Re: [systemd-devel] Emergency mode if non-critical /etc/fstab entries are missing

[Manuel Amador (Rudd-O)]

On 09/26/2016 10:31 AM, Reindl Harald wrote:
>
>
> Am 26.09.2016 um 11:27 schrieb Oliver Neukum:
>> On Sun, 2016-09-25 at 23:57 +0200, Reindl Harald wrote:
>>>
>>> RTFM - when you don't say "nofail" it's ecpected to be crucial
>>>
>>> your entry says it's crucial
>>
>> That in turn raises the question why the default should be different
>> than what is used in earlier systems
>
> because earlier systems (sysvinit) hat no concept like emergency mode
> as they where a lousy bunch of scripts where you ended in case of a
> crucial disk failing in a undefined state?
>
> because earlier systems had no concept for "nofail" or "fail" at all

Yes, they did.  Boot would fail if a device in fstab was set to mount on
boot (option "noauto" absent) and it was not present during boot.

This is precisely why nofail is the default.

Sergei is right.  RTFM.

-- 
Rudd-O
http://rudd-o.com/




signature.asc
Description: OpenPGP digital signature
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

Re: [systemd-devel] [PATCH v3] 98integrity: Use /etc/ima as dir for IMA policy and config file

[Stefan Berger]

Harald,

  please do not apply this patch.

Stefan


>
> From: Stefan Berger 
>
> To sync with systemd, use the filepath /etc/ima/ima-policy as
> the default file location for the IMA policy. At the same time we
> move the ima config file location to /etc/ima/ima. Adapt the
> documentation to the new path. Maintain backwards compatibility
> by still reading the old files in case the new ones do not exist.
>
> Signed-off-by: Stefan Berger 
> ---
>  modules.d/98integrity/README   |  8 
>  modules.d/98integrity/ima-keys-load.sh   |  7 ++-
>  modules.d/98integrity/ima-policy-load.sh | 20 +---
>  3 files changed, 27 insertions(+), 8 deletions(-)
>
> diff --git a/modules.d/98integrity/README b/modules.d/98integrity/README
> index 64de0ae..c8ccee5 100644
> --- a/modules.d/98integrity/README
> +++ b/modules.d/98integrity/README
> @@ -33,10 +33,10 @@ line.
>
>  # Save the policy in a file.
>
> -# Create the configuration file '/etc/sysconfig/ima' to override
> the path name of
> +# Create the configuration file '/etc/ima/ima' to override the path 
name of

>  # the IMA custom policy.
> -- '/etc/sysconfig/ima' (with the default value) 
-

> -IMAPOLICY="/etc/sysconfig/ima-policy"
> +- '/etc/ima/ima' (with the default value) -
> +IMAPOLICY="/etc/ima/ima-policy"
> 
 -

>
>
> @@ -64,5 +64,5 @@ IMAPOLICY="/etc/sysconfig/ima-policy"
>
>  # 98integrity/ima-keys-load.sh script loads the signed certificates 
stored
>  # in the $IMAKEYSDIR onto the trusted IMA keyring.  The default 
$IMAKEYSDIR
> -# directory is /etc/keys/ima, but can be specified in the 
/etc/sysconfig/ima

> +# directory is /etc/keys/ima, but can be specified in the /etc/ima/ima
>  # policy.
> diff --git a/modules.d/98integrity/ima-keys-load.sh b/modules.d/
> 98integrity/ima-keys-load.sh
> index 659b722..922af1e 100755
> --- a/modules.d/98integrity/ima-keys-load.sh
> +++ b/modules.d/98integrity/ima-keys-load.sh
> @@ -2,7 +2,10 @@
>
>  SECURITYFSDIR="/sys/kernel/security"
>  IMASECDIR="${SECURITYFSDIR}/ima"
> -IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
> +IMACONFIG="${NEWROOT}/etc/ima/ima"
> +
> +# for backwards compatibility
> +IMACONFIG_OLD="${NEWROOT}/etc/sysconfig/ima"
>
>  load_x509_keys()
>  {
> @@ -11,6 +14,8 @@ load_x509_keys()
>  # override the default configuration
>  if [ -f "${IMACONFIG}" ]; then
>  . ${IMACONFIG}
> +elif [ -f "${IMACONFIG_OLD}" ]; then
> +. ${IMACONFIG_OLD}
>  fi
>
>  if [ -z "${IMAKEYDIR}" ]; then
> diff --git a/modules.d/98integrity/ima-policy-load.sh b/modules.d/
> 98integrity/ima-policy-load.sh
> index 85cd3b9..a92b1bb 100755
> --- a/modules.d/98integrity/ima-policy-load.sh
> +++ b/modules.d/98integrity/ima-policy-load.sh
> @@ -5,10 +5,19 @@
>  # Copyright (C) 2011 Politecnico di Torino, Italy
>  #  TORSEC group -- http://security.polito.it 


