[systemd-devel] sd-bus vs glib object path node hierarchy

2015-06-16 Thread Umut Tezduyar Lindskog
Hi,

I have noticed that glib vs sd-bus have different hierarchy in terms
of how objects are stacked. I don't have any argument why one or the
other one would be better but I was wondering what the reason for this
difference.

/com/a/b registered with sd_bus_add_object_vtable
Introspection:
└─/com/a/b

/com/a/b registered with glib
Introspection:
└─/com
  └─/com/a
└─/com/a/b

Umut
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] Pass environment variables down to systemd-service in container

2015-06-16 Thread Peter Paule
Excerpts from Lennart Poettering's message of 2015-06-15 00:32:09 +0200:
 
 Nope, we deliberately clean up the env block we pass to services.
 

Mmmh, would it possible to add some kind of a whitelist for environment
variables to the systemd- and/or service.unit-configuration for
variables which are passed on to services? Maybe something like
http://httpd.apache.org/docs/2.2/mod/mod_env.html#passenv.

This would make things a lot of easier when containers are used with
systemd as process supervisor. At least for Ruby on Rails or other
software which makes use of environment variables for configuration.

This way I can build a single image I can use in different environments
just by setting environment files. Does that make sense to you?

Outer Service Units
  # Service 1
  ExecStart=docker run -e RAILS_ENV=production -e 
DATABASE_URL=postgresql://localhost/app_production centos-rails
  
  # Service 2
  ExecStart=docker run -e RAILS_ENV=staging -e 
DATABASE_URL=postgresql://localhost/app_staging centos-rails

Inner Service Units (Example)
  PassEnv=RAILS_ENV
  ExecStart=RAILS_ENV=${RAILS_ENV} /srv/app/bin/rails


 You can reimport the env vars though by reading them from
 /proc/1/environ. Needs some manual hackery though... 

Just for the records: Or bind mount an environment file, though I don't
like it. It looks like a hack, too.

  ExecStart=docker run -v /opt/app/rails_env:/etc/default/app/environment.conf

/pp
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] sd-bus vs glib object path node hierarchy

2015-06-16 Thread Lennart Poettering
On Tue, 16.06.15 15:51, Umut Tezduyar Lindskog (u...@tezduyar.com) wrote:

 Hi,
 
 I have noticed that glib vs sd-bus have different hierarchy in terms
 of how objects are stacked. I don't have any argument why one or the
 other one would be better but I was wondering what the reason for this
 difference.
 
 /com/a/b registered with sd_bus_add_object_vtable
 Introspection:
 └─/com/a/b
 
 /com/a/b registered with glib
 Introspection:
 └─/com
   └─/com/a
 └─/com/a/b

Yeah, the spec says nothing about this. It's not clear whether
middle nodes should be synthesized or not for cases like this. I
decided to keep things minimal for sd-bus, and I think we should stay
with that unless this turns out to be a real problem for
something. Note though that the nodes in between actually are
accessible if you use their path explicitly, they just aren't
announced in the introspection, that's all.

But maybe Simon has an opinion on this? Simon?

Lennart

-- 
Lennart Poettering, Red Hat
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] Improve boot-time of systemd-based device, revisited

2015-06-16 Thread Kok, Auke-jan H
On Mon, Jun 15, 2015 at 5:44 AM, Harald Hoyer harald.ho...@gmail.com
wrote:

 On 14.06.2015 15:17, cee1 wrote:

  BTW, systemd-bootchart has a option to chart entropy, how is the
  entropy involved in boot up procedure?

 Well, if daemons need bytes from /dev/random (think sshd key generation), I
 guess they will have to wait for enough entropy, and so does the boot
 process
 in the end.


​I added the option since we discovered that the entropy pool can take a
very long time to fill, and while this generally doesn't affect startup
(sshd etc. are usually started on demand) it may be problematic for
services like kerberos, an SSL enabled web server.

It's largely irrelevant for the basic OS components, though.

Cheers,

Auke
​
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] sd-bus vs glib object path node hierarchy

2015-06-16 Thread Lennart Poettering
On Tue, 16.06.15 22:54, Krzesimir Nowak (krzesi...@endocode.com) wrote:

 16 cze 2015 6:09 PM Lennart Poettering lenn...@poettering.net
 napisał(a):
 
  On Tue, 16.06.15 15:51, Umut Tezduyar Lindskog (u...@tezduyar.com) wrote:
 
   Hi,
  
   I have noticed that glib vs sd-bus have different hierarchy in terms
   of how objects are stacked. I don't have any argument why one or the
   other one would be better but I was wondering what the reason for this
   difference.
  
   /com/a/b registered with sd_bus_add_object_vtable
   Introspection:
   └─/com/a/b
  
   /com/a/b registered with glib
   Introspection:
   └─/com
 └─/com/a
   └─/com/a/b
 
  Yeah, the spec says nothing about this. It's not clear whether
  middle nodes should be synthesized or not for cases like this. I
  decided to keep things minimal for sd-bus, and I think we should stay
  with that unless this turns out to be a real problem for
  something. Note though that the nodes in between actually are
  accessible if you use their path explicitly, they just aren't
  announced in the introspection, that's all.
 
  But maybe Simon has an opinion on this? Simon?
 
 That reminds me of a bug (or not-a-bug) in go-dbus [1] - it also generates
 flat hierarchy. This is a problem for tools like d-feet - they fail to
 introspect services with flat hierarchy. Of course, it might be a bug in
 d-feet itself.
 
 [1] https://github.com/godbus/dbus/issues/14

Unless I misunderstand this sd-bus and go-dbus actually work very
differently here: sd-bus actually synthesizes an object and suppresses
it in the introspection. go-dbus doesn't even synthesize it. That
means that if d-feet asks the intermediary objects on an sd-bus server
all is good even if the service will never announce it voluntarily...

I also just verified that d-feet works fine with sd-bus services.

Lennart

-- 
Lennart Poettering, Red Hat
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


[systemd-devel] /etc/resolv.conf link in container

2015-06-16 Thread Johannes Ernst
I have a root filesystem in directory foo/
It has symlink
foo/etc/resolv.conf - /run/systemd/resolve/resolv.conf

When I’m booting the container:
sudo systemd-nspawn --directory foo --boot

I’m getting:
Failed to copy /etc/resolv.conf to /home/…./foo/etc/resolv.conf: Too many 
levels of symbolic links

This message makes very little sense to me. Why is a copy necessary? and is 
that indeed /etc/resolv.conf or foo/etc/resolv.conf?

If I boot with -n, I don’t seem to get the error.

Puzzled.



Johannes.


___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] nspawn --ephemeral

2015-06-16 Thread Lennart Poettering
On Tue, 16.06.15 14:53, Johannes Ernst (johannes.er...@gmail.com) wrote:

 I have a root filesystem directory in foo/
 
 I boot with nspawn, and immediately, in the container:
 systemctl poweroff
 
 This works fine if invoked as:
 sudo systemd-nspawn --directory foo --boot -n
 
 But if I add --ephemeral (and it is a btrfs filesystem)
 sudo systemd-nspawn --directory foo --boot -n --ephemeral
 I get:
 Sending SIGTERM to remaining processes...
 Sending SIGKILL to remaining processes...
 Powering off.
 Container ... has been shut down.
 Cannot remove subvolume '/home/.../.#foo...', ignoring: Directory not 
 empty
 
 btrfs subvolume list reports two new subvolumes:
 …/.#foo...
 …/.#foo.../var/lib/machines
 
 Indeed I cannot remove subvol …/.#foo… unless I first remove subvol 
 …/.#foo.../var/lib/machines
 
 Further, foo/ does not actually contain /var/lib/machines
 but in the booted container, it actually lists two subvolumes with that path:
 # btrfs subvolume list /
 ID 351 gen 250192 top level 5 path var/lib/machines
 ID 371 gen 256382 top level 5 path home/…/.#foo
 ID 372 gen 256382 top level 371 path var/lib/machines
 On the host, we have the same, but the second one has the prefix i.e. 
 home/…/.#foo/var/lib/machines
 
 Hmm …?

Do you use systemd v220? only in v220 we support recursively removing
subvolumes, and there's a tmpfiles snippet that creates
/var/lib/machines as subvolume.

Lennart

-- 
Lennart Poettering, Red Hat
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] [PATCH 4/5] import/pull: Tag replaced with reference

2015-06-16 Thread Thomas H.P. Andersen
On Thu, May 7, 2015 at 5:47 PM, Pavel Odvody podv...@redhat.com wrote:
 Signed-off-by: Pavel Odvody podv...@redhat.com
 ---
  src/import/pull.c | 28 +---
  1 file changed, 17 insertions(+), 11 deletions(-)

 diff --git a/src/import/pull.c b/src/import/pull.c
 index ef7b035..8054612 100644
 --- a/src/import/pull.c
 +++ b/src/import/pull.c
 @@ -227,7 +227,7 @@ static void on_dkr_finished(DkrPull *pull, int error, 
 void *userdata) {
  static int pull_dkr(int argc, char *argv[], void *userdata) {
  _cleanup_(dkr_pull_unrefp) DkrPull *pull = NULL;
  _cleanup_event_unref_ sd_event *event = NULL;
 -const char *name, *tag, *local;
 +const char *name, *reference, *local, *digest;
  int r;

  if (!arg_dkr_index_url) {
 @@ -240,13 +240,19 @@ static int pull_dkr(int argc, char *argv[], void 
 *userdata) {
  return -EINVAL;
  }

 -tag = strchr(argv[1], ':');
 -if (tag) {
 -name = strndupa(argv[1], tag - argv[1]);
 -tag++;
 +digest = strchr(argv[1], '@');
 +if (digest) {
 +reference = digest + 1;
 +name = strndupa(argv[1], digest - argv[1]);
 +}
 +
 +reference = strchr(argv[1], ':');
 +if (reference) {
 +name = strndupa(argv[1], reference - argv[1]);
 +reference++;
  } else {
  name = argv[1];
 -tag = latest;
 +reference = latest;
  }

This part does not look correct. Any value that we set for
reference/name in the digest part will be overwritten in the next
block. I do not know the format of the string so I cannot create a
patch for this. Can you take a look Pavel?


  if (!dkr_name_is_valid(name)) {
 @@ -254,8 +260,8 @@ static int pull_dkr(int argc, char *argv[], void 
 *userdata) {
  return -EINVAL;
  }

 -if (!dkr_tag_is_valid(tag)) {
 -log_error(Tag name '%s' is not valid., tag);
 +if (!dkr_ref_is_valid(reference)) {
 +log_error(Tag name '%s' is not valid., reference);
  return -EINVAL;
  }

 @@ -288,9 +294,9 @@ static int pull_dkr(int argc, char *argv[], void 
 *userdata) {
  }
  }

 -log_info(Pulling '%s' with tag '%s', saving as '%s'., 
 name, tag, local);
 +log_info(Pulling '%s' with reference '%s', saving as 
 '%s'., name, reference, local);
  } else
 -log_info(Pulling '%s' with tag '%s'., name, tag);
 +log_info(Pulling '%s' with reference '%s'., name, 
 reference);

  r = sd_event_default(event);
  if (r  0)
 @@ -304,7 +310,7 @@ static int pull_dkr(int argc, char *argv[], void 
 *userdata) {
  if (r  0)
  return log_error_errno(r, Failed to allocate puller: %m);

 -r = dkr_pull_start(pull, name, tag, local, arg_force);
 +r = dkr_pull_start(pull, name, reference, local, arg_force, PULL_V2);
  if (r  0)
  return log_error_errno(r, Failed to pull image: %m);

 --
 2.1.0




 ___
 systemd-devel mailing list
 systemd-devel@lists.freedesktop.org
 http://lists.freedesktop.org/mailman/listinfo/systemd-devel

___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


[systemd-devel] nspawn --ephemeral

2015-06-16 Thread Johannes Ernst
I have a root filesystem directory in foo/

I boot with nspawn, and immediately, in the container:
systemctl poweroff

This works fine if invoked as:
sudo systemd-nspawn --directory foo --boot -n

But if I add --ephemeral (and it is a btrfs filesystem)
sudo systemd-nspawn --directory foo --boot -n --ephemeral
I get:
Sending SIGTERM to remaining processes...
Sending SIGKILL to remaining processes...
Powering off.
Container ... has been shut down.
Cannot remove subvolume '/home/.../.#foo...', ignoring: Directory not empty

btrfs subvolume list reports two new subvolumes:
…/.#foo...
…/.#foo.../var/lib/machines

Indeed I cannot remove subvol …/.#foo… unless I first remove subvol 
…/.#foo.../var/lib/machines

Further, foo/ does not actually contain /var/lib/machines
but in the booted container, it actually lists two subvolumes with that path:
# btrfs subvolume list /
ID 351 gen 250192 top level 5 path var/lib/machines
ID 371 gen 256382 top level 5 path home/…/.#foo
ID 372 gen 256382 top level 371 path var/lib/machines
On the host, we have the same, but the second one has the prefix i.e. 
home/…/.#foo/var/lib/machines

Hmm …?


Johannes.

___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] sd-bus vs glib object path node hierarchy

2015-06-16 Thread Krzesimir Nowak
16 cze 2015 6:09 PM Lennart Poettering lenn...@poettering.net
napisał(a):

 On Tue, 16.06.15 15:51, Umut Tezduyar Lindskog (u...@tezduyar.com) wrote:

  Hi,
 
  I have noticed that glib vs sd-bus have different hierarchy in terms
  of how objects are stacked. I don't have any argument why one or the
  other one would be better but I was wondering what the reason for this
  difference.
 
  /com/a/b registered with sd_bus_add_object_vtable
  Introspection:
  └─/com/a/b
 
  /com/a/b registered with glib
  Introspection:
  └─/com
└─/com/a
  └─/com/a/b

 Yeah, the spec says nothing about this. It's not clear whether
 middle nodes should be synthesized or not for cases like this. I
 decided to keep things minimal for sd-bus, and I think we should stay
 with that unless this turns out to be a real problem for
 something. Note though that the nodes in between actually are
 accessible if you use their path explicitly, they just aren't
 announced in the introspection, that's all.

 But maybe Simon has an opinion on this? Simon?

That reminds me of a bug (or not-a-bug) in go-dbus [1] - it also generates
flat hierarchy. This is a problem for tools like d-feet - they fail to
introspect services with flat hierarchy. Of course, it might be a bug in
d-feet itself.

[1] https://github.com/godbus/dbus/issues/14


 Lennart

 --
 Lennart Poettering, Red Hat
 ___
 systemd-devel mailing list
 systemd-devel@lists.freedesktop.org
 http://lists.freedesktop.org/mailman/listinfo/systemd-devel
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] nspawn --ephemeral

2015-06-16 Thread Johannes Ernst
Aha! Works in 220. (It’s still in testing in Arch, so I had been on 219)

I’m still unclear why there’s an (empty) /var/lib/machines in the container.

 On Jun 16, 2015, at 15:22, Lennart Poettering lenn...@poettering.net wrote:
 
 On Tue, 16.06.15 14:53, Johannes Ernst (johannes.er...@gmail.com 
 mailto:johannes.er...@gmail.com) wrote:
 
 I have a root filesystem directory in foo/
 
 I boot with nspawn, and immediately, in the container:
systemctl poweroff
 
 This works fine if invoked as:
sudo systemd-nspawn --directory foo --boot -n
 
 But if I add --ephemeral (and it is a btrfs filesystem)
sudo systemd-nspawn --directory foo --boot -n --ephemeral
 I get:
Sending SIGTERM to remaining processes...
Sending SIGKILL to remaining processes...
Powering off.
Container ... has been shut down.
Cannot remove subvolume '/home/.../.#foo...', ignoring: Directory not 
 empty
 
 btrfs subvolume list reports two new subvolumes:
…/.#foo...
…/.#foo.../var/lib/machines
 
 Indeed I cannot remove subvol …/.#foo… unless I first remove subvol 
 …/.#foo.../var/lib/machines
 
 Further, foo/ does not actually contain /var/lib/machines
 but in the booted container, it actually lists two subvolumes with that path:
# btrfs subvolume list /
ID 351 gen 250192 top level 5 path var/lib/machines
ID 371 gen 256382 top level 5 path home/…/.#foo
ID 372 gen 256382 top level 371 path var/lib/machines
 On the host, we have the same, but the second one has the prefix i.e. 
 home/…/.#foo/var/lib/machines
 
 Hmm …?
 
 Do you use systemd v220? only in v220 we support recursively removing
 subvolumes, and there's a tmpfiles snippet that creates
 /var/lib/machines as subvolume.
 
 Lennart
 
 -- 
 Lennart Poettering, Red Hat

___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


[systemd-devel] machinectl status vs show

2015-06-16 Thread Johannes Ernst
Are those supposed to produce the same information, just formatted differently 
(man vs machine per man page)?

I’m failing to convince ‘show’ to give me the container’s IP address, while 
‘status’ has all of them.

Cheers,


Johannes.


___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] Why we need to read/save random seed?

2015-06-16 Thread cee1
2015-06-16 0:21 GMT+08:00 Lennart Poettering lenn...@poettering.net:
 On Mon, 15.06.15 23:33, cee1 (fykc...@gmail.com) wrote:

 Hi,

 I maybe got confused.

 First, systemd-random-seed.service will save a seed from
 /dev/urandom when shutdown, and load that seed to /dev/urandom when
 next boot up.

 My questions are:
 1. Can we not save a seed, but load a seed that is read from **
 /dev/random ** to ** /dev/urandom **?

 The seed is used for both. Then you'd feed the stuff you got from the
 RNG back into the RNG which is a pointless excercise.

systemd-random-seed.service will load the seed on disk to
/dev/urandom, and save a seed to disk when shutdown, right?

The article at http://www.2uo.de/myths-about-urandom/ suggests us
saving the seed as soon as there is enough entropy(means read from
/dev/random? if returns, there's enough entropy),

Saving the seed early, make it more tolerant against the case of
system crashes - that means not shutdown properly(which maybe the case
on some mobile device such as STB.



-- 
Regards,

- cee1
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] Can kdbus send signal to the source connection?

2015-06-16 Thread eshark
Hi,


At 2015-06-15 22:32:27, Lennart Poettering lenn...@poettering.net wrote:
On Mon, 15.06.15 19:05, eshark (eshar...@163.com) wrote:

 Hi, All,
If I post this email to the wrong mail-list, please tell me, thank 
 you.
 
Now many JS applications implement the client and service in the same 
 thread, so they share the same connection too.
 
 However when the client or the service want to send signal to the other,  
 the receiver cannot get the signal because the kdbus driver 
 
 won't broadcast the signal to the source connection.
 
   I've tried to simply allow the kdbus driver to send signal to all the 
 connections including the source , but it seems not work OK.
 
 I wonder that how I can make kdbus send signal to the source connection, or 
 that this is impossible ?

I am not dure I follow. Are you developing a native kdbus client

library for JS? 
Yes, we already have a library based on DBus, and I'm migrating it to KDBus.



Did I get this right, you have one bus connection per thread, but
possibly both a kdbus client and its service run from the server, and
you want broadcast msgs sent out from one to then also be matchable by

the other?
Yes.  And I've tried removing the condition in kdbus_bus_broadcast(), as David  
said. 
But this modification caused that the network module of our system cannot work 
OK,  it's very strange ,
and I'm not familiar with the network module, so I  haven't find the root 
cause. 
Maybe it has nothing to do with KDBus? I am not sure.



Can't you dispatch that locally? i.e. in addition to passing the msg
to kdbus also enqueue it locallly along the kdbus fd, or so?

But I am not sure I understand the problem fully...

Lennart

-- 
Lennart Poettering, Red Hat
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] Can kdbus send signal to the source connection?

2015-06-16 Thread David Herrmann
Hi

On Tue, Jun 16, 2015 at 9:35 AM, eshark eshar...@163.com wrote:
 Hi,


 At 2015-06-15 22:32:27, Lennart Poettering lenn...@poettering.net wrote:
On Mon, 15.06.15 19:05, eshark (eshar...@163.com) wrote:

 Hi, All,
If I post this email to the wrong mail-list, please tell me, thank
 you.

Now many JS applications implement the client and service in the
 same thread, so they share the same connection too.

 However when the client or the service want to send signal to the other,
 the receiver cannot get the signal because the kdbus driver

 won't broadcast the signal to the source connection.

   I've tried to simply allow the kdbus driver to send signal to all
 the connections including the source , but it seems not work OK.

 I wonder that how I can make kdbus send signal to the source connection,
 or that this is impossible ?

I am not dure I follow. Are you developing a native kdbus client
library for JS?
 Yes, we already have a library based on DBus, and I'm migrating it to KDBus.


Did I get this right, you have one bus connection per thread, but
possibly both a kdbus client and its service run from the server, and
you want broadcast msgs sent out from one to then also be matchable by
the other?
 Yes.  And I've tried removing the condition in kdbus_bus_broadcast(), as
 David  said.
 But this modification caused that the network module of our system cannot
 work OK,  it's very strange ,
 and I'm not familiar with the network module, so I  haven't find the root
 cause.
 Maybe it has nothing to do with KDBus? I am not sure.

Can you be more specific, please? What do you mean by network module
of our systemd cannot work OK?

Thanks
David
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] Can kdbus send signal to the source connection?

2015-06-16 Thread David Herrmann
Hi

On Tue, Jun 16, 2015 at 12:07 PM, eshark eshar...@163.com wrote:
 At 2015-06-16 15:54:10, David Herrmann dh.herrm...@gmail.com wrote:
Can you be more specific, please? What do you mean by network module
of our systemd cannot work OK?

 Sorry.  Acctually  our network module cannot get ip by DHCP.  Our network
 module is
 connman, which depends on libdbus.And the connman will connect to KDBus
 through the bus-proxyd, which is implemented in the libsystemd.

Can you please be more specific!

Does this only happen with kdbus?
Does this only happen with you kdbus-patch to make broadcasts being
sent to oneself?
Or does it happen with unmodified kdbus, too?
What exactly changes?
Does everything work perfectly well without kdbus?
Is the missing DHCP connectivity the only difference you see with kdbus?
What kdbus version do you run?
What kdbus tree do you use?
What systemd version do you use? (in case of git: which commit?)
Did you pass --enable-kdbus to systemd?
What upstream kernel version do you use?
Any obscure messages in the system-log that you didn't see before?
...

Please try to paste as much information as possible. Otherwise, it's
really a hassle to ask for each piece of information separately.

Thanks
David
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] Fedora 21 and systemd-nspawn

2015-06-16 Thread Lennart Poettering
On Mon, 15.06.15 21:15, Chris Morgan (chmor...@gmail.com) wrote:

 On a somewhat related topic, are many people making use of nspawn
 containers in production or test environments? I was a little surprised by
 the issues I had when trying them out with f21. f22 seems smoother but
 still required the audit=0 and I think I had to disable selinux to set the
 password but I was trying for a while with a blank password so...
 
 But yeah, was wondering if there were known users of nspawn containers that
 discussed their use cases.

Until recently the man page clarified that it was a tool for debugging
things only. However, we removed that recently, because I noticed that
people *are* using it in production now. Also, the rkt guys use it as
backend for their stuff these days.

Turning off audit is not necessary anymore since we did the seccomp
hack, at least on x86-64. It's still necessary to turn it off
explicitly on i386. Also note, that even in i386 it's also not
necessary to turn off auditing when you use debian or ubuntu in the
container, only running fedora/redhat inside a container requires
this (because only Fedora's PAM is weird).

My guess is that most people who run nspawn turn off selinux though,
or don't use Fedora, since SELinux appears to be pretty much a
fedora/redhat-only thing.

Both the selinux and audit issues apply to all container managers that
are supposed to run full distros inside, not only nspawn.

Lennart

-- 
Lennart Poettering, Red Hat
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel


Re: [systemd-devel] Can kdbus send signal to the source connection?

2015-06-16 Thread eshark
Hi,


At 2015-06-16 15:54:10, David Herrmann dh.herrm...@gmail.com wrote:
Hi

On Tue, Jun 16, 2015 at 9:35 AM, eshark eshar...@163.com wrote:
 Hi,


 At 2015-06-15 22:32:27, Lennart Poettering lenn...@poettering.net wrote:
On Mon, 15.06.15 19:05, eshark (eshar...@163.com) wrote:

 Hi, All,
If I post this email to the wrong mail-list, please tell me, thank
 you.

Now many JS applications implement the client and service in the
 same thread, so they share the same connection too.

 However when the client or the service want to send signal to the other,
 the receiver cannot get the signal because the kdbus driver

 won't broadcast the signal to the source connection.

   I've tried to simply allow the kdbus driver to send signal to all
 the connections including the source , but it seems not work OK.

 I wonder that how I can make kdbus send signal to the source connection,
 or that this is impossible ?

I am not dure I follow. Are you developing a native kdbus client
library for JS?
 Yes, we already have a library based on DBus, and I'm migrating it to KDBus.


Did I get this right, you have one bus connection per thread, but
possibly both a kdbus client and its service run from the server, and
you want broadcast msgs sent out from one to then also be matchable by
the other?
 Yes.  And I've tried removing the condition in kdbus_bus_broadcast(), as
 David  said.
 But this modification caused that the network module of our system cannot
 work OK,  it's very strange ,
 and I'm not familiar with the network module, so I  haven't find the root
 cause.
 Maybe it has nothing to do with KDBus? I am not sure.

Can you be more specific, please? What do you mean by network module

of our systemd cannot work OK?


Sorry.  Acctually  our network module cannot get ip by DHCP.  Our network 
module is
connman, which depends on libdbus.And the connman will connect to KDBus 
through the bus-proxyd, which is implemented in the libsystemd.


I have not traced into connman , so I'm not very clear about the root cause.


Thanks !


Li Cheng



Thanks
David
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel