systemd: Use systemd functions to consider systemd availability
PATCH 1/1 systemd: Use systemd functions to consider systemd availability
From: David Sommerseth <[email protected]...>
This is another systemd implementation clean-up. It was found that SELinux will block OpenVPN from checking /sys/fs/cgroups. As OpenVPN only checked /sys/fs/cgroups and /sys/fs/cgroups/systemd to see if systemd was available or not, it was considered better to query systemd directly to see whether or not to query for usernames and passwords via systemd.
This patch has been compile tested on Fedora 19 and Fedora 21 alpha and function tested on Fedora 19.
v2 - Use PKG_CHECK_MODULES() + check for libsystemd before
libystemd-daemon. systemd >= 209 use a unified library
--- configure.ac | 24 +++++++++++++++++++++++- src/openvpn/Makefile.am | 1 + src/openvpn/console.c | 10 ++++++---- 3 files changed, 30 insertions(+), 5 deletions(-)
configure.ac +23 -1
@@ -997,6 +997,28 @@ if test "$enable_lz4" = "yes" && test "$enable_comp_stub" = "no"; then fi +dnl +dnl Check for systemd +dnl + +if test "$enable_systemd" = "yes" ; then + PKG_CHECK_MODULES([libsystemd], [systemd libsystemd], + [], + [PKG_CHECK_MODULES([libsystemd], [libsystemd-daemon])] + ) + AC_CHECK_HEADERS(systemd/sd-daemon.h, + , + [ + AC_MSG_ERROR([systemd development headers not found.]) + ]) + + saved_LIBS="${LIBS}" + LIBS="${LIBS} ${libsystemd_LIBS}" + AC_CHECK_FUNCS([sd_booted], [], [AC_MSG_ERROR([systemd library is missing sd_booted()])]) + OPTIONAL_SYSTEMD_LIBS="${libsystemd_LIBS}" + AC_DEFINE(ENABLE_SYSTEMD, 1, [Enable systemd integration]) + LIBS="${saved_LIBS}" +fi AC_MSG_CHECKING([git checkout])
@@ -1037,7 +1059,6 @@ test "${enable_def_auth}" = "yes" && AC_DEFINE([ENABLE_DEF_AUTH], [1], [Enable d test "${enable_pf}" = "yes" && AC_DEFINE([ENABLE_PF], [1], [Enable internal packet filter]) test "${enable_strict_options}" = "yes" && AC_DEFINE([ENABLE_STRICT_OPTIONS_CHECK], [1], [Enable strict options check between peers]) test "${enable_password_save}" = "yes" && AC_DEFINE([ENABLE_PASSWORD_SAVE], [1], [Allow --askpass and --auth-user-pass passwords to be read from a file]) -test "${enable_systemd}" = "yes" && AC_DEFINE([ENABLE_SYSTEMD], [1], [Enable systemd support]) case "${with_crypto_library}" in openssl)
@@ -1170,6 +1191,7 @@ AC_SUBST([OPTIONAL_SNAPPY_CFLAGS]) AC_SUBST([OPTIONAL_SNAPPY_LIBS]) AC_SUBST([OPTIONAL_LZ4_CFLAGS]) AC_SUBST([OPTIONAL_LZ4_LIBS]) +AC_SUBST([OPTIONAL_SYSTEMD_LIBS]) AC_SUBST([OPTIONAL_PKCS11_HELPER_CFLAGS]) AC_SUBST([OPTIONAL_PKCS11_HELPER_LIBS])
src/openvpn/Makefile.am +1 -0
@@ -126,6 +126,7 @@ openvpn_LDADD = \ $(OPTIONAL_PKCS11_HELPER_LIBS) \ $(OPTIONAL_CRYPTO_LIBS) \ $(OPTIONAL_SELINUX_LIBS) \ + $(OPTIONAL_SYSTEMD_LIBS) \ $(OPTIONAL_DL_LIBS) if WIN32 openvpn_SOURCES += openvpn_win32_resources.rc
src/openvpn/console.c +6 -4
@@ -34,6 +34,10 @@#include "buffer.h" #include "misc.h" +#ifdef ENABLE_SYSTEMD +#include <systemd/sd-daemon.h> +#endif +#ifdef WIN32 #include "win32.h"
@@ -143,15 +147,13 @@ close_tty (FILE *fp)static bool check_systemd_running () { -struct stat a, b, c; +struct stat c;/* We simply test whether the systemd cgroup hierarchy is * mounted, as well as the systemd-ask-password executable * being available */ -return (lstat ("/sys/fs/cgroup" , &a) ==0 ) - && (lstat ("/sys/fs/cgroup/systemd" , &b) ==0 ) - && (a.st_dev != b.st_dev) +return (sd_booted () >0 ) && (stat (SYSTEMD_ASK_PASSWORD_PATH , &c) ==0 ); }
Signature · 1 line
1.8.3.1
ACK. "Doesn't break anything on my test system, so safe for non-systemd users, and looks reasonable for those"
Your patch has been applied to the master branch.
commit f33ee6bcb12fdc3869b17b7c528a209f16581e2e
Author: David Sommerseth Date: Fri Oct 3 19:16:07 2014 +0200
systemd: Use systemd functions to consider systemd availability
Signed-off-by: David Sommerseth <[email protected]...>
Acked-by: Gert Doering <[email protected]...>
Message-Id: <[email protected]...>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9072
Signed-off-by: Gert Doering <[email protected]...>--
kind regards,
Gert Doering