>  # Roberto Sassu 
> +#
> +# Copyright (C) 2016 IBM Corporation
> +#
> +# Stefan Berger 
> +#
>
>  IMASECDIR="${SECURITYFSDIR}/ima"
> -IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
> -IMAPOLICY="/etc/sysconfig/ima-policy"
> +IMACONFIG="${NEWROOT}/etc/ima/ima"
> +IMAPOLICY="/etc/ima/ima-policy"
> +
> +# for backwards compatibility
> +IMACONFIG_OLD="${NEWROOT}/etc/sysconfig/ima"
> +IMAPOLICY_OLD="/etc/sysconfig/ima-policy"
>
>  load_ima_policy()
>  {
> @@ -21,11 +30,16 @@ load_ima_policy()
>  fi
>
>  # override the default configuration
> -[ -f "${IMACONFIG}" ] && \
> +if [ -f "${IMACONFIG}" ]; then
>  . ${IMACONFIG}
> +elif [ -f "${IMACONFIG_OLD}" ]; then
> +. ${IMACONFIG_OLD}
> +fi
>
>  # set the IMA policy path name
>  IMAPOLICYPATH="${NEWROOT}${IMAPOLICY}"
> +[ ! -f "${IMAPOLICYPATH}" ] && \
> +IMAPOLICYPATH="${NEWROOT}${IMAPOLICY_OLD}"
>
>  # check the existence of the IMA policy file
>  [ -f "${IMAPOLICYPATH}" ] && {
> --
> 2.8.3
>



___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

[systemd-devel] [PATCH v3] 98integrity: Use /etc/ima as dir for IMA policy and config file

[Stefan Berger]

From: Stefan Berger 

To sync with systemd, use the filepath /etc/ima/ima-policy as
the default file location for the IMA policy. At the same time we
move the ima config file location to /etc/ima/ima. Adapt the
documentation to the new path. Maintain backwards compatibility
by still reading the old files in case the new ones do not exist.

Signed-off-by: Stefan Berger 
---
 modules.d/98integrity/README |  8 
 modules.d/98integrity/ima-keys-load.sh   |  7 ++-
 modules.d/98integrity/ima-policy-load.sh | 20 +---
 3 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/modules.d/98integrity/README b/modules.d/98integrity/README
index 64de0ae..c8ccee5 100644
--- a/modules.d/98integrity/README
+++ b/modules.d/98integrity/README
@@ -33,10 +33,10 @@ line.
 
 # Save the policy in a file.
 
-# Create the configuration file '/etc/sysconfig/ima' to override the path name 
of
+# Create the configuration file '/etc/ima/ima' to override the path name of
 # the IMA custom policy.
-- '/etc/sysconfig/ima' (with the default value) -
-IMAPOLICY="/etc/sysconfig/ima-policy"
+- '/etc/ima/ima' (with the default value) -
+IMAPOLICY="/etc/ima/ima-policy"
 -
 
 
@@ -64,5 +64,5 @@ IMAPOLICY="/etc/sysconfig/ima-policy"
 
 # 98integrity/ima-keys-load.sh script loads the signed certificates stored 
 # in the $IMAKEYSDIR onto the trusted IMA keyring.  The default $IMAKEYSDIR
-# directory is /etc/keys/ima, but can be specified in the /etc/sysconfig/ima
+# directory is /etc/keys/ima, but can be specified in the /etc/ima/ima
 # policy.
diff --git a/modules.d/98integrity/ima-keys-load.sh 
b/modules.d/98integrity/ima-keys-load.sh
index 659b722..922af1e 100755
--- a/modules.d/98integrity/ima-keys-load.sh
+++ b/modules.d/98integrity/ima-keys-load.sh
@@ -2,7 +2,10 @@
 
