Introduced to work-around systems with broken RTCs, it also introduced a
dormant bug in Finit, triggered at shutdown on some systems. The call
to dlclose() removed the memory to the rtc_timer which libuev later then
referenced.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Initiating a shutdown/reboot from `initctl` should not cause `initctl`
to be killed in do_shutdown().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a user sets up a TTY without a device, triggering the tty->notty
code path, the tty->dev will be NULL and tty_parse_args() still return
OK result.
Found by Coverity Scan
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Enhance fallback entropy generation by mixing in multiple sources:
runtime statistics, PID, and high-resolution timestamps.
This provides better initialization for the PRNG when neither saved
entropy nor hardware RNG are available during early boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When using Finit with an external getty that supports alternative login
program argument, the tty_parse_args() function did not check if a getty
command had already been registered:
tty [12345] /sbin/agetty -L -l /bin/login console noclear
This caused Finit to try /bin/login as the getty program.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change introduces two new states for the big Finit state machine:
runlevel-clean and reload-clean. Here Finit now waits for any post or
cleanup script to finish before returning OK to the initctl command.
Additionally, the service state machine has been updated to ensure a
run/task/sysv/service calls any post or cleanup script before they are
removed. A new 'dead' state for svc_t is introduced which any removed
svc_t ends up in now instead of becing collected from 'halted' state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add cleanup:script support, runs at service removal
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some subsystems call iwatch_add() without first calling iwatch_del() on
the same path. E.g., cgroup_config().
Issue #417 but unclear atm. if this is the root cause.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A long running pre/post/ready script must be killed properly, not by
targeting its process group. Process group cleanup is handled by the
service_monitor() when reaping the script's PID.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
New test adds /bin/fail.sh to verify that a failing pre:script (that
also takes too long to run) is detected: exit code and timeout.
Ensure existing test pass full path to /sbin/fail.sh script.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Check exit status of `pre:` scripts, on failure drive service/sysv to
`crashed` state. The exit code of `post:` scripts remain ignored for
now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Syntax:
[pre|post|ready]:[0-3600,]/path/to/script
Description:
Before this patch all pre/post/ready scripts used the global kill
delay as timeout. After this patch it is possible to disable the
timeout as well as set a timeout >60, which is max kill delay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Follow-up to 465bc17, which addressed unintended restart of siblings.
This patch fixes a problem where template instantiated services are not
properly reloaded/restarted when marked as "dirty" with `initctl touch`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
add support for 'nofail' fstab option. if present, finit's fsck invocation ignores errors for this device.
this is useful if you have an fstab entry for a device with UUID= or LABEL= which isn't always present and which you'd like to not
bail on (so you set nofail). in this case finit leaves the presence-or-not decision to fsck, which exits nonzero.
for block devices that are directly listed in fstab this change isn't important, because for such finit looks for the blockdev's existence and skips the fsck if n/a.
Consider the case where container@.conf is an available template. When
creating a container@foo.conf it will share the same base .conf as an
existing container@bar.conf, but we do not expect to restart bar just
because foo is instantiated.
Up until this change, all template siblings were considered "dirty" if a
new one was created or updated. Skipping realpath() for all files that
have a '@' works around the problem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These plugins signal success and failure directly to the console, the
user should inspect syslog for more information.
This change is a follow-up to 340cae4, where kernel logs of LOG_ERR and
higher are allowed to log directly to the console. Since syslogd has
not been started before these plugins, the log messages would otherwise
leak to the console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 42ef3d3c, for v4.4-rc1, support for setting a custom RTC restore date
was introduced. Unfortunately the configure script was wrong and caused
config.h to contain
#define RTC_TIMESTAMP_CUSTOM "$rtc_date"
instead of
#define RTC_TIMESTAMP_CUSTOM "2023-04-10 14:35:42"
Furthermore, the error handling for strptime() was wrong, so the restore
date was always reverted to the default.
This patch fixes both issues and extends the DATE of --with-rtc-date to
also include seconds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch introduces a new configure option --with-rtc-file=FILE. When
enabled the RTC plugin detects missing RTC device and falls back to save
and restore system time from a file instead. When --with-rtc-file is
used without an argument the default file is /var/lib/misc/rtc, but the
feature itself is disabled by default.
The usefulness of this feature may not be obvious at first, but some
systems are equipped with an RTC that resets to a random date at power
on. This can be really bad in the case the date is far in the future,
because an NTP sync would then cause time skips backwards, which shows
up in logs and causes a whole lot of pain in alarm systems.
The solution is to disable the RTC driver or device tree node, and when
Finit starts up, the RTC plugin detects a the device node and instead
restores time from the last save game. Meaning time will always only
move forwards.
NOTE: when Finit is built --with-rtc-file we always save to disk, but
only restore from the "save game" if restoring from RTC fails.
If the system has no RTC we always restore from disk.
As an added bonus, this change also makes sure to periodically
sync also the RTC with the system clock. Useful for systems
that do not run an NTP client.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some boot loaders, like GRUB, leave background color artifacts from
their boot menu. This patch resets the foreground and background
color attributes, and then clears the screen, without clearing the
scrollback buffer.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch changes a behavior that's been default since Finit 4.0,
introduced in 4d05bf9 with 4.0-rc2.
If service B depends on A and A needs to be reloaded, then B may be
affected. If A is declared as NOHUP <!>, then A will be stopped and
restarted, during which time the condition it provides is removed,
and B will also be stopped.
However, and as of this patch, if A is declared supporting HUP, then the
condition A provides will only go into flux, during which time B will be
SIGSTOPed instead of needing to be reloaded.
Fix#415
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When dealing with "L+" and "R", the function call 'nftw' should not
follow symbolic links, otherwise, it would also delete the targets
which is wrong.
For instance, if there is already a symbolic link:
```
/path/to/the/link -> /path/to/some/folder
```
if we set the following in a tmpfile conf:
```
L+ /path/to/the/link - - - - /path/to/the/target
```
the result would be /path/to/some/folder also get deleted, which it
should not.
it could be even worse, when the symbolic link already is pointing to:
/path/to/the/target, the whole /path/to/the/target would be deleted on
next system boot.
Signed-off-by: Mathias Thore <mathias.thore@atlascopco.com>
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Adds the function fistmpfs to determine if a new tmpfs mount should be
performed on /run and /tmp. The function supports cases where more
complex mount hierarchies are in use, including overlayfs backed mounts.
Signed-off-by: Mathias Thore <mathias.thore@atlascopco.com>
A Linux system booted with the kernel command line option 'quiet' only
logs error (and above) severity messages to the console. For embedded
systems, which is the primary target for Finit, this is what you want
to see.
Hence, and after careful consideration, this patch changes the default
behavior of Finit to allow kernel logs to the console. A build-time
configure flags, --disable-kernel-logging, has been added to restore
legacy behavior.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Systems that have the following tty setup and multiple consoles listed
in /sys/class/tty/console/active misbehave:
tty [12345789] @console 0 xterm noclear passenv
Only the first listed console is started properly, the remaining ones
were registered using the wrong :ID and no arguments to getty.
This patch fixes the parsing and re-use of the base paramenters for
all consoles listed in the active file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently no code checks the return code of ifupdown at runlevel
changes, but for future reference this code has been refactored
to match the changes made in cbdb949 to fix issue #400.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This problem affects all calls to run_interactive() that check the
return value of the command. Causing HOOK_MOUNT_ERROR to *not* run
on mount failure, and sulogin() to *not* be started on fsck error.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Silence log warnings for command x/X (ignore clean for path), because
Finit does not do tmpfiles cleaning at runtime.
x /tmp/podman-run-*
x /tmp/containers-user-*
x /tmp/run-*/libpod
D! /var/lib/containers/storage/tmp 0700 root root
D! /run/podman 0700 root root
D! /var/lib/cni/networks
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After reports from the field, see issue #397, of lockups at reboot,
we've decided to drop this code from PID 1. It was added before the 4.x
series, when the current progress output was introduced. For the older
style progress it served a purpose since the placement of [OK]/[FAIL]
was on the right hand side.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When the system shuts down, or user changes runlevels, we don't have to
call cond_clear_update(), because this can lead to nested service_stop()
calls, which in turn lead to out of sync progress updates:
[ .. ] Stopping Foo
[ OK ] Stopping Bar
[ OK ]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The /etc/issue file on Alpine Linux says "Kernel \r on an \m (\l)", so
\r needs to return the uts release rather than os-release VERSION.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The responsibility of the kernel event daemon is to relay kernel events
to Finit. At shutdown and reboot it is too late for more events and the
daemon should just shut down with other services.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix copy-paste of error message from cond-w.c
A read-only root filesystem may have /var/lock, while we want to remove
it and add a symlink to ../run/lock. Ignore errors from this since we
cannot do anything about it. It is up to the user to fix their skeleton
or use an overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Inspired by Alpine Linux, add /dev/mqueue if missing. We should check
the /proc/filesystems first, but this is quicker.
The sticky bit ensures only the owner of files in /dev/shm can delete or
rename files. This is also what Alpine Linux use.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A service with notify:pid is 'ready' when the pidfile has been created,
the converse also holds true -- when a pidfile is removed the service is
no longer 'ready'.
The state transition for the service has probably already been done, in
svc_set_state(), clearing all <service/foo/*> conditions when the PID
was collected. The pidfile event may arrive later, so for completeness
we make sure the 'ready' condition is not recreated at least.
Problem introduced in 912a281 with the original supoport for service
readiness notification.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
There exist two possible basename functions, a xpg compliant one in libgen.h
and a GLIBC exclusive one declared in string.h, that was previously also declared by musl libc.
Both implementations are expecting different parameter types (`const char *` for GLIBC and `char *` for xpg)
With the removal of the basename function from string.h in musl libc, we could only rely on the xpg implementation.
Unfortunately, the xpg implementation of basename does modify the contents of whatever you put in it,
even though that there really is no need for it.
This is an issue in some cases, where we might want to get the basename of a read-only variable, e.g. a `const char *`,
as trying to modify something read-only is undefined behavior.
So in order to keep things consistent for us, we implement our own version of basename called `basenm`,
that does not modify the passed argument.
As of Finit v4.6 we no longer assert the PID condition for services
declaring themselves as notify != pid. We replace D with a forking
service to catch any future regressions in the pidfile plugin.
No need to check reload PID of D, it is enough to check PID of C.
Also, reduce the number of retries at startup. If we haven't gone
up within 10 sec with this tiny config something is really wrong.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Premise, a service declaring itself 'notify:none' should never assert a
pid condition. However, forking services still need to be supported and
the only way to do that is if they create a pid file. Hence, instead of
skipping pidfile_update_conds() completely we need to filter the type.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-11-13T04:02:23 [WRN]: conf_change_act():failed registering /etc/finit.conf/ event mask 00000004: Not a directory
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes an issue when finding a global environment variable with
spaces in the variable name:
set COLORTERM=yes
Literally, 'set COLORTERM' was the name of the variable.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change expands the readiness notification system in Finit with the
native 'pid' style, which will remain the default readiness in Finit 4.x
For systems that want to transition to Finit 5.x early, a global option
to set 'readiness none' in /etc/finit.conf, has been added. This change
the service default notification mode to 'notify:none', which can also
be set by Finit 4.x ('readiness pid') for select services.
