace, since transitioning to your own namespace is forbidden, as it would result in re-entering your user namespace as root. Arguably it may be valid to check this at the call site, rather than inside namespace_enter, but it is less code to do it inside, and if the intention of calling namespace_enter is to *be* in the target namespace, rather than to transition to the target namespace, it is a reasonable approach. The check for whether the user namespace is the same must happen before entering namespaces, as we may not be able to access /proc during the intermediate transition stage. We can't instead attempt to enter the user namespace and then ignore the failure from it being the same namespace, since the error code is not distinct, and we can't compare namespaces while mid-transition.

machined: Relax path checks for Copy{From,To} Absolute paths should be sufficient to prevent funny business, and while path_is_safe() checks this, it also checks whether the path contains . or .. components, which while odd, aren't a security risk.

machine: remove unused variables

property callback returns are consistent It is no different to return 0 over 1 in the property callback. It is confusing to return 1 which made me think 1 has a special purpose. This way code is consistent with the rest of the tree.

turn kdbus support into a runtime option ./configure --enable/disable-kdbus can be used to set the default behavior regarding kdbus. If no kdbus kernel support is available, dbus-dameon will be used. With --enable-kdbus, the kernel command line option "kdbus=0" can be used to disable kdbus. With --disable-kdbus, the kernel command line option "kdbus=1" is required to enable kdbus support.

Stop talking about the "XDG" version of basename() XDG refers to X Desktop Group, a former name for freedesktop.org. This group is responsible for specifications like basedirs, .desktop files and icon naming, but as far as I know, it has never tried to redefine basename(). I think these references were meant to say XPG (X/Open Portability Guide), a precursor of POSIX. POSIX is better-known and less easily confused with XDG, and is how the basename(3) man page describes the libgen.h version of basename(). The other version of basename() is glibc-specific and is described in basename(3) as "the GNU version"; specifically mention that version, to disambiguate.

sd-bus: allow passing NULL as bus parameter to sd_bus_send() If NULL is specified for the bus it is now automatically derived from the passed in message. This commit also changes a number of invocations of sd_bus_send() to make use of this.

sd-bus: drop bus parameter from message callback prototype This should simplify the prototype a bit. The bus parameter is redundant in most cases, and in the few where it matters it can be derived from the message via sd_bus_message_get_bus().

shared: add process-util.[ch]

shared: add formats-util.h

machine: do not rely on asprintf setting arg on error Strictly speaking, the output variable is undefined if asprintf fails. We use the return value not the arg everywhere, and should we do here.

machined: use x-machine-unix prefix for the container bus on dbus1 This fixes "machinectl login" on systems configured with --disable-kdbus. The error was: machinectl login foo Failed to get machine PTY: Input/output error

machined: fix check if host directory could be opened CID#1271351

remove unused includes This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.

logind: open up most bus calls for unpriviliged processes, using PolicyKit Also, allow clients to alter their own objects without any further priviliges. i.e. this allows clients to kill and lock their own sessions without involving PK.

machined: open up most of machined's commands to unprivileged clients via PolicyKit

machined: make "machinectl copy-to" and "machinectl copy-from" server side operations This way, any bus client can make use of these calls.

machined: various simplifications

machined: move logic for bind mounting into containers from machinectl to machined This extends the bus interface, adding BindMountMachine() for bind mounting directories from the host into the container.

Revert "tree-wide: Always use recvmsg with MSG_CMSG_CLOEXEC" This reverts commit d6d810fbf8071f8510450dbacd1d083f37603656. It's apparently not OK to pass MSG_CMSG_CLOEXEC to recvmsg() of raw sockets.

tree-wide: Always use recvmsg with MSG_CMSG_CLOEXEC

machined: refuse certain operation on non-container machines, since they cannot work elsewhere

machined,bus-proxy: fix connecting to containers

machined: Move image discovery logic into src/shared, so that we can make use of it from nspawn

machined: remove spurious include of <sys/capability.h> They do not use any functions from libcap directly. The CAP_KILL constant in use by these files comes from <linux/capability.h> imported through "missing.h". Tested that "systemd-machined" builds cleanly and works after this change.

machined: introduce polkit for OpenLogin() call This way "machinectl login" can be opened up to run without privileges.

machined: add new call OpenMachineLogin() that starts a getty in a container on a pty and returns the pty master fd to the client This is a one-stop solution for "machinectl login", and should simplify getting logins in containers.

systemd-run: support -t mode when combined with -M For that, ask machined for a container PTY and use that.

machined: add OpenMachinePTY() bus call for allocating a PTY device within a container Then, port "machinectl" over to make use of it.

