tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

core: rework unit timeout handling, and add new setting RuntimeMaxSec= This clean-ups timeout handling in PID 1. Specifically, instead of storing 0 in internal timeout variables as indication for a disabled timeout, use USEC_INFINITY which is in-line with how we do this in the rest of our code (following the logic that 0 means "no", and USEC_INFINITY means "never"). This also replace all usec_t additions with invocations to usec_add(), so that USEC_INFINITY is properly propagated, and sd-event considers it has indication for turning off the event source. This also alters the deserialization of the units to restart timeouts from the time they were originally started from. Before this patch timeouts would be restarted beginning with the time of the deserialization, which could lead to artificially prolonged timeouts if a daemon reload took place. Finally, a new RuntimeMaxSec= setting is introduced for service units, that specifies a maximum runtime after which a specific service is forcibly terminated. This is useful to put time limits on time-intensive processing jobs. This also simplifies the various xyz_spawn() calls of the various types in that explicit distruction of the timers is removed, as that is done anyway by the state change handlers, and a state change is always done when the xyz_spawn() calls fail. Fixes: #2249

core: fix support for transient resource limit properties Make sure we can properly process resource limit properties. Specifically, allow transient configuration of both the soft and hard limit, the same way from the unit files. Previously, only the the hard rlimits could be configured but they'd implicitly spill into the soft hard rlimits. This also updates the client-side code to be able to parse hard/soft resource limit specifications. Since we need to serialize two properties in bus_append_unit_property_assignment() now, the marshalling of the container around it is now moved into the function itself. This has the benefit of shortening the calling code. As a side effect this now beefs up the rlimit parser of "systemctl set-property" to understand time and disk sizes where that's appropriate.

shared: simplify parsing of bus properties a bit Let's write the property name and value in one call, when that's possible, shorthing our code a bit.

core: fix handling of AccuracyUSec and RandomDelayUSec bus properties Clear up some confusion regarding the USec and Sec suffixes we use. In configuration files we usually use the Sec suffix, to indicate the implied time unit if none is specified. The respective bus properties however use the USec property, since they expose 64bit unsigned integers containing time in µs. Before this patch timer units exposed a bus property AccuracyUSec (which hence is the correct name) but when parsing transient property data would look for AccuracySec instead (which is incorrect). This patch ensures we look for AccuracySec correctly, but keeps the code for AccuracyUSec in place for compatibility, but adds a warning to ensure that apps are updated to use the right property.

systemctl: improve message when a job fails with a JOB_INVALID state This result can only happen if the job was a reload job for an inactive unit. Make the error message actually say that.

bus-util: print "systemctl --user" on user service manager When a unit was started with "systemctl --user" and it failed, error messages is printed as "systemctl status". But it should be "systemctl --user status".

shared: include what we use The next step of a general cleanup of our includes. This one mostly adds missing includes but there are a few removals as well.

core: expose soft limits on the bus This is a follow-up for https://github.com/systemd/systemd/pull/1994 See https://github.com/systemd/systemd/pull/1994#issuecomment-160087219

tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy GLIB has recently started to officially support the gcc cleanup attribute in its public API, hence let's do the same for our APIs. With this patch we'll define an xyz_unrefp() call for each public xyz_unref() call, to make it easy to use inside a __attribute__((cleanup())) expression. Then, all code is ported over to make use of this. The new calls are also documented in the man pages, with examples how to use them (well, I only added docs where the _unref() call itself already had docs, and the examples, only cover sd_bus_unrefp() and sd_event_unrefp()). This also renames sd_lldp_free() to sd_lldp_unref(), since that's how we tend to call our destructors these days. Note that this defines no public macro that wraps gcc's attribute and makes it easier to use. While I think it's our duty in the library to make our stuff easy to use, I figure it's not our duty to make gcc's own features easy to use on its own. Most likely, client code which wants to make use of this should define its own: #define _cleanup_(function) __attribute__((cleanup(function))) Or similar, to make the gcc feature easier to use. Making this logic public has the benefit that we can remove three header files whose only purpose was to define these functions internally. See #2008.

core: rename Random* to RandomizedDelay* The name RandomSec is too generic: "Sec" just specifies the default unit type, and "Random" by itself is not enough. Rename to something that should give the user general idea what the setting does without looking at documentation.

core: add new RandomSec= setting for time units This allows configuration of a random time on top of the elapse events, in order to spread time events in a network evenly across a range.

bus-util: make sure --property=RemainAfterElapse=1 works

bus-util: add in forgotten error messages

execute: Add new PassEnvironment= directive This directive allows passing environment variables from the system manager to spawned services. Variables in the system manager can be set inside a container by passing `--set-env=...` options to systemd-spawn. Tested with an on-disk test.service unit. Tested using multiple variable names on a single line, with an empty setting to clear the current list of variables, with non-existing variables. Tested using `systemd-run -p PassEnvironment=VARNAME` to confirm it works with transient units. Confirmed that `systemctl show` will display the PassEnvironment settings. Checked that man pages are generated correctly. No regressions in `make check`.

