Commit Graph

39407 Commits

Author SHA1 Message Date
Lennart Poettering
5b2fc74fca NEWS: add preliminary contributor list 2019-04-02 17:31:41 +02:00
Lennart Poettering
e67ccb54a2 update .mailmap 2019-04-02 17:31:00 +02:00
Lennart Poettering
82c604607f Merge pull request #12056 from poettering/seccomp-suid-sgid
Introduce RestrictSUIDSGID= for disabling SUID/SGID file creation
2019-04-02 17:30:11 +02:00
Lennart Poettering
6d85ba7299 update TODO 2019-04-02 16:56:48 +02:00
Lennart Poettering
bf65b7e0c9 core: imply NNP and SUID/SGID restriction for DynamicUser=yes service
Let's be safe, rather than sorry. This way DynamicUser=yes services can
neither take benefit of, nor create SUID/SGID binaries.

Given that DynamicUser= is a recent addition only we should be able to
get away with turning this on, even though this is strictly speaking a
binary compatibility breakage.
2019-04-02 16:56:48 +02:00
Lennart Poettering
62aa29247c units: turn on RestrictSUIDSGID= in most of our long-running daemons 2019-04-02 16:56:48 +02:00
Lennart Poettering
7445db6eb7 man: document the new RestrictSUIDSGID= setting 2019-04-02 16:56:48 +02:00
Lennart Poettering
9d880b70ba analyze: check for RestrictSUIDSGID= in "systemd-analyze security"
And let's give it a heigh weight, since it pretty much can be used for
bad things only.
2019-04-02 16:56:48 +02:00
Lennart Poettering
f69567cbe2 core: expose SUID/SGID restriction as new unit setting RestrictSUIDSGID= 2019-04-02 16:56:48 +02:00
Lennart Poettering
167fc10cb3 test: add test case for restrict_suid_sgid() 2019-04-02 16:56:48 +02:00
Lennart Poettering
3c27973b13 seccomp: introduce seccomp_restrict_suid_sgid() for blocking chmod() for suid/sgid files 2019-04-02 16:56:48 +02:00
Lennart Poettering
9e6e543c17 seccomp: add debug messages to seccomp_protect_hostname() 2019-04-02 16:56:48 +02:00
Lennart Poettering
42561fc99c core: add a generic helper that forwards per-unit method calls from Manager
Quite often we have a method DoSomethingWithUnit() on the Manager object
that is the same as a function DoSomething() on a Unit object. Let's
shorten things by introducing a common function that forwards the
former to the latter, instead of writing this again and again.
2019-04-02 16:38:20 +02:00
Zbigniew Jędrzejewski-Szmek
237ebf61e2 Merge pull request #12013 from yuwata/fix-switchroot-11997
core: on switching root do not emit device state change based on enumeration results
2019-04-02 16:06:07 +02:00
Zbigniew Jędrzejewski-Szmek
84ce204a93 Merge pull request #12185 from poettering/login-unstore-fd
logind: remove unused fds from fdstore
2019-04-02 14:27:27 +02:00
Zbigniew Jędrzejewski-Szmek
8a306989b3 Merge pull request #12186 from poettering/lgtm-updates
lgtm ruleset updates
2019-04-02 14:19:27 +02:00
Zbigniew Jędrzejewski-Szmek
2356d683f8 Merge pull request #12183 from poettering/askpwargv
tty-ask-password: let's copy argv[] before forking
2019-04-02 13:50:14 +02:00
Frantisek Sumsal
1a862e2151 journal: LGTM doesn't recognize suppressions in /* */ 2019-04-02 12:47:14 +02:00
Lennart Poettering
f71611fed2 test: stop using dup() needlessly 2019-04-02 12:45:46 +02:00
Lennart Poettering
9b4805421e lgtm: beef up list of dangerous/questionnable API calls not to make 2019-04-02 12:45:46 +02:00
Lennart Poettering
efc19ee485 logind: when we cannot attach a passed fd to a device, close it
Replaces: #8532
2019-04-02 11:52:58 +02:00
Lennart Poettering
883d1b01b0 logind: simplify removal of device fds
let's use sd_notifyf(). Let's also stop validating the session ID here.
This is the destructor. if it contains a dash, we are already too late
here anyway.
2019-04-02 11:51:50 +02:00
Chris Morin
924426a703 journal-remote: use source's boot-id
systemd-journal-remote always wrote the boot-id of the device it was running on
to the header of its journal files. When the source had a different boot-id
(because it was generated on a different boot, or a different device), the
boot-ids in the file were inconsistent. The _BOOT_ID field was that of the
source, but the journal file header and each entry object header were that of
the device systemd-journal-remote ran on. This breaks journalctl --list-boots
on any of these files.

Set the boot-id in the header to be that of the source. This also fixes the
entry object headers.
2019-04-02 10:32:21 +02:00
Yu Watanabe
52cf2b13a0 ipv4ll: do not reset seed generation counter on restart
Fixes #12145.
2019-04-02 10:27:30 +02:00
Lennart Poettering
d9550542a8 Merge pull request #12007 from poettering/clock-change
.timer OnClockChange= and OnTimezoneChange= settings
2019-04-02 10:24:35 +02:00