machined: add a full bus object for images

machined/machinectl: add logic to show list of available images This adds a new bus call to machined that enumerates /var/lib/container and returns all trees stored in it, distuingishing three types: - GPT disk images, which are files suffixed with ".gpt" - directory trees - btrfs subvolumes

copy: use btrfs reflinking only whe we know we copy full files

sd-bus: move common errors src/shared/bus-errors.h → src/libsystemd/sd-bus/bus-common-errors.h Stuff in src/shared/ should not use stuff from src/libsystemd/ really.

rtnl: when querying local addresses and gateways, take address family into account

networkd: add minimal client tool "networkd" to query network status In the long run this should become a full fledged client to networkd (but not before networkd learns bus support). For now, just pull interesting data out of networkd, udev, and rtnl and present it to the user, in a simple but useful output.

change type for address family to "int" Let's settle on a single type for all address family values, even if UNIX is very inconsitent on the precise type otherwise. Given that socket() is the primary entrypoint for the sockets API, and that uses "int", and "int" is relatively simple and generic, we settle on "int" for this.

shared: rename PROTO_ADDRESS_SIZE() to FAMILY_ADDRESS_SIZE() We mostly use "family" to refer to AF_INET, AF_INET6, etc, let's use this terminology here, too

machined: allow registering host-side network interfaces for communication with containers

machined: when querying addresses of a container, use same code as nss-myhostname uses

shared: split out in_addr related calls from socket-util.[ch] into its private in-addr-util.[ch] These are enough calls for a new file, and they are sufficiently different from the sockaddr-related calls, hence let's split this out.

machined: various modernizations when enumerating container addresses

machinectl: show /etc/os-release information of container in status output

machined: add logic to query IP addresses of containers

sd-bus: introduce sd_bus_slot objects encapsulating callbacks or vtables attached to a bus connection This makes callback behaviour more like sd-event or sd-resolve, and creates proper object for unregistering callbacks. Taking the refernce to the slot is optional. If not taken life time of the slot will be bound to the underlying bus object (or in the case of an async call until the reply has been recieved).

bus: replace sd_bus_label_{escape,unescape}() by new sd_bus_path_{encode,decode}() The new calls work similarly, but enforce a that a common, fixed bus path prefix is used. This follows discussions with Simon McVittie on IRC that it should be a good idea to make sure that people don't use the escaping applied here too wildly as anything other than the last label of a bus path.

Introduce strv_consume which takes ownership This mirrors set_consume and makes the common use a bit nicer.

machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined

bus: decorate the various object vtables with SD_BUS_VTABLE_PROPERTY_CONST where appropriate

bus: add new sd_bus_creds object to encapsulate process credentials This way we can unify handling of credentials that are attached to messages, or can be queried for bus name owners or connection peers. This also adds the ability to extend incomplete credential information with data from /proc, Also, provide a convenience call that will automatically determine the most appropriate credential object for an incoming message, by using the the attached information if possible, the sending name information if available and otherwise the peer's credentials.

bus: also add error parameter to object find and enumerator callbacks Just in order to bring things inline with the method and property callbacks.

bus: rework message handlers to always take an error argument Message handler callbacks can be simplified drastically if the dispatcher automatically replies to method calls if errors are returned. Thus: add an sd_bus_error argument to all message handlers. When we dispatch a message handler and it returns negative or a set sd_bus_error we send this as message error back to the client. This means errors returned by handlers by default are given back to clients instead of rippling all the way up to the event loop, which is desirable to make things robust. As a side-effect we can now easily turn the SELinux checks into normal function calls, since the method call dispatcher will generate the right error replies automatically now. Also, make sure we always pass the error structure to all property and method handlers as last argument to follow the usual style of passing variables for return values as last argument.

bus: let's simplify things by getting rid of unnecessary bus parameters

bus: add API calls to escape string components of objects paths

logind: add virtual object paths that always can be used to refer to the callers session, user, seat or machine object This way clients can skip invoking GetSessionByPID() for their own PID or a similar call to access these objects.

machined: simplifications

machined: port over to libsystemd-bus

logind: update the session state file before we send out the CreateSession() reply https://bugs.freedesktop.org/show_bug.cgi?id=67273

machined: correct how some properties are exported on the bus

machined: fix bus path unescaping

machined: split out machine registration stuff from logind Embedded folks don't need the machine registration stuff, hence it's nice to make this optional. Also, I'd expect that machinectl will grow additional commands quickly, for example to join existing containers and suchlike, hence it's better keeping that separate from loginctl.