Skip to content

Changelog for 66-tools

In 0.3.0.0

Overview

This release adds 66-web, a web interface to drive 66 from a browser.

66-dbus-launch no longer needs any external D-Bus library. It reads the bus configuration by itself and applies its policy, and a change of policy no longer requires restarting the whole bus. 66-userd, which starts the services of a user when they log in, is now reliable on fresh accounts and right after boot.

66-ns, the sandbox tool, went through a deep review. Several of its mounts landed in the wrong place or silently did nothing: they now do what the documentation says. It can now run a program on another root than the one of the host, such as a directory holding an installation, and its shipped rule files now follow the sandboxing options of systemd, with a conversion table in its documentation.

What you must do

Run 66-web passwd once before the first 66-web serve: without a credential, the interface serves nothing.

The D-Bus session socket moves from /run/user/UID/dbus to /run/user/UID/bus. If a configuration or a script of yours names the old path, update it.

If your services use the rule files of 66-ns, check them. Some rules never did anything and now take effect, others now follow systemd more closely:

  • kernel-logs.rule and kernel-tunables.rule now really hide and lock what they list. Until now, every one of their entries was skipped.
  • system-strict.rule now makes /boot and /tmp read-only as well.
  • private-tmp.rule now gives a /tmp and a /var/tmp that every user can write to. They were created writable by root only.
  • system.rule no longer lists /bin, /lib, /lib64 and /sbin. On a system where they point into /usr, which it already covers, nothing changes.

When you combine several rule files, the first one to give a path wins. Put system-strict.rule last, after private-dev.rule and the home-*.rule files: it gives /dev and /home itself, and the other way round 66-ns fails to set up /dev.

Interface changes

  • ignore=yes skips an element only when its source is missing:

    It used to skip the element every time, so an element marked ignore=yes was never applied, even when its source existed.

  • Two elements with the same target: the last one given wins:

    Elements were compared on their source, so the same directory bound to two places was kept only once.

  • execl-cmdline, 66-getenv, 66-gnwenv and 66-writenv are deprecated:

    They will be removed in the next release, and they now write a warning at each run.

    66-getenv, 66-gnwenv and 66-writenv complemented 66 when it ran on top of s6 and s6-rc. 66 has dropped s6 and s6-rc and now handles the environment variables itself, so nothing uses these tools anymore.

    execl-cmdline is no longer needed: 66-execute now does its job.

  • An element below a hidden one is dropped:

    The documentation always said so, but an element whose target sat below a hidden one, while its source lived elsewhere, was still mounted inside the hidden placeholder.

  • The mount options of a bind now apply:

    noexec, nosuid, nodev and the atime options of a bind element were ignored without a word, only ro worked. A rule or an element that asks for them now gets them.

  • A target reached through a symlink brought by another element is refused:

    66-ns exits with code 100 and gives the path to use instead. Such a target used to create directories on the host and to be mounted outside the sandbox, again without any error.

  • Only a bind or a recursive element can target /:

    Any other type exits with code 100. See the next section for what an element targeting / does.

New things to explore

  • 66-web, a web interface to 66:

    A single program serves a web page and a JSON API to list services and trees, read their state, follow their changes live and act on them. It handles the services of the user that runs it and nothing else. A frontend file is provided in contributions/service/66-web. See 66-web.

  • 66-dbus-launch reads the bus configuration:

    The launcher reads system.conf or session.conf, follows their includes and hands the resulting policy to the broker. A rule installed in system.d used to take effect only after restarting the bus, which cut every client: a SIGHUP to the launcher is now enough. Activatable services are read from their .service files. See 66-dbus-launch.

  • 66-ns on another root:

    An element whose target is / becomes the root of the sandbox, for instance a directory where pacman -r installed a system. The other elements keep bringing in directories of the host:

    66-ns -o unshare=user:pid -e /srv/rootfs:target=/ -r rootfs.rule -e /home/user/src:target=/build -- /bin/sh

    The new rootfs.rule provides /proc, /dev, /sys, /tmp, /run and /etc/resolv.conf. See Custom root.

  • 66-ns rule files that follow systemd:

    Each rule file now applies the same paths, with the same modes, as the matching sandboxing option of systemd: ProtectSystem= is system*.rule, ProtectHome= is home-*.rule, PrivateTmp= is private-tmp.rule, and so on. Three new rules complete the set: cgroups-ro.rule (ProtectControlGroups=yes), hostname-ro.rule (ProtectHostname=yes) and api-vfs.rule (MountAPIVFS=yes). The conversion table translates every option, with an example of a whole unit.

  • A complete /dev for 66-ns without root:

    In rootless mode, type=dev now also provides /dev/fd, /dev/stdin, /dev/stdout, /dev/stderr, a private /dev/pts with /dev/ptmx, and /dev/shm. The process substitution of bash, <(command), works inside the sandbox.

Bug fixes

  • 66-dbus-launch picks up the services left out of the 66 tree:

    A launcher killed while it parsed the D-Bus services could leave some of them out of the tree for good.

  • 66-dbus-launch no longer reports a false start failure:

    On its first start, the launcher parses every new service before it says it is ready, which could take longer than three seconds and make 66 report a timeout for a launcher that was running fine.

  • 66-userd works on an account that never used 66:

    Starting the trees of such an account failed, since its 66 directories had never been created.

  • 66-userd leaves the system accounts alone:

    A greeter, a service account or a cron job of a system user has no service tree. The accounts below USERD_MIN_UID, and root, are no longer handled.

  • 66-userd can be restarted:

    A lock kept by the guardian of a user blocked any restart of the daemon.

  • 66-userd starts the trees once the supervision is listening:

    At login, the trees could fail because the daemons of the user's scandir were not listening yet.

  • 66-userd no longer reports a user online with nothing running:

    A user whose trees failed to start was still reported online.

  • 66-userd keeps its readiness watcher running:

    The watcher read a counter its event loop had already consumed, failed, and stopped.

  • 66-ns mounts a directory before what goes inside it:

    A target placed under the target of another element could be mounted first, then hidden by its parent or impossible to create. Building a package in a sandbox with makepkg hit it.

  • 66-ns creates the missing mountpoints:

    A tmpfs, proc, dev or sys element on a missing directory failed with unable to find: tmpfs, as did a file or a symlink whose parent directory was missing. A tmpfs on /dev/shm in rootless mode hit it.

  • 66-ns no longer copies a file to bind it:

    To bind a file, 66-ns made a full copy of it at the target, and that copy stayed on the disk after the sandbox ended. It now creates an empty file there.

  • 66-ns makes the whole tree read-only with -e /:options=ro:

    /dev, /proc, /run and /sys stayed writable.

  • 66-ns read-only binds work without root on /tmp and alike:

    In rootless mode, making read-only a directory that lives on /tmp, or on any other nosuid, nodev or noatime mount, failed with Operation not permitted.

  • 66-ns rule files work without root on /root:

    system-strict.rule and home-ro.rule failed in rootless mode on /root, a directory the caller cannot enter.

  • 66-ns mounts a fresh /sys with a private network:

    type=sys failed with Operation not permitted in rootless mode with -o unshare=net.

  • 66-ns follows the symlinks of a custom root inside it:

    A target going through an absolute symlink of the root was resolved against the host. When the host had no such path, 66-ns failed to create the target.

Under the hood

  • 66-dbus-launch now carries odbus, a small D-Bus client of its own that speaks only to the controller socket of dbus-broker. Messages received while the launcher waited for an answer were set aside and never processed: nothing told the launcher they were waiting.
  • The tools follow the latest changes of oblibs: file types are given as FLAGS_* bits, and 66-web and 66-writenv write their files through its atomic write and sync helpers.

For packagers

  • oblibs: the FLAGS_* bits, sync_fd and the file_tmp_* helpers came after 0.4.0.1. Build against the release that follows it.
  • lib66 0.9.0.0 is still enough.
  • basu and elogind are no longer needed. The enable-dbus option is gone: 66-dbus-launch is always built.
  • python3 is needed at build time, to embed the web page into 66-web.
  • New meson options dbus-system-config, dbus-session-config and dbus-system-uid-max, see INSTALL.md. The default of dbus-session-name changes from dbus to bus; pass -Ddbus-session-name=dbus to keep the former session socket.
  • The HTML template of the documentation now comes from docs-builder.
  • Four rule files are new in contributions/rule: api-vfs.rule, cgroups-ro.rule, hostname-ro.rule and rootfs.rule.

