commit
9dae0dbcc9
GPG Key ID:
D87CBBC16D2E4A72
@ -0,0 +1,117 @@
|
|||||||
|
From f896e672ec6101ccbb21108345946e834455a25f Mon Sep 17 00:00:00 2001
|
||||||
|
From: Franck Bui <fbui@suse.com>
|
||||||
|
Date: Fri, 3 Apr 2020 10:00:25 +0200
|
||||||
|
Subject: [PATCH] pid1: by default make user units inherit their umask from the
|
||||||
|
user manager
|
||||||
|
|
||||||
|
This patch changes the way user managers set the default umask for the units it
|
||||||
|
manages.
|
||||||
|
|
||||||
|
Indeed one can expect that if user manager's umask is redefined through PAM
|
||||||
|
(via /etc/login.defs or pam_umask), all its children including the units it
|
||||||
|
spawns have their umask set to the new value.
|
||||||
|
|
||||||
|
Hence make user units inherit their umask value from their parent instead of
|
||||||
|
the hard coded value 0022 but allow them to override this value via their unit
|
||||||
|
file.
|
||||||
|
|
||||||
|
Note that reexecuting managers with 'systemctl daemon-reexec' after changing
|
||||||
|
UMask= has no effect. To take effect managers need to be restarted with
|
||||||
|
'systemct restart' instead. This behavior was already present before this
|
||||||
|
patch.
|
||||||
|
|
||||||
|
Fixes #6077.
|
||||||
|
|
||||||
|
(cherry picked from commit 5e37d1930b41b24c077ce37c6db0e36c745106c7)
|
||||||
|
|
||||||
|
Related: RHEL-28048
|
||||||
|
---
|
||||||
|
man/systemd.exec.xml | 9 +++++++--
|
||||||
|
src/basic/process-util.c | 17 +++++++++++++++++
|
||||||
|
src/basic/process-util.h | 1 +
|
||||||
|
src/core/unit.c | 12 ++++++++++--
|
||||||
|
4 files changed, 35 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
|
||||||
|
index b04b4ba552..844c1ce94b 100644
|
||||||
|
--- a/man/systemd.exec.xml
|
||||||
|
+++ b/man/systemd.exec.xml
|
||||||
|
@@ -590,8 +590,13 @@ CapabilityBoundingSet=~CAP_B CAP_C</programlisting>
|
||||||
|
<term><varname>UMask=</varname></term>
|
||||||
|
|
||||||
|
<listitem><para>Controls the file mode creation mask. Takes an access mode in octal notation. See
|
||||||
|
- <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry> for details. Defaults
|
||||||
|
- to 0022.</para></listitem>
|
||||||
|
+ <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
|
||||||
|
+ details. Defaults to 0022 for system units. For units of the user service manager the default value
|
||||||
|
+ is inherited from the user instance (whose default is inherited from the system service manager, and
|
||||||
|
+ thus also is 0022). Hence changing the default value of a user instance, either via
|
||||||
|
+ <varname>UMask=</varname> or via a PAM module, will affect the user instance itself and all user
|
||||||
|
+ units started by the user instance unless a user unit has specified its own
|
||||||
|
+ <varname>UMask=</varname>.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
diff --git a/src/basic/process-util.c b/src/basic/process-util.c
|
||||||
|
index 9e2237375d..af44bfab3e 100644
|
||||||
|
--- a/src/basic/process-util.c
|
||||||
|
+++ b/src/basic/process-util.c
|
||||||
|
@@ -657,6 +657,23 @@ int get_process_ppid(pid_t pid, pid_t *ret) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
+int get_process_umask(pid_t pid, mode_t *umask) {
|
||||||
|
+ _cleanup_free_ char *m = NULL;
|
||||||
|
+ const char *p;
|
||||||
|
+ int r;
|
||||||
|
+
|
||||||
|
+ assert(umask);
|
||||||
|
+ assert(pid >= 0);
|
||||||
|
+
|
||||||
|
+ p = procfs_file_alloca(pid, "status");
|
||||||
|
+
|
||||||
|
+ r = get_proc_field(p, "Umask", WHITESPACE, &m);
|
||||||
|
+ if (r == -ENOENT)
|
||||||
|
+ return -ESRCH;
|
||||||
|
+
|
||||||
|
+ return parse_mode(m, umask);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
int wait_for_terminate(pid_t pid, siginfo_t *status) {
|
||||||
|
siginfo_t dummy;
|
||||||
|
|
||||||
|
diff --git a/src/basic/process-util.h b/src/basic/process-util.h
|
||||||
|
index a3bd2851b4..9059aad4cc 100644
|
||||||
|
--- a/src/basic/process-util.h
|
||||||
|
+++ b/src/basic/process-util.h
|
||||||
|
@@ -41,6 +41,7 @@ int get_process_cwd(pid_t pid, char **cwd);
|
||||||
|
int get_process_root(pid_t pid, char **root);
|
||||||
|
int get_process_environ(pid_t pid, char **environ);
|
||||||
|
int get_process_ppid(pid_t pid, pid_t *ppid);
|
||||||
|
+int get_process_umask(pid_t pid, mode_t *umask);
|
||||||
|
|
||||||
|
int wait_for_terminate(pid_t pid, siginfo_t *status);
|
||||||
|
|
||||||
|
diff --git a/src/core/unit.c b/src/core/unit.c
|
||||||
|
index 76fb9f8075..d3459dcdd0 100644
|
||||||
|
--- a/src/core/unit.c
|
||||||
|
+++ b/src/core/unit.c
|
||||||
|
@@ -167,8 +167,16 @@ static void unit_init(Unit *u) {
|
||||||
|
if (ec) {
|
||||||
|
exec_context_init(ec);
|
||||||
|
|
||||||
|
- ec->keyring_mode = MANAGER_IS_SYSTEM(u->manager) ?
