Disable the default "podman pull" retry value. We use execd to retry
"podman create" on failure. Wihtout this change, a single container
can block start of other containers by 3 * 20 seconds. Now we only
block max 20 seconds before we try starting the next container.
Modern versions of podman (>= 5.0) have this --retry option, but it
does not have CNI, so this is a temporary workaround.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The LOG_SECURITY facility was set wrong (1 << 13) instead of (13 << 3), see
https://github.com/kernelkit/sysklogd/blob/0fc6656/src/syslog.h#L120 for
details. This caused all audit log messages to be logged in LOG_USER.
Also, rename LOG_SECURITY -> LOG_AUDIT and log macro SECURITY() -> AUDIT()
to match RFC5424 terminology.
Similar fix to sysrepo, LOG_AUDIT facility instead of daemon + WARNING.
Additionally, drop the leading [severity] prefix to sysrepo logs. Only
needed when logging to stdout.
Follow-up to issue #521
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When sysrepo-plugind is processing callback events, make sure to log the
error and exit(1) the entire process so the system can handle the problem.
For example, restart all dependent services.
Fixes#585
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit introduces a new SECURITY() log macro that logs to facility
'audit' (sometimes called 'security') with severity set to 'alert'. It
is then used to instrument the single most important things to log; all
changes to users and their privileges.
We also add logging to sysrepo, which knows the username for changes to
running-config, copies to startup-config, and RPCs.
Fixes#521
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a backport of sysklogd v2.6.0 support for log rotation settings
in the .conf file. Previously only supported on the command line.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only the most important bridge and usb fixes have been ported in this
commit, and a new patch for the r8153 link/traffic LEDs, ported from
the FriendlyELEC/Rockchip kernel tree.
Fixes#274
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable BR2_DOWNLOAD_FORCE_CHECK_HASHES for R2S
- Relocate VisionFive2 patches to global patch dir for sharing with R2S
- Add hash for ATF v2.9
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Just like other packages we should version our Linux patches as well,
even though it may be painful and cause some extra overhead, in the
end it allows multi-kernel setups and compatibility with customer's
using Infix as a BR2_EXTERNAL.
Fixes#489
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For netopeer2 we need to patch away local-users, since if it is enabled
netopeer2 requires all users that should be allowed to use netconf to
also be configured in ietf-netconf-server.
Also add some upstream patches.
This also adds support in sysrepot to install factory config on boot,
default is only to allow it when installing the module, we can not do
that anymore, since the modules is installed during build and the factory
config (or failure) can only be determed when booted.
- Add missing locking around standard counter groups
- Fix reference counting issue with IGMPv3/MLDv2 reports
Found as part of debugging the regression test suite on hardware.
This local patch of sysrepo adds support for detecting non-zero return
code from sysrepo callbacks during SR_EV_DONE, which upstream sysrepo
currently, as of v2.2.105, discards.
With this change failure to load startup-config results in the system
detecting the failure applying failure-config instead.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The fact that a USB device currently is not authorized is not an error.
This patch adjusts the log level to slip below 'quiet' to prevent logs
to console at boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Backport fix to allow raw kernel logs to console
- Save 10 rotated (and gzipped) backups of all logs
The latter change was discussed a few weeks ago. We determined it was a
safe number since all active products have eMMC with *lots* of storage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Even when `managed = "in-band-status";` was specified on a port,
mv88e6xxx would insist on forcing the values that were supposed to be
automatically picked up by the MAC via in-band signaling.
In the case of USXGMII links on 6393X, forcing the link bit would
sometimes, for reasons that are not understood, cause the SERDES to
reset its USXGMII link partner base page (register 4.0xf0a2) to 0,
which it would then interpret as 10M/half-duplex. As a result, the
SERDES would erroneously perform rate-matching to 10M on egress
towards the PHY (which is configured for 10G/full-duplex), leading to
nothing but dropped packets and much sadness.
This can most easily be reproduced by the following setup:
.------------.
| .-----. .-------.
| | p9 +---+ 3310P +--.
| 6393X :-----: :-------: | T- or X-Units looped via external cable
| | p10 +---+ 3310P +--'
| '-----' '-------'
'------------'
Make sure that neither p9 nor p10 are managed using in-band-status.
1. ip link set dev p9 up; ip link set dev p10 up
2. ip link set dev p9 down
3. ip link set dev p9 up
After step (3), p10 will experience the failure described above in
about 3/4 of the cases. In the cases where the issue does not arise,
simply repeat steps (2) and (3).
Patches in queue for upcoming v4.8 release of Finit fixes:
- initctl touch does not respect -n flag, returning error
- initctl touch does not support template services
Related to issue #375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
