tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

udevd: do not clean up fds in main fds will also be closed during manager cleanup in run, leading to an error when we try to close them again. It is now possible to "leak" the fds on error, but it's an unlikely event and we will exit immediately anyway. Fixes #2418.

udevd: initialize fds to -1 and close them before exiting Little change in practice, because the program will exit soon afterwards, but the standard style of closing all fds is now followed. Also gets rid of gcc warning about fd_ctrl and fd_uevent being unitialized.

udev: add emacs header line Otherwise emacs wants to use 2-space indentation and other attrocities.

tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy GLIB has recently started to officially support the gcc cleanup attribute in its public API, hence let's do the same for our APIs. With this patch we'll define an xyz_unrefp() call for each public xyz_unref() call, to make it easy to use inside a __attribute__((cleanup())) expression. Then, all code is ported over to make use of this. The new calls are also documented in the man pages, with examples how to use them (well, I only added docs where the _unref() call itself already had docs, and the examples, only cover sd_bus_unrefp() and sd_event_unrefp()). This also renames sd_lldp_free() to sd_lldp_unref(), since that's how we tend to call our destructors these days. Note that this defines no public macro that wraps gcc's attribute and makes it easier to use. While I think it's our duty in the library to make our stuff easy to use, I figure it's not our duty to make gcc's own features easy to use on its own. Most likely, client code which wants to make use of this should define its own: #define _cleanup_(function) __attribute__((cleanup(function))) Or similar, to make the gcc feature easier to use. Making this logic public has the benefit that we can remove three header files whose only purpose was to define these functions internally. See #2008.

tree-wide: use right cast macros for UIDs, GIDs and PIDs

treewide: use the negative error codes returned by our functions Our functions return negative error codes. Do not rely on errno being set after calling our own functions.

util-lib: split out allocation calls into alloc-util.[ch]

socket-util: move CMSG_FOREACH() from macro.h to socket-util.h

user-util: move UID/GID related macros from macro.h to user-util.h

util-lib: move /proc/cmdline parsing code to proc-cmdline.[ch]

util-lib: move a number of fs operations into fs-util.[ch]

util-lib: split string parsing related calls from util.[ch] into parse-util.[ch]

util-lib: split out IO related calls to io-util.[ch]

util-lib: split out fd-related operations into fd-util.[ch] There are more than enough to deserve their own .c file, hence move them over.

util-lib: split our string related calls from util.[ch] into its own file string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.

basic: split out cpu set specific APIs into cpu-set-util.[ch]

tree-wide: drop {} from one-line if blocks Patch via coccinelle.

udev: ignore ENOEXEC from cgroup lookup The recent cgroup-rework changed the error code for un-mounted cgroupfs to ENOEXEC. Make sure udev ignores it just like ENOENT and does not spill warnings on the screen.

sd-event: make sure sd_event_now() cannot fail Previously, if the event loop never ran before sd_event_now() would fail. With this change it will instead fall back to invoking now(). This way, the function cannot fail anymore, except for programming error when invoking it with wrong parameters. This takes into account the fact that many callers did not handle the error condition correctly, and if the callers did, then they kept simply invoking now() as fall back on their own. Hence let's shorten the code using this call, and make things more robust, and let's just fall back to now() internally. Whether now() is used or the cache timestamp may still be detected via the return value of sd_event_now(). If > 0 is returned, then the fall back to now() was used, if == 0 is returned, then the cached value was returned. This patch also simplifies many of the invocations of sd_event_now(): the manual fall back to now() can be removed. Also, in cases where the call is invoked withing void functions we can now protect the invocation via assert_se(), acknowledging the fact that the call cannot fail anymore except for programming errors with the parameters. This change is inspired by #841.

udev: fix parameter process

udev: unify reporting of invalid cmdline keys This way it does not need distinct string literals and it also preserves the "rd." prefix.

udev: fix crash with invalid udev.log-priority Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1245293

tree-wide: fix write_string_file() user that should not create files The latest consolidation cleanup of write_string_file() revealed some users of that helper which should have used write_string_file_no_create() in the past but didn't. Basically, all existing users that write to files in /sys and /proc should not expect to write to a file which is not yet existant.

fileio: consolidate write_string_file*() Merge write_string_file(), write_string_file_no_create() and write_string_file_atomic() into write_string_file() and provide a flags mask that allows combinations of atomic writing, newline appending and automatic file creation. Change all users accordingly.

