tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

src/basic: rename audit.[ch] → audit-util.[ch] and capability.[ch] → capability-util.[ch] The files are named too generically, so that they might conflict with the upstream project headers. Hence, let's add a "-util" suffix, to clarify that this are just our utility headers and not any official upstream headers.

util-lib: move a number of fs operations into fs-util.[ch]

util-lib: split out user/group/uid/gid calls into user-util.[ch]

util-lib: split out fd-related operations into fd-util.[ch] There are more than enough to deserve their own .c file, hence move them over.

tree-wide: add more void casts for various syscall invocations

timesyncd: fix how we print a PID

timesyncd: remove RLIMIT_NPROC NSS plugins might create additional threads. Remove the limit, we cannot really make any assumptions here.

everywhere: port everything to sigprocmask_many() and friends This ports a lot of manual code over to sigprocmask_many() and friends. Also, we now consistly check for sigprocmask() failures with assert_se(), since the call cannot realistically fail unless there's a programming error. Also encloses a few sd_event_add_signal() calls with (void) when we ignore the return values for it knowingly.

util: split out signal-util.[ch] from util.[ch] No functional changes.

remove unused includes This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.

timesyncd: set RLIMIT_NPROC to 2 This way timesyncd cannot be used to fork(). Note that it generally is not safe to use RLIMIT_NPROC, since it breaks running the same daemon in multiple containers if they do not use user namespacing. However, timesyncd is excepted from running in a container anyway, hence it is safe in this case.

treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.

treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.

treewide: auto-convert the simple cases to log_*_errno() As a followup to 086891e5c1 "log: add an "error" parameter to all low-level logging calls and intrdouce log_error_errno() as log calls that take error numbers", use sed to convert the simple cases to use the new macros: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\("(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_\1_errno(-\4, "\2%m"\3);/' Multi-line log_*() invocations are not covered. And we also should add log_unit_*_errno().

notify: send STOPPING=1 from our daemons

timesyncd: split up into multiple source file The source file got much too large, hence split up the sources into multiple per-object files, similar in style to resolved.

timesyncd: move the generic sockaddr_equal() call to socket-util.h

timesyncd: when we don't know anything about the network state, assume we are online This should provide better compatibility with systems that lack networkd

timesyncd: always use CLOCK_BOOTTIME if we can After all we want to compare a monotonically increasing clock with the remote clock, hence we shouldn't ignore system suspend periods.

Properly report invalid quoted strings $ systemd-analyze verify trailing-g.service [./trailing-g.service:2] Trailing garbage, ignoring. trailing-g.service lacks ExecStart setting. Refusing. Error: org.freedesktop.systemd1.LoadFailed: Unit trailing-g.service failed to load: Invalid argument. Failed to create trailing-g.service/start: Invalid argument

Reject invalid quoted strings String which ended in an unfinished quote were accepted, potentially with bad memory accesses. Reject anything which ends in a unfished quote, or contains non-whitespace characters right after the closing quote. _FOREACH_WORD now returns the invalid character in *state. But this return value is not checked anywhere yet. Also, make 'word' and 'state' variables const pointers, and rename 'w' to 'word' in various places. Things are easier to read if the same name is used consistently. mbiebl_> am I correct that something like this doesn't work mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-passwd "Unlock EncFS"' mbiebl_> systemd seems to strip of the quotes mbiebl_> systemctl status shows mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-password Unlock EncFS $RootDir $MountPoint mbiebl_> which is pretty weird

core: only set the kernel's timezone when the RTC runs in local time We can not reliably manage any notion of local time. Every daylight saving time change or time zone change by traveling will make the time jump, and the local time might jump backwards which creates unsolvable problems with file timestamps. We will no longer tell the kernel our local time zone and leave everything set to UTC. This will effectively turn FAT timestamps into UTC timestamps. If and only if the machine is configured to read the RTC in local time mode, the kernel's time zone will be configured, but systemd-timesysnc will disable the kernel's system time to RTC syncing. In this mode, the RTC will not be managed, and external tools like Windows bootups are expected to manage the RTC's time. https://bugs.freedesktop.org/show_bug.cgi?id=81538

sd-network: fix parameter order for sd_network_monitor_new() Constructors should return the object they created as first parameter, except when they are generated as a child/member object of some other object in which case that should be first.

Let config_parse open file where applicable Special care is needed so that we get an error message if the file failed to parse, but not when it is missing. To avoid duplicating the same error check in every caller, add an additional 'warn' boolean to tell config_parse whether a message should be issued. This makes things both shorter and more robust wrt. to error reporting.

Constify ConfigTableItem tables

timesyncd: add sockaddr_pretty wrapper

timesyncd: only listen to clock changes when connected This reverts previous commit and applies a different fix. manager_clock_watch() callback calls manager_send_request() to kick off a resync. We can only do that when we're actually connected to something. It is not useful to setup the callback from manager_new(). Now the callback will be dropped in manager_connect() and requested in manager_begin(). https://bugs.freedesktop.org/show_bug.cgi?id=80932

timesyncd: suppress resync at system time change when not connected Jul 04 17:46:03 orchid systemd[1]: Starting Network Time Synchronization... Jul 04 17:46:03 orchid systemd[1]: Started Network Time Synchronization. Jul 04 17:46:22 orchid systemd-timesyncd[301]: System time changed. Resyncing. Jul 04 17:46:22 orchid systemd-timesyncd[301]: Assertion 'm->current_server_name' https://bugs.freedesktop.org/show_bug.cgi?id=80932

resolved: make use of union in_addr_union in resolved, too

timesyncd: split privilege dropping code out of timesyncd so that we can make use of it from other daemons too This is preparation to make networkd work as unpriviliged user.

timesysnc: reword network watching messages, and move resolver errors to debug

timesyncd: only update stamp file when we are synchronized Create initial stamp file with compiled-in time to prevent bootups with clocks in the future from storing invalid timestamps. At shutdown, only update the timestamp if we got an authoritative time to store.

time-util: make sure USEC_PER_SEC and friends are actually of type usec_t

timesyncd: use STR_IN_SET()

timesyncd: fix english language typo

timesyncd: save clock to disk everytime we get an NTP fix, and bump clock at boot using this This is useful to make sure the system clock stays monotonic even on systems that lack an RTC. Also, why we are at it, also use the systemd release time for bumping the clock, since it's a slightly less bad than starting with jan 1st, 1970. This also moves timesyncd into the early bootphase, in order to make sure this initial bump is guaranteed to have finished by the time we start real daemons which might write to the file systemd and thus shouldn't leave 1970's timestamps all over the place...

timesyncd: only attempt to connect when an address is configured For now, we accept both link-local and routable addresses, maybe we want to restrict ourselves to routable addresses only.

fix spelling of privilege

timesyncd: make use of floating event sources for signal handling

timesyncd: enable watchdog support

timesyncd: run timesyncd as unpriviliged user "systemd-timesync" (but still with CAP_SYS_TIME)

timesyncd: fix typo in comment

timesyncd: fix error path return value https://bugs.freedesktop.org/show_bug.cgi?id=78752

timesyncd: read global operational state from networkd

timesyncd: only run when the system has a carrier on a network interface As the operational state detection in sd-network is still too primitive, timesyncd will likely try to connect a bit early, so the first attempt will fail.

timesyncd: shorten log message

timesyncd: never accept NTP time from server that is older than systemd's release time

timesyncd: read server settings from a configuration file Also, allow compiling in a default server list via a configure command line item.

timesyncd: when an NTP server doesn't respond, proceed with the next

list: make LIST_FIND_TAIL work for empty lists

timesyncd: keep order of NTP servers

timesyncd: make sure to reread /etc/resolv.conf when we try the next NTP server

timesyncd: accept NTP version 3 responses

timesyncd: add a more servers by default

timesyncd: also try next server when sendto() fails

timesyncd: don't busy loop when we cannot connect to any servers

timesyncd: properly handle multiple configured NTP servers and multiplei IP addresses per server name

timesyncd: lookup name server via sd-resolve, support IPv6, react to SIGINT/SITERM

timesync: use safe_close() where possible

timesync: always initialize structs when declaring them as far as possible with contsant values

timesyncd: log drift value as signed

timesyncd: log drift correction

timesyncd: use nanosecond mode

timesyncd: remove debug code

timesyncd: limit debug values to milliseconds

timesyncd: update log message

timesyncd: add unit and man page

rename timedate-sntp to timesync