In 0.2.0.3

Overview

This release only changes how the documentation is published.

Bug Fixes

  • Publish the documentation through obdev/docs-builder (f1f2337). The former deployment script read MinIO variables the CI no longer provides, so the documentation of 0.2.0.2 was never published.

In 0.2.0.2

Overview

This is a bug fix release.

Bug Fixes

  • 66-userd: initialize the base of the user before driving 66 (71c30ce). The guardian calls the ssexec handlers directly, so it never ran the sanitize step the 66 command performs first, and 66 tree start failed on any account whose base had never been created. A first login on such an account now creates its base and its default tree.
  • 66-userd: do not supervise accounts below USERD_MIN_UID, 1000 by default (84006f5). A greeter, a service account or a cron job of a system user owns no service tree. Their session is still registered, its runtime directory mounted, and it still counts for the power policy, but no guardian, scandir or tree is started for it. Root is refused a second time by the guardian itself, since for uid 0 the per-user scandir is the scandir of the system and driving it would stop the machine at logout.

In 0.2.0.1

Overview

This is a bug fix release.

Bug Fixes

  • pam_userd: export DBUS_SESSION_BUS_ADDRESS into the login session (87cb9cf). The guardian builds that address for the scandir branch, but the session of the user never received it, so a D-Bus client started from the session was left to the fallback of its implementation. The module now exports the very address the guardian gives to the scandir, gated on the same runtime directory check as XDG_RUNTIME_DIR.
  • 66-olexec: suppress a compilation warning on the return value of dup() (e5e2283).
  • Fix the version comparison of the documentation deployment (7841edb).

In 0.2.0.0

  • Adapt to oblibs 0.4.0.0
  • Depends on lib66 0.9.0.0

Overview

This release makes 66-tools fully oblibs-native. The direct dependencies on skalibs and execline are both gone, the legacy configure/make build has been removed in favor of meson, and 66-ns has been rewritten with proper supervision under a pid namespace.

Breaking changes

  • The legacy configure and make build system has been removed. The project is now built exclusively with meson (1c01296). See INSTALL.md.
  • The skalibs dependency has been dropped entirely; oblibs is self-contained and does not depend on it (ff6bfbf).
  • The execline dependency has been dropped: execl-cmdline no longer links it (796df87). No binary links execline anymore.
  • 66-ns now needs lib66 at build time (1ab255e): it includes <66/config.h> for the compile-time paths. It links no symbol from it, so lib66 is not a runtime dependency of that binary.
  • lib66 is now a mandatory dependency of the project, and libpam becomes a new one: 66-userd, 66-userctl and pam_userd.so are built unconditionally.

New features

  • 66-userd, 66-userctl and pam_userd: session and user tracking for a 66 system, without D-Bus. A PAM module reports the opening and the closing of a login session to a daemon which, on the first login of a user, mounts the runtime directory of that user and starts their 66-scandir and enabled trees, and on the last logout stops them. 66-userctl is the query and power-action CLI. The module is installed but never wired into the PAM stack by the package: see pam_userd, that step is mandatory.

    When a scandir is already running for that user, a previous guardian died and left its own behind, the scandir@ module is still enabled, or one was started by hand — it is adopted rather than started a second time, and the enabled trees are brought up on it. Services already up are left running.

  • 66-ns: supervision under a pid namespace. When a pid namespace is requested, 66-ns runs as pid 1 and acts as a transparent proxy for the supervised daemon: it forwards the catchable control signals to the tracked main, follows the real daemon across a double-fork, mirrors its exit code back to the supervisor, and tears the namespace down once the service is gone. The new -p, --pidfile option makes supervision authoritative (4e8f4be, a38366d).

  • Long options are now available for every tool, e.g. -h, --help (92436f3, cdc900b). execl-toc is intentionally left short-only, as its options mirror mount(8).

Bug Fixes

  • execl-toc: detect a group name lookup failure that previously went unnoticed (4b4a0ba).
  • 66-dbus-launch: bind the socket behind an exclusive lock, so a concurrent launch on the same path gets a clean EBUSY instead of stealing the path from the running instance (3e4c272).
  • 66-dbus-launch: reject a notification file descriptor greater than INT_MAX (ca039f2).
  • 66-which: fix a leak of the realpath result (fa9db26).
  • 66-dbus-launch: fix a swapped io_read argument order (fa9db26).