Teach bus_append_unit_property_assignment() about 'Delegate' property

process-util: move a couple of process-related calls over

util-lib: split out allocation calls into alloc-util.[ch]

util-lib: split out printf() helpers to stdio-util.h

user-util: move UID/GID related macros from macro.h to user-util.h

util-lib: split out syslog-related calls into syslog-util.[ch]

util-lib: move /proc/cmdline parsing code to proc-cmdline.[ch]

util-lib: split out resource limits related calls into rlimit-util.[ch]

util-lib: split string parsing related calls from util.[ch] into parse-util.[ch]

run: can launch units with RuntimeDirectory

run: can launch units with ProtectHome

util-lib: split out fd-related operations into fd-util.[ch] There are more than enough to deserve their own .c file, hence move them over.

run: can launch units with ProtectSystem

util-lib: split our string related calls from util.[ch] into its own file string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.

util: split out escaping code into escape.[ch] This really deserves its own file, given how much code this is now.

run: can launch units with ReadWriteDirectories, ReadOnlyDirectories, InaccessibleDirectories

run: fix Environment parsing * `Environment=` resets previous assignments * `Environment='a=1 b=2'` sets `a` to `1` and `b` to `2` * `Environment='"a=1 2" b=2"'` sets `a` to `1 2` and `b` to `2`

Hook more properties for transient units systemd-run can now launch units with EnvironmentFile set.

run: can launch units with OOMScoreAdjust

run: can launch units with TimerSlackNSec

systemd-run: can launch units with SyslogFacility

systemd-run: can launch units with SyslogLevel

bus-util: change `Default`-chopping to `Limit`-searching See https://github.com/systemd/systemd/pull/1534#commitcomment-13744013 Actually, thinking about this, maybe it would be nicer to actually look for "Limit" in the string rather than chopping off a "Default".... Sounds more generic...

core: manager: expose DefaultLimit* as properties on dbus

bus-util: add bus_property_get_rlimit (move from core/dbus_execute)

systemd-run can now launch units with SyslogIdentifier

systemd-run can now launch units with SyslogLevelPrefix

bus-util: rename bus_open_transport() to bus_connect_transport() In sd-bus, the sd_bus_open_xyz() family of calls allocates a new bus, while sd_bus_default_xyz() family tries to reuse the thread's default bus. bus_open_transport() sometimes internally uses the former, sometimes the latter family, but suggests it only calls the former via its name. Hence, let's avoid this confusion, and generically rename the call to bus_connect_transport(). Similar for all related calls. And while we are at it, also change cgls + cgtop to do direct systemd connections where possible, since all they do is talk to systemd itself.

Hook more properties for transient units systemd-run can now launch units with WorkingDirectory, RootDirectory set.

core: refactor cpu shares/blockio weight cgroup logic Let's stop using the "unsigned long" type for weights/shares, and let's just use uint64_t for this, as that's what we expose on the bus. Unify parsers, and always validate the range for these fields. Correct the default blockio weight to 500, since that's what the kernel actually uses. When parsing the weight/shares settings from unit files accept the empty string as a way to reset the weight/shares value. When getting it via the bus, uniformly map (uint64_t) -1 to unset. Open up StartupCPUShares= and StartupBlockIOWeight= to transient units.

Hook more properties for transient units systemd-run can now launch units with PrivateTmp, PrivateDevices, PrivateNetwork, NoNewPrivileges set.

core: add support for the "pids" cgroup controller This adds support for the new "pids" cgroup controller of 4.3 kernels. It allows accounting the number of tasks in a cgroup and enforcing limits on it. This adds two new setting TasksAccounting= and TasksMax= to each unit, as well as a gloabl option DefaultTasksAccounting=. This also updated "cgtop" to optionally make use of the new kernel-provided accounting. systemctl has been updated to show the number of tasks for each service if it is available. This patch also adds correct support for undoing memory limits for units using a MemoryLimit=infinity syntax. We do the same for TasksMax= now and hence keep things in sync here.

tree-wide: never use the off_t unless glibc makes us use it off_t is a really weird type as it is usually 64bit these days (at least in sane programs), but could theoretically be 32bit. We don't support off_t as 32bit builds though, but still constantly deal with safely converting from off_t to other types and back for no point. Hence, never use the type anymore. Always use uint64_t instead. This has various benefits, including that we can expose these values directly as D-Bus properties, and also that the values parse the same in all cases.

tree-wide: use coccinelle to patch a lot of code to use mfree() This replaces this: free(p); p = NULL; by this: p = mfree(p); Change generated using coccinelle. Semantic patch is added to the sources.

bus-util: support details in CheckAuthorization calls Extra details for an action can be supplied when calling polkit's CheckAuthorization method. Details are a list of key/value string pairs. Custom policy can use these details when making authorization decisions.

Revert "sd-bus: do not connect to dbus-1 socket when kdbus is available" This reverts commit d4d00020d6ad855d65d31020fefa5003e1bb477f. The idea of the commit is broken and needs to be reworked. We really cannot reduce the bus-addresses to a single address. We always will have systemd with native clients and legacy clients at the same time, so we also need both addresses at the same time.

bus-util: make more properties settable in --property= Add a couple of new properties to the supported set we can pass in systemd-run's and systemd-nspawn's --property= switch.

sd-bus: do not connect to dbus-1 socket when kdbus is available We should not fall back to dbus-1 and connect to the proxy when kdbus returns an error that indicates that kdbus is running but just does not accept new connections because of quota limits or something similar. Using is_kdbus_available() in libsystemd/ requires it to move from shared/ to libsystemd/. Based on a patch from David Herrmann: https://github.com/systemd/systemd/pull/886

tree-wide: fix indentation

turn kdbus support into a runtime option ./configure --enable/disable-kdbus can be used to set the default behavior regarding kdbus. If no kdbus kernel support is available, dbus-dameon will be used. With --enable-kdbus, the kernel command line option "kdbus=0" can be used to disable kdbus. With --disable-kdbus, the kernel command line option "kdbus=1" is required to enable kdbus support.

build-sys: split internal basic/ library from shared/ basic/ can be used by everything cannot use anything outside of basic/ libsystemd/ can use basic/ cannot use shared/ shared/ can use libsystemd/