Re: [systemd-devel] Design patterns for privilege separating systemd services?

2021-02-18 Thread Colin Walters
On Thu, Feb 18, 2021, at 4:33 PM, Lennart Poettering wrote: > 1. So we have another RFE which I am very sympathetic to which is to >add an Open= setting to service unit files, which could be used to >open any kind of file at activation time and pass it via our usual >socket

[systemd-devel] Design patterns for privilege separating systemd services?

2021-02-17 Thread Colin Walters
I'm having a debate with the SSSD team over here around multiple systemd units and privilege separation: https://github.com/SSSD/sssd/issues/3412 And we also had a related topic come up in Fedora CoreOS where we have a privileged service (rpm-ostreed.service) and we want a separate unprivileged

Re: [systemd-devel] Why does initrd-parse-etc.service re-start initrd-fs.target?

2019-12-08 Thread Colin Walters
On Sun, Dec 8, 2019, at 5:20 PM, Colin Walters wrote: > > > On Fri, Dec 6, 2019, at 12:53 PM, Andrei Borzenkov wrote: > > > After real root is mounted daemon-reload re-runs fstab generator which > > parses real root /etc/fstab and may pull mount points from it. > &g

Re: [systemd-devel] Why does initrd-parse-etc.service re-start initrd-fs.target?

2019-12-08 Thread Colin Walters
On Fri, Dec 6, 2019, at 12:53 PM, Andrei Borzenkov wrote: > After real root is mounted daemon-reload re-runs fstab generator which > parses real root /etc/fstab and may pull mount points from it. > Restarting initrd-fs.target will propagate start request to its (newly > created) dependent mount

[systemd-devel] Why does initrd-parse-etc.service re-start initrd-fs.target?

2019-12-05 Thread Colin Walters
See https://github.com/coreos/ignition-dracut/pull/140 Basically, we do a lot of nontrivial stuff in the initramfs (Ignition) and this was re-starting some of our units, which I found surprising. The behavior seems to have come from

Re: [systemd-devel] Make systemd-localed modify the kernel commandline for the initrd keymap?

2019-11-25 Thread Colin Walters
On Thu, Oct 31, 2019, at 12:26 PM, Lennart Poettering wrote: > Well, what I proposed is a file. OSTree can cover files on disk, no? Yes...we can try to figure out an extension to version them. > I doubt on AWS you want to configure keymaps though, do you? No, but there are similar server

Re: [systemd-devel] Make systemd-localed modify the kernel commandline for the initrd keymap?

2019-10-01 Thread Colin Walters
On Sun, Sep 29, 2019, at 6:08 AM, Lennart Poettering wrote: > i.e maybe write down a spec, that declares how to store settings > shared between host OS, boot loader and early-boot kernel environment > on systems that have no EFI NVRAM, and then we can make use of > that. i.e. come up with

Re: [systemd-devel] Using systemd.offline-updates from an ostree based system

2019-04-26 Thread Colin Walters
On Fri, Apr 26, 2019, at 3:47 PM, Dan Nicholson wrote: > > I think /etc is the only guaranteed to be writable location that's > generic to all ostree systems. If possible, I'd get systemd to honor > /etc/system-update. I think /etc seems sane for this but the other option that Lennart raised

[systemd-devel] Why doesn't `systemd-random-seed load` use RNDADDENTROPY ?

2018-07-07 Thread Colin Walters
Came up in this bug: https://bugzilla.redhat.com/show_bug.cgi?id=1572944#c44 As far as I can see it never did, but here the entropy is fully trusted; seems like using the ioctl would help avoid some entropy fallout from the recent kernel random changes, right?

Re: [systemd-devel] DynamicUsers and read-only /var

2018-05-24 Thread Colin Walters
On Wed, May 16, 2018, at 10:56 AM, Simon McVittie wrote: > > Projects like libostree and rpm-ostree might have some useful concepts > or code for managing immutable, read-only rootfs or /usr deployments, > since that's what they do: in an ostree-based OS, /usr is an > atomically-updated

Re: [systemd-devel] Starting a service at shutdown time, with requirements

2018-03-20 Thread Colin Walters
On Tue, Mar 20, 2018, at 3:25 PM, Lennart Poettering wrote: > On Di, 20.03.18 15:09, Colin Walters (walt...@verbum.org) wrote: > > > Another way I've thought about handling this is to basically invert things > > so that > > we have a "stub" unit that start

[systemd-devel] Starting a service at shutdown time, with requirements

2018-03-20 Thread Colin Walters
I'm working on: https://github.com/ostreedev/ostree/issues/545 TL;DR: libostree is an image-like update system, and I want to take some actions at system shutdown time, specifically performing a "snapshot+merge" of /etc after most other services are shut down. The way ostree handles /etc (IMO a

Re: [systemd-devel] dbus and exit-on-idle

2017-05-23 Thread Colin Walters
On Sun, May 21, 2017, at 08:26 PM, Matthijs van Duin wrote: > I've been pondering how to allow my bus-activated service to exit when > it's unneeded (which is 99% of the time), and in particular how to deal > with exit/activate races correctly... See also

[systemd-devel] "libsystemdexec/systemd-run --exec-from-unit"

2017-01-28 Thread Colin Walters
Hey so, this is is a half-baked thought, but here goes: One problem I've hit when trying to use systemd unit file features is that they only work when executed by systemd. Let's take the example of User=, but it applies to tons of other ones too. Wait you ask - your service runs under systemd,

Re: [systemd-devel] Avoid polkit queries from systemctl in package maintainer scripts/when running as root?