Fixes#386.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes an annying buglet that creeped in just before the v4.5 release
causing none of the internal services to be registered properly:
conf_save_service():Failed creating ${localstatedir}/run/finit/system/dbus.conf: No such file or directory
plugin_run_hook():Calling modules-load hook n:o 5 (arg: 0x55c4c8133621) ...
load():Scanning /etc/modules-load.d for config files ...
cond_set_oneshot():hook/svc/plugin
cond_set_oneshot_noupdate():hook/svc/plugin => /run/finit/cond/hook/svc/plugin
cond_update():hook/svc/plugin
parse_conf():*** Parsing /etc/finit.conf
conf_save_service():Failed creating ${localstatedir}/run/finit/system/runparts.conf: No such file or directory
The fix, like most, is simple when you find it. We must expand $runstatedir
before creating the #define in config.h
For convenience, here's the patch for the generated configure script:
&<---------------------------[cut here]---------------------------
--- a/configure 2023-11-05 23:39:51.907334321 +0100
+++ b/configure 2023-11-05 23:39:58.339299795 +0100
@@ -15352,7 +15352,15 @@
printf "%s\n" "#define FINIT_EXECPATH_ \"$pkglibexecdir\"" >>confdefs.h
-printf "%s\n" "#define FINIT_RUNPATH_ \"$runstatedir/finit/system\"" >>confdefs.h
+ finit_runpath="$runstatedir/finit/system"
+ finit_runpath=`(
+ test "x$prefix" = xNONE && prefix="$ac_default_prefix"
+ test "x$exec_prefix" = xNONE && exec_prefix="${prefix}"
+ eval echo \""$finit_runpath"\"
+ )`
+
+
+printf "%s\n" "#define FINIT_RUNPATH_ \"$finit_runpath\"" >>confdefs.h
&<---------------------------[cut here]---------------------------
Ensure you include the three empty lines for context at the end!
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We cannot rely on the auto-detection of Bash completion dir during 'make
distcheck' because autotools does not use DESTDIR, only --prefix for the
install check, and pkg-config returns a system path.
Also, show detected path in configure summary for debug.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In Finit v4.5 we've moved the start of rc.local and runparts to the
transtion from bootstrap to multi-user, so we must give it time to
finish.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In Finit v4.5 we've moved the start of rc.local and runparts to the
transtion from bootstrap to multi-user, so we must give it time to
finish.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This odd little feature makes it possible to declare run/tasks with a
condition that does not block Finit transitioning from bootstrap to the
next runlevel.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Regression in v4.5 release cycle, no changelog notice needed.
Reported as part of issue #378 by Alexander Zangerl.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change allows us to support constructs like this:
RUNDIR=/var/run/somesvc
DAEMON_ARGS=--workdir $RUNDIR --other-args...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Introduced back in v4.3-rc2, 82cc10be8, the support for automatic
service conditions have had a weird and unintended behavior. Any
change in state (see doc/svc-machine.png) caused Finit to clear
out *all* previously acquired service conditions.
However, when moving between RUNNING and PAUSED states, a service
should not have its conditions cleared. The PAUSED state, seen
also by all conditions moving to FLUX, is only temporary while an
`initctl reload` is processed. If a service has no changes to be
applied it will move back to RUNNING.
Also, we cannot clear the service conditions because other run/task
or services may depend on it and clearing them would cause Finit to
SIGTERM these processes (since they are no longer eligible to run).
This patch not only adds this pre-condition to `cond_clearn()`, it
also clarifies which state (before or after) the particular code
is interested in.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Renamed .conf file for udev/mdev etc. caused 'mdev -df' to start in
tests. This fix closes that again since none of that is needed in
our small namespaced world.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Alexander Zangerl reports that <service/foo/STATE> conditions seem to be
removed when calling `initctl reload`, even though no .conf changes have
been made.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The delayed matcehd works when all run/task/services provide their own
unique identity, but for replacements this is sometimes not the case.
Example from system/10-hotplug.conf.in:
run nowarn conflict:udevd,mdev cgroup.init name:coldplug <service/mdevd/ready> \
[S] mdevd-coldplug -- Cold plugging system
vs
run nowarn conflict:udevd,mdevd cgroup.init name:coldplug if:!mdevd <service/mdev/running> \
[S] @pkglibexecdir@/coldplug -- Cold plugging system
Here they both provide the <run/coldplug/*> conditions, and if the first
is loaded, because we found mdevd, then we should not attempt to load
this one.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The updated 10-hotplug.conf now ensures modules are loaded, so we no
longer need the modprobe.so plugin to be enabled by default.
Also, update the hotplug "plugin" description, it is kept entirely
for backwards compatibility reasons after the plugin was converted
to 10-hotplug.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit replaces the `mdev -s` call to populate the device tree with
the "new" `mdev -df` daemon mode, introduced in BusyBox 1.31.0, 2019.
In daemon mode mdev listens to kernel uevents, replacing the hotplug use
of mdev. After creating the netlink socket, 'mdev -df' performs the same
initial scan as 'mdev -s' did.
To perform device (re)discovery, module loading and setup, including any
firmware loading, a coldplug operation is typically required. This is
done by the new /libexec/finit/coldplug script, by Alexander Zangerl.
Unlike 'mdevadm settle', mdev does not offer any mechanism to detect when
the discovery operation is done: on slower systems the triggering side,
the coldplug script, often completes quite a bit earlier than mdev's
uevent processing. I.e., depending on <run/coldplug/success> is not an
indicator of all devices having been (re)discovered and fully set up.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On some systems udev may very well take more than five seconds to complete.
Probing modules, loading firmware, etc. Note, the timeout only sets the
maximum wait time.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The directory may hold various custom generated conditions that are not
managed by Finit. Not being able to remove the directory is not a
critical error.
finit[1]: cond_delpath():Failed removing condition path /var/run/finit/cond/: Directory not empty
Therefore, ignore ENOENT and ENOTEMPTY and log everything/anything else.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes the regression in the tests, which runs in a very stripped
down world without tmpfiles.d etc.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds a new function conf_save_service() replacing service_register() for
plugins and bundled services like watchdogd, keventd, runparts, etc.
The benefits to this change are several:
- Plugin/Bundled services no longer risk starting before udev or other
critical services/task have started
- Definitions can be overridden by an administrator (see docs)
- Increases visibility (user: where are all these services coming from?)
Previously the origin (file the service was loaded from) was NULL.
- Adds another level of extensibility to Finit
The most notable change is that dbus is no longer started before udevd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The system/10-hotplug.conf needs to index its calls to udevadm for all
calls to udevadm, not just the trigger calls. Otherwise the first
udevadm is overloaded with all subseequent (unindexed) udevamd stanzas.
Also, make sure all udevadm calls to settle/reload are hidden.
Fix#372
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The if: statement, introduced in v4.4, allows for discarding run/task/services
that depend on other services, based on that service's name, or condition.
Discarding in this context means unloading from the configuration.
At runtime, however, it has proven quite useful to be able to conditionally
qualify a run/task/service based on a condition. Consider this example from
the Infix operating system:
run name:startup log:prio:user.notice \
[S] <pid/sysrepo> confd -b --load startup-config -- Loading startup-config
run name:failure log:prio:user.critical if:<usr/fail-startup> \
[S] <pid/sysrepo> confd --load failure-config -- Loading failure-config
The two run statements reside in the same .conf file so Finit runs them in true
sequence. If loading the file `startup-config` fails confd sets the condition
usr/fail-startup, thus allowing the next run statement to load `failure-config`.
Notice the difference between <pid/sysrepo> condition and if:<usr/fail-startup>.
The former is a condition for starting and the latter is a condition to check if
a run/task/service is qualified to even be considerered. The best comparison is
with the [runlevel] option, it too is used to qualify.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change opens up the runlevel change API from bootstrap. The twist
is that the change is only queued, i.e., the call `initctl runlevel 9`
during bootstrap only changes the configured runlevel to go to after
bootstrap has completed.
Effectively, this change allows overriding the `runlevel` directive in
/etc/finit.conf without having to change the file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No more changes are expected after -rc3. Will be used for testing in
Infix and br2-ext-finit before the final v4.5 GA.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch extens the SysV compatibility support in Finit by adding
support for limiting `runparts` to run only SNNfoo, or KNNfoo, style
scripts from a directory.
Additionally, by default `runparts` now runs entirely in the background
without any progress. To enable progress, an optional argument has been
added to the runparts command line.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As pointed out in #366, the configure options --enable-fastboot and
--enable-fsckfix should just alter the default values of the two fsck
command line options.
This commit simplifies the code and makes it possible to override using
the command line regardless of the two build options.
Finally, add the two command line options to doc/cmdline.md
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We use LOG_CONS to ensure log messages reach the operator, but since
watchdogd starts very early this means non-critical messages like the
initial greeting leaks to console because syslogd has not yet started.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With non-standard paths, e.g., when running `make distcheck`, the
absolute path to some commands become ridiculously long. However,
this has been a recurring issue for some users in the past, so it
is time to increase the capabilibieies of Finit to cover this.
Yes, a better way is probably to allocate all these strings when they
are used, but that would require a redesign of the initctl API and
likely cause a lot of regressions before everything has stabilized.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The rescue mode that can be invoked from the kernel command line is
potentially unsafe. Many systems lock the root user account, or use
another account for managing, e.g. 'admin'. The sulogin program(s)
would on such systems give the user a root prompt.
In #357 we added support for setting a custom sulogin user, but for some
systems that is not enough. On many embedded systems the /etc/passwd
and shadow files are populated at bootstrap and at the time rescue mode
runs, these files will be unpopulated.
The only, truly safe, approach on such systems is to disable rescue mode
completely. Otherwise intricate Finit plugins have to be used that run
before rescue mode is started -- increasing the complexity of the system
as a whole.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In issue #357 there's a proposal for optionally allowing /bin/login, but
after intense discussions we've agreed that would be opening up for all
sorts of potential (security) issues.
it's better to keep things as-is but with the added twist of supporting
a custom user at configure time, e.g., 'admin'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Non-trivial systems, like Infix[1], require more than one lap around the
track to warm up. This is a follow-up to issue #362, commit 4701ede, in
fixing an obvious oversight in the new sm_check_bootstrap() work. While
there are still outstanding bootstrap tasks or services that have not
yet started, we must reschedule the worker.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Drop complete() logic, waiting for run tasks to finish, from the
service_start() funciton to the general service_monitor(). This
refactor frees up the main loop and allows us to answer any API
calls from initctl even from the run task itself.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For some specialized forms of runparts, e.g., start-stop scripts in SysV
init replacements, there is a need to append an argument. Typically
this is 'start' or 'stop'.
This functionality has been broken for quite some time, meaning we
should consider it being unused by current users of Finit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bootstrap-only tests that just verify basic functionality are often very
short. This change handles that by retrying SIGUSR2 until Finit has had
the chance to finalize bootstrap and enable signals.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The code refactored in this commit has long been an eyesore. The
hand-over, from the sequential main() function, to the event loop
was clumsy at best and was very difficult to debug.
Instead of using a series of workers we now delegate everything to
the big state machine by introducing a new SM_BOOTSRTAP_WAIT_STATE.
Both the runparts and rc.local scripts now run in the background, no
longer blocking the event loop from responding to initctl calls. To
ensure they run at the same point in time two things have been done:
1. A new <int/bootstrap> condition has been added which triggers
runparts, which now is a regular task created by conf_init()
2. /etc/rc.local is started from SM_RUNLEVEL_WAIT_STATE when we
transition from runlevel S to any other runlevel.
Fixes#356
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This should clarify the messup on the behalf of the mainatiner in not
documenting this properly, including the deviations introduced in v4.4
See issue #359 for a background.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- iwatch events return filenames in dir field, ignore file for those
- improve warning message on failure
- drop bogus "Out of memory" error log message
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The execvp() call always fails with -1, so only logging exit code when
collecting the PID is not enough. When debugging the user needs to see
the errno from execvp(), e.g., "No such file or directory", when the
command was missing the absolute path to the executable.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Related to 6f0d448 in that we check if the kernel knows about this
process before we try to stop it. If it's already dead we clean up
and return.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This turns out to be the root-cause of #227. Finit is waiting forever
for proceeses to stop at shutdown/reboot, while a subreaper has already
collected the PID, or Finit for some reason did not collect the PID.
When the process timeout calls service_kill() we now check if the kernel
actually knows of this process or not. If it's already been collected,
we can notify Finit of this by calling service_monitor() to clean up the
'svc' and in turn call sm_step() to finalize the state transition.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When calling `initctl -b create` from a start script at bootstrap you
risk blocking the boot since Finit currently cannot reply to IPC during
that period.
This patch allows -f to override this builtin check for the following
initctl commands:
- touch
- show
- edit
- create
- delete
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes add a new svc_block_t type: SVC_BLOCK_CONFLICT so a user
can more clearly see why a run/task/service has not been started by
Finit. The reason for the block is by default logged, which can be
escaped by using the `nowarn` flag.
Also, when the conflict is resolved, allow the service to start.
With these changes, the system/hotplug.conf should work better and
cause less questions about "strange" log messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apparently the qemu-system-x86_64 in -nographics mode does all sorts of
crazy things to the terminal. Most annoying, it disables linewrap.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 91a9c83 a regression was introduced that affects the way Finit stops
a supervised process and its process group.
Instead of sending SIGTERM to the process, delegating the responsibility
to that process to inform any children it may have, Finit as of 91a9c83
sends SIGTERM to the entire process group. For SIGKILL this is fine,
SIGKILL only runs as cleanup and as a last ditch effort if the process
doesn't respond to SIGTERM.
This regression, introduced in v3.2, directly affects services like
avahi-autoipd that have forked off children that it needs to tell to
exit cleanly before it returns. With the patch in question these
children are never allowed to complete, which in turn causes lingering
169.254 link-local addresses on interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When started as a monitor in a container, or for the test suite run from
distcheck, we must allow Finit to find its own tools like initctl. This
should also be a more generic solution that cover more cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A simple distcheck revealed that the local path[] was too small to store
something like /home/jocke/src/finit/finit-4.4-rc1/usr/lib/finit/system/
This refactor should cover all cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The user may have their own setup of things, by default we should not
cause unnecessary warnings in syslog.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to an old design decision runlevel S was encoded internally as '0',
meaning it was the same as halt/poweroff. If you want to run scripts at
system shutdown this was less then ideal since it meant your scripts
also ran at bootstrap.
This change is quite invasive. It introduces INIT_LEVEL (10) as the
value for runlevel S, meaning all code that parses and/or evaluates
anything for runlevel 0/S was affected and had to be reworked.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some services (openresolv) tries to talk to it very early, so lets get
dbus up and running as soon as possible.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The logger redirection process was sometimes in the init group instead
of the system/<svc>/ group. This was due to the parent PID being moved
after the logger was forked.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When we've started a run task, regardless of its exit status, we must
mark it as not dirty to prevent it from being endlessly restarted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When the inotify callback is called for a file that has been removed,
the call to realpath() obviously fails (ENOENT). This fix only takes
the regular case into account, files removed from a symlinked enabled
directory is not handled -- needs more work for that.
Regression introduced in 0a94f3f, PR #347, issue #346.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Post audit, concensus is to drop if: and always do post-eval of all
ifdef: statements. Also, rename ifdef: to if: for completeness.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Multiple parallel tests writing to the same /var leads to quite
unexpected results. Let's start fresh in each test instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is the first example of the just minted advanced stanza syntax with
if-statements, conflict handling, and nowarn flags.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Conditional loading of stanza depending on ident is already loaded. The
if: checks as in-band while ifdef: checks out-of-band, i.e., post eval.
The optional leading '!' negates the comparison, if NOT foo then ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Slowly migrating away from hard-coded services in plugins. This way
it's possible for the user to both inspect and override as needed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The tmpfilesd() glob sorts files according to name, we could name our
.conf as 00finit.conf to prevent ordering issues with, e.g. dnsmasq,
but this is more elegant and allows for multi-level override.
NOTE: bootmisc depends on the pidfile plugins since the latter need
to set up its iwatches of /run before bootmisc creates /run.
Depending on if it's a system with /var/run or /run we need to
drop /var/run before recreating it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This changes the semantics of Finit a bit by checking for the command to
run when registering it, skipping commands that cannot be found in the
absolute path provided in the command, or in $PATH.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Then it works to run the applets from outside the unshare. Useful for
testing and test development.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds very basic tmpfiles.d/ support to Finit. Much of the
basic types are supported, but not all, so for now, please check the
code for details on what is working.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Starting a service like this works fine:
service [2345789] env:-/etc/default/nginx nginx -g 'daemon off;'
However, on `initctl reload` the previous argument was lost while
parsing the end of the new one. So the comparison always resulted
in a 'diff' causing the service to be unnecessarily restarted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
initctl: Follow priciple of least surprise for "cond get"
Fixes regression in 4.4 release cycle, commit c3c662f, when support for FLUX condition state was added.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The accepted standard in Unix is to report successful executions with
exitcode 0. Therefore, map a "initctl cond get" of a condition to the
following exitcodes:
- On: 0
- Off: 1
- Flux: 255
Fixes: c3c662fe64 ("initctl: ensure 'cond get' support flux state")
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
The TTY and log configuration is overloaded using a union in svc_t, so
we cannot "reset" the log attribute on reload. In fact, a TTY should
never be allowed to have a tty:anything set, so change the parser to
ignore log options for ttys.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unfortunately we cannot use realpath(3) here since the the PID files
usually do not yet exist at this point.
Add and modify my ugly de_dotdot() from Merecat httpd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When this code was moved from finit.c we rely on WDT_DEVNODE to be
defined in config.h, which is controlled by configure. Meaning, before
the relocation, Finit did not honor the configure settings.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This issue was found when the test pre-post-serv.sh suddnely started
failing, unclear how it could ever have worked before considering the
nature of this patch.
The trick here is when reloading a service like this:
service env:/etc/env serv -np -e foo:bar
into this:
service pre:/bin/pre.sh serv -np
In the second the env: has been removed and pre: added. But with Finit
prior to this patch, env: was kept leading to unintended behavior. The
same goes for the other options included in this patch.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In particular watchdogd we want to start in runlevel S to ensure we
start kicking the WDT. (Some HW WDTs are enabled from power on.)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All services registered in the system rely on conf_init() having been
set up properly, e.g., global_rlimit. Having conf_init() be responsible
also for registering static services is only logical, and also helps us
clean up main() a bit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of the revert in c9fe9afa, we restore HOOK_BASFFS_UP to its
proper place at the end of fs_mount_all(). For this to not cause any
regressions we add a new hook, HOOK_SVC_PLUGIN, and update all plugins
that call service_register() to run at the new hook.
This will cause regressions for external 3rd party plugins that rely on
HOOK_BASEFS_UP to be called at its previous postion. Nevertheless, this
is the proper fix to the problem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With all the change and revert mess of the HOOK_BASEFS_UP tests started
failing due to usr.so and sys.so failed to set up their conditions. It
then became clear that boomisc.so cleaned up /run ... with the revert
we got service_register() to be called before global_rlimit[] was setup
causing services registered by plugins, before conf_init(), to crash.
This plugin and test is here to ensure we catch this problem in case of
any future refactor.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not all Linux systems are based on Debian, and even if they are inspired
by Debian (Buildroot), they do not necessarily use the same defaults.
This patch probes the current system for:
- dbus user and group
- dbus PID file
If the user/group cannot be found we fall back to "root", if the PID
file cannot be determined we ignore PID file readiness.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit 5b41c6e since it causes regressions in plugins
adding services to the system. The proper fix for early bootmisc
is to add a new hook, which will be added in subsequent commits.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No need for special handling of s6 services, we now have the new
service_notify_reconf() function that is called on init reload.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sysklogd logger is capable of logging the PID of the actual service,
rather than just the logger tool itself (which would be a differet PID
every time).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When 'initctl reload' is called new "configuration generation" is
started by Finit. This mechanism ensures services reaffirm their
readiness and helps distinguish between their ready before reload
and after.
For native services the pidfile plugin handles this. The s6 style
services are one-shot only, and thus use a static ready condition.
This patch adds support for stepping the configuration generation
of unmodified systemd style services.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To reset the crash counter of the 'serv' daemon we need to remove it
from /etc/finit.conf (and reload) between each test phase.
The repeated test phases can now be dropped, since the lack of reset
was the root cause for it failing sometimes in extended runs.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Correct an obvious oversight, we need to ensure the native pidfile based
daemons also work as intended in the new readiness notification world.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure the test mimics actual real-world scenario where daemons do not
create a PID file at all.
Issue #343.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The 'initctl cond' commands were initiallý added to only manage usr
conditions. Recently the 'cond get' command was expanded to allow
reading general conditions as well.
However, since general conditions support three states the command
returned 'on' for conditions that were in flux. This patch fixes
that oversight.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The svc_set_state() function not only handles state transitions, it also
makes sure to cancel any outstaing service timeouts. Before the service
readiness support was added, service conditions were simply a single bit
of information, so clearing its conditions before changing states had no
impact. With readiness we have multiple bits of information that are
set as conditions.
When restarting a crashing service we set a timeout to retry restarting,
or ensure the service is now running. This means that the service can
signal READY before RUNNING is reasserted, but the RUNNING state can be
set also by the service state machine, so we need to ensure we do not
re-assert RUNNING if it's already set, and thereby clearing READY.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Issue #343 reports that readiness notification on crash/restart is lost.
This update to notify.sh reproduces that bug.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Principle of least surprise. When no even the maintainer remembers
the correct command, it is time to add an alias.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Over the years there have been multiple cases of invalid and/or unsafe
uses of signals and initctl commands at bootstrap and shutdown. These
cases cannot be safely supported. This commit locks down finit a bit
to avoid the most common cases.
If you run into this, please open a new discussion at GitHub and we'll
talk about it. Maybe I've been overzealous or you have another use-case
that warrants opening up some or parts of the API.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not until fs_mount_all() has completed do we have /run, or /var/run, and
never after shutdown has been initiated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As pointed out by Jack Newman in issue #338, when conditions are not
available (at boot before cond_init(), or shutdown when /var or /var/run
have been unmounted) we should not try to create any conditions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Slightly different take on issue #334 making it optional, possible to
enable per system.
reboot-delay <0-60> # default: 0 (disabled)
When enabled (non-zero), runs after filesystems have been unmounted,
the root filesystems has been remounted read-only, and sync(2) has
been called, twice.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The bootmisc plugin sets up the base path for finit and figures out if
the system has /run or /var/run -- needed by the other plugins.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This to save time during regular pushes and pull requests, the tests
run from distcheck take a long time, and they're not getting fewer.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
At this hook point the bootmisc.so plugin runs and creates all relevant
system directories. Much of the rest of system bootstrap relies on this
so it should be called together with the other FS hooks as soon as all
the filesystems have been mounted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Works locally with/without this patch, but I cannot understand why it
would ever be needed in the first place, so removing.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When the /etc/finit.d/enabled directory is a symlink elsehwere, e.g.,
/var/finit.d/enabled, a relative symlink will not work.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
sig.c was calling plugin_run_hooks for the shutdown hooks, but the
shutdown hooks do not have registered callbacks in hook-scripts.c
Instead directly call plugin_script_run()
This fixes `initctl reload` correctly restarting all daemons that have new
command line arguments.
Previously command line arguments changes were only acted upon if the
service was explicitly reloaded `initctl reload myservice`.
We use strtok() quite extensively in .conf parser. Parsing of a service
line is split in two, with the command arguments being parsed very late.
Adding a new sub-option parser, based on strtok(), risk losing command
arguments. Thus, change to use strtok_r() so that we always know where
the arg parser is.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Last update of plugin before dropping it in favor of an equivalent .conf
snippet. (Pending new finit-conf repository).
Issue #327
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch changes the way progress for unmounting filesystems is
displayed. To see each filesystem being unmounted Finit now must
be in debug mode.
A general "Unmounting filesystems ..." have been added instead as well
as progress for last hook script and finall call to reboot().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change drops the confusing status progress output, which was always
OK since the actual modprobe operation runs in the background. No need
to show status of the "added a task to finit, found modprobe" command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of waiting until runlevel 2, 3, 4, or 5 to load modules with
this plugin, we should load modules as soon as possible, i.e., in
runlevel S. This also means that Finit will clean up all the tasks
so we don't have to see them in `initctl status`.
To allow users to revert to the old behavior, we add a new setting
set runlevel 2345
that per modules-load.d/file changes the runlevel for all modprobe
commands.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
GitHub have now stepped their 'ubuntu-latest' image to Ubuntu 22.04.
With that comes the GLIBC bump to >= 2.34 which require aligning the
time bits and file offset bits to 64 bits. This is libuev v2.4.0.
We also make sure to align libite to the same version between the
workflows to avoid any nasty surprises.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All hook scripts are called with at least one environment variable set,
FINIT_HOOK_NAME, useful when reusing the same hook script for multiple
hook points. It is set to the string name, also used by the path, e.g.,
hook/net/up.
For all hook points from hook/sys/shutdown and later, FINIT_SHUTDOWN is
also set, to one of: halt, poweroff, reboot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For all other run_parts() use-cases we just give the script control over
stdout/stderr to prevent clobbering ANSI color escape codes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit 03c08d3970 due to it
breaking handling of bootstrap tasks, causing endless boot loop.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This protects against any hook scripts or services calling initctl when
we're going down. There's no way to service these requests anyway, so
no point in keeping the socket open. This way initctl can check for
the existence of the socket before attempting any IPC command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add support for /etC/os-release, with fallback to /usr/lib/os-release,
overriding some traditional modifiers with the os-release variant. The
traditional values for these modifiers are taken from uname, which on
Linux systems are pretty useless since they always return the kernel
name and version instead of the distro/OS values.
E.g., \s becomes PRETTY_NAME instead of 'Linux' and \v becomes the
pretty VERSION, while \r becomes VERSION_ID.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change makes it possible to use the standard continuation character
in .conf files. For example:
service [23456] \
log:stderr \
<!pid/foo> \
bar \
-- This is the bar service, it depends on foo # comment that's dropped
Notice the additional support for comments on .conf lines. If you use
the comment character today you must change to escape it. Like this:
service :2 foo -- Foo \#2
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When removing a whole tree of conditions we need to walk through each
and call cond_update() to ensure that all dependant tasks are stopped
and put back in waiting.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change prevents Finit from attempting to continue restarting
crashing services that've lost their conditions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Hopefully prevent spurious failures, dunno why atm., parallel checks
should work now. (Works locally with make -j20 check)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a service starts up the pidfile.so plugin automatically detects any
new pidfiles that show up in the system. If it finds a matching service
which does not have a custom configured pidfile, it auto-assigns the
detected pidfile to the service.
However, when the user later calls `initctl reload` to update the
running configuration set, Finit service_register() mistakenly will
set the service to forking since it now suddenly has a pidfile ...
The new style way of configuring a forking service is to set the
type:forking
option. The old compat way was to set `pid:!/path/to/pidfile`, so
in service_register() we must be very careful not to interpret the
registered pidfile as confiugred by the user -- i.e., check the pid
option.
Bug #313
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a service crashes Finit launches a restart timer that periodically
will try restart the service. If a user calls `initctl stop foo` finit
must cancel this timer callback, otherwise we may end up with a weird
state where Finit thinkgs the service is running, but pid: 0, i.e., not
started.
Note: this fix has been expanded upon from the proof of concept
submitted by Jack Newman.
Bug #313
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Running tests in massive parallel causes failing startk-kill-service.sh.
This in turn was caused by the shared test tool 'slay' that cached its
"oldpid" file to a shared area of the rootfs (tenv-root). It must use a
test instance-specific ramdisk.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds support for a new command line option finit.config=PATH
which can be used to tell Finit to start with /etc/factory.conf instead
of /etc/finit.conf.
For the complete experience a new top-level configuration file directive
`rcsd PATH` has aslo been added. It in turn can be used by factory.conf
as follows to override /etc/finit.d:
rcsd /etc/factory.d
Manually verified in myLinux
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since the s6 readiness notification mechanism closes the notification
socket to Finit (as per s6 spec.) the 'ready' condition should then
always be asserted, even across system reconfiguration events.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Services that have not been changed, or otherwise needed to be reloaded,
need to have their 'ready' condition reasserted on 'initctl reload',
otherwise it will remain in 'flux'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds support for JSON output to `initctl status` using a
`-j` or `--json` command line option.
Example:
root@anarchy:~# initctl status -j mdevd
{
"identity": "mdevd",
"description": "MDEVD Extended Hotplug Daemon",
"status": "crashed",
"exit": { "code": 100 },
"origin": "built-in",
"command": "/bin/mdevd -C -O 4",
"restarts": 10,
"pidfile": "/run/mdevd.pid",
"pid": 0,
"user": "root",
"group": "root",
"uptime": 0,
"runlevels": [ "S", 1, 2, 3, 4, 5, 7, 8, 9 ]
}
The excellent tool `jq` can be used to extract certain parts of the
output for further scripting. E.g. `initctl status -j foo | jq .exit`
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This was added for the benefit of `initctl status foo`, but we have
other users of these functions that don't expect a leading slash.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The condition subsystem starts very late, this should not affect running
callbacks in plugins. In d810ac0 an extra return statement was included
in a new if() statement block that run plugins hooks. This caused a
massive regression in how Finit starts up and runs.
- drop return; statement that causes regression
- move #ifdefs to surround if() statement
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds support for running hook scripts at two new hook points
during the shutdown process:
- HOOK_SVC_DN: after all services and non-reserved processes have been
killed (and collected)
- HOOK_SYS_DN: after all file systems have been unmounted, *just prior*
to Finit calling reboot() to shut down or reboot the system
See doc/plugins.md for details and an example.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Leave the system as it was when we found it. Also, we'll build things
on top of cond_is_available() to handle pre bootstrap and pre shutdown
tasks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Always use the configured restart delay for crashing services. If no
delay is configured, we default to an initial 2000 msec for forking
daemons and start-stop scripts, and 1 msec for non-forking daemons.
We must track the increasing delay in the svc_t because processes can
fail quickly in differing ways. E.g, the test daemon 'serv' behaves
extra evil by crashing right after having created its pidile (i.e.,
when it's signaled to Finit it is 'ready' and all is dandy ...). If
we don't track the delay per svc_t we would restart 'serv' after only
1 msec every (other) time.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When there is no log daemon, and we are running in a container, or we
cannot log to the kernel ring buffer, then we log to stderr. This patch
improves the log output by prefixing each message with a timestamp.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We want to stress test Finit as much as possible. We add a small log
though (which admittedly gives us a little bit of a delay) just to see
what happens when debugging failing tests.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds the oncrash:script option to call the post:script
action, if defined, for a crashing service. The EXIT_CODE variable
sent to the script is set to `crashed`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
By definition, the readiness notification is reserved for daemons. May
possibly be extended also to sysv services later. If you arrive hare
with that request, please file an issue with the project.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Follow-up to abcb3ce, calling the service ready:script when readiness
has been signaled to or detected by Finit.
Issue #300
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Always better to have at least one sulogin available, if the system
provided sulogin isn't available we fall back to the built-in one.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds service readiness notification to support daemons
employing systemd and s6 notification. Complementing the native
Finit readiness support using PID files that exist already.
The two have slightly different ways of implementing readiness:
- https://www.freedesktop.org/software/systemd/man/sd_notify.html
- https://skarnet.org/software/s6/notifywhenup.html
Finit now provides both a NOTIFY_SOCKET environemnt variable, for
systemd, and a way to start s6 daemons with a descriptor argument.
For details on the syntax, see the `service` documentation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before we clear all conditions for a service, ensure pid_file_read()
didn't fail due to the PID file not (yet) containing a valid number.
If the process dies while starting up, and subsequently removes its
PID file, then the file shouldn't exist. However, if we get inotify
before the process has finished writing the PID, then we just return
and wait for the next event.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This was a tough nut to crack. Spent 3-4 calendar weeks (getting blurry
now) to try and figure it all out. In the end, the following changes
were necessary:
- Ensure setup-root.sh is guaranteed to run before any of the tests
- Give all tests their unique /etc, /tmp, and /run inside the chroot.
Turns out tmpfs+overlayfs can be used unprivileged inside an unshare
- A static BusyBox binary with support for mount helpers so we can
do the mkdir magic in skel/etc/fstab for the /etc overlay
The last item turned out to be a bit of a roller coaster ride of its
own. First of all, the original binary we used was from the upstream
BusyBox project[1]. I was sure it couldn't be that hard to enable the
CONFIG_FEATURE_MOUNT_HELPERS ... oh boy was I wrong. To make long and
tedious story short; two new projects on GitHub were created for this
task: 1) troglobit/misc[2] to house a mirror of https://musl.cc
toolchains and 2) troglobit/busybox-builder[3] to download, patch, and
build the thing using a .config from the myLinux[4] project. Patching
this .config was necessary, however, since musl libc is strict POSIX
and does not have any of the BSD extensions, e.g. REG_STARTEND that is
in GLIBC regex(3).
[1]: https://busybox.net/downloads/binaries/1.31.0-defconfig-multiarch-musl/
[2]: https://github.com/troglobit/misc/releases/tag/11-20211120
[3]: https://github.com/troglobit/busybox-builder/releases/tag/1_35_0
[4]: https://github.com/troglobit/myLinux
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This delays the start of the .conf monitor and service initialization
slightly to allow the event loop to run earlier to process any events
from the initial setup.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch renames the internal states for run/task/services to avoid
any confusion with the introduction of 'ready:scripts'.
* WAITING -> PAUSED
* READY -> WAITING
A service condition that used, e.g., <service/foo/ready> should now
instead use <service/foo/waiting>.
Note: A new condition with the old name <service/foo/ready> will be
introduced shortly to signify service "readiness", a concept
used in other PID 1, like systemd and s6.
For details, see issue #299.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In Finit a daemon can signal its readiness by creating/touching its PID
file. An ancient UNIX concept -- a daemon creates its PID file when it
has set up signal handlers and is ready to receive IPC (signals), right
before entering its while(1) loop.
Finit took the concept a bit further, adding readiness signalling also
to daemon's by touching their PID file after having processed a SIGHUP.
For both these conditions Finit now supports a ready:script, called when
readiness is detected. In later commits support for s6 and systemd
style readiness notification will be added that will hook the mechanism
implemented in this commit as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This support API is for running things like pre:script, post:script and
the upcoming ready:script for services. A ready:script will be called
when a service notifies Finit of its readyness.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds the mdevd[1] plugin from Andy's fork of Finit, only
minor whitespace adjustment and group fix introduced, along with
updates to configure.ac and the documentation.
Currently the hotplug.sh calls mdevd-coldplug (instad of mdev -s), but
since mdevd is not guaranteed to have started and be ready, it is also
started with mdevd -C. A better solution is to use the s6 notify code
to synchronize the start of mdevd-coldplug. Support for this is coming
soon to Finit.
[1]: https://github.com/hongkongkiwi/finit/blob/master/plugins/mdevd.c
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Service/task/run are today identified by name:id this means the path to
a command is not necessarily the basis for the identity. Hence, an
svc_t can now be updated with new the correct path to a command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As a real life example, this can be useful for a mfgtest mode for the
device, wherein the bootloader can be set to finit.cond=test_mode or
finit.cond=user_mode and then specific services can start up in test
mode which wouldn't normally start.
Or even custom firmware update mode such as finit.cond=fw_update_mode
which performs some specific firmware update steps and doesn't launch
normal processes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In fbcd7d2 and 96257cc the state machine transitions were changed to
ensure that pre:scripts only run when conditions have been asserted, and
that manual:yes run/tasks end properly in 'DONE' as their siblilngs.
Also include SVG in repo for reference since that's the best export from
the original at draw.io
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a follow-up to #274, in which Andy pointed out that ending up in
state 'stopped' was a bit confusing for manual:yes run/tasks.
With the following change we let all run/tasks end in state 'done', yet
still allow manual:yes ones to transition to 'ready' when the user calls
`initctl start foo`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The whole point of pre: scripts is that they run just before the actual
run/task/service process, hence they need to be locked behind the same
conditions as the process. Otherwise pre: scripts would be nothing more
than plain tasks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As it turns out, not all buses in Linux will add `modalias` attributes
to their devices in sysfs. One notable exception are MDIO buses. The
plugin's scan routine would thus not pick them up.
Fortunately, the information is always available in the device's
`uevent` attribute.
Therefore, default to looking for modaliases in the device's `uevent`
attribute instead, falling back to `modalias` only if `uevent` is not
availble (this should never happen).
Since the modprobe plugin (unsurpricingly) may cause new modules to be
loaded, it makes sense to to delay the initial device node scan until
we know that no mode nodes will show up within the next few
microseconds.
This is a fix to a regression introduced in e51587c. The idea is to
have 'initctl status foo' show all instances of foo, provided there are
more than one. E.g.
root@anarchy:~# initctl -t status foo
0 foo:1 stopped [--234-----] hej knekt
0 foo:2 stopped [--234-----] hej snigel
0 foo:3 stopped [--234-----] hej kalas
And not foobar:
0 foo:1 stopped [--234-----] hej knekt
0 foo:2 stopped [--234-----] hej snigel
0 foo:3 stopped [--234-----] hej kalas
0 foobar stopped [--234-----] hej foobar
If you type an exact match you can drill down like so:
root@anarchy:~# initctl status foo:1
Status : stopped (code=exited, status=0/SUCCESS, manual=yes)
Identity : foo:1
Description : hej knekt
...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this change only service stanzas respected the manual:yes
option, now it (should) work on any svc_t type. Not tested on ttys.
The initctl tool has been given an extra manual=yes output for these
types of run/task/service entries, shown only when the manual option
is set.
Example:
root@anarchy:~# initctl status foo.sh
Status : stopped (code=exited, status=0/SUCCESS, manual=yes)
Identity : foo.sh ~~~~~~~~~~~~
Description : Hej foo
Origin : /etc/finit.d/enabled/foo.conf
Environment :
Condition(s):
Command : /root/foo.sh
PID file : none
PID : 0
User : root
Group : root
Uptime : N/A
Starts : 1
Restarts : 0 (0/10)
Runlevels : [--2345----]
Notice also the new `Starts : 1` which is a counter for the number of
starts in the current runlevel. On runlevel change it is reset to 0.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Prefix plugin defines with DBUS_ to allow overriding at build-time
- Create missing directories for modern d-bus
Signed-off-by: Andy Savage <andy@savage.hk>
This change makes it possible tell the bundled/built-in getty to call
/bin/login with the '-p' flag, to preserve any environment set in the
Finit .conf files.
Issue #286
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Allow filtering of conditions in raw dump, i.e., the possibility to show
only conditions of a certain type. The TYPE argument is not validated
in any way, so any prefix match is allowed, e.g.
initctl cond dump service/s
Shows all conditions for services starting with 's'.
Fixes issue #272
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When adding a new service option recently, I copy-pasted and forgot to
update the length argument to strncasecmp(), so it was time to fix that
once and for all.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change allows endless restarts, similar to `respawn` but honors
`restart_sec`. There is no upper limit on the number of times Finit
tries to restart a crashing service. Same as `restart:-1`
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This seemed odd at first, but it turns out we seem to have adjusted the
time scale for the bootstrap worker, so we were off by ... a factor 10.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Move the stop+start from initctl to the state machine by allowing
stopped tasks to restart once it has been collected. This should
prevent finit from blocking, allowing it to handle other requests
while waiting for the service's PID to be collected.
Effectively, this will allow a service to call initctl to restart
itself, as reported in issue #280.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change diversifies the exit codes used by initctl on fatal errors.
Previously only Std C codes 0 and 1 were used, with the initctl specific
255 for some cases.
Both the LSB init script codes and BSD sysexits.h codes are used. See
util.c exitcodes[] for the full list. The idea is to complement the
change in 9a76f08, issue #266, so that initctl can be used silently for
scripting purposes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch introduces ERR(), ERRX(), WARN(), and WARNX() as replacements
to their lower case counterparts. These log macros respect the 'quiet'
flag to initctl, leaving only the return code as indicator to user.
Fixes#266
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No need for the verbose output on error, simply state the cause of the
problem. The user can issue `initctl -h` to check the syntax of the
command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Drop `| tail -10` from 'log foo' command. Let user call tail themselves
and only limit with tail on status command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Grep in /var/log/syslog, or messages, for both the service identity (not
just svc->cmd) and also try to find [PID] for more relevant information.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop basename() of svc->cmd from remaining code
- Replace uses of svc->cmd with svc_ident(svc)
- Use svc_ident() as default log tag
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
What a ride, apparently we support restarting run/tasks in the same
runlevel they have already started once in. Still unsure if adding
support for reloading a particular Finit .conf file for a service
should be in the context of this command (it isn't now). Maybe it
is better left as a future expansion when we switch to the new .conf
format?
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A user with no cgroup support in kernel does not know what they are
missing, and a user running in a container has someone else managing
cgroups.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a plugin that will allow the user to trigger the execution of
scripts from plugin hook points. This is particularly useful for early
boot debugging that needs to take place before regular services are
available.
For example, let's say that you want to enable some kernel tracing
before modules are loaded. With hook-scripts, you can just drop in a
shell script in /libexec/finit/hook/mount/all/ that will poke the
right control files in tracefs.
Init script return pretty quickly after launch, so we cannot use that to
detect if they, or the daemon they launched, have crashed. So we start
the service_retry() with a 2 sec delay, which should be ample time to
allow the pidfile plugin to detect a forking service's new PID.
In release-cycle regression, no public issue needed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In some conditions, typically when the same command is used for multiple
services, e.g. the modules-load plugin, the svc_find() function returned
an existing "similar" entry instead of NULL, causing loss of config.
When creating, and searching for, a run/task/service we must follow the
new name:id paradigm to the letter. Always create based on name:id and
always search for matching name:id. The name may be derived from the
command, but they cannot be used interchangably.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change makes it possible to see the new service's resulting name
and id before we create it with svc_new(). We extend the debug output
slightly to see what's going on and why we sometimes lose modules from
the modules-load plugin ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For many usecases, e.g. the modules-load plugin, the same command can be
used to create multple run/task/services makeing it real difficult to
debug such systems when Finit does not show the correct task name. It
also hides nasty bugs, as will be shown in a later commit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for a `set` directive in the modules-load plugin.
Currently only `set noindex` and `set index = NUM` are supported and
either disable indexing (:ID) of modules, or reset the index to NUM,
for the given file. For each new file read the index is reset to
the value it would have had. E.g.
01-foo.conf: => name:id
esp4.ko => modprobe.esp4.ko:1
set noindex
deflate.ko => modprobe.deflate.ko
02-bar.conf:
nls_iso8859-15.ko => modprobe.nls_iso8859-15.ko:3
nls_utf8.ko => modprobe.nls_utf8.ko:4
Fixes issue #257
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Drop the config.h include from helpers.h after a report from a colleague
trying to build an external plugin from the latest GIT sources.
Instead, make sure config.h is included, and properly commented, in all
.c files that have configure #ifdefs and other deps. Also, move more
ot the includes from helpers.h to their respective .c file instead to
reduce the amount of headers an external plugin pulls in.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The bundled sulogin could be considered insecure, so leave it up to the
administrator, or system integrator, to decide which sulogin(8) is best
suited.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Finit can now track and set environment variables from finit.conf. The
syntax is pretty much what you'd expect:
foo=bar
baz="qux"
On reload of .conf files, all tracked environment variables are cleared
so if `foo=bar` is removed from finit.conf, or any finit.d/*.conf file,
it will no longer be used by Finit or any new (!) started run/tasks or
services.
The only variables reset to sane defaults on .conf reload are:
PATH=_PATH_STDPATH
SHELL=_PATH_BSHELL
LOGNAME=root
USER=root
It is entirely possible to override these as well from the .conf files,
but be careful. Changing SHELL changes the behavior of system() and a
lot of other commands as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When iterating over the system fstab file to call fsck, Finit calls the
helper function ismnt(), which opens /proc/mounts to make sure mounted
file systems are not fsck'ed. Both the main function and ismnt() used
the same non-reentrant getmntent() API which caused ismnt() to set the
fstab pointer for the first out of whack.
This change replaces getmntent() in the two critical functions with the
getmntent_r() API instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some systems have /dev/root declared in their /etc/fastb as /. This is
as special device node created by the kernel based on the root=, and a
few other variables. This may be a symlink, and if so, and on a mdev
system, the symlink may point to the wrong device node ... so we must
try to figure out the major:minor from / and then traverse /sys/block
to find our root device.
Note: this commit also does a bit of refactoring for readability and
also adds a few debug lines that may be dropped before release.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A subtle regression was introduced in 5593372f, when moving to get
getmntent() family of APIs. Finding the 'ro' flag (or not) in the
system fstab broke and Finit never tried to remount / read-write.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change basically add this for pre/post scripts:
sh -ac '. /path/to/env; exec ./pre-post.sh'
Meaning the env file can be a simple foo=bar file, which Finit reads and
call setenv() on all variables, and the user do not need to call export
on all variables -- additionally, any functions defined in an env file
can be used by the pre-post scripts, but are ignored by Finit. I.e.,
the service only gets the variables set, no functions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The swapon and swapoff commands do not support a custom fstab, they
assume /etc/fstab is the only true source of swap devices and files.
This change adds rudimentary (!) support for figuring out any swap
device or file to use from any finit.fstab. Please note, options are
not supported at the moment.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since a forking service, e.g. a sysv init script, will exit very early
we cannot log the same as for regular services "Starting foo[123]", so
instead we log "Started bar[321]" when we get the pidfile update and
the same when stopping a forking service, log "Stopped bar[321]" when
we collect the PID.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds the following service conditions, which can be used to
synchronize other stanzas:
- service/foo/running
- service/foo/halted
- service/foo/missing
- service/foo/crashed
- service/foo/stopped
- service/foo/busy
- service/foo/restart
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit c63279630b which
clearly was not needed to fix the problem. After this revert the
test(s) still pass, but now we can also start bridge-stp, e.g.
bridge-stp br0 start
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Default debug level for the netlink plugin is just too noisy. Let's
drop debug messages (mostly) intended for developers.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When logged in from sulogin we cannot send IPC to Finit, not even
signals, to delegate reboot. For usability, attempt to tell reboot that
it's in sulogin mode -- provided the bundled sulogin is used -- to let
reboot trigger over to forced reboot.
We cannot do much about initctl, just document this as a limitation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This lets any callers of client_connect() decide what to do wrt. error
recovery and fallback mechanisms. E.g., reboot may want to check if
it's in sulogin mode, or fall back to sending signals to PID 1.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for bringing up the system with an alternate fstab at
boot. E.g., when using a primary/secondary setup for boot partitions.
By default /etc/fstab is read, like before, this can now be changed
using configure --with-fstab=/path/to/fstab.primary, which sets the
default that can be overridden using finit.fstab=/etc/fstab.secondary
If mounting, or fsck, fails in any way, Finit calls its own bundled
sulogin, or the system sulogin(8), to let the user handle the issue.
If there is no sulogin available, Finit will try to start up in its
rescue.conf boot mode.
Please note, in either of these rescue modes, use `reboot -f` to get the
system to reboot. Finit is on pause in the background in rescue mode
and cannot be relied on (since there may not be any writable filesystems
available.).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The iterator works on any fstab like file, but to keep confusion to a
minimum, rename local variable.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The setfsent() family of APIs was never standardized and on Linux only
GLIBC implement them. We've tried to overcome this limitation, and to
support uClibc/uClibc-ng and musl libc, by providing replacements APIs
in helpers.c.
However, and since we want to support alternative /etc/fstab files, the
setmntent() family of APIs is more widespread and supports reading from
any fstab or mtab file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling `initctl debug` is supposed to toggle Finit debug messages on
the boot console. This broke in ae09272b when improving support for
running Finit in containers.
Part of this change is a slight refactor of who calles log_init() when
starting up, and when to call ttinit(). We now call ttinit() every time
we toggle debug.
Also, toggling back to normal logging had a bug. The new default log
level for Finit is LOG_INFO, but toggling back set it to LOG_NOTICE.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Usability.
Remains backwards compatible for now, but finit.show_status is as of 4.3
deprecated. Likely to be removed int 5.0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Explicitly set arg to non-NULL value. The call to conf() later will
steer up the value to point to the full path of the user's finit.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When we added support for using popen() to run(), to log the output, we
forgot to update the error handling path. Found by Coverity Scan.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We don't want repeats of issue #236, so let's start by tracking down any
bugs hidden in logging functions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On regular desktop systems, like Debian, the dbus-daemon forks off a
dbus-launch process to start up things like your desktop for you. This
process is not known to Finit and lingers in the background since it's
been reparented to init, and to top things off it seems to ignore any
SIGTERMs send to it.
Obviously this makes a shutdown on such systems very noisy, so this
patch changes the print() to a _d() so anyone debugging a system can see
it with `-- finit.debug` on the kernel command line, or `initctl debug`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This split unmount is a bit crude, unfortunately. A user may have set
up a bind or overlayfs mount on top of a tmpfs -- so unmounting tmpfs
first will then always result in EBUSY.
Avoid logging busy errors and fake OK. We'll catch it later in the
second stage unmount.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Turns out that on Debian `ifdown -a` can block for quite a while at
shutdown/reboot. So we'd like to use the --force option. However,
the BusyBox ifdown tool doesn't support --force, only -f, which in
turn the regular ifdown tool doesn't support.
Regardless, we can allow network shutdown to run in the background
like bring-up, at reboot we want to reboot quickly and don't care
so much, and on runlevel change to single-user mode we can allow
for some lagging behind in the background.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Mention why configure script is missing from GIT
- Adjust command line for enabling Finit debug
- Plus some minor formatting issues
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Useful to debug system events after the system has started up and you
don't want to rebuild Finit to add the `-d` command line flag.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is needed since 5ff27c4f when support for debugging Finit and the
kernel independently was added.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A forking service, e.g. a SysV init script, that returns is no longer
running, even though the monitored service may still be starting. We
must mark the svc->pid as terminated until we know more -- otherwise
we may stall on a shutdown at that exact point.
Also, when shutting down, and stopping all services, ensure we do not
start the carousel for non-existing PIDs. This might also cause our
stalling at shutdown.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having to create files, and copying them in place for each
test, we move all static test files to a skeleton rootfs. This makes
it a lot easier to get an overview of how things and how they work.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note: we need to add /usr/bin and /usr/sbin to the standard PATH
for tests and the test environment itself.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In https://github.com/actions/virtual-environments/commit/12fa229 the
ubuntu-latest runner was updated to Ubuntu 20.04.4, with Linux kernel
version: 5.13.0-1014-azure. This broke the Finit tests completely
and the only possible solution, for now, seems to be reverting back
to the ubuntu-18.04 runner instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In an upside world, much like the Finit test cases, the root may be
relocated. This make /var/run relative to /var, instead of /. Which
hopefully is safer and covers more use-cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All tests except the first two now suddenly started failing. Might be
the new caching support for the busybox binary, but that works on other
clean clones -- working theory now is that there's something subtle
with the setup-root.sh test -- which PASSes ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add `type:forking` service option to trigger guessing pidfile to
watch for, instead of `pid:!foo` option, which is not intuitive.
This option may likely also survive into the new file format :)
- Update docs and add examples
- Update start-stop-serv.sh test case with this new variant
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before this fix, a service declared with respawn could not be changed at
runtime to remove the respawn flag.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While without a working Internet connection today I ran into the issue
of not being able to run the tests. This adds a basic caching mechanism
to setup-root.sh which saves busybox-x86_64 in ~/.cache, if available.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
serv: add support for foregrounding, running with and without PID file,
including custom PID filename.
test: verify Finit can start & monitor services that:
1) Fork and creates a PID file in a known location
2) Don't fork and don't create a PID file, but Finit does
3) Don't fork but create a PID file
4) Don't fork and create custom named PID file
Note: Finit cannot support a service that forks and doesn't create a PID
file. This combination is impossible to support without tracking
all processes created in /proc -- which Finit does not do atm.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling sync is not needed, remount does this for us.
Remount with 'dummydev' causes warnings and is not needed. It appears
sysvinit used this to try and fix a sparc related bug. Instead, use the
rootfs keyword to ensure we don't accidentally remount a bind mounted /.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Coding style for shell scripts:
- Tabs for indent (change in Emacs needed)
- Braces on their own line, like C functions
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No point waiting for SysV start/stop scripts to finish, PID 1 should not
risk getting blocked forever by broken scripts. Instead we fork them off
and forget about them until they terminate. If they are buggy and don't
finish, it's the problem of the admin.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
I'll have to ask Jacques what this was for, because it doesn't seem to
be needed to run and monitor the test. Also, it lingers at shutdown,
causing some unintended side effects in Finit.
Commenting out for now, as a reminder to myself.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a SysV init script starts a daemon, Finit knows nothing of the PID
it should monitor. The PID is written, by start-stop-daemon or the
daemon itself, to the PID file. Finit monitors for new PID files and
can match the PID in such files with an svc_t.
For the regular use-case, we prefer first looking up the matching svc_t
based on the PID -- assuming we start and monitor the service. As a
fallback we resort to mathching the svc_t's declared PID file with the
new file we just discovered.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We want to find the PID of the daemon the init script starts, so we need
a way to declare this to Finit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
SysV init scripts should not go to "done" state but "halted" so we can
do: `initctl stop foo; initctl start foo`, like we do for our regular
monitored services.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Install start-stop-daemon in test root. Add S01-service.sh, which uses
start-stop-daemon to start service.sh. Modify service.sh to respect
signals, and not exit immediately when sleep exits due to SIGTERM.
Remove PID file in signal callback and make sure to exit OK
The test itself is basically a copy of the start-stop-service.sh test.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The slay script checks for common errors and gives some logs and status
of Finit when something goes wrong. Helps detect issue #226 when the
start-kill-service.sh test runs at 100000 laps.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When running in a container we still want to use any syslog daemon
available for our logging needs. However, the time between the first
logit() in Finit and any such daemon having started can be long. In a
normal (non-containerized) setup we log to the kernel ring buffer, but
that's not available in a container scenario. At least not for
unprivileged containers. So we need to detect all these cases and be
prepared to fall back to log to the console, either using these LOG_CONS
flag to openlog(), or by simply calling vfprintf() to stderr.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This trick can also be used by others who want to run Finit in an
unshare. Set the container environment variable to 'unshare',
like lxc and docker do for their products.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Turns out the kill(2) syscall returns ENOENT, not ESRCH, in our test
suite. Don't know why, the man page never mentions ENOENT, only the
ESRCH code. Let's check for both, either way ithe PID is not there.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A service may have unexpectedly died, and we never got the signal, so
when stopping services we must set the new state after we've tried to
stop the service. Otherwise the svc_set_state() function starts a
background timer for the SIGKILL job, which may block a reboot.
The kill() syscall tells us if the service was there or not, if not we
must clean up and go to HALTED state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
At startup (and reconf) of systems with lots of services there is a risk
of losing inotify events, e.g., PID file creation/delete events. This
patch increase the receive buffer (doubles it).
On Linux the getsockopt() for SO_RCVBUF returns double the set size, due
to housekeeping in the kernel. So we don't have to do any adjustments
when setting it.
Issue #226
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In some (error) cases the PID known to Finit may no longer exist, or may
not have been added to a cgroup (yet). Handle this case by skipping the
output of cgroup info in such conditions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On, e.g., a container based system logs may not be available so check
also that the messages fallback exists instead of causing confusing
error in the status output for the service.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To silence warnings at startup/shutdown, check for existance of swapon
and swapoff before calling them.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a run task is started with svc->started = 1, it should be
considered started successfully or failed on the other hand.
Signed-off-by: Sergio Morlans <sergio.morlans@atlascopco.com>
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
This patch adds support for optional logging of output from all run()
commands. For run_interactive() we've opted to log instead of just
redirect, meaning output on error is till on console but also in log.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We've been discussing, over the years, that we'd like to have an easier
way to debug bringup with Finit. Network bringup is one such case where
it's hard to debug if/what you've misspelled in /etc/network/interfaces
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes a seemingly long-running bug; we only brought down networking
in shutdown/halt and for runlevel 1, single-user mode -- not reboot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In commit f0f358a13:
[ service.c: set/clear condition 'done' for run tasks ]
a runtask done condition would be set/cleared when entering DONE/HALTED
states, but it did not cover all the user cases, for instance, sometimes
an end user may want to know if a runtask has finished sucessfully or
to decide what to do on its failures.
So we now change the conditions to: tsktype/tskname/success and
tsktype/tskname/failure.
And this change not only applies to run/task types, but also applies to
sysv type, in case it fails, a sysv/tskname/failure condition would be
set.
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Refactor new kill/shutdown implementation from 3e0063e to fix the
regression in compiler output:
sig.c: In function ‘kill_callback’:
sig.c:222:12: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
222 | kill(pid, (int)context);
| ^
Also, some minor renames and simplificactions to match project style.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Check all pointers
- Declaratons always at top of func/scope
- Use established variable nomenclature
- Skip useless if() stmt
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Comments preferably at beginning of func/sect
- Reorder code slightly, add whitespace for readability
- Drop useless comment
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit implements a test for the signal feature of initctl. The
existing service used in tests (`common/service.sh`) has been extended
with a signal trap handler. When SIGUSR1 is received, it will write the
string `'USR1'` to `/tmp/usr1.log`. The test will run `initctl signal
service.sh SIGUSR1` and assert that the contents of the file
`/tmp/usr1.log` really is `USR1`.
The implementation looks up the named service by using
`svc_parse_jobstr`. The callbacks for `svc_parse_jobstr` has been
augmented to accept a user data parameter. For this use case,
a carrier for the actual signal was needed. The address of the
signal parameter is taken and passed on as a `void *`. The
callback then simply deferences it as an int - the signal number.
In the test framework for finit, a set of shell scripts are used to
setup a test harness, run tests, and finalize tests. In the setup, a
file system is created for the virtualized/containerized environment in
which all tests are run, located at `$FINIT_SRC/test/tenv-root`. In the
tear down phase of each test, the file `/var/lock` is made readable
using `chmod +r`. It is not clear _why_ the teardown code does this, as
there are no references in the test framework to this path anywhere
else. It is conceivable that the teardown phase attempted to "reset the
state" for next test.