udev: destroy manager before cleaning environment Due to our _cleanup_ usage for the udev manager, it will be destroyed after the "exit:" label has finished. Therefore, it is the last destruction done in main(). This has two side-effects: - mac_selinux is destroyed before the udev manager is, possible causing use-after-free if the manager-cleanup accesses selinux data - log_close() is called *before* the manager is destroyed, possibly re-opening the log if you use --debug (and thus not re-applying the --debug option) Avoid this by moving the manager-handling into a new function called run(). This function will be left before we enter the "exit:" label in main(), hence, the manager object will be destroyed early.

udevd: force --debug mode to stderr https://github.com/systemd/systemd/issues/462

udev: worker - check return value of udev_monitor_enable_receiving() Fixes CID#1297430.

udevd: suppress warning if we don't find cgroup This is expected on non-systemd systems, so just log it at debug level. This fixes issue #309.

udved: remove dead code Leftover from 6af5e6a4c918a68b196a04346732e094e5373a36

udevd: daemon - connect /dev/null to std{in,out,err} in debug mode This is essentially a revert of 5c67cf2 and fixes issue #190.

udev: don't close FDs before dropping them from epoll Make sure we never close fds before we drop their related event-source. This will cause horrible disruptions if the fd-num is re-used by someone else. Under normal conditions, this should not cause any problems as the close() will drop the fd from the epoll-set automatically. However, this changes if you have any child processes with a copy of that fd. This fixes issue #163. Background: If you create an epoll-set via epoll_create() (lets call it 'EFD') you can add file-descriptors to it to watch for events. Whenever you call EPOLL_CTL_ADD on a file-descriptor you want to watch, the kernel looks up the attached "struct file" pointer, that this FD refers to. This combination of the FD-number and the "struct file" pointer is used as key to link it into the epoll-set (EFD). This means, if you duplicate your file-descriptor, you can watch this file-descriptor, too (because the duplicate will have a different FD-number, hence, the combination of FD-number and "struct file" is different as before). If you want to stop watching an FD, you use EPOLL_CTL_DEL and pass the FD to the kernel. The kernel again looks up your file-descriptor in your FD-table to find the linked "struct file". This FD-number and "struct file" combination is then dropped from the epoll-set (EFD). Last, but not least: If you close a file-descriptor that is linked to an epoll-set, the kernel does *NOTHING* regarding the epoll-set. This is a vital observation! Because this means, your epoll_wait() calls will still return the metadata you used to watch/subscribe your file-descriptor to events. There is one exception to this rule: If the file-descriptor that you just close()ed was the last FD that referred to the underlying "struct file", then _all_ epoll-set watches/subscriptions are destroyed. Hence, if you never dup()ed your FD, then a simple close() will also unsubscribe it from any epoll-set. With this in mind, lets look at fork(): Assume you have an epoll-set (EFD) and a bunch of FDs subscribed to events on that EFD. If you now call fork(), the new process gets a copy of your file-descriptor table. This means, the whole table is copied and the "struct file" reference of each FD is increased by 1. It is important to notice that the FD-numbers in the child are exactly the same as in the parent (eg., FD #5 in the child refers to the same "struct file" as FD #5 in the parent). This means, if the child calls EPOLL_CTL_DEL on an FD, the kernel will look up the linked "struct file" and drop the FD-number and "struct file" combination from the epoll-set (EFD). However, this will effectively drop the subscription that was installed by the parent. To sum up: even though the child gets a duplicate of the EFD and all FDs, the subscriptions in the EFD are *NOT* duplicated! Now, with this in mind, lets look at what udevd does: Udevd has a bunch of file-descriptors that it watches in its sd-event main-loop. Whenever a uevent is received, the event is dispatched on its workers. If no suitable worker is present, a new worker is fork()ed to handle the event. Inside of this worker, we try to free all resources we inherited. However, the fork() call is done from a call-stack that is never rewinded. Therefore, this call stack might own references that it drops once it is left. Those references we cannot deduce from the fork()'ed process; effectively causing us to leak objects in the worker (eg., the call to sd_event_dispatch() that dispatched our uevent owns a reference to the sd_event object it used; and drops it again once the function is left). (Another example is udev_monitor_ref() for each 'worker' that is also inherited by all children; thus keeping the udev-monitor and the uevent-fd alive in all children (which is the real cause for bug #163)) (The extreme variant is sd_event_source_unref(), which explicitly keeps event-sources alive, if they're currently dispatched, knowing that the dispatcher will free the event once done. But if the dispatcher is in the parent, the child will never ever free that object, thus leaking it) This is usually not an issue. However, if such an object has a file-descriptor embedded, this FD is left open and never closed in the child. In manager_exit(), if we now destroy an object (i.e., close its embedded file-descriptor) before we destroy its related sd_event_source, then sd-event will not be able to drop the FD from the epoll-set (EFD). This is, because the FD is no longer valid at the time we call EPOLL_CTL_DEL. Hence, the kernel cannot figure out the linked "struct file" and thus cannot remove the FD-number plus "struct file" combination; effectively leaving the subscription in the epoll-set. Since we leak the uevent-fd in the children, they retain a copy of the FD pointing to the same "struct file". Thus, the EFD-subscription are not automatically removed by close() (as described above). Therefore, the main daemon will still get its metadata back on epoll_watch() whenever an event occurs (even though it already freed the metadata). This then causes the free-after-use bug described in #163. This patch fixes the order in which we destruct objects and related sd-event-sources. Some open questions remain: * Why does source_io_unregister() not warn on EPOLL_CTL_DEL failures? This really needs to be turned into an assert_return(). * udevd really should not leak file-descriptors into its children. Fixing this would *not* have prevented this bug, though (since the child-setup is still async). It's non-trivial to fix this, though. The stack-context of the caller cannot be rewinded, so we cannot figure out temporary refs. Maybe it's time to exec() the udev-workers? * Why does the kernel not copy FD-subscriptions across fork()? Or at least drop subscriptions if you close() your FD (it uses the FD-number as key, so it better subscribe to it)? Or it better used FD+"struct file_table*"+"struct file*" as key to not allow the childen to share the subscription table.. *sigh* Seems like we have to live with that API forever.