 SECURITYFSDIR="/sys/kernel/security"
 IMASECDIR="${SECURITYFSDIR}/ima"
-IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
+IMACONFIG="${NEWROOT}/etc/ima/ima"
+
+# for backwards compatibility
+IMACONFIG_OLD="${NEWROOT}/etc/sysconfig/ima"
 
 load_x509_keys()
 {
@@ -11,6 +14,8 @@ load_x509_keys()
 # override the default configuration
 if [ -f "${IMACONFIG}" ]; then
 . ${IMACONFIG}
+elif [ -f "${IMACONFIG_OLD}" ]; then
+. ${IMACONFIG_OLD}
 fi
 
 if [ -z "${IMAKEYDIR}" ]; then
diff --git a/modules.d/98integrity/ima-policy-load.sh 
b/modules.d/98integrity/ima-policy-load.sh
index 85cd3b9..a92b1bb 100755
--- a/modules.d/98integrity/ima-policy-load.sh
+++ b/modules.d/98integrity/ima-policy-load.sh
@@ -5,10 +5,19 @@
 # Copyright (C) 2011 Politecnico di Torino, Italy
 #TORSEC group -- http://security.polito.it
 # Roberto Sassu 
+#
+# Copyright (C) 2016 IBM Corporation
+#
+# Stefan Berger 
+#
 
 IMASECDIR="${SECURITYFSDIR}/ima"
-IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
-IMAPOLICY="/etc/sysconfig/ima-policy"
+IMACONFIG="${NEWROOT}/etc/ima/ima"
+IMAPOLICY="/etc/ima/ima-policy"
+
+# for backwards compatibility
+IMACONFIG_OLD="${NEWROOT}/etc/sysconfig/ima"
+IMAPOLICY_OLD="/etc/sysconfig/ima-policy"
 
 load_ima_policy()
 {
@@ -21,11 +30,16 @@ load_ima_policy()
 fi
 
 # override the default configuration
-[ -f "${IMACONFIG}" ] && \
+if [ -f "${IMACONFIG}" ]; then
 . ${IMACONFIG}
+elif [ -f "${IMACONFIG_OLD}" ]; then
+. ${IMACONFIG_OLD}
+fi
 
 # set the IMA policy path name
 IMAPOLICYPATH="${NEWROOT}${IMAPOLICY}"
+[ ! -f "${IMAPOLICYPATH}" ] && \
+IMAPOLICYPATH="${NEWROOT}${IMAPOLICY_OLD}"
 
 # check the existence of the IMA policy file
 [ -f "${IMAPOLICYPATH}" ] && {
-- 
2.8.3

___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

Re: [systemd-devel] [PATCH v2] 98integrity: Use /etc/ima as dir for IMA policy and config file

[Stefan Berger]

On 11/30/2016 10:52 AM, Harald Hoyer wrote:

On 30.11.2016 16:24, Stefan Berger wrote:

On 11/30/2016 10:16 AM, Harald Hoyer wrote:

On 30.11.2016 16:10, Stefan Berger wrote:

From: Stefan Berger 

To sync with systemd, use the filepath /etc/ima/ima-policy as
the file location for the IMA policy. At the same time we
move the ima config file location to /etc/ima/ima. Adapt the
documentation to the new path.

Signed-off-by: Stefan Berger 

One more thing: Do you want to be backwards compatible and also read the old 
files, if they exist?

I had thought about that and can certainly add it.  Neither Fedora, RHEL, nor 
SUSE are packaging these files so far. So likely
there aren't many users out there. Considering that, what would you suggest?


Hmm, I'll add it to the dracut NEWS file


Let me send a v3 of the patch with backwards compatibility. I'll have it 
look for the new location first, then fall back to the old files.



___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

Re: [systemd-devel] [PATCH v2] 98integrity: Use /etc/ima as dir for IMA policy and config file

[Harald Hoyer]

On 30.11.2016 16:24, Stefan Berger wrote:
> On 11/30/2016 10:16 AM, Harald Hoyer wrote:
>> On 30.11.2016 16:10, Stefan Berger wrote:
>>> From: Stefan Berger 
>>>
>>> To sync with systemd, use the filepath /etc/ima/ima-policy as
>>> the file location for the IMA policy. At the same time we
>>> move the ima config file location to /etc/ima/ima. Adapt the
>>> documentation to the new path.
>>>
>>> Signed-off-by: Stefan Berger 
>>
>> One more thing: Do you want to be backwards compatible and also read the old 
>> files, if they exist?
> 
> I had thought about that and can certainly add it.  Neither Fedora, RHEL, nor 
> SUSE are packaging these files so far. So likely
> there aren't many users out there. Considering that, what would you suggest?
> 

Hmm, I'll add it to the dracut NEWS file
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

Re: [systemd-devel] [PATCH v2] 98integrity: Use /etc/ima as dir for IMA policy and config file

[Stefan Berger]

On 11/30/2016 10:16 AM, Harald Hoyer wrote:

On 30.11.2016 16:10, Stefan Berger wrote:

From: Stefan Berger 

To sync with systemd, use the filepath /etc/ima/ima-policy as
the file location for the IMA policy. At the same time we
move the ima config file location to /etc/ima/ima. Adapt the
documentation to the new path.

