systemd中文文档 - 启动: http://systemd.cn/docs/Booting/ - 自动启动评估: http://systemd.cn/docs/Booting/AUTOMATIC_BOOT_ASSESSMENT/ - 启动组件和根文件系统探测: http://systemd.cn/docs/Booting/ROOTFS_DISCOVERY/ - 引导加载程序接口: http://systemd.cn/docs/Booting/BOOT_LOADER_INTERFACE/ - 恢复出厂设置: http://systemd.cn/docs/Booting/FACTORY_RESET/ - 挂载点可用性要求: http://systemd.cn/docs/Booting/MOUNT_REQUIREMENTS/ - TPM2 PCR测量: http://systemd.cn/docs/Booting/TPM2_PCR_MEASUREMENTS/ - Boot Loader Specification: http://systemd.cn/docs/BOOT_LOADER_SPECIFICATION/ - Discoverable Partitions: http://systemd.cn/docs/DISCOVERABLE_PARTITIONS/ - Elf Dlopen Metadata: http://systemd.cn/docs/ELF_DLOPEN_METADATA/ - Osc Context: http://systemd.cn/docs/OSC_CONTEXT/ - Package Metadata for Executable Files: http://systemd.cn/docs/PACKAGE_METADATA_FOR_EXECUTABLE_FILES/ - API File Systems: http://systemd.cn/docs/API_FILE_SYSTEMS/ - Appstream Bundle: http://systemd.cn/docs/APPSTREAM_BUNDLE/ - Backports: http://systemd.cn/docs/BACKPORTS/ - Booting Without /usr is Broken: http://systemd.cn/docs/SEPARATE_USR_IS_BROKEN/ - Code Quality Tools: http://systemd.cn/docs/CODE_QUALITY/ - Coding Style: http://systemd.cn/docs/CODING_STYLE/ - Compatibility with SysV: http://systemd.cn/docs/INCOMPATIBILITIES/ - Container Interface: http://systemd.cn/docs/CONTAINER_INTERFACE/ - Contributing: http://systemd.cn/docs/CONTRIBUTING/ - Control Group APIs and Delegation: http://systemd.cn/docs/CGROUP_DELEGATION/ - Converting Existing Users to systemd-homed: http://systemd.cn/docs/CONVERTING_TO_HOMED/ - Credentials: http://systemd.cn/docs/CREDENTIALS/ - Desktop Environment Integration: http://systemd.cn/docs/DESKTOP_ENVIRONMENTS/ - Diagnosing Boot Problems: http://systemd.cn/docs/DEBUGGING/ - File Descriptor Store: http://systemd.cn/docs/FILE_DESCRIPTOR_STORE/ - Frequently Asked Questions: http://systemd.cn/docs/FAQ/ - Governance: http://systemd.cn/docs/GOVERNANCE/ - Hacking on systemd: http://systemd.cn/docs/HACKING/ - Home Directories: http://systemd.cn/docs/HOME_DIRECTORY/ - Inhibitor Locks: http://systemd.cn/docs/INHIBITOR_LOCKS/ - Initrd Interface: http://systemd.cn/docs/INITRD_INTERFACE/ - Journal Export Formats: http://systemd.cn/docs/JOURNAL_EXPORT_FORMATS/ - Journal File Format: http://systemd.cn/docs/JOURNAL_FILE_FORMAT/ - Journal Message Catalogs: http://systemd.cn/docs/CATALOG/ - JSON Group Records: http://systemd.cn/docs/GROUP_RECORD/ - JSON User Records: http://systemd.cn/docs/USER_RECORD/ - Known Environment Variables: http://systemd.cn/docs/ENVIRONMENT/ - Locking Block Device Access: http://systemd.cn/docs/BLOCK_DEVICE_LOCKING/ - Minimal Builds: http://systemd.cn/docs/MINIMAL_BUILDS/ - My Service Can't Get Realtime!: http://systemd.cn/docs/MY_SERVICE_CANT_GET_REALTIME/ - Native Journal Protocol: http://systemd.cn/docs/JOURNAL_NATIVE_PROTOCOL/ - New Control Group Interfaces: http://systemd.cn/docs/CONTROL_GROUP_INTERFACE/ - Notes for Translators: http://systemd.cn/docs/TRANSLATORS/ - Password Agents: http://systemd.cn/docs/PASSWORD_AGENTS/ - Pax Controla Groupiana: http://systemd.cn/docs/PAX_CONTROL_GROUPS/ - Portability and Stability: http://systemd.cn/docs/PORTABILITY_AND_STABILITY/ - Portable Services Introduction: http://systemd.cn/docs/PORTABLE_SERVICES/ - Porting systemd To New Distributions: http://systemd.cn/docs/DISTRO_PORTING/ - Porting to New Architectures: http://systemd.cn/docs/PORTING_TO_NEW_ARCHITECTURES/ - Predictable Network Interface Names: http://systemd.cn/docs/PREDICTABLE_INTERFACE_NAMES/ - Presets: http://systemd.cn/docs/PRESET/ - Project IDs for Disk Quotas on Exec Directories: http://systemd.cn/docs/DISK-QUOTAS-PROJECTIDS/ - Random Seeds: http://systemd.cn/docs/RANDOM_SEEDS/ - Reporting of Security Vulnerabilities: http://systemd.cn/docs/SECURITY/ - Resource Pressure Handling: http://systemd.cn/docs/PRESSURE/ - Running Services After the Network Is Up: http://systemd.cn/docs/NETWORK_ONLINE/ - Safely Building Images: http://systemd.cn/docs/BUILDING_IMAGES/ - Socket Activation with Popular Daemons: http://systemd.cn/docs/DAEMON_SOCKET_ACTIVATION/ - Steps to a Successful Release: http://systemd.cn/docs/RELEASE/ - Storage Daemons for the Root File System: http://systemd.cn/docs/ROOT_STORAGE_DAEMONS/ - systemd Community Conduct Guidelines: http://systemd.cn/docs/CODE_OF_CONDUCT/ - systemd Coredump Handling: http://systemd.cn/docs/COREDUMP/ - systemd File Hierarchy Requirements: http://systemd.cn/docs/SYSTEMD_FILE_HIERARCHY_REQUIREMENTS/ - systemd Optimizations: http://systemd.cn/docs/OPTIMIZATIONS/ - systemd Repository Architecture: http://systemd.cn/docs/ARCHITECTURE/ - systemd-boot UEFI Boot Manager: http://systemd.cn/docs/BOOT/ - systemd-homed and JSON User/Group Record Support in Desktop Environments: http://systemd.cn/docs/USERDB_AND_DESKTOPS/ - systemd-resolved and VPNs: http://systemd.cn/docs/RESOLVED-VPNS/ - Testing systemd Using Sanitizers: http://systemd.cn/docs/TESTING_WITH_SANITIZERS/ - The Case for the /usr Merge: http://systemd.cn/docs/THE_CASE_FOR_THE_USR_MERGE/ - Tips And Tricks: http://systemd.cn/docs/TIPS_AND_TRICKS/ - User Record Blob Directories: http://systemd.cn/docs/USER_RECORD_BLOB_DIRS/ - User/Group Name Syntax: http://systemd.cn/docs/USER_NAMES/ - User/Group Record Lookup API via Varlink: http://systemd.cn/docs/USER_GROUP_API/ - Users, Groups, UIDs and GIDs on systemd Systems: http://systemd.cn/docs/UIDS-GIDS/ - Using /tmp/ and /var/tmp/ Safely: http://systemd.cn/docs/TEMPORARY_DIRECTORIES/ - Varlink API Style: http://systemd.cn/docs/VARLINK/ - VM Interface: http://systemd.cn/docs/VM_INTERFACE/ - What Settings Are Currently Available For Transient Units?: http://systemd.cn/docs/TRANSIENT-SETTINGS/ - Writing Desktop Environments: http://systemd.cn/docs/WRITING_DESKTOP_ENVIRONMENTS/ - Writing Display Managers: http://systemd.cn/docs/WRITING_DISPLAY_MANAGERS/ - Writing Network Configuration Managers: http://systemd.cn/docs/WRITING_NETWORK_CONFIGURATION_MANAGERS/ - Writing Resolver Clients: http://systemd.cn/docs/WRITING_RESOLVER_CLIENTS/ - Writing syslog Daemons Which Cooperate Nicely With systemd: http://systemd.cn/docs/SYSLOG/ - Writing VM and Container Managers: http://systemd.cn/docs/WRITING_VM_AND_CONTAINER_MANAGERS/ # Testing systemd Using Sanitizers To catch the *nastier* kind of bugs, you can run your code with [Address Sanitizer](https://clang.llvm.org/docs/AddressSanitizer.html) and [Undefined Behavior Sanitizer](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html). This is mostly done automagically by various CI systems for each PR, but you may want to do it locally as well. The process slightly varies depending on the compiler you want to use and which part of the test suite you want to run. ## mkosi To build with sanitizers in mkosi, create a file `mkosi/mkosi.local.conf` and add the following contents: ``` [Build] Environment=SANITIZERS=address,undefined ``` The value of `SANITIZERS` is passed directly to meson's `b_sanitize` option, See https://mesonbuild.com/Builtin-options.html#base-options for the format expected by the option. Currently, only the sanitizers supported by gcc can be used, which are `address` and `undefined`. Note that this will only work with a recent version of mkosi (>= 14 or by running mkosi directly from source). ## gcc gcc compiles in sanitizer libraries dynamically by default, so you need to get the shared libraries first - on Fedora these are shipped as separate packages (`libasan` for Address Sanitizer and `libubsan` for Undefined Behavior Sanitizer). The compilation itself is then a matter of simply adding `-Db_sanitize=address,undefined` to `meson`. That's it - following executions of `meson test` and integration tests under `test/` subdirectory will run with sanitizers enabled. However, to get truly useful results, you should tweak the runtime configuration of respective sanitizers; e.g. in systemd we set the following environment variables: ```bash ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1 UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1 ``` ## clang In case of clang things are somewhat different - the sanitizer libraries are compiled in statically by default. This is not an issue if you plan to run only the unit tests, but for integration tests you'll need to convince clang to use the dynamic versions of sanitizer libraries. First of all, pass `-shared-libsan` to both `clang` and `clang++`: ```bash CFLAGS=-shared-libasan CXXFLAGS=-shared-libasan ``` The `CXXFLAGS` are necessary for `src/libsystemd/sd-bus/test-bus-vtable-cc.c`. Compilation is then the same as in case of gcc, simply add `-Db_sanitize=address,undefined` to the `meson` call and use the same environment variables for runtime configuration. ```bash ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1 UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1 ``` After this, you'll probably notice that all compiled binaries complain about missing `libclang_rt.asan*` library. To fix this, you have to install clang's runtime libraries, usually shipped in the `compiler-rt` package. As these libraries are installed in a non-standard location (non-standard for `ldconfig`), you'll need to manually direct binaries to the respective runtime libraries. ``` # Optionally locate the respective runtime DSO $ ldd build/systemd | grep libclang_rt.asan libclang_rt.asan-x86_64.so => not found libclang_rt.asan-x86_64.so => not found $ find /usr/lib* /usr/local/lib* -type f -name libclang_rt.asan-x86_64.so 2>/dev/null /usr/lib64/clang/7.0.1/lib/libclang_rt.asan-x86_64.so # Set the LD_LIBRARY_PATH accordingly export LD_LIBRARY_PATH=/usr/lib64/clang/7.0.1/lib/ # If the path is correct, the "not found" message should change to an actual path $ ldd build/systemd | grep libclang_rt.asan libclang_rt.asan-x86_64.so => /usr/lib64/clang/7.0.1/lib/libclang_rt.asan-x86_64.so (0x00007fa9752fc000) ``` This should help binaries to correctly find necessary sanitizer DSOs. Also, to make the reports useful, `llvm-symbolizer` tool is required (usually part of the `llvm` package). ## Background notes The reason why you need to force dynamic linking in case of `clang` is that some applications make use of `libsystemd`, which is compiled with sanitizers as well. However, if a *standard* (uninstrumented) application loads an instrumented library, it will immediately fail due to unresolved symbols. To fix/workaround this, you need to pre-load the ASan DSO using `LD_PRELOAD=/path/to/asan/dso`, which will make things work as expected in most cases. This will, obviously, not work with statically linked sanitizer libraries. These shenanigans are performed automatically when running the integration test suite.