everywhere: port everything to sigprocmask_many() and friends This ports a lot of manual code over to sigprocmask_many() and friends. Also, we now consistly check for sigprocmask() failures with assert_se(), since the call cannot realistically fail unless there's a programming error. Also encloses a few sd_event_add_signal() calls with (void) when we ignore the return values for it knowingly.

sd-netlink: rename from sd-rtnl

util: introduce CMSG_FOREACH() macro and make use of it everywhere It's only marginally shorter then the usual for() loop, but certainly more readable.

tree-wide: remove spurious space

udevd: merge manager_new() and manager_listen() again Now that listen_fds() have been split out, we can safely move the allocation of the manager object after doing the forking (the fork is done to notify legcay init-systems that the fds are ready). Subsequently, we can merge manager_listen() back into managre_new(). This entails a minor behaviour change: the application of permissions to static device nodes now happens after the fork (but still before notifying systemd about being ready).

udevd: make sd_notify independent of forknig/notify mode This will simply silently fail on non-systemd systems, so there is no reason to make it conditional. Also make it clear that we notify systemd about being ready as the last step before starting the event loop, whereas the forking might need to happen earlier.

udevd: manager - split listen_fds() out of manager_new() This will allow us in a follow-up commit to listen to fds before forking and still allocate the manager only after the fork.

udevd: unify fd handling in forking/notify modes Hide the differenec in listen_fds, by simply opening the fds here in case they are not passed in.

udevd: make cgroup logic independent of socket passing This should have no behavioural change, but it is odd to tie the cgroup cleaning to whether or not we are passed sockets. The point really is if we are guaranteed to be in a dedicated cgroup, so instead check for our parent being PID1 (we already implicitly only do this on systemd systems).

udevd: only bind ctrl and netlink sockets when we open them If they are passed from PID1 this is not necessary.

udevd: rename systemd_fds to listen_fds

udevd: simplify signal mask handling We used to block all signals, and restore the original signal mask before exec'ing external processes. Now we just block the signals we care about and unconditionally unblock all signals before exec'ing.

udev: add some asserts Mostly for documentation purposes.

udevd: open sockets before forking The communication channels must all be opened before forknig in daemon mode, or we cannot guarantee that udevadm will work correctly as soon as udevd is started.

udevd: don't allocate sd_event object before fork In daemon mode we would break sd-event as it cannot work accross different processes. Simply delay the allocation to after the fork.

udevd: don't sanitize fd 0,1,2 Kay said: 'it is from ancient times, when we started udevd from the kernel's usermodhelper which had no fd 0,1,2'.

udevd: notify - expose a bit more of the internal state This notifies PID1 about config being flushed, about shutdown starting and shutdown finalizing.

udevd: notify - keep NOTIFY_SOCKET around Only unset the env var in the workers, but otherwise keep it around in the main daemon.

udevd: modernize status notification Only log about starting in daemon mode, rely on PID1 to log this in notify mode. Also explicitly set the STATUS variable, as is done in notify mode as is done for other serivecs.

udevd: event - port spawn_wait() to sd-event This allows us to drop the special sigterm handling in spawn_wait() as this will now be passed directly to the worker event loop. We now log failing spawend processes at 'warning' level, and timeouts are in terms of CLOCK_BOOTTIME when available, otherwise the behavior is unchanged.

udevd: move main-loop to sd-event

udevd: explicitly try to start event queue when it may be possible Rather than trying to schedule new events on every main-loop iteration, do it explicitly when processing an event finishes, a worker is killed, a new uevent is received, or the event queue is explicitly restarted.

udevd: only check for changed config before scheduling new events Also move builtin and rules initialization from main loop to event_queue_start(). No functional change.

udevd: introduce manager_exit() and manager_reload() The behavior is mostly unchanged, but rather than only ever calling these functions at fixed points in the event loop, they are called directly whenever they are invoked.

udevd: fix SIGCHLD handling in --daemon mode We were listening for SIGCHLD in the wrong process.

udev: fix inotify handling This partly reverts: commit 6d1b1e0bc6bd020218afc5f05286bf372be283d5 Author: Tom Gundersen <teg@jklm.no> Date: Sun May 24 15:10:04 2015 +0200 udevd: worker - fully clean up unnecessary fds The inotify-fd _is_ used in the workers, so don't close it! Have a look at udev-watch.c, which keeps track of the inotify-fd as a global variable (ugh!).

udevd: event - fix event queue in daemenozied mode We would enforce that events could only be added to the queue from the main process, but that brake in daemonized mode. Relax the restriction to only allow one process to add events to the queue. Reported by Mantas Mikulėnas.

udevd: worker - modernize a bit Initialize structs when declaring rather than using memzero().

udevd: worker - fully clean up unnecessary fds These are only ever used in the parent process, so close them early in the worker.

nspawn: finish user namespace support

udevd: main - use _exit() when daemonizing Makes it a bit clearer what is going on, rather than jumping to the end of main(). No functional change.

udevd: main - reshuffle First parse config, then sanitize environment before donig any further setup. No functional change.

udevd: rename on_reque_{exit,reload} to on_sig{term,chld} No functional change.

udevd: introduce on_event_timeout{,_warning} This uses kill_and_sigcont() instead of kill(), otherwise no functional change.

udevd: process all SIGCHLD events every time the handler is invoked We were returning rather than continuing in some cases. The intention was always to fully process all pending events before returning from the SIGCHLD handler. Restore this behaviour.

udevd: init/exit the builtins in manager_new/free No functional change.

udevd: move file descriptors to Manager No functional change.

udevd: queue - update queue state when events are queued/freed This way it is more obvious that the queue flag file is always up-to-date. Moreover, we only have to touch/unlink it when the first/last event is allocated/freed.

udevd: on_worker - distinguish between EINTR and EAGAIN EAGAIN means there are no more messages to read, so give up. EINTR means we got interrupted reading a message, so try again.

udevd: worker - use loop_write() rather than send() When notifying the main daemon about event completion, make sure the message is sent successfully, and not interrupted.

udevd: manager - move a few global variables into the Manager object

udevd: pass a Manager objcet to event handlers Stop relying on global variables in event handlers, and move them all to a Manager object instead.

udevd: remove stale comment

udevd: explicitly update queue file before answering to ping This avoids updating the flag files twice for every loop, and also removes another dependency in the main-loop, so we are freer to reshufle it as we want.

udevd: explicitly read out uevents we create ourselves Rather than skippling ctrl handling whenever we have handlede inotify events (and hence may have synthesized a 'change' event), just call the uevent handling explicitly from on_inotify() so that the event queue is up-to-date.

udevd: move to sd-event-style event handlers

udevd: make udev_ctrl_connection global This allows us to simplify the ctrl_msg handler. Eventually all this global state should move to a Manager object or so.

udevd: remove unused function

udevd: don't explicitly count the number of workers Simply query the size of the hashmap keeping all the worker contexts instead.

udevd: keep workers in a hashmap rather than a list This makes the code somewhat more readable.

udevd: worker - drop reference counting Make the worker context have the same life-span as the worker process. It is created on fork() and free'd on SIGCHLD. The change means that we can get worker_returned() for a worker context that is no longer around, this is not a problem and we can just drop the message. The only use for worker_returned() is to know to reschedule events to workers that are still around, so if the worker has already exited it is not important to keep track of. We still print a debug statement in this case to be on the safe side.

udev: fix weird coding-style Eeeew!

udevd: worker - allow passing NULL to worker_unref()

udevd: worker - use _exit() rather than exit() Follow the coding style and avoid the exit handlers.

udevd: modernize error handling We never return magic exit codes, but just EXIT_FAILUER or EXIT_SUCCESS.

udevd: use kernel cmdline parser

udevd: worker - move some fields from the worker to the event

udevd: worker - introduce worker_attach_event()

udevd: worker - make refcounting clearer Take and drop explicit references where it makes sense.

udevd: worker - only allocate the worker struct in the main process This is not used in the worker, so avoid having to free it there.

udevd: rename worker_new() to worker_spawn()

udevd: don't track worker exitcode We used to use this to track failed events so they could be retriggered, but that is no longer done, so the code can be dropped.

udevd: worker - log if worker result cannot be sent If the main daemon is not notified about a worker finishing an event the refcounting of the worker struct will be wrong, and we will lose track of the number of children we have to wait for. This should not happen, but if it does we better complain loudly about it. Worst case udev will wait for 30 seconsd at shutdown waiting for nonexistent workers.

udevd: worker - warn if unknown worker returns

udevd: worker - let the kernel attach the sender pid No need to include this explicitly, just use SCM_CREDENTIALS.

udevd: don't unref worker objects on SIGSTOP/SIGCONT We should not be receiving these anyway, but let's be correct.

udevd: warn if we receive SIGCHLD from untracked worker

udevd: improve logging in SIGCHLD handling Remove some redundant logging, and reduce the log-level in most cases. The only case that is really critical is if a worker failed while hanlding an event, so keep that at error level.

udevd: fix synchronization with settle when handling inotify events udev uses inotify to implement a scheme where when the user closes a writable device node, a change uevent is forcefully generated. In the case of block devices, it actually requests a partition rescan. This currently can't be synchronized with "udevadm settle", i.e. this is not reliable in a script: sfdisk --change-id /dev/sda 1 81 udevadm settle mount /dev/sda1 /foo The settle call doesn't synchronize there, so at the same time we try to mount the device, udevd is busy removing the partition device nodes and readding them again. The mount call often happens in that moment where the partition node has been removed but not readded yet. This exact issue was fixed long ago: http://git.kernel.org/cgit/linux/hotplug/udev.git/commit/?id=bb38678e3ccc02bcd970ccde3d8166a40edf92d3 but that fix is no longer valid now that sequence numbers are no longer used. Fix this by forcing another mainloop iteration after handling inotify events before unblocking settle. If the inotify event caused us to generate a "change" event, we'll pick that up in the following loop iteration, before we reach the end of the loop where we respond to settle's control message, unblocking it.

shared: add formats-util.h

sd-device,udevd: fix spelling /ammend/amend/

udev: make set_usec_initialized() internal to libudev Instead introduce ensure_usec_initialized(), which copies the timestamp if possible otherwise sets it to now(CLOCK_MONOTONIC).

udev: dont use EWOULDBLOCK EWOULDBLOCK is the same as EAGAIN, stop using it.

udevd: improve handling of failed worker The information in the db is stale, so it does not make sense to expose it any longer. Also, don't drop the kernel event, but simply pass it on to userspace without ammending it.

udevd: don't free event when killing the worker, wait until it has been reaped This will allow us to clean up the device when we are notified about the worker being killed.

udev: simplify event_queue_update() and add debug logging This essentially replaces open("/run/udev/queue", O_WRONLY|O_CREAT|O_CLOEXEC|O_TRUNC|O_NOFOLLOW, 0444) with open("/run/udev/queue", O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, 0644), which is ok for our purposes.

udevd: close race in udev settle The udev-settle guarantees that udevd is no longer processing any of the events casued by udev-trigger. The way this works is that it sends a synchronous PING to udevd after udev-trigger has ran, and when that returns it knows that udevd has started processing the events from udev-trigger. udev-settle will then wait for the event queue to empty before returning. However, there was a race here, as we would only update the /run state at the beginning of the event loop, before reading out new events and before processing the ping. That means that if the first uevent arrived in the same event-loop iteration as the PING, we would return the ping before updating the queue state in /run (which would happen on the next iteration). The race window here is tiny (as the /run state would probably get updated before udev-settle got a chance to read /run), but still a possibility. Fix the problem by updating the /run state as the last step before returning the PING. We must still update it at the beginning of the loop as well, otherwise we risk being stuck in poll() with a stale state in /run. Reported-by: Daniel Drake <drake@endlessm.com>

remove unused includes This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.

include <poll.h> instead of <sys/poll.h> include-what-you-use automatically does this and it makes finding unnecessary harder to spot. The only content of poll.h is a include of sys/poll.h so should be harmless.