Signed-off-by: Stefan Berger 


One more thing: Do you want to be backwards compatible and also read the old 
files, if they exist?


I had thought about that and can certainly add it.  Neither Fedora, 
RHEL, nor SUSE are packaging these files so far. So likely there aren't 
many users out there. Considering that, what would you suggest?


___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

[systemd-devel] [PATCH v2] 98integrity: Use /etc/ima as dir for IMA policy and config file

[Stefan Berger]

From: Stefan Berger 

To sync with systemd, use the filepath /etc/ima/ima-policy as
the file location for the IMA policy. At the same time we
move the ima config file location to /etc/ima/ima. Adapt the
documentation to the new path.

Signed-off-by: Stefan Berger 
---
 modules.d/98integrity/README | 8 
 modules.d/98integrity/ima-keys-load.sh   | 2 +-
 modules.d/98integrity/ima-policy-load.sh | 9 +++--
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/modules.d/98integrity/README b/modules.d/98integrity/README
index 64de0ae..c8ccee5 100644
--- a/modules.d/98integrity/README
+++ b/modules.d/98integrity/README
@@ -33,10 +33,10 @@ line.
 
 # Save the policy in a file.
 
-# Create the configuration file '/etc/sysconfig/ima' to override the path name 
of
+# Create the configuration file '/etc/ima/ima' to override the path name of
 # the IMA custom policy.
-- '/etc/sysconfig/ima' (with the default value) -
-IMAPOLICY="/etc/sysconfig/ima-policy"
+- '/etc/ima/ima' (with the default value) -
+IMAPOLICY="/etc/ima/ima-policy"
 -
 
 
@@ -64,5 +64,5 @@ IMAPOLICY="/etc/sysconfig/ima-policy"
 
 # 98integrity/ima-keys-load.sh script loads the signed certificates stored 
 # in the $IMAKEYSDIR onto the trusted IMA keyring.  The default $IMAKEYSDIR
-# directory is /etc/keys/ima, but can be specified in the /etc/sysconfig/ima
+# directory is /etc/keys/ima, but can be specified in the /etc/ima/ima
 # policy.
diff --git a/modules.d/98integrity/ima-keys-load.sh 
b/modules.d/98integrity/ima-keys-load.sh
index 659b722..6c6db40 100755
--- a/modules.d/98integrity/ima-keys-load.sh
+++ b/modules.d/98integrity/ima-keys-load.sh
@@ -2,7 +2,7 @@
 
 SECURITYFSDIR="/sys/kernel/security"
 IMASECDIR="${SECURITYFSDIR}/ima"
-IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
+IMACONFIG="${NEWROOT}/etc/ima/ima"
 
 load_x509_keys()
 {
diff --git a/modules.d/98integrity/ima-policy-load.sh 
b/modules.d/98integrity/ima-policy-load.sh
index 85cd3b9..4cd6ba3 100755
--- a/modules.d/98integrity/ima-policy-load.sh
+++ b/modules.d/98integrity/ima-policy-load.sh
@@ -5,10 +5,15 @@
 # Copyright (C) 2011 Politecnico di Torino, Italy
 #TORSEC group -- http://security.polito.it
 # Roberto Sassu 
+#
+# Copyright (C) 2016 IBM Corporation
+#
+# Stefan Berger 
+#
 
 IMASECDIR="${SECURITYFSDIR}/ima"
-IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
-IMAPOLICY="/etc/sysconfig/ima-policy"
+IMACONFIG="${NEWROOT}/etc/ima/ima"
+IMAPOLICY="/etc/ima/ima-policy"
 
 load_ima_policy()
 {
-- 
2.8.3

___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

Re: [systemd-devel] [PATCH v2] 98integrity: Use /etc/ima as dir for IMA policy and config file

[Harald Hoyer]

On 30.11.2016 16:10, Stefan Berger wrote:
> From: Stefan Berger 
> 
> To sync with systemd, use the filepath /etc/ima/ima-policy as
> the file location for the IMA policy. At the same time we
> move the ima config file location to /etc/ima/ima. Adapt the
> documentation to the new path.
> 
> Signed-off-by: Stefan Berger 


One more thing: Do you want to be backwards compatible and also read the old 
files, if they exist?