The code that that this commit removes does not always work. When
`/var/lock` is a symlink, and resolves to an absolute path, the test
framework does not function properly. The teardown code is run in the
context of the host computer, and touching files outside of the
virtualized environment is not ok.
The removal of the offending code does not seem to affect tests: all
tests pass without it, so its existence is questionable.
Signed-off-by: Jörgen Sigvardsson <jorgen.sigvardsson@gmail.com>
Blocking SIGTERM means Finit will wait another two seconds before it
sends SIGKILL, which casues a delayed [WARN] Killing ... before we can
proceed to shutdown/reboot -- not OK. Don't know what I was smoking
back in 2017, but it must've been good.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When running in a container we might not have the necessary privileges
to mount cgroups. Don't cause error in this case, just log it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows disabling (enabled by default) the modprobe and tty
plugins. They are not particularly useful in container use-cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We extend the service.sh to emulate a well behaving service that creates
and removes its own PID file.
The new test emulates a crash by sending SIGKILL to service.sh. We then
verify that Finit restarts it, and eventually registers the new PID when
the services recreates the PID file.
Issue #226
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- We need a working /var and /run for some features, e.g. PID
monitoring and status files for urandom.so
- Add empty fstab to silence mount errors from finit
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A regression was introduced by commit f0f358a1:
[ service.c: set/clear condition 'done' for run tasks ]
svc->type is a integer but mistakenly being used as string, which will
cause crash.
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Instead of unconditionally waiting 2 seconds for processes to die,
check continuously for remaining processes, and break the loop when
none remain.
Turn PID 1 to a RT process with highest priority 99 during shutdown,
this ensures it would not be preempted by other RT processes.
Signed-off-by: Robert Andersson <robert.m.andersson@atlascopco.com>
Signed-off-by: Mathias Thore <mathias.thore@atlascopco.com>
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
We like to know when a runtask (run/task/sysv)is done, so as to start
the services that depending on it, set a oneshot condition 'done' for
that case and clear it when runtask services enter HALTED state.
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
It should not use relaxed comparison in some places, otherwise it mess
up with scenarios like:
```
$ initctl status ntpdpre
$ initctl status ntpd
```
the output might be same for both of the above commands without this
fix.
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
This patch adds the -v,--version option to initctl, which acts as an
alias to the 'version' command. For now they end up in the same old
function, printing the program version. However, in time this will be
changed so that the 'version' command asks a running Finit for its
version instead of assuming the daemon is of the same version.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A 'module foo args ...' line in finit.conf can be looooooong. This
patch drops the module args from the progress output for brevity.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the introduction of GLIBC v2.34, all 32-bit devices running Linux
get the option of having a 64-bit time_t to survice the UNIX 2038
apocalypse.
Support for 64-bit time_t was added to libuev in v2.4.0. The build
flags for linking against libuev are defined in the library's .pc
files, which basically gives you -D_TIME_BITS=64 for your CPPFLAGS.
However, it turns out the $(uev_CFLAGS) from pkg-config were only used
when building the main finit binary -- not for the plugins, causing
some really wacky behavior as a result. All plugins and Finit itself
had some very different opinions on what `struct plugin` looked like,
including offsets and size. This led to all I/O plugins initializing
their sockets at the wrong offset -- little-endian 32-bit targets set
the HOOK_SHUTDOWN callback hook to address 0x1 -- which the reboot
code then tried to execute, of course leading to a segfault.
This is quite possibly the root cause of issue #216
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Previous patches only checked if cgroups v2 support was available in
the kernel. If mounting failed cgroups support was disabled.
However, much of the core logic to cgroups in Finit revolve around the
CPU controller. This patch adds checks to ensure that the kernel has
basic controller support as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch prevents bogus error messages from Finit for when
directories or symlinks already exist.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Traditionally we've reset the service restart counter on two occasions:
1) when a service reaches its max crash count (default 10), and
2) when a service somehow "stabilizes"
In the second case the service is restored to normal running state and
we "forget" its bad previous behavior. Meaning we cannot catch daemons
that act in an unstable manner outside the "rage quit" scenario.
This patch allows for slowing aging (decrementing) the restart counter
once every five minutes. Meaning we still catch rage quitters but now
are also able catch other types of misbehavior.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a recent feature request to keep track of the total
number of restarts (including crashes and initctl restart) of both
service and sysv daemons.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Clearing of the svc->pidfile was introduced in e1b87d70 for a
restriction that has now been removed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for detecting if the Linux kernel Fint runs on
has support for cgroups v2. The probe is done very early, in runlevel
S, when attempting to mount /sys/fs/cgroup. Meaning, the log message
may be lost on systems that do not run sysklogd[1].
Here's the relevant logs from a system running myLinux on a kernel
that has cgroups v2 support disabled:
Jan 10 20:19:40 anarchy finit[1]: myLinux 2021.11-696-g8fddaf36ed, entering runlevel S
Jan 10 20:19:40 anarchy finit[1]: Kernel does not support cgroups v2, disabling.
Jan 10 20:19:41 anarchy finit[1]: myLinux 2021.11-696-g8fddaf36ed, entering runlevel 2
All code paths that attempt to set or query kernel cgroups config has
been short circuited when this happens. However, this does not apply
to any cgroup related config in the Finit .conf files -- which may of
course be omitted. Yet, if configuration directives exist, they will
be parsed and may cause error.
Also, the initctl tool checks if /sys/fs/cgroup is mounted at runtime
and disables all status output and commands that rely on the feature.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
initctl cannot link with helpers.c, so let's relocate these helper
functions to util.c instead. Need them to probe for cgroup support.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A timeout is not the same as a restart delay, which this option really
controls, but the name restart_delay is a bit too long. Hence, this
obvious name so there's no ambiguity what unit we're dealing with.
Keeping restarttmo:SEC as a compatibility setting for the benefit of
the original authors, for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Minor coding style cleanup. Also, clang complained of a signed vs
unsigned comparison in service_retry(), max(timeout, svc->restart_tmo)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As suggested in issue #197, this new command: 'initctl id [NAME]'
lists identities of all, or named, services. E.g,
# initctl id telnetd
telnetd:23
telnetd:2323
The NAME argument is optional, when omitted it lists all enabled
run/task/sysv/service in the system, with their full name, and any
optional identitty. E.g.
# initctl id
dropbear
tty:console
mdnsd
mini-snmpd
smcrouted
sntpd
ssdpd
sysklogd
watchdogd
httpd
telnetd:23
telnetd:2323
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When the system has multiple services 'foo' the initctl command
'status foo' should give a focused overview of all matching foo:*,
whereas a 'status foo:2' should show the detailed view of that
particular instance.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since Finit v4.0 kernel console output has been silenced just prior to
the banner being printed, unless finit.debug mode was enabled. This
patch makes sure to check the kernel loglevel, if it's >= 7, finit no
longer disables kernel console ouput.
Consequently, you now need 'quiet' on your kernel command line, or a
loglevel < 7 for a quiet boot, at least until a syslogd takes over.
This means that you now can debug the kernel and finit independently,
which should be a great comfort to anyone doing bringup or any form of
kernel debugging.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch switches from "cp /var/lib/misc/random-seed /dev/urandom"
to use the kernel RNDADDENTROPY ioctl, which actually increments the
entropy count.
Also, the amount of random data saved at reboot is increased from the
fairly low 512 to 32768 bytes.
All in all, this should greatly improve the stability of most systems
during, or close to, bootstrap. In particular embedded systems with
limited or no HWRNG.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we just want to clear the complete line, and are already a the
beginning of the line, we can use the simpler \e[K which also seems
to fix the display resize bug in #210.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to an unfortunate name clash with the DirectFB project LiTE, the
libite (-lite) project had to change its header namespace from
lite/*.h -> libite/*.h
This patch adds support for the new namepace in Finit, triggered by the
define _LIBITE_LITE, from the .pc file read by pkg-config. This should
only be needed on systems that install libite without the compatibility
symlink lite -> libite/ in the staging include directory.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
It would be good if we can control the services more specifically with
the following parameters like:
restart:N - how many times shall the service to be restarted on
failures (<10), the default max is 10.
restart_tmo - the timeout of the restarting.
norestart - dont restart on failures.
oncrash - once all retrying also fail, how to deal with it,
rebooting or ignoring the failures.
Signed-off-by: Robert Andersson <robert.m.andersson@atlascopco.com>
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Both DBUS user and pidfile is configurable in DBUS compilation, by
passing "--with-dbus-user=" and "--with-system-pid-file=", let's avoid
hard-coding them here, use macros instead.
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
It's configurable in /etc/login.defs as NOLOGINS_FILE, avoid to hard
coding it here, introduce a macro FINIT_NOLOGIN_PATH instead which is
configurable from compiler flags, it's not defined, then back to
_PATH_NOLOGIN from /usr/include/paths.h.
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
fastboot: once enabled, fsck would be skipped on filesystems listed in
/etc/fstab.
fsckfix: once enabled, 'fsck -ys' would be run instead of 'fsck -a',
and check the return value larger than 1 as a failure and goes
to login console.
They are both disabled by default, no functional changes unless an end
user choose to enable them.
The idea derives from Sysvinit's "FASTBOOT" and "FSCKFIX".
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
The iterator function getmntent() is not stable. It may skip
entries if the contents of the iterated file changes, which
is the case with /proc/mounts when filesystems are unmounted.
As a result, some filesystems were never unmounted.
To fix this, iteratation is now restarted after every
sucessful unmount.
Signed-off-by: Robert Andersson <robert.m.andersson@atlascopco.com>
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
"protected" is a C++ key word, replace it with "is_protected" avoid
compiling failures with C++ compiler.
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
There are small typos in:
- doc/conditions.md
- src/mount.c
- src/svc.h
Fixes:
- Should read `satisfied` rather than `satsifed`.
- Should read `process` rather than `prorcess`.
- Should read `measure` rather than `meausre`.
We've had several logit() messages of LOG_INFO level that never
really made it to syslog because we classified it as "debug".
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds "the missing" first runlevel log entry when Finit has
printed the console banner and begins its bootstrap phase.
At this point we know syslogd hasn't been started yet, so we rely on
logit() to redirect this to /dev/kmsg in the meantime. Later syslogd
will pick this up, see that it's not from the kernel, and log it to
the proper log file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If any of these mount() calls fail, not counting EBUSY because that
would mean sth is already mounted, there really isn't much we can do.
So the least we should do is warn on console if it happens.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note, this is dead code, currently unsused in Finit. Possibly an
external plugin makes use of it, but even that is highly unlikely.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
I'm writing this in X started on a system running Finit v4.1-pre that
does not have elogind installed. It does, however, still have systemd
installed, so systemd-logind is available.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Fix bug when calling sys_update_conds() when dir already exists
and we're not being called from the scandir() handler. I.e.,
every time but the first for each new condition sub-family
- Drop sys conditions that don't affect any svc_t. This may seem
counterintuitive, and we should probably not use oneshot conds,
but if we leave these conds asserted they may cause inadvertent
trigger if a finit.conf is loaded which ha this sys cond. E.g.,
if ctrlaltdel is asserted and we enable a task in finit.conf and
call `initctl reload`, the task would start immediately, even
though ctrl-alt-del may have been pressed a week ago
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch removes the cognitive overhead of having to manually set your
OS heading, --with-heading="Foo OS vX.YY". As of this patch, Finit by
default extracts PRETTY_NAME from /etc/os-release. It is now possible
to also disable the heading entirely using --without-heading
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Shouldn't be needed for real cases, but we have seen automated scripts send
'\n' instead of '\r', or '\r' + '\n'.
Signed-off-by: Jacques de Laval <Jacques.De.Laval@westermo.com>
Similar to 6224166 (previous commit), this old code is a remnant of a
bygone era and not needed anymore.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Once upon a time, SIGSTOP was used to pause Finit during flashing (MTD)
of a system image. This to prevent Finit from accidentally starting any
programs, i.e., reading from flash disk during or after upgrade.
This was quite intrusive, and has possible nasty side effects, e.g., any
process with root access sends SIGSTOP prevents TTY login. So this patch
now removes the functionality and recommends using a dedcicated runlevel
for such critical tasks instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a service is started and then stopped before it has created it's pid file,
it could be left forever in the "stopping" state, if we don't reset the
starting flag.
Signed-off-by: Jacques de Laval <Jacques.De.Laval@westermo.com>
The waitpid() function can return -1 due to EINTR (signal), so we should
restart it to make sure we collect all zombies.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some systems may want to handle RTC and /dev/urandom by themselves, or
not at all as in the case of containers where the host does all this.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For most use-cases the kernel will give Finit its arguments as proper
command line args in argc + argv[], like any other program. However,
for some users, most notably Alpine Linux, there is a slightly broken
initramfs that cannot forward more than one argument using init_args,
for such systems you can re-enable the old behavior with a configure
switch --enable-kernel-cmdline -- it's not ideal but what can you do.
The main reason for removing this feature by default is to support
use-cases where Finit runs as the init for container apps that can read
/proc -- we do not want them to use the init args from the host.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
It has barely worked and only caused more problems than solved annoying
issues. We have one console for output, /dev/console, which the kernel
sets up for us.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, fix default: case in error handling, must always continue back to
poll() on any recv() error.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Progress at startup has been hidden for services w/o -- description, but
for some reason this check was not added to service_stop(). This patch
rectifies the situation, finally.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a `respawn` flag for services and ttys, always set for
ttys, that allows bypassing the crash/restart counter and immediately
restart a 'crashing' service.
For tty type services this is the expected behavior, but for regular
services it is not. That is why `respawn` flags is not advertised in
the docs.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Basic security measure, don't bail to shell if we cannot find/exec
login, instead try sulogin before falling back to plain shell.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
By default, Linux gives us /dev/console for output. This is a pseudo
device that uses the same actual device as the last console=foo listed
in /proc/cmdline. The last one listed is the main console, which is
also the *first* one listed in /sys/class/tty/console/active, so we skip
that when we check for system consoles to avoid duplicating output.
The getty code in tty.c currently has its own handling of @console,
which we keep for now. Ideally, however, the code should be merged.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
By moving the built-in getty to a stand-alone bundled getty we can now
refactor the old run_getty() functions into a single one.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When TTYs became first class citizens in Finit 4.0 much of the
boilerplate setup is now down by service_start(). Also, the calls to
TIOCSCTTY, VINTR, and SIGINT ignore is not necessary to do here, it
should be done by the getty used, if any.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We must detach from the controlling TTY before enabling signals and
setting up new stdio. TTYs have their own handling of stdio.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch moves the built-in getty out of Finit into /libexec/finit/,
reducing the size of the Finit binary and simplifying the code.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When starting a getty Finit checks first that the configured TTY device
actually exists and is a TTY. This patch, by Tobias Waldekranz, ensures
Finit (PID 1) doesn't acquire the TTY device as a controlling TTY. If
that happens PID 1 will get all signals sent to the process actually
started with the device as its controlling TTY.
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When an external getty is used, and an absolute path is not given, the
parser tried to use access() to determine built-in vs external getty.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If we don't extract the level (disregarding facility), statements such as
"logit(LOG_CONSOLE | LOG_NOTICE, ...)" would never reach the kernel log.
Signed-off-by: Jacques de Laval <Jacques.De.Laval@westermo.com>
This patch drops the default signal handlers for SIGPWR and SIGINT with
optional tasks in /etc/finit.conf, triggered by two new conditions:
sys/pwr/fail and sys/key/ctrlaltdel, respectively.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apparently fgetln() is available in musl libc, but not glibc. This is a
funciton that first appeared in 4.4BSD. We take a risk that fgetline()
is free in all libc's, getline() is not.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch is a refactor of the prototype sys condition plugin. It
moves most of the logic to monitor kernel events into a keventd that,
currently only, sets and clears the sys/pwr/ac condition. The sys
plugin itself is now only a monitor of conditions and ensures Finit
follows them. This is a lot more secure and moves (at least one piece
of) netlink processing out from PID 1.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The top-level cgroup init is a leaf group and should be treated as such,
even for user setup tasks/services.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The udevd, dbus, bundled watchdog, and others were started without a
valid cgroup. This is a workaround to ensure they are assigned one.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes a long-standanding issue with finit not controlling the
reboot when the user presses ctrl-alt-delete (PC systems).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch does several things related to /run and system reliability.
- Mount /run with MAX 10% of usable RAM
- Create and mount /run/lock as a separate tmpfs with max 5 MiB
As a spin-off, this patch also fixes permisions on /run/lock to 0777
so regular users can create lock files.
Note: none of this code runs if /run is mounted alread in /etc/fstab
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Handle EAGAIN properly, for both regular and resync flow, on any error
in the regular flow (unless ENOBUFS) we want to check for nl_ifdown on
any of the successfully parsed messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for calling recv() repeatedly to get the netlink
response from the kernel. As a result, the recv() buffer can be reduced
down to 4k again.
Both the regular flow and the resync flow now follow the exact same code
path, except for the ENOBUFS handling. If we get ENOBUFS in resync, we
are screwed anyway.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For RTM_GETLINK we need a `struct ifinfomsg`, not `struct rtmsg`,
otherwise the kernel will get 8 extra bytes and complain about it.
This patch makes sure to set the correct iface change mask as well, and
increases the debug logs a bit to get a fix on sizes used. We increase
the recv() buffer 8k -> 64k to make sure we can get all data in one big
swoop. Plan is to refactor this mess in a later commit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a major redesign of the netlink plugin to be able to handle
ENOBUFS¹ properly. Pending verification, this change replaces the patch
to increase socket buffer size, which in real life turned out to be
insufficient.
When nl_callback() calls recv() and it fails with ENOBUFS, we consider
our cache of the kernel state invalid and thus:
1. deassert all net/ conditions
2. open a new (temporary) netlink socket
3. send RTM_GETLINK and re-assert all interfaces using nl_link()
4. send RTM_GETROUTE and re-assert all routes with nl_route()
Like before, the kernel will not send us a RTM_DELROUTE when it removes
the default route, so we still have to track this ourselves. This patch
also refactors that functionality to only resync routes when the ifindex
associated previosly with the default route goes down or is removed.
The previous change that added nl_default() to recheck, has been dropped
to instead reuse the standard nl_route() callback.
___
¹ see netlink(7) for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch fixes the problem with Linux not sending netlink route change
notifications when interfaces for these routes goes down. When an iface
goes down we now send a route request to the kernel and check the return
message, if no default route is found we deassert net/default/route.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch restores parts of 4febd28, but in a more orderly fashion, in
order to get a standard Debian system to boot properly with X and tools.
The patch adds fs_finalize() which checks if /dev/sh/, /dev/pts, /run,
and /tmp have been mounted properly from /etc/fstab. If not, then the
function makes sure to mount tmfps (or devpts) file systems as expected
by most modern systems.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch changes the behavior of SIGUSR1. Previously USR1 could be
used to halt a running Finit system, similar to BusyBox init. However,
compatibility with sysvinit and systemd has been deemed more important.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Coverity suggests validating against only a set of known characters.
However, the kernel allows just about all characters in an interface
name. This version of valdiate_ifname() is blatantly stolen, more
or less, from linux/net/core/dev.c
https://code.woboq.org/linux/linux/net/core/dev.c.html#1020
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
sulogin should return OK (exit code 0) when the user presses Ctrl-D,
regardless of the prompt shown. Otherwise Finit may look for another
sulogin to run straight after this one.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify build system.
The logit tool is, as of v4.0, installed into /libexec/finit/logit and
thus not part of the system $PATH. If a sysadmin or distro wants to
remove it from the system it's entirely possible since Finit always
checks for logit availability before attempting to use it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before 4e5d06b the only way to go into rescue mode was to skip certain
steps and then attempt to load /lib/finit/rescue.conf. After 4e5d06b
we keep the old handling as a fallback in case early sulogin fails.
The new tty option 'rescue' is added, which recue.conf is updated with.
This option implies notty mode and will try sulogin (again) before it
falls back to start /bin/sh as a login shell.
The reason we keep this is to be able to handle all possible use-cases
and also allow sysadmins to set up the behavior that fits their needs.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch does two things:
1. A system with a root account that has no password is now
allowed to login without password, as one expects.
2. A systems with a locked root account, is treated as (1).
The latter of the two may very well turn out to be a really bad idea.
Much angst have been poured into it, yet the end decision is to allow
access.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Most major init systems have a way to start a rescue shell. This is
usally started when the string `rescue` is read from the kernel's
command line.
The traditional Finit way of handling this has been to skip certain
phases of the standard boot, skip /etc/finit.conf et al, and go for a
/lib/finit/rescue.conf instead. This pratice has been imroved over
the last few commits with a sulogin. However, there was no way to
resume boot, like most other init systems offer.
This patch implements a very simple rescue mode, utilizing the new
sulogin, replacing the old (and experimental) emergency shell. If
Ctrl-D is pressed at the maintenance login prompt the boot is now
resumed. The same goes for exit/Ctrl-D from the maintenace shell.
The preferred sulogin is the bundled /libexec/finit/sulogin, but
if that isn't installed, the first one in $PATH is used. If no
sulogin at all is found, Finit proceeds as before this patch, to
skip certains steps and go for a /lib/finit/rescue.conf. Hence,
al steps can be controlled by an administrator.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- splice out sh() as a separate function
- make sh() session leader and set controlling TTY (TIOCSCTTY)
to make it a proper login shell with Ctrl-C functionality
- simplify call to execl()
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These plugins should not run in rescue mode, because the system may be
in a very bad state and we do not want to make the situation any worse
than it already is.
Essentially, only services in rescue.conf should run in rescue mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Check if watchdogd *and* `WDT_DEVNODE` exists before registering the
built-in watchdogd at boot
- Update bootstrap.md with this additional constraint
- Update config.md with references to bootstrap and the new constraint
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch fixes an issue where services that support SIGHUP are not
properly stop/started on changes to their command line arguments.
A change to a service's env: file, e.g. /etc/default/foo for service
foo, must also be counted as a change to the foo args.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
AC_PLUGIN([netlink], [yes], [Basic netlink plugin for IFUP/IFDN and GW events. Can be replaced with externally built plugin that links with libnl or similar.])
AC_PLUGIN([hotplug], [yes], [Setup and start udev or mdev hotplug daemon])
AC_PLUGIN([hook-scripts], [no], [Trigger script execution from hook points])
AC_PLUGIN([hotplug], [yes], [Start udevd or mdev kernel event datamon])
AC_PLUGIN([rtc], [yes], [Save and restore RTC using hwclock])
AC_PLUGIN([tty], [yes], [Automatically activate new TTYs, e.g. USB-to-serial])
AC_PLUGIN([urandom], [yes], [Setup and save random seed at boot/shutdown])
AC_PLUGIN([testserv], [no], [Test plugin to start test serv daemon])
# Check for extra arguments or packages
AC_ARG_WITH([bash-completion-dir],
AS_HELP_STRING([--with-bash-completion-dir[=PATH]], [Directory to install Bash completion, default: auto]),
AS_HELP_STRING([--with-sulogin@<:@=USER@:>@], [Enable built-in sulogin, optional USER to request password for (default root), default: no.]),[sulogin=$withval],[with_sulogin=no])
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Joachim Wiberg