Assorted format fixes Types used for pids and uids in various interfaces are unpredictable. Too bad.

udevadm,..: make --help output of udev tools more like the output of the various other tools

tmpfiles: add new line type 'v' for creating btrfs subvolumes

util: fix strict aliasing violations in use of struct inotify_event v5 There is alot of cleanup that will have to happen to turn on -fstrict-aliasing, but I think our code should be "correct" to the rule.

core: unify how we iterate over inotify events Let's add some syntactic sugar for iterating through inotify events, and use it everywhere.

udevd: don't take reference for NULL rtnl object

treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.

udevd: don't set receive buffer size when socket activated The socket unit does this, so no need to redo it in udevd.

treewide: drop unnecessary trailing \n in log_*() calls

treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.

treewide: auto-convert the simple cases to log_*_errno() As a followup to 086891e5c1 "log: add an "error" parameter to all low-level logging calls and intrdouce log_error_errno() as log calls that take error numbers", use sed to convert the simple cases to use the new macros: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\("(.*)%s"(.*), strerror\(-([a-zA-Z_]+)\)\);/log_\1_errno(-\4, "\2%m"\3);/' Multi-line log_*() invocations are not covered. And we also should add log_unit_*_errno().

udev: support ENV{}=="" global property matches

udev: move global property handling from libudev to udevd

udev: switch to systemd logging functions

util: simplify proc_cmdline() to reuse get_process_cmdline() Also, make all parsing of the kernel cmdline non-fatal.

s/commandline/command line/g

udev: avoid magic constants in kernel-cmdline parsers Lets recognize the fact that startswith() returns a pointer to the tail on success. Use it instead of hard-coding string-lengths as magic constants.

udev: Fix parsing of udev.event-timeout kernel parameter.

mac: rename apis with mac_{selinux/smack}_ prefix

udevd: don't fail if /run/udev exists

udev: fix typos Spotted by Andreas Henriksson.

udevd: check return of various functions One reported by Coverity. Fixes CID #996252.

udevd: parse_argv - warn if argumens are invalid Found by Coverity. Fixes CID #1238780.

udevd: use safe_ato*() in place of strto*()

udev: apply permissions to static nodes before signallying READY Processes expecting static nodes to have the right permissions may order themselves after systemd-udevd.service, make sure that actually guarantees what is expected.

udev: only print after final log level has been determined This delays label_init(), and drops the (duplicate) printing of version information.

udevd: initialize epoll_event structs on allocation Also move the rest of event initialization next to the event loop (no functional change).

udev: don't close std{in,out,err} Rather than printing debug output to stderr and redirecting this to /dev/null when not wanted, use the correct log_*() function in the first place.

udev: drop duplicate logging Once upon a time logging during early boot was unreliable, so extra logging messages were sent by udev to stderr. That is no longer a concern, so drop all fprintf() calls from udved.

udev: split out parse_argv() Also rename some global variables to arg_* to make it clearer where they come from.

udev: split out help and modernise a bit

udev: timeout - warn after a third of the timeout before killing

udev: timeout - increase timeout Some kernel modules still take more than one minute to insmod, we no longer rely on the timeout killing insmod within a given period of time, so just bump this to a much higher value. Its only purpose is to make sure that nothing stays aronud forever.

udev - drop print_kmsg The only remaining user was 'starting version XXX', which is now logged using log_info().

udev: event - keep one rtnl per worker, rather than per event Creating the rtnl context is cheap, but freeing it may not be, due to synchronous close(). Also drop some excessive logging. We now log about the changing ifname exactly once.

udev: bump event timeout to 60 seconds

udev: remove userspace firmware loading support

Reject invalid quoted strings String which ended in an unfinished quote were accepted, potentially with bad memory accesses. Reject anything which ends in a unfished quote, or contains non-whitespace characters right after the closing quote. _FOREACH_WORD now returns the invalid character in *state. But this return value is not checked anywhere yet. Also, make 'word' and 'state' variables const pointers, and rename 'w' to 'word' in various places. Things are easier to read if the same name is used consistently. mbiebl_> am I correct that something like this doesn't work mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-passwd "Unlock EncFS"' mbiebl_> systemd seems to strip of the quotes mbiebl_> systemctl status shows mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-password Unlock EncFS $RootDir $MountPoint mbiebl_> which is pretty weird

udev: place opening { at the same line as the function declaration

udev: unify event timeout handling

udevd: add --event-timeout commandline option Some events take longer than the default 30 seconds. Killing those events will leave the machine halfway configured. Add a commandline option '--event-timeout' to handle these cases.

udev: exclude MD from block device ownership event locking MD instantiates devices at open(). This is incomptible with the locking logic, as the "change" event emitted when stopping a device will bring it back.

udev: check the return value from udev_enumerate_scan_devices The return value from udev_enumerate_scan_devices was stored but never used. I assume this was meant to be checked.

udev: really exclude device-mapper from block device ownership event locking Arguments were wrong order, no? This fixes commits: e918a1b5a94f270186dca59156354acd2a596494 3d06f4183470d42361303086ed9dedd29c0ffc1b

udev: guard REREADPT by exclusive lock instead of O_EXCL

udev: make sure we always get "change" for the disk The kernel will return 0 for REREADPT when no partition table is found, we have to send out "change" ourselves.