2016-04-04 Thread Colin Walters
On Mon, Apr 4, 2016, at 11:31 AM, Martin Pitt wrote: > A more upstreamable approach would be to not query polkit at all if > geteuid() == 0. Is there any legit scenario where root would be denied > running systemctl directly, but a polkit rule would allow it > nevertheless? I can't think of

Re: [systemd-devel] [ANNOUNCE] Separating gudev from systemd

2015-06-01 Thread Colin Walters
On Tue, May 19, 2015, at 11:06 AM, David Herrmann wrote: Hi We're about to remove gudev from the systemd repository, as it is in no way related to the systemd code-base, nor used by the systemd project. To preserve backwards compatibility, gudev was extracted into a separate repository and

Re: [systemd-devel] [PATCH] tmpfiles: don't create subvolumes in chroot

2015-05-21 Thread Colin Walters
On Wed, Apr 1, 2015, at 10:02 AM, Martin Pitt wrote: IMHO subvolumes, like hard disk partitions, are something that the administrator of a host should create deliberately only. Automatically created ones just create confusion about why the heck can't I remove that directory.. It's roughly

Re: [systemd-devel] Booting to systemd in a chroot

2015-05-14 Thread Colin Walters
On Thu, May 14, 2015, at 04:30 PM, JT Olds wrote: Since you are reinstalling anyways, I'd suggest trying out btrfs as your filesystem. Create separate subvolumes for each OS and you can get rid of chrooting anything. Plus, you can share your home subvolume if you like. To be totally honest,

Re: [systemd-devel] [PATCH] Patches for lockfile code

2015-05-05 Thread Colin Walters
On Tue, May 5, 2015, at 11:15 PM, Zbigniew Jędrzejewski-Szmek wrote: On Mon, May 04, 2015 at 08:57:56PM -0400, Colin Walters wrote: I'm planning to use the code in ostree (via libglnx), here's a few minor patches for systemd's lockfile code. 1/3 is useful, applied. 2/3 is OK

[systemd-devel] [PATCH] Patches for lockfile code

2015-05-04 Thread Colin Walters
I'm planning to use the code in ostree (via libglnx), here's a few minor patches for systemd's lockfile code. From 9e249575b2b99110a29f32f53aab1c1048b72eb9 Mon Sep 17 00:00:00 2001 From: Colin Walters walt...@verbum.org Date: Mon, 4 May 2015 16:12:46 -0400 Subject: [PATCH 1/3] lockfile-util.[ch

Re: [systemd-devel] SD_BUS_VTABLE_CAPABILITY

2015-04-16 Thread Colin Walters
On Thu, Apr 16, 2015, at 02:23 PM, Lennart Poettering wrote: Now, to put together a more complex scenario for you: consider a small web UI that can be used to set the system time. It should realy run at minimal privileges, after all it has a surface to the web. Hence you write it as daemon,

Re: [systemd-devel] [PATCH] path-lookup: use secure_getenv()

2015-03-16 Thread Colin Walters
On Mon, Mar 16, 2015, at 02:31 PM, Ronny Chevalier wrote: I think it would hurt in a SELinux environment. Because if the AT_SECURE flag is set, secure_getenv will return NULL and tools like systemctl will fail for certain tasks. Yeah, beware the possible regressions here, see e.g.:

Re: [systemd-devel] [PATCH] core/mount: only add dependencies to active units for dynamic mounts [was: Re: unit: When stopping due to BindsTo=, log which unit caused it]

2015-02-26 Thread Colin Walters
Hi Martin, thanks for looking into this. On Thu, Feb 26, 2015, at 12:43 PM, Martin Pitt wrote: The attached patch does that. It's not really pretty, but it works for me: mounts in the initramfs are now left alone, and the automatic unmount of force-ejected media is still working. The patch

Re: [systemd-devel] [PATCH] unit: When stopping due to BindsTo=, log which unit caused it

2015-02-17 Thread Colin Walters
On Tue, Feb 17, 2015, at 01:47 PM, Colin Walters wrote: I'm trying to track down a relatively recent change in systemd which broke OSTree; see https://bugzilla.gnome.org/show_bug.cgi?id=743891 Systemd started to stop sysroot.mount, and this patch should help me debug why at least. Running

[systemd-devel] [PATCH] unit: When stopping due to BindsTo=, log which unit caused it

2015-02-17 Thread Colin Walters
I'm trying to track down a relatively recent change in systemd which broke OSTree; see https://bugzilla.gnome.org/show_bug.cgi?id=743891 Systemd started to stop sysroot.mount, and this patch should help me debug why at least. While we're here, break on the first unit we find that will

Re: [systemd-devel] Docker vs PrivateTmp

2015-01-18 Thread Colin Walters
On Sat, Jan 17, 2015, at 11:02 PM, Lars Kellogg-Stedman wrote: Hello all, With systemd 216 on Fedora 21 (kernel 3.17.8), I have run into an odd behavior concerning the PrivateTmp directive, and I am looking for help identifying this as: - Everything Is Working As Designed, Citizen - A

Re: [systemd-devel] [PATCH v2] Do not clear parent mount flags when setting up namespaces

2015-01-02 Thread Colin Walters
On Thu, Jan 1, 2015, at 03:36 PM, Topi Miettinen wrote: Copy parent directory mount flags when setting up a namespace and don't accidentally clear mount flags later. I think unless they're obvious, git commits should at least have a brief rationale for *why* you're making the change, not just

[systemd-devel] [PATCH] util: Fix signedness error in lines(), match implementations

2015-01-01 Thread Colin Walters
From a74befe02b8a8141a2ffc5613372ef8082a2c6d2 Mon Sep 17 00:00:00 2001 From: Colin Walters walt...@verbum.org Date: Thu, 1 Jan 2015 14:57:08 -0500 Subject: [PATCH] util: Fix signedness error in lines(), match implementations Regression introduced by ed757c0cb03eef50e8d9aeb4682401c3e9486f0b

Re: [systemd-devel] [PATCH] util: Fix signedness error in lines(), match implementations

2015-01-01 Thread Colin Walters
On Thu, Jan 1, 2015, at 03:21 PM, Zbigniew Jędrzejewski-Szmek wrote: Is there an actual regression? Afaict, your patch does not change the behaviour in any way... I can't think of an actual real world regression. I could have said error introduced by or something? It only fixes the case

[systemd-devel] [PATCH] missing: define NET_NAME_UNKNOWN

2014-12-04 Thread Colin Walters
#endif +#ifndef NET_NAME_UNKNOWN +# define NET_NAME_UNKNOWN 0 +#endif + #ifndef BPF_XOR # define BPF_XOR 0xa0 #endif -- 1.8.3.1 From 6568250e5ec1873b9b8df986fa07bd6e23ddf5a1 Mon Sep 17 00:00:00 2001 From: Colin Walters walt...@verbum.org Date: Thu, 4 Dec 2014 13:11:03 -0500 Subject: [PATCH

[systemd-devel] syntax error in master

2014-11-11 Thread Colin Walters
See: http://build.gnome.org/continuous/buildmaster/builds/2014/11/11/23/build/log-systemd.txt Perhaps something like this? diff --git a/src/bus-proxyd/bus-proxyd.c b/src/bus-proxyd/bus-proxyd.c index c5aeaac..afee131 100644 --- a/src/bus-proxyd/bus-proxyd.c +++ b/src/bus-proxyd/bus-proxyd.c @@

[systemd-devel] [PATCH] libudev: Use correct free function

2014-11-01 Thread Colin Walters
FILE * wants cleanup_fclose(). Spotted by udev hwdb segfaulting in gnome-continuous' buildroot construction. --- src/libudev/libudev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) From ab6d4e20cb37dc666bbd80b5014a6bf91d4aa554 Mon Sep 17 00:00:00 2001 From: Colin Walters walt

Re: [systemd-devel] Enter in systemd-nspawn as specific user

2014-10-02 Thread Colin Walters
On Thu, Oct 2, 2014, at 05:09 AM, Miroslav Suchy wrote: Hi, when I run systemd-nspawn, I become root user inside of that container. If I want to become specific user inside of that container, I have to do something like: You might also be interested in:

Re: [systemd-devel] sysusers and login.defs checks

2014-07-22 Thread Colin Walters
On Mon, Jul 21, 2014, at 09:43 AM, Lennart Poettering wrote: I am pretty strongly against this. Making this administrator configurable apepars very wrong, this really should be a decision for the distribution vendor, and that's it. You list one concern below, are there others? We shouldn't

[systemd-devel] [PATCH] sysusers: Preserve label of /etc/{passwd, group}

2014-07-11 Thread Colin Walters
715e1ff352601d841fc0e29ecddd9f0f5ed6fe46 Mon Sep 17 00:00:00 2001 From: Colin Walters walt...@verbum.org Date: Fri, 11 Jul 2014 15:03:29 -0400 Subject: [PATCH] sysusers: Preserve label of /etc/{passwd,group} These files are specially labeled on SELinux systems, and we need to preserve that label. --- src/shared

Re: [systemd-devel] [PATCH] tmpfiles: only execute chmod()/chown() when needed

2014-07-11 Thread Colin Walters
On Fri, Jul 11, 2014, at 06:05 AM, Michael Olbrich wrote: This avoids errors like this, when the paths are already there with the correct permissions and owner: chmod(/var/spool) failed: Read-only file system I'd say we should avoid running systemd-tmpfiles if the filesystem is read only.

Re: [systemd-devel] [PATCH] tmpfiles: only execute chmod()/chown() when needed

2014-07-11 Thread Colin Walters
On Fri, Jul 11, 2014, at 03:04 PM, Dave Reisner wrote: No way. This precludes tmpfiles from creating directories in /run. Yeah that suggestion would break other stuff too, ignore it. This does get into the ostree commit I linked to though; we could just have systemd mount /var as a tmpfs if

Re: [systemd-devel] [PATCH] readahead: add option to create pack in directory other than root

2014-07-08 Thread Colin Walters
On Tue, Jul 8, 2014, at 05:12 AM, Lennart Poettering wrote: b) readahead-collect would check if /var/lib/systemd is on the same mount point as /. If so, it would store the file in /var/lib/systemd/readahead. Otherwise it would store the file in /.readahead, as before. If this logic

[systemd-devel] [PATCH] resolved: Move symlink creation from tmpfiles to daemon runtime

2014-07-07 Thread Colin Walters
/resolved-manager.c | 12 +++- tmpfiles.d/etc.conf| 1 - 2 files changed, 11 insertions(+), 2 deletions(-) From e914a95d5061c685d7310593c8a2dc247111ad9f Mon Sep 17 00:00:00 2001 From: Colin Walters walt...@verbum.org Date: Mon, 7 Jul 2014 08:27:43 -0400 Subject: [PATCH] resolved

Re: [systemd-devel] [PATCH] resolved: Move symlink creation from tmpfiles to daemon runtime

2014-07-07 Thread Colin Walters
On Mon, Jul 7, 2014, at 10:35 AM, Lennart Poettering wrote: And of course, it's the most reasonable thing to do really, as in today's world it's populated dynamically from DHCP more often than not, and hence more runtime material than static configuration material. I agree. But... Humm,

[systemd-devel] mount units and symlinks

2014-06-30 Thread Colin Walters
Hi, we were trying to update systemd to git master in gnome-continuous, and hit an issue with mount points that are symlinks. It's pretty easy to reproduce: mkdir /mnt/a ln -s a /mnt/b cat /etc/systemd/system/mnt-b.mount EOF [Mount] What=tmpfs Where=/mnt/b Type=tmpfs

Re: [systemd-devel] mount units and symlinks

2014-06-30 Thread Colin Walters
On Mon, Jun 30, 2014, at 12:29 PM, Lennart Poettering wrote: Why would you create such a symlink? This sounds wrong. /tmp should generally be a tmpfs these days, why would you link that? I need to support cases where /tmp is not tmpfs (e.g. current Fedora cloud images). The rationale is the

Re: [systemd-devel] new user/group population on bootup

2014-06-16 Thread Colin Walters
On Sun, Jun 15, 2014, at 02:56 PM, Lennart Poettering wrote: BTW: given that there's now at least Colin, Kay, me, and CoreOS working on getting empty /etc working, can we at least try to agree where the vendor versions of the files should be? I am kinda voting for /usr/share/etc, and this is

Re: [systemd-devel] new user/group population on bootup

2014-06-14 Thread Colin Walters
On Fri, Jun 13, 2014, at 12:35 PM, Michael Marineau wrote: For what its worth, in my efforts to make CoreOS boot with a completely empty root filesystem I found that the changes required were usually not too dramatic. Fixing many packages, like sudo, just amounted to shipping different config

[systemd-devel] new user/group population on bootup

2014-06-13 Thread Colin Walters
Hi, I had a quick look at the new: http://cgit.freedesktop.org/systemd/systemd/commit/?id=1b99214789101976d6bbf75c351279584b071998 and followon commits. My high level takeaway right now is that this looks OK for nspawn containers, but it's not clear to me it's viable or right for the host OS, at

Re: [systemd-devel] new user/group population on bootup

2014-06-13 Thread Colin Walters
On Fri, Jun 13, 2014, at 05:36 AM, Colin Walters wrote: My high level takeaway right now is that this looks OK for nspawn containers, but it's not clear to me it's viable or right for the host OS, at least for general purpose systems. That was wrongly stated - basically I'm just skeptical

Re: [systemd-devel] systemd pam and O_CLOEXEC problem

2014-05-09 Thread Colin Walters
On Mon, May 5, 2014 at 6:48 AM, dedede gfgfgf trtrtrtrtrtr s.kabano...@mail.ru wrote: Investigations showed that since in pam module we started to dup fifo descriptor problem appeared. Dup does not set O_CLOEXEC flag. So after fork/exec all children processes have that descriptor and when

Re: [systemd-devel] [PATCH 2/2] core: let selinux_setup() load policy more than once

2014-04-28 Thread Colin Walters
On Fri, Apr 25, 2014 at 6:26 PM, Will Woods wwo...@redhat.com wrote: But if SELinux was already initialized, selinux_setup() skips loading policy and returns 0. So if you load policy normally, and then you switch-root to a new root that has new policy, selinux_setup() never loads the new

[systemd-devel] binding tmpfiles.d to unit startup

2014-03-01 Thread Colin Walters
Hi, So for OSTree I am trying to move to a model where services populate the contents of /var on *start*. See previous discussion here: https://www.mail-archive.com/systemd-devel@lists.freedesktop.org/msg07859.html The really great part about this is that one is then able to totally reset

Re: [systemd-devel] [PATCH] TODO: Simple conditionals in tmpfiles

2014-03-01 Thread Colin Walters
On Fri, Feb 28, 2014 at 9:36 AM, Josh Triplett j...@joshtriplett.org wrote: --- Strawman proposal, open to suggestions. ... + - Simple conditionals: C path mode user group - (tmpfiles-line) does tmpfiles-line if path has mode, user, and group: +C /usr/bin/screen 2755 root utmp - d

Re: [systemd-devel] binding tmpfiles.d to unit startup

2014-03-01 Thread Colin Walters
On Sat, Mar 1, 2014 at 1:44 PM, Michael Biebl mbi...@gmail.com wrote: I vaguely remember that we exactly had this discussion a while ago. Argh, yes, possibly. The dangers of getting older... Unfortunately I'm not able to find it in the archives right now. I think if we did talk about

Re: [systemd-devel] binding tmpfiles.d to unit startup

2014-03-01 Thread Colin Walters
On Sat, Mar 1, 2014 at 2:18 PM, Tom Gundersen t...@jklm.no wrote: And a bit further down that thread there was this proposal from Lennar (which doesn't seem far from what Colin wants): http://lists.freedesktop.org/archives/systemd-devel/2013-July/012024.html. Right...so rereading that, the

Re: [systemd-devel] binding tmpfiles.d to unit startup

2014-03-01 Thread Colin Walters
On Sat, Mar 1, 2014 at 2:46 PM, Colin Walters walt...@verbum.org wrote: RuntimeDirectory=/run/mydaemon PersistentStateDirectory=/var/lib/mydaemon Btw, see also this thread: https://lists.fedoraproject.org/pipermail/server/2014-February/000843.html Putting these together (and how about we

[systemd-devel] [PATCH] selinux: Only attempt to load policy exactly once, in the real root

2014-02-20 Thread Colin Walters
where we expect to find policy, and attempt to load it exactly from there. Right now since I'm not aware of anyone who does policy-in-initramfs, this function is hardcoded to return false. Lots-of-very-painful-debugging-by: Colin Walters walt...@verbum.org --- src/core/main.c | 6 -- src/core

Re: [systemd-devel] systemd from git doesn't work with g-object-introspection 1.32.1

2014-02-20 Thread Colin Walters
On Thu, Feb 20, 2014 at 8:41 AM, Zbigniew Jędrzejewski-Szmek zbys...@in.waw.pl wrote: On Thu, Feb 20, 2014 at 01:37:55PM +0100, Holger Schurig wrote: Compilation on Debian Stable, this happens during a make: GISCAN src/gudev/GUdev-1.0.gir Usage: g-ir-scanner [options] sources

Re: [systemd-devel] [PATCH] selinux: Only attempt to load policy exactly once, in the real root

2014-02-20 Thread Colin Walters
On Thu, Feb 20, 2014 at 1:06 PM, Stephen Smalley s...@tycho.nsa.gov wrote: Wouldn't it be better (and more correct) to probe both the initramfs and the real root, and if neither one can load policy successfully and enforcing=1, then halt? So you're saying we should handle -ENOENT specially

Re: [systemd-devel] [PATCH] selinux: Only attempt to load policy exactly once, in the real root

2014-02-20 Thread Colin Walters
On Thu, Feb 20, 2014 at 1:36 PM, Lennart Poettering lenn...@poettering.net wrote: On Thu, 20.02.14 18:17, Colin Walters (walt...@verbum.org) wrote: Hmm, maybe a simple check access(/etc/selinux/, F_OK) would be enough? There's no point in trying to initialized SELinux if that dir does

Re: [systemd-devel] [PATCH] selinux: Only attempt to load policy exactly once, in the real root

2014-02-20 Thread Colin Walters
On Thu, Feb 20, 2014 at 2:45 PM, Daniel J Walsh dwa...@redhat.com wrote: You mean !in_initrd() || access(selinux_path(), F_OK) = 0? I don't think so - that would mean we would silently continue if enforcing=1, but we happen to not find a policy on disk. Right? I think my patch is

Re: [systemd-devel] [PATCH] selinux: Only attempt to load policy exactly once, in the real root

2014-02-20 Thread Colin Walters
On Thu, Feb 20, 2014 at 4:10 PM, Eric Paris epa...@parisplace.org wrote: I think the idea was if we are not in the initrd - try to load policy if we are in the initrd and we find selinux_path() - try to load policy Thus embeded/thin who put everything inside the initrd will work (and the

Re: [systemd-devel] [PATCH] selinux: Only attempt to load policy exactly once, in the real root

2014-02-20 Thread Colin Walters
On Thu, Feb 20, 2014 at 4:21 PM, Colin Walters walt...@verbum.org wrote: I'm testing this suggested patch now. I tweaked the suggestion a bit because the selinux_path() API call made the most sense inside selinux-setup.c. Attached patch works for me. From

Re: [systemd-devel] systemd from git doesn't work with g-object-introspection 1.32.1

2014-02-20 Thread Colin Walters
On Thu, Feb 20, 2014 at 7:37 AM, Holger Schurig holgerschu...@gmail.com wrote: Compilation on Debian Stable, this happens during a make: GISCAN src/gudev/GUdev-1.0.gir When posting errors from builds, always use make V=1. Usage: g-ir-scanner [options] sources g-ir-scanner: error: no

Re: [systemd-devel] Create a new logind session from a systemd --user unit

2014-01-08 Thread Colin Walters
[ I'm going to trim the CC, I'm pretty sure everyone who has commented so far is on systemd-devel ] On Wed, 2014-01-08 at 13:55 +0100, David Herrmann wrote: This basically defeats the whole purpose of a session. A lot of it, yes. The session becomes: * A refcount on the user@.service * A

Re: [systemd-devel] [PATCH 00/11] *** SUBJECT HERE ***

2013-12-20 Thread Colin Walters
On Thu, 2013-12-19 at 14:20 +0100, Florian Weimer wrote: readdir_r is rather broken on Linux because there are some directories it cannot read. Citation? Are you talking about http://womble.decadent.org.uk/readdir_r-advisory.html ? ___

Re: [systemd-devel] The whole su/pkexec session debate

2013-12-02 Thread Colin Walters
On Mon, 2013-12-02 at 14:37 +0100, David Herrmann wrote: But then gnome-session should simply call ReleaseSession() on the bus itself.. I'd rather have some sort of API where a particular process is the session leader, and its exit implies closing. Something like a pid file in

Re: [systemd-devel] [systemd-commits] 4 commits - catalog/systemd-fr.catalog catalog/systemd-ru.catalog configure.ac Makefile.am po/.gitignore po/LINGUAS po/ru.po

2013-12-01 Thread Colin Walters
On Sun, 2013-12-01 at 01:26 +0100, Zbigniew Jędrzejewski-Szmek wrote: Actually I don't think we need to totally forbid declarations after statements. I don't have an opinion myself on making -Wdeclaration-after-statement an error or not, but presently with GCC 4.7 as in gnome-continuous, we

Re: [systemd-devel] [systemd-commits] 4 commits - catalog/systemd-fr.catalog catalog/systemd-ru.catalog configure.ac Makefile.am po/.gitignore po/LINGUAS po/ru.po

2013-11-29 Thread Colin Walters
on an old gcc. There's also this approach: From 7affb075dd1889fbb6b8d8865dec4b5e1d36448f Mon Sep 17 00:00:00 2001 From: Colin Walters walt...@verbum.org Date: Fri, 29 Nov 2013 14:43:45 -0500 Subject: [PATCH] macro: Split assert_cc, add assert_cc_toplevel To suppress warnings about -Wdeclaration-after

Re: [systemd-devel] pam: Don't use loginuid [was: Re: Fix PAM module to not clobber XDG_RUNTIME_DIR with su]

2013-11-22 Thread Colin Walters
On Wed, 2013-11-20 at 19:19 -0500, Colin Walters wrote: I care about pkexec. Note we're now carrying a workaround for this: https://bugs.freedesktop.org/show_bug.cgi?id=71894 ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org http

Re: [systemd-devel] The whole su/pkexec session debate

2013-11-20 Thread Colin Walters
On Wed, 2013-11-20 at 10:16 +, Colin Guthrie wrote: How do we fix this? There are a lot of cases - screen is just one of them. I think to make forward progress on this we'll have to enumerate the cases, evaluate the problems with each, then for each problem, evaluate a fix - and make sure

Re: [systemd-devel] pam: Don't use loginuid [was: Re: Fix PAM module to not clobber XDG_RUNTIME_DIR with su]

2013-11-20 Thread Colin Walters
On Tue, 2013-11-19 at 22:38 +, Colin Guthrie wrote: 'Twas brillig, and Colin Walters at 19/11/13 18:13 did gyre and gimble: +d /run/user/0 0755 root root 10d This should probably be 0700 like the runtime dirs usually are I think. Ooops =/ Fixed! Also won't this folder be naturally

Re: [systemd-devel] pam: Don't use loginuid [was: Re: Fix PAM module to not clobber XDG_RUNTIME_DIR with su]

2013-11-20 Thread Colin Walters
On Thu, 2013-11-21 at 00:32 +0100, Lennart Poettering wrote: On Tue, 19.11.13 10:42, Colin Walters (walt...@verbum.org) wrote: My patch though starts to pave the way for having XDG_RUNTIME_DIR consistently point to that of the user's uid I think this is just bogus. You used su. I use

Re: [systemd-devel] pam: Don't use loginuid [was: Re: Fix PAM module to not clobber XDG_RUNTIME_DIR with su]

2013-11-20 Thread Colin Walters
On Thu, 2013-11-21 at 00:36 +0100, Lennart Poettering wrote: On Tue, 19.11.13 13:13, Colin Walters (walt...@verbum.org) wrote: Anyways, new tested patch attached. Lennart, any objections? Yes. Let's not tape over problems and pretend things could work if we freely mix and match things

Re: [systemd-devel] pam: Don't use loginuid [was: Re: Fix PAM module to not clobber XDG_RUNTIME_DIR with su]

2013-11-20 Thread Colin Walters
On Thu, 2013-11-21 at 01:20 +0100, Michael Biebl wrote: 2013/11/18 Michael Stapelberg stapelb...@debian.org: This is a rather pressing issue for us (it breaks GDM logins in some cases), and we’d like to fix it by cherry-picking a patch that was merged upstream. some cases is very vague.

Re: [systemd-devel] pam: Don't use loginuid [was: Re: Fix PAM module to not clobber XDG_RUNTIME_DIR with su]

2013-11-19 Thread Colin Walters
On Mon, 2013-11-18 at 19:35 -0500, Colin Walters wrote: And that's what I'm testing - with Martin's patch in the loop I was still getting XDG_DATA_DIR for uid 1000, I'll try to debug soon. Ok, some discussion on IRC revealed that I was only using the second patch to s/loginuid/uid/, but we

Re: [systemd-devel] pam: Don't use loginuid [was: Re: Fix PAM module to not clobber XDG_RUNTIME_DIR with su]

2013-11-19 Thread Colin Walters
a process of uid N reads /run/userdir it is a symlink to /run/user/N which is automatically mounted as a tmpfs. Anyways, new tested patch attached. Lennart, any objections? From 98da613a2dfcf4bb6bee709f29aba142cd34f118 Mon Sep 17 00:00:00 2001 From: Colin Walters walt...@verbum.org Date: Tue, 19

Re: [systemd-devel] pam: Don't use loginuid [was: Re: Fix PAM module to not clobber XDG_RUNTIME_DIR with su]

2013-11-18 Thread Colin Walters
Hi, On Mon, 2013-11-18 at 21:59 +0100, Michael Stapelberg wrote: Therefore, I’d like to ask people with a commit bit (Colin?) to please have another look and merge the patch unless something is still wrong with it :). Thanks! This is on my radar; the patch wasn't working for me but I haven't

Re: [systemd-devel] [PATCH 00/28] Initial DHCP v4 library implementation

2013-11-13 Thread Colin Walters
On Thu, 2013-11-14 at 06:49 +0900, Marcel Holtmann wrote: that is the long term plan. Once ConnMan is switching over to use libsystemd-bus and kdbus, we are switching over to using the systemd event loop instead of GLib main loop But I think the long term architecturally correct place for

Re: [systemd-devel] [PATCH 00/28] Initial DHCP v4 library implementation

2013-11-13 Thread Colin Walters
On Thu, 2013-11-14 at 07:25 +0900, Marcel Holtmann wrote: I am a bit lost on your concerns here. Our focus for ConnMan is libsystemd-bus and kdbus support. Yeah, sorry; I just kind of used your mail as a basis for the larger picture of sd_event as public API. And as a system daemon, I only

Re: [systemd-devel] [PATCH 00/28] Initial DHCP v4 library implementation

2013-11-13 Thread Colin Walters
On Thu, 2013-11-14 at 00:47 +0100, Lennart Poettering wrote: I am pretty sure it makes sense to have domain-specific event loops. I am not convinced that it would even be possible to unify all event loop implementations into one. For example, GLib and and sd-event support priorization of

[systemd-devel] [PATCH] build-sys: Add --disable-networkd option

2013-11-12 Thread Colin Walters
this. --- Makefile.am |2 ++ configure.ac |8 2 files changed, 10 insertions(+), 0 deletions(-) From f2d9637bc8ec7543b9a0ced18b35d5911e41be86 Mon Sep 17 00:00:00 2001 From: Colin Walters walt...@verbum.org Date: Tue, 12 Nov 2013 15:43:17 -0500 Subject: [PATCH] build-sys: Add --disable

Re: [systemd-devel] [PATCH] build-sys: Add --disable-networkd option

2013-11-12 Thread Colin Walters
On Tue, 2013-11-12 at 22:48 +0100, Tom Gundersen wrote: I also made the man pages conditional, please have a look if that works for you. Looks right. (Wow, make-man-rules.py is some nice magic) For what it's worth, if shipping or running networkd has any adverse effect (apart from space

Re: [systemd-devel] [PATCH 0/1] systemd will fail to compile if libgcrypt is missing

2013-11-05 Thread Colin Walters
On Tue, 2013-11-05 at 16:22 +0100, Lennart Poettering wrote: This pretty much like all other projects handle this, too. Just for what it's worth in a number of parts of GNOME we started using m4_ifdef more consistently. For example:

Re: [systemd-devel] [PATCH 0/1] systemd will fail to compile if libgcrypt is missing

2013-11-05 Thread Colin Walters
On Tue, 2013-11-05 at 16:39 +, Colin Guthrie wrote: Does this not increase the danger that a make dist run on a machine without those deps installed would result in a configure script that accidentally doesn't have support for those features? Or do I misunderstand how the m4_ifdef stuff

Re: [systemd-devel] Need advice on daemon's architecture

2013-11-04 Thread Colin Walters
On Mon, 2013-11-04 at 14:57 +, Simon McVittie wrote: See Linux signal(7) for a list of async-signal-safe operations: it's not as long a list as you might hope, and mostly contains syscalls. In particular, malloc() is not on the list, which rules out a lot of library code... Given however

Re: [systemd-devel] [PATCH] sd-login: Fix typo

2013-11-02 Thread Colin Walters
On Fri, 2013-11-01 at 00:24 +0100, Bastien Nocera wrote: s/sessio,/session,/ Looks like this got lost in the other mailing list noise; just pushed now. ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org

Re: [systemd-devel] [PATCH 1/2] manager: connect to private bus even if $DBUS_SESSION_BUS_ADDRESS is not set

2013-10-13 Thread Colin Walters
On Wed, 2013-10-09 at 17:33 +0300, Mantas Mikulėnas wrote: On Wed, Oct 9, 2013 at 3:59 PM, Colin Walters walt...@verbum.org wrote: Your patch seems to be at odds with the commit message; since DBUS_SESSION_BUS_ADDRESS won't be set for the user bus, we won't attempt a connection, right

Re: [systemd-devel] [PATCH 1/2] manager: connect to private bus even if $DBUS_SESSION_BUS_ADDRESS is not set

2013-10-09 Thread Colin Walters
Your patch seems to be at odds with the commit message; since DBUS_SESSION_BUS_ADDRESS won't be set for the user bus, we won't attempt a connection, right? What you're really trying to fix I assume is the warning systemd outputs when it currently spawns user@? Note I also patched this code in

Re: [systemd-devel] [PATCH] Add SHELL environment variable

2013-09-24 Thread Colin Walters
On Mon, 2013-09-23 at 21:01 -0500, Evan Callicoat wrote: Ideally in the long-term, applications which rely on SHELL being set should be fixed to just grab it from getpwnam() or similar, but until that becomes more common, I propose this simple change to make user sessions a little bit nicer

Re: [systemd-devel] A small issue with user@.service

2013-09-20 Thread Colin Walters
Hi Yuxuan, On Fri, 2013-09-20 at 23:36 +0800, Yuxuan Shui wrote: Dear developers, I had post-poned systemd updates for a long time, because update from 204 to 206 breaks systemd --user. Now start systemd --user manually fails with: See previous threads:

Re: [systemd-devel] [PATCH] logind: put correct user object paths in introspection data

2013-09-20 Thread Colin Walters
On Fri, 2013-09-20 at 18:14 +0300, Mantas Mikulėnas wrote: Sync with user_bus_path() in logind-user-dbus.c Right, looks like this was missed with 9444b1f2. Applied, thanks! ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org

Re: [systemd-devel] [PATCH] cgroup: add missing equals for BlockIOWeight

2013-09-16 Thread Colin Walters
On Mon, 2013-09-16 at 09:57 +0800, Gao feng wrote: --- src/core/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Applied, thanks! ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org

Re: [systemd-devel] [PATCH 6/7] mount: filesystems mounted in the initrd should not conflict with umount.target in the real root

2013-09-11 Thread Colin Walters
On Wed, 2013-09-11 at 16:31 +0200, Lennart Poettering wrote: Well, everything that this list would declare is that /, /etc, /usr (and maybe very few others) are the bits that systemd requires to be mounted when the host's systemd is first invoked. Where it is mounted from, and in which order

Re: [systemd-devel] [PATCH 6/7] mount: filesystems mounted in the initrd should not conflict with umount.target in the real root

2013-09-11 Thread Colin Walters
On Wed, 2013-09-11 at 16:55 +0200, Lennart Poettering wrote: Well, but /etc would be one of those which would be listed in that OS resource dir list... Sure, it makes total sense for systemd to hard require it (and the others) to be mounted; again I'm just more interested in the unmounting.

Re: [systemd-devel] [PATCH 6/7] mount: filesystems mounted in the initrd should not conflict with umount.target in the real root

2013-09-11 Thread Colin Walters
On Wed, 2013-09-11 at 19:11 +0200, Lennart Poettering wrote: Can you elaborate on this? Why wouldn't it suffice to drop in a .mount unit for the mount in question which excludes the mount point from being unmounted with this? It doesn't appear possible to remove the default Conflicts= just by

Re: [systemd-devel] [PATCH 6/7] mount: filesystems mounted in the initrd should not conflict with umount.target in the real root

2013-09-10 Thread Colin Walters
On Tue, 2013-09-10 at 18:47 +0200, Lennart Poettering wrote: I'd actually prefer having an explicit blacklist for this, so that we don't have to trust the initrd too much that... But nowadays it's systemd running in the initrd, what's not to trust? However, I'd really like to see this

Re: [systemd-devel] [RFC v2] mount: improve DefaultDependencies and use in generator

2013-08-23 Thread Colin Walters
On Fri, 2013-08-23 at 15:09 +0800, Tom Gundersen wrote: This moves reduces redundancy between systemd core and the fstab-generator, by improving and relying on the DefaultDependencies logic. It's also worth pointing out that conceptually Lennart has been obsoleting a lot of this stuff with:

Re: [systemd-devel] [PATCH 1/5] configure.ac: Add option to disable configuring the BIOS test

2013-08-21 Thread Colin Walters
On Wed, 2013-08-21 at 11:13 -0700, Darren Hart wrote: +if test x$enable_biostest != xno; then Use AS_IF() please; systemd's current configure.ac is not consistent in this respect, but it will save debugging painful m4 crap later: https://bugzilla.gnome.org/show_bug.cgi?id=681413

Re: [systemd-devel] [PATCH v2] gnome-ask-password-agent: do not double fork spawned process

2013-08-14 Thread Colin Walters
On Wed, 2013-08-14 at 06:46 +0200, Michael Laß wrote: pkexec does not like being a lonely child: Refusing to render service to dead parents. Do not double fork when spawning the process by using the DO_NOT_REAP_CHILD flag. Clean up manually using a child watch. Pushed, thanks!

Re: [systemd-devel] [PATCH] gnome-ask-password-agent: do not double fork spawned process

2013-08-13 Thread Colin Walters
On Tue, 2013-08-13 at 23:42 +0200, Michael Laß wrote: pkexec does not like being a lonely child: Refusing to render service to dead parents. Do not double fork when spawning the process by using the DO_NOT_REAP_CHILD flag. Instead clean up manually by calling waitpid. It's cleaner to use

Re: [systemd-devel] Create a new logind session from a systemd --user unit

2013-08-05 Thread Colin Walters
On Mon, 2013-08-05 at 12:24 +0100, Simon McVittie wrote: On 04/08/13 15:46, Colin Walters wrote: 1) Pretty much all the user processes are no longer inside a session at all. 2) It is now much harder to log in multiple times graphically; this is kind of a crazy thing to do, but it's

Re: [systemd-devel] Create a new logind session from a systemd --user unit

2013-08-05 Thread Colin Walters
On Sun, 2013-08-04 at 21:02 +0300, Oleksii Shevchuk wrote: What about logind/polkit? I.e. if i start nm-applet from systemd@user, than polkit doesn't authenticate it, as it not belong to active session Ok, I tossed up: https://people.gnome.org/~walters/user-session-patches/polkit/ With this

  1   2   >