___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

Re: [systemd-devel] [PATCH] 98integrity: Use /etc/ima/ima-policy as file location for IMA policy

[Harald Hoyer]

On 30.11.2016 15:05, Stefan Berger wrote:
> From: Stefan Berger 
> 
> To sync with systemd, use the filepath /etc/ima/ima-policy as
> the file location for the IMA policy.
> 
> Signed-off-by: Stefan Berger 
> ---
>  modules.d/98integrity/ima-policy-load.sh | 7 ++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/modules.d/98integrity/ima-policy-load.sh 
> b/modules.d/98integrity/ima-policy-load.sh
> index 85cd3b9..35cfbcc 100755
> --- a/modules.d/98integrity/ima-policy-load.sh
> +++ b/modules.d/98integrity/ima-policy-load.sh
> @@ -5,10 +5,15 @@
>  # Copyright (C) 2011 Politecnico di Torino, Italy
>  #TORSEC group -- http://security.polito.it
>  # Roberto Sassu 
> +#
> +# Copyright (C) 2016 IBM Corporation
> +#
> +# Stefan Berger 
> +#
>  
>  IMASECDIR="${SECURITYFSDIR}/ima"
>  IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
> -IMAPOLICY="/etc/sysconfig/ima-policy"
> +IMAPOLICY="/etc/ima/ima-policy"
>  
>  load_ima_policy()
>  {
> 

you might want to change $IMACONFIG also then?

___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

[systemd-devel] [PATCH] 98integrity: Use /etc/ima/ima-policy as file location for IMA policy

[Stefan Berger]

From: Stefan Berger 

To sync with systemd, use the filepath /etc/ima/ima-policy as
the file location for the IMA policy.

Signed-off-by: Stefan Berger 
---
 modules.d/98integrity/ima-policy-load.sh | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules.d/98integrity/ima-policy-load.sh 
b/modules.d/98integrity/ima-policy-load.sh
index 85cd3b9..35cfbcc 100755
--- a/modules.d/98integrity/ima-policy-load.sh
+++ b/modules.d/98integrity/ima-policy-load.sh
@@ -5,10 +5,15 @@
 # Copyright (C) 2011 Politecnico di Torino, Italy
 #TORSEC group -- http://security.polito.it
 # Roberto Sassu 
+#
+# Copyright (C) 2016 IBM Corporation
+#
+# Stefan Berger 
+#
 
 IMASECDIR="${SECURITYFSDIR}/ima"
 IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
-IMAPOLICY="/etc/sysconfig/ima-policy"
+IMAPOLICY="/etc/ima/ima-policy"
 
 load_ima_policy()
 {
-- 
2.8.3

___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

Re: [systemd-devel] systemd-journald error

[D.S. Ljungmark]

On 25/11/16 22:47, Joel wrote:
> Lennart -
> 
> 
> Thank you for the reply.
> 
> 
> It's not clear whether you are instructing me to do something
> (restart journald or rebuild initrd) or asking a question.

If your distribution builds in the config file into the initrd, it's not
enough to simply edit the journald.conf on your live system and restart
journald,  you'll also need to rebuild the initrd.

If journald is started in initrd (early boot), it will still see the
config file from the initrd if getting a reload signal.


> On Fri, 25.11.16 05:33, Joel Miller (jm-hotm...@hotmail.com) wrote:
> 
>> Because I had misspelled the word "persistent" as "persisten"
>> (dropping the final "t"), I received the following error:
>> 
>> [1.485872] systemd-journald[104]:
>> [/etc/systemd/journald.conf:11] Failed to parse storage setting,
>> ignoring: persisten
>> 
>> Despite correcting the .conf file (/etc/systemd/journald.conf in
>> SuSE Leap 42.1), the error remains, perhaps because the value is
>> cached somewhere in the system, but it is not causing any issues
>> that I can detect.  I welcome any suggestions of where to look.
> 
> You have to restart journald of course?
> 
> Or maybe rebuild your initrd because the config file is also added
> to the initrd on your distro?
> 
> Lennart
> 
> -- Lennart Poettering, Red Hat
> 
> 
> 
> ___ systemd-devel mailing
> list systemd-devel@lists.freedesktop.org 
> https://lists.freedesktop.org/mailman/listinfo/systemd-devel
> 
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel

Re: [systemd-devel] systemd-journald error

[Lennart Poettering]

On Fri, 25.11.16 21:47, Joel (jm-hotm...@hotmail.com) wrote:

> Lennart -
> 
> Thank you for the reply.
> 
> It's not clear whether you are instructing me to do something (restart 
> journald or rebuild initrd) or asking a question.
> 
> Please note that while I have some experience with Linux and the SuSE distro 
> (about 11 years or so), this is the first time I am delving into systemd.
> 
> I was simply trying to find out where else the value (storage=persistent) is 
> registered or cached.

I am sorry, I don't understand what you are asking.

Of course, journald.conf is read by journald. If that answers your
question.

Lennart

-- 
Lennart Poettering, Red Hat
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel