|
 |
a4b143 |
From 6359b8041144a0571853b1dcad55ad60922af55d Mon Sep 17 00:00:00 2001
|
|
|
a4b143 |
From: Lennart Poettering <lennart@poettering.net>
|
|
|
a4b143 |
Date: Tue, 17 Sep 2013 16:42:36 -0500
|
|
|
a4b143 |
Subject: [PATCH] journald: avoid NSS in journald
|
|
|
a4b143 |
|
|
|
a4b143 |
In order to avoid a deadlock between journald looking up the
|
|
|
a4b143 |
"systemd-journal" group name, and nscd (or anyother NSS backing daemon)
|
|
|
a4b143 |
logging something back to the journal avoid all NSS in journald the same
|
|
|
a4b143 |
way as we avoid it from PID 1.
|
|
|
a4b143 |
|
|
|
a4b143 |
With this change we rely on the kernel file system logic to adjust the
|
|
|
a4b143 |
group of created journal files via the SETGID bit on the journal
|
|
|
a4b143 |
directory. To ensure that it is always set, even after the user created
|
|
|
a4b143 |
it with a simply "mkdir" on the shell we fix it up via tmpfiles on boot.
|
|
|
a4b143 |
---
|
|
|
a4b143 |
src/journal/journald-server.c | 25 ++-----------------------
|
|
|
a4b143 |
src/journal/journald-server.h | 3 ---
|
|
|
a4b143 |
tmpfiles.d/systemd.conf | 3 +++
|
|
|
a4b143 |
3 files changed, 5 insertions(+), 26 deletions(-)
|
|
|
a4b143 |
|
|
|
a4b143 |
diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
|
|
|
a4b143 |
index c252710..8007b05 100644
|
|
|
a4b143 |
--- a/src/journal/journald-server.c
|
|
|
a4b143 |
+++ b/src/journal/journald-server.c
|
|
|
a4b143 |
@@ -180,25 +180,6 @@ static uint64_t available_space(Server *s, bool verbose) {
|
|
|
a4b143 |
return s->cached_available_space;
|
|
|
a4b143 |
}
|
|
|
a4b143 |
|
|
|
a4b143 |
-static void server_read_file_gid(Server *s) {
|
|
|
a4b143 |
- const char *g = "systemd-journal";
|
|
|
a4b143 |
- int r;
|
|
|
a4b143 |
-
|
|
|
a4b143 |
- assert(s);
|
|
|
a4b143 |
-
|
|
|
a4b143 |
- if (s->file_gid_valid)
|
|
|
a4b143 |
- return;
|
|
|
a4b143 |
-
|
|
|
a4b143 |
- r = get_group_creds(&g, &s->file_gid);
|
|
|
a4b143 |
- if (r < 0)
|
|
|
a4b143 |
- log_warning("Failed to resolve '%s' group: %s", g, strerror(-r));
|
|
|
a4b143 |
-
|
|
|
a4b143 |
- /* if we couldn't read the gid, then it will be 0, but that's
|
|
|
a4b143 |
- * fine and we shouldn't try to resolve the group again, so
|
|
|
a4b143 |
- * let's just pretend it worked right-away. */
|
|
|
a4b143 |
- s->file_gid_valid = true;
|
|
|
a4b143 |
-}
|
|
|
a4b143 |
-
|
|
|
a4b143 |
void server_fix_perms(Server *s, JournalFile *f, uid_t uid) {
|
|
|
a4b143 |
int r;
|
|
|
a4b143 |
#ifdef HAVE_ACL
|
|
|
a4b143 |
@@ -209,11 +190,9 @@ void server_fix_perms(Server *s, JournalFile *f, uid_t uid) {
|
|
|
a4b143 |
|
|
|
a4b143 |
assert(f);
|
|
|
a4b143 |
|
|
|
a4b143 |
- server_read_file_gid(s);
|
|
|
a4b143 |
-
|
|
|
a4b143 |
- r = fchmod_and_fchown(f->fd, 0640, 0, s->file_gid);
|
|
|
a4b143 |
+ r = fchmod(f->fd, 0640);
|
|
|
a4b143 |
if (r < 0)
|
|
|
a4b143 |
- log_warning("Failed to fix access mode/rights on %s, ignoring: %s", f->path, strerror(-r));
|
|
|
a4b143 |
+ log_warning("Failed to fix access mode on %s, ignoring: %s", f->path, strerror(-r));
|
|
|
a4b143 |
|
|
|
a4b143 |
#ifdef HAVE_ACL
|
|
|
a4b143 |
if (uid <= 0)
|
|
|
a4b143 |
diff --git a/src/journal/journald-server.h b/src/journal/journald-server.h
|
|
|
a4b143 |
index e856ef2..0393e38 100644
|
|
|
a4b143 |
--- a/src/journal/journald-server.h
|
|
|
a4b143 |
+++ b/src/journal/journald-server.h
|
|
|
a4b143 |
@@ -97,9 +97,6 @@ typedef struct Server {
|
|
|
a4b143 |
usec_t max_file_usec;
|
|
|
a4b143 |
usec_t oldest_file_usec;
|
|
|
a4b143 |
|
|
|
a4b143 |
- gid_t file_gid;
|
|
|
a4b143 |
- bool file_gid_valid;
|
|
|
a4b143 |
-
|
|
|
a4b143 |
LIST_HEAD(StdoutStream, stdout_streams);
|
|
|
a4b143 |
unsigned n_stdout_streams;
|
|
|
a4b143 |
|
|
|
a4b143 |
diff --git a/tmpfiles.d/systemd.conf b/tmpfiles.d/systemd.conf
|
|
|
a4b143 |
index 4924b4e..c397c71 100644
|
|
|
a4b143 |
--- a/tmpfiles.d/systemd.conf
|
|
|
a4b143 |
+++ b/tmpfiles.d/systemd.conf
|
|
|
a4b143 |
@@ -23,3 +23,6 @@ d /run/systemd/machines 0755 root root -
|
|
|
a4b143 |
d /run/systemd/shutdown 0755 root root -
|
|
|
a4b143 |
|
|
|
a4b143 |
F /run/nologin 0644 - - - "System is booting up."
|
|
|
a4b143 |
+
|
|
|
a4b143 |
+m /var/log/journal 2755 root systemd-journal - -
|
|
|
a4b143 |
+m /var/log/journal/%m 2755 root systemd-journal - -
|