|
||||||
|
- EXEC_KEYRING_SHARED : EXEC_KEYRING_INHERIT;
|
||||||
|
+ if (MANAGER_IS_SYSTEM(u->manager))
|
||||||
|
+ ec->keyring_mode = EXEC_KEYRING_SHARED;
|
||||||
|
+ else {
|
||||||
|
+ ec->keyring_mode = EXEC_KEYRING_INHERIT;
|
||||||
|
+
|
||||||
|
+ /* User manager might have its umask redefined by PAM or UMask=. In this
|
||||||
|
+ * case let the units it manages inherit this value by default. They can
|
||||||
|
+ * still tune this value through their own unit file */
|
||||||
|
+ (void) get_process_umask(getpid_cached(), &ec->umask);
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
kc = unit_get_kill_context(u);
|
||||||
@ -0,0 +1,28 @@
|
|||||||
|
From 49dbe60d4b3c6f111911c8217bc5e7da5a4ba0d0 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Michal Sekletar <msekleta@redhat.com>
|
||||||
|
Date: Wed, 31 May 2023 18:50:12 +0200
|
||||||
|
Subject: [PATCH] pam: add call to pam_umask
|
||||||
|
|
||||||
|
Setting umask for user sessions via UMASK setting in /etc/login.defs is
|
||||||
|
a well-known feature. Let's make sure that user manager also runs with
|
||||||
|
this umask value.
|
||||||
|
|
||||||
|
Follow-up for 5e37d1930b41b24c077ce37c6db0e36c745106c7.
|
||||||
|
|
||||||
|
(cherry picked from commit 159f1b78576ce91c3932f4867f07361a530875d3)
|
||||||
|
|
||||||
|
Resolves: RHEL-28048
|
||||||
|
---
|
||||||
|
src/login/systemd-user.m4 | 1 +
|
||||||
|
1 file changed, 1 insertion(+)
|
||||||
|
|
||||||
|
diff --git a/src/login/systemd-user.m4 b/src/login/systemd-user.m4
|
||||||
|
index eb291beaed..a194a636d6 100644
|
||||||
|
--- a/src/login/systemd-user.m4
|
||||||
|
+++ b/src/login/systemd-user.m4
|
||||||
|
@@ -10,4 +10,5 @@ session required pam_selinux.so nottys open
|
||||||
|
session required pam_loginuid.so
|
||||||
|
session optional pam_keyinit.so force revoke
|
||||||
|
session required pam_namespace.so
|
||||||
|
+session optional pam_umask.so silent
|
||||||
|
session optional pam_systemd.so
|
||||||
@ -0,0 +1,81 @@
|
|||||||
|
From 045ba12c6337760f0a7f8b0ceb9f998b309e025f Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jan Macku <jamacku@redhat.com>
|
||||||
|
Date: Fri, 9 Feb 2024 14:48:02 +0100
|
||||||
|
Subject: [PATCH] ci: deploy systemd man to GitHub Pages
|
||||||
|
|
||||||
|
rhel-only
|
||||||
|
|
||||||
|
Related: RHEL-32494
|
||||||
|
|
||||||
|
Co-authored-by: Frantisek Sumsal <frantisek@sumsal.cz>
|
||||||
|
---
|
||||||
|
.github/workflows/deploy-man-pages.yml | 60 ++++++++++++++++++++++++++
|
||||||
|
1 file changed, 60 insertions(+)
|
||||||
|
create mode 100644 .github/workflows/deploy-man-pages.yml
|
||||||
|
|
||||||
|
diff --git a/.github/workflows/deploy-man-pages.yml b/.github/workflows/deploy-man-pages.yml
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000000..9da38a1687
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/.github/workflows/deploy-man-pages.yml
|
||||||
|
@@ -0,0 +1,60 @@
|
||||||
|
+name: Deploy systemd man to Pages
|
||||||
|
+
|
||||||
|
+on:
|
||||||
|
+ push:
|
||||||
|
+ branches: [ rhel-8.10.0 ]
|
||||||
|
+ paths:
|
||||||
|
+ - man/*
|
||||||
|
+ - .github/workflows/deploy-man-pages.yml
|
||||||
|
+ schedule:
|
||||||
|
+ # Run every Monday at 4:00 AM UTC
|
||||||
|
+ - cron: 0 4 * * 1
|
||||||
|
+ workflow_dispatch:
|
||||||
|
+
|
||||||
|
+permissions:
|
||||||
|
+ contents: read
|
||||||
|
+
|
||||||
|
+# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
|
||||||
|
+# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
|
||||||
|
+concurrency:
|
||||||
|
+ group: pages
|
||||||
|
+ cancel-in-progress: false
|
||||||
|
+
|
||||||
|
+jobs:
|
||||||
|
+ # Single deploy job since we're just deploying
|
||||||
|
+ deploy:
|
||||||
|
+ environment:
|
||||||
|
+ name: github-pages
|
||||||
|
+ url: ${{ steps.deployment.outputs.page_url }}
|
||||||
|
+ runs-on: ubuntu-latest
|
||||||
|
+
|
||||||
|
+ permissions:
|
||||||
|
+ pages: write
|
||||||
|
+ id-token: write
|
||||||
|
+
|
||||||
|
+ steps:
|
||||||
|
+ - uses: actions/checkout@v4
|
||||||
|
+
|
||||||
|
+ - name: Install dependencies
|
||||||
|
+ run: |
|
||||||
|
+ RELEASE="$(lsb_release -cs)"
|
||||||
|
+ sudo add-apt-repository -y --no-update --enable-source
|
||||||
|
+ sudo apt-get -y update
|
||||||
|
+ sudo apt-get -y build-dep systemd
|
||||||
|
+
|
||||||
|
+ - name: Build HTML man pages
|
||||||
|
+ run: |
|
||||||
|
+ meson setup build
|
||||||
|
+ ninja -C build man/html
|
||||||
|
+
|
||||||
|
+ - name: Setup Pages
|
||||||
|
+ uses: actions/configure-pages@v4
|
||||||
|
+
|
||||||
|
+ - name: Upload artifact
|
||||||
|
+ uses: actions/upload-pages-artifact@v3
|
||||||
|
+ with:
|
||||||
|
+ path: ./build/man
|
||||||
|
+
|
||||||
|
+ - name: Deploy to GitHub Pages
|
||||||
|
+ id: deployment
|
||||||
|
+ uses: actions/deploy-pages@v4
|
||||||
@ -0,0 +1,24 @@
|
|||||||
|
From 604d2f1c8b6ecb46be7f70c5be7ae6fc6be04cab Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jan Macku <jamacku@redhat.com>
|
||||||
|
Date: Thu, 11 Apr 2024 10:14:51 +0200
|
||||||
|
Subject: [PATCH] ci(src-git): update list of supported products
|
||||||
|
|
||||||
|
rhel-only
|
||||||
|
|
||||||
|
Related: RHEL-32494
|
||||||
|
---
|
||||||
|
.github/tracker-validator.yml | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/.github/tracker-validator.yml b/.github/tracker-validator.yml
|
||||||
|
index b09f702dd9..1bb684e722 100644
|
||||||
|
--- a/.github/tracker-validator.yml
|
||||||
|
+++ b/.github/tracker-validator.yml
|
||||||
|
@@ -16,5 +16,5 @@ products:
|
||||||
|
- rhel-8.8.0.z
|
||||||
|
- rhel-8.9.0
|
||||||
|
- rhel-8.9.0.z
|
||||||
|
- - rhel-8.10.0
|
||||||
|
- - rhel-8.10.0.z
|
||||||
|
+ - rhel-8.10
|
||||||
|
+ - rhel-8.10.z
|
||||||
Loading…
Reference in new issue