udev: guard REREADP logic with open(O_ECXL)

udev: try first re-reading the partition table mounted partitions: # dd if=/dev/zero of=/dev/sda bs=1 count=1 UDEV [4157.369250] change .../0:0:0:0/block/sda (block) UDEV [4157.375059] change .../0:0:0:0/block/sda/sda1 (block) UDEV [4157.397088] change .../0:0:0:0/block/sda/sda2 (block) UDEV [4157.404842] change .../0:0:0:0/block/sda/sda4 (block) unmounted partitions: # dd if=/dev/zero of=/dev/sdb bs=1 count=1 UDEV [4163.450217] remove .../target6:0:0/6:0:0:0/block/sdb/sdb1 (block) UDEV [4163.593167] change .../target6:0:0/6:0:0:0/block/sdb (block) UDEV [4163.713982] add .../target6:0:0/6:0:0:0/block/sdb/sdb1 (block)

udev: synthesize "change' events for partitions when tools change the disk This should make sure that fdisk-like programs will automatically cause an update of all partitions, just like mkfs-like programs cause an update of the partition.

udevd: inotify - modernizations

udev: exclude device-mapper from block device ownership event locking

udev: always close lock file descriptor https://bugs.freedesktop.org/show_bug.cgi?id=79576

udev: avoid use of uninitialized err After 1ea972174baba40dbc80c51cbfc4edc49764b59b err is no longer set unless we hit a special case. Initialize it to 0 and remove a check that will never fail.

udev: do not skip the execution of RUN when renaming a network device fails

udev: serialize/synchronize block device event handling with file locks

udev: remove seqnum API and all assumptions about seqnums The way the kernel namespaces have been implemented breaks assumptions udev made regarding uevent sequence numbers. Creating devices in a namespace "steals" uevents and its sequence numbers from the host. It confuses the "udevadmin settle" logic, which might block until util a timeout is reached, even when no uevent is pending. Remove any assumptions about sequence numbers and deprecate libudev's API exposing these numbers; none of that can reliably be used anymore when namespaces are involved.

everywhere: always use O_CLOEXEC where it makes sense

everywhere: make use of new0() and macro() macros, and stop using perror()

use memzero(foo, length); for all memset(foo, 0, length); calls In trying to track down a stupid linker bug, I noticed a bunch of memset() calls that should be using memzero() to make it more "obvious" that the options are correct (i.e. 0 is not the length, but the data to set). So fix up all current calls to memset(foo, 0, length) to memzero(foo, length).

udev: LOG_PRIORITY -> LOG_LEVEL

log: log_error() and friends add a newline after each line anyway, so avoid including it in the log strings

udev: declare some symbols static

util: unify reading of /proc/cmdline Instead of individually checking for containers in each user do this once in a new call proc_cmdline() that read the file only if we are not in a container.

udev: use initialization instead of zeroing in one place

Revert "udevd: simplify sigterm check" This reverts commit 47e737dc13bf4251ae5a2249ec29b34503ed92e1 - it introduced a use-after-free. The only way the code would get simpler is with a cleanup function, but eh, not worth it for just this one bit. Reviewed by kay on IRC.

udevd: simplify sigterm check

udevd: respect the log-level set in /etc/udev/udev.conf A regression introduced when we moved to systemd's logging is that the only way to adjust the log-level of the udev daemon is via the env var, kernel commandline or the commandline. This reintroduces support for specifying this in the configuration file.

udev: export tags of "dead" device nodes to /run/udev/static_node-tags/ Based on a patch by Kay Sievers. A tag is exported at boot as a symlinks to the device node in the folder /run/udev/static_node-tags/<tagname>/, if the device node exists. These tags are cleaned up by udevadm info --cleanup-db, but are otherwise never removed.

static-nodes: move creation of static nodes from udevd to tmpfiles As of kmod v14, it is possible to export the static node information from /lib/modules/`uname -r`/modules.devname in tmpfiles.d(5) format. Use this functionality to let systemd-tmpfilesd create the static device nodes at boot, and drop the functionality from systemd-udevd. As an effect of this we can move from systemd-udevd to systemd-tmpfiles-setup-dev: * the conditional CAP_MKNOD (replaced by checking if /sys is mounted rw) * ordering before local-fs-pre.target (see 89d09e1b5c65a2d97840f682e0932c8bb499f166)

nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.

util: rename write_one_line_file() to write_string_file() You can write much more than just one line with this call (and we frequently do), so let's correct the naming.

udev: check return value of uname.

