Working out how long the service manager keeps restarting a failing service
takes the exponential backoff formula from systemd.service(5) and a manual
simulation of the start rate limit. Getting either wrong means a service
that's supposed to fail after a while is restarted forever.
Let's add a restart-delays command that does both. It lists each restart
until the delay stops growing, with the total of the delays up to that
restart, and then says whether the start rate limit rejects a restart and
when. Like security, it reads the settings of loaded units from the service
manager, or loads unit files with --offline=yes. With --json=, it prints the
same data as a JSON object.
The command computes the delays with the same functions as the service
manager. It checks the start rate limit with ratelimit_below_at() for each
restart until the delay stops growing. After that, every restart waits the
same delay. We then compute the rejected restart from the number of starts
that the current window of the rate limit still allows.
A small tool that generates file manifests of plain directory trees in
the four formats manifest-util knows (simple list, SHA256SUMS, mtree,
UAPI.16), and verifies directory trees against such manifests. It
works on plain directories only, i.e. does not dissect images, for that
systemd-dissect --uapi16/--sha256sums/--mtree/--list remain available
and share the same code.
The format is selected with --format=, and the fields to include or
check with --field= (defaulting to what systemd-dissect emits). For
mtree manifests --hash= selects SHA512 instead of SHA256. All
positional arguments are optional: the directory defaults to the
current directory, "make" writes to standard output unless a file is
specified, and "verify" reads the manifest from standard input unless a
file is specified.
Generation fails if inodes had to be skipped or some of their metadata
had to be omitted (for example because of missing privileges), unless
--graceful is specified, in which case we only insist that the
top-level inode is covered.
"hostnamectl tags --apply" asks systemd-hostnamed to apply the
machine-tags.d/ configuration via the new ApplyTags() Varlink call.
As the call is only available via Varlink, the switch is not supported
together with --host= or --machine=.
When providing ad-hoc protocol upgrade support to existing programs
via the `varlinkctl serve` command it is often useful/desirable
to limit it to a certain polkit action. So we add a new flag called
`--polkit-action=` here that does exactly this. The protocol upgrade
is only allowed when the given polkit action is allowed for the
user.
Thanks to Lennart for suggesting this in PR#43994
- Missing '--' for compgen, and '-o nospace' and '-o dirnames' are
for compopt rather than compgen,
- add missing '-1' completion.
- argument of --cpu is optional, hence it must be concatenated with '=',
- drop unnecessary assignments for cur and prev.
Add "varlinkctl monitor" which connects to systemd-varlink-monitord and
displays captured varlink messages in real time, with both pretty-printed
and JSON-SEQ output modes. Supports filtering by --pid, --path, and
--uid. Includes integration tests covering pre-existing sockets, new
sockets, filtering, large message reassembly, garbage data handling, and
JSON output validation.
Installing an update might make further updates available, for example
because the update ships new or changed transfer files, components, or
system extensions containing such files. Hence add a new --loop=N
switch, which runs the update logic repeatedly, re-reading all
definitions each time, until either nothing is installed anymore, or N
iterations have been done.
If --reboot is specified the reboot is requested once, after the last
iteration.
Not specifying --loop= is equivalent to --loop=1, i.e. the behaviour
remains unchanged.
systemctl: add new "systemctl wait" command
It's quite useful being able to wait for a unit to be terminated and see
its exit data, just like we do it for systemd-run, without triggering
any other operation (which is what systemctl stop would do).
Fixes: #32017
The root row in systemd-cgtop previously displayed whole-system RAM
usage read from /proc/meminfo (MemTotal - MemAvailable), not a cgroup
sum. This is a pragmatic fallback — the kernel intentionally does not
expose memory.current on the v2 root cgroup (see the existing
is_root_cgroup() comment about avoiding 'multiple truth about system
state'), so cgtop picked /proc/meminfo to fill the gap.
Nevertheless, that caued the '/' row to provide different information
than every other row in the table:
- All child rows: 'what is this cgroup charged for?' (anon + file
+ sock + shmem attributable to the cgroup).
- Root row: 'what is the whole system using?' (includes kernel
slab, vmalloc, pagetables, zram mem_used, and anything not
attributable to any cgroup).
On a typical desktop the root row can read ~10 GB while the sum of
direct children is ~5 GB, with no explanation visible in the tool
itself.
This commit:
1. Introduces --root-memory= command line option.
2. Flips the default for the root row to the sum of memory.current
over its direct children.
3. Adds a '/' interactive key that toggles between the two modes.
4. Updates the interactive help string ('?' / 'h'), the man page,
and the bash completion for the new option.
Inside a container (detect_container() > 0), is_root_cgroup() already
returns false, so none of this applies — the container's '/' still
reads memory.current from the namespaced cgroup as before.
Co-authored-by: Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com>
It's quite useful being able to wait for a unit to be terminated and see
its exit data, just like we do it for systemd-run, without triggering
any other operation (which is what systemctl stop would do).
Fixes: #32017
It's nice to use --attach since it validates our images. So far, it
strictly insisted on checking that the image was a DDI however, which
limits its use for certain usecases.
Add "--relax" to address this limitation.
Create the file with open_tmpfile_linkable_at().
Write the recovery key and trailing newline to the temporary fd.
Set the final mode to 0600 before publishing it.
Link it into place with link_tmpfile_at(..., LINK_TMPFILE_SYNC).
The `restart` verb was added to machinectl as a convenience alias for
`reboot`, but its shell completions were never updated. Add it to both
the bash and zsh completions.
Several verbs in the STANDALONE bucket accept --json=, but that bucket only
offers --help --version --system --user --global --no-pager, so completion
never suggested the option for them.
Split those verbs out into a new STANDALONE_JSON bucket that additionally
offers --json=off/pretty/short. The verbs are moved rather than copied, as
${VERBS[*]} is used to complete the verb list itself.
Add a new --no-reconfigure flag to 'networkctl reload' that reloads
.network and .netdev files from disk without reconfiguring any network
interfaces. This may be useful to avoid reconfiguring multiple interfaces
simultaneously when multiple .network files are updated, or when an updated
.network file is applied to multiple interfaces.
On the networkd side, manager_reload() gains a reconfigure_links parameter
that gates the per-link reconfiguration loop. A new io.systemd.Network.Reload
varlink method is added that exposes this as an optional reconfigureLinks
boolean (defaults to true). Both plain 'networkctl reload' and
'--no-reconfigure' now unconditionally call this method first. If an older
networkd returns MethodNotFound, plain reload falls back to
io.systemd.service.Reload for backward compatibility; '--no-reconfigure'
fails with a clear error in that case.
Add a "bootctl link-auto" verb and a matching io.systemd.BootControl.LinkAuto()
Varlink method that behave exactly like "bootctl link" / Link(), except that
the UKI and extra resources are discovered automatically instead of being
passed in. The following directories are searched, in decreasing priority:
/etc/systemd/uki/, /run/systemd/uki/, /var/lib/systemd/uki/ (where
systemd-sysupdate stages downloaded resources), /usr/local/lib/systemd/uki/
and /usr/lib/systemd/uki/.
- the UKI is taken from kernel.efi, or the best version in kernel.efi.v/
(resolved via vpick, without honouring boot-counting suffixes), from the
highest-priority directory that has one;
- extra resources are picked up from extras.d/, matching *.sysext.raw,
*.confext.raw and *.cred, each either as a plain file or as a versioned
*.v/ directory resolved via vpick, combined across all directories with
higher-priority directories winning on conflicts.
Everything is resolved relative to the pinned root directory fd. Files passed
via --extra= on the command line are linked in addition to the auto-discovered
ones.
Also bind io.systemd.SysUpdate.Notify.OnCompletedUpdate() in the boot control
Varlink server, which simply does the same as LinkAuto(), and hook a socket
into /run/systemd/sysupdate/notify/ via systemd-sysupdate-notify-bootctl.socket
(enabled by default via the preset) so a freshly downloaded kernel is linked
into $BOOT automatically after a sysupdate run.
kexec-tools has a --reuse-cmdline option which is very convenient
when doing a lot of reboots, add the same to systemctl.
Dedup options, letting the last one wins in case of duplicates,
so that 'systemctl kexec --reuse-cmdline' can be chained many times
without continuosly expanding the cmdline with duplicates from
the boot entry.
This is meant to mirror sudo's -k/--reset-timestamp and
-K/--remove-timestamp options, which revoke the temporary authorization
provided by the timestamp files in /var/run/sudo/ts.
To achieve the same effect in run0, we ask polkit to revoke our
temporary authorization. If used with a command, run0 will revoke the
temporary auth and then immediately authorize the user again, just like
sudo -k. All the bus calls are completed synchronously, as they need to
complete before authorizing the user anyway.
Like sudo, the effect of -k/--reset-timestamp is to revoke only the
tmpauthz that polkit would have used to authorize the command, if
available. The -K/--remove-timestamp option will revoke all temporary
authorizations across all ttys.
machinectl bind-volume MACHINE PROVIDER:VOLUME[:CONFIG][:K=V,...]
machinectl unbind-volume MACHINE PROVIDER:VOLUME
For bind-volume, machinectl parses the SPEC with the shared
bind_volume_parse(), Acquires the storage volume from the named
provider on the machinectl side, locates the target machine's
io.systemd.MachineInstance control socket via
machine_get_control_address(), pushes the fd across, and calls
io.systemd.MachineInstance.AddStorage with name='<provider>:<volume>'
and the user-supplied config string.
For unbind-volume, machinectl just forwards the name string to
io.systemd.MachineInstance.RemoveStorage.
Volumes attached at machine startup (e.g. via systemd-vmspawn's
--bind-volume=) are rejected with StorageImmutable when the user
attempts to unbind them at runtime.
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Lennart Poettering