build-sys: fix HAVE/ENABLE_FIRMWARE https://bugs.freedesktop.org/show_bug.cgi?id=62864

udevd.c: set udev children_max according to CPU count Setting children_max according to RAM leads to too much concurrent I/O.

udev: ifdef all firmware special handling

udev: remove database conversion code

honor SELinux labels, when creating and writing config files Also split out some fileio functions to fileio.c and provide a SELinux aware pendant in fileio-label.c see https://bugzilla.redhat.com/show_bug.cgi?id=881577

use streq instead of strcmp

udev: move string copy functions to shared/

udevd: add missing ':' to getopt_long 'e' Parameter -e is set without additional argument in getopt and this leads to segfault when calling 'systemd-udevd -e'.

use the same email address everywhere

udev: use usec_t and now()

udev: allow firmware requests to bypass the dependency tracking The removal of the TIMEOUT= handling in udevd put firmware requests into the devpath parent/child dependency tracking. Drivers which block in module_init() asking userspace for firmware ran into a 30 sec device timeout. The whole firmware loading willl hopefully move into the kernel and the fragile-since-day-one fake async driver-core device dance involving udev can be retired: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=abb139e75c2cdbb955e840d6331cb5863e409d0e

man: fix a bunch of typos in docs https://bugs.freedesktop.org/show_bug.cgi?id=54501

dev-setup: make NULL as parameter for dev_setup() equivalent to ""

dev-setup: allow a path prefix for use in chroots With this adjustment, we can reuse this code elsewhere, such as in nspawn.

udev: re-initialize builtins in the daemon process, not in the worker

udev: set log.c's log level from udev's kernel command line option

udev: avoid creating /dev/kmsg with fopen() to support CONFIG_PRINTK=n

log: correct usage of logging API at a few places

udev: add some O_CLOEXEC

udev: static nodes - fix default permissions if no rules is given <falconindy> kay: just curious -- it looks like nodes created by udev from modules.devname all have 000 perms, and there's nothing in udev that attempts to change this. is it intended? <falconindy> c--------- 1 root root 10, 223 Jul 1 23:10 uinput <kay> falconindy: we might miss the default of 0600 <falconindy> seems like it <kay> falconindy: stuff that has a rule works i guess <kay> falconindy: i'll add the 0600 now

udevd: fix bogus mkdir invocation The filename parameter passed to mkdir can't contain anything but a garbage value at this point. This was meant to be the full pathname to the new udev DB, as the mkdir_parents() call before it won't create the trailing child directory. [replace mkdir_parents() + mkdir() with mkdir_p() -- kay]

udevd: use ROOTPREFIX to create path to modules.devname

udev: use the matching binary name "systemd-udevd" in log messages

udev: kernel cmdline - accept rd.* parameters

udev: reset /proc/self/oom_score_adj in worker processes Only the main daemon process should be excluded from OOM handling, not the worker processes or their child processes.

udev: limit minimum worker count to 16

udev: lower the starting children_max -> drop the minimum required RAM from 23mb to 5mb Udev was the limiting factor for us on low-RAM systems. Given an average RSS of 180kb, 128 workers would require ~23mb of RAM. Now, please consider what happens when there is only, say, 15mb free. Udev protects itself from OOM, and the kernel can do nothing but panic. 28 workers * 0.18mb = ~5mb. This change should not affect more powerful systems much, given that they still get the addition from the amount of RAM.

Revert "label: fix systemd-udev labeling of /run directory." This reverts commit 9b5af248f04b6cad8a5bca836e89a39e9f6823d9. Udev now explicitely labels only files/directories in /dev. The selinux array API is not released and will not work on other distros at this moment.

udev: do not selinux label files in /run/udev

mkdir: append _label to all mkdir() calls that explicitly set the selinux context

label: fix systemd-udev labeling of /run directory. systemd-udev is currently incorrectly labeling /run/udev/* content because it is using selinux prefix labeling of /dev. This patch will allow systemd-udev to use prefix labeling of /dev and /run.

udev: use container_of() macro

udev: use only oom_score_adj interface

udev: unify /dev static symlink setup

selinux: unify systemd and udev code

udev: kill udev_selinux_setfscreateconat()

udev: replace util_create_path() with mkdir_parents()

udev: remove configuration options for /dev, /sys, /run directories

udev: replace ARRAY_SIZE() with ELEMENTSOF()

udev: cleanup the udev cgroup when the daemon enters the idle state

udev: fix a few issues detected by the llvm static analyzer

udev: fix gcc warnings showing up after adding $(AM_CFLAGS)

udev: remove support for /lib/udev/devices/; tmpfiles should be used

udev: switch to systemd logging functions

move imported udev into place