Enhancements

  • Ported every tool from skalibs to the new oblibs interfaces (fa9db26).
  • 66-ns has been rewritten as a set of focused, modular translation units backed by oblibs and lib66 (1ab255e).
  • execl-cmdline reimplements el_semicolon/el_getstrict natively on oblibs (796df87).
  • 66-dbus-launch migrates its service hash table from uthash to the oblibs intrusive hash table (6866b5e).
  • Documentation and CI are aligned on the 66 project: lowdown HTML/man rules, a mkdocs stack and matching pipeline stages (dcaa800), and the build instructions are unified into a single INSTALL.md (7925ab1).

In 0.1.2.0

  • Adapt to oblibs 0.3.4.0

Overview

This is a bug fix and enhancement release.

Bug Fixes

  • Fixed type behavior and adapted to oblibs for hash.h file (0182864).
  • Suppressed compiler warning (0182864).
  • Fixed typos in documentation (0182864, a536fb9).

Enhancements

  • Switched to Meson build system for improved cross-platform support and efficiency (378e67f). Traditional configure and make remain functional during the transition but consider it as deprecated. See INSTALL_MESON.md for details.

In 0.1.1.0

  • Adapt to oblibs 0.3.1.0

New features

  • 66-dbus-launch: A tool for launching, supervising, and reacting to dbus-broker events emitted by relevant D-Bus signals. This tool is not build by default, see ./configure --help at Dbus support section and 66-dbus-launch documentation for build requirements and use.

Bug Fixes

  • Typo fix

In 0.1.0.2

  • Adapt to oblibs 0.3.0.0

  • Bugs fix:

    • fix -r options at 66-ns program.
    • reset ignore options if element exist to avoid skipping it.

In 0.1.0.1

  • Bugs fix

  • Adapt to skalibs 2.14.1.0

  • Adapt to oblibs 0.2.0.2

In 0.1.0.0

  • Adapt to skalibs 2.14.0.1

  • Adapt to execline 2.9.4.0

  • Adapt to oblibs 0.2.0.0

In 0.0.8.0

  • Adapt to skalibs 2.11.0.0

  • Adapt to execline 2.8.1.0

  • Adapt to oblibs 0.1.4.0

  • Remove slashpackage convention.

In 0.0.7.3

  • Behavior changes: execl-cmdline: accept empty value for a key with -s options

  • Bugs fix: 66-getenv: do not split single/double quoted value

In 0.0.7.2

  • Bugs fix: 66-ns: Fix overeating cpu usage

In 0.0.7.1

  • Fix musl build

In 0.0.7.0

  • Adapt to skalibs 2.10.0.0

  • Adapt to execline 2.7.0.0

  • Adapt to oblibs 0.1.2.0

  • New tool:

    • 66-ns: setup a namespace and execs a program inside it.

  • html documentation is now versionned.

In 0.0.6.2

  • bug fix:
    • execl-toc respect -t -n options if the test crash

In 0.0.6.1

  • Bugs fix: fix execl-toc -t -n main_options behavior

In 0.0.6.0

WARNING: execl-envfile binary was removed. It now a part of 66 software.

  • adapt to oblibs v0.0.9.0

  • execl-toc:

    • Add -M options: create the parent directories of an element with a specific mode.
    • Allow to set the uid/gid at -u and -g by numeric or name value.

  • 66-yeller:

    • -z option mean now enable color instead of disable color. It was a big mistake to do the contrary. Sorry for this inconvenient.

  • documentation installation: calling the makefile with make install install now the documentation by default.

In 0.0.5.1

  • Bug fix: fix wrong umask at creation time

In 0.0.5.0

  • Adapt to oblibs v0.0.8.0
  • add -m option to 66-clock tool
  • New tool:
    • execl-toc:
      • this tool allow to check an element and create it if it not exist.
    • 66-yeller:
      • A powerfull, specialized echo tool.

In 0.0.4.0

  • Minor bugs fix

  • Adapt to oblibs v0.0.6.0

  • New 66-clock tool:

    • get and write sytem time to stdout.

In 0.0.3.1

  • Adapt to oblibs v0.0.5.0

  • Fix parse of double-quote at execl-cmdline

In 0.0.3.0

  • Adapt to oblibs v0.0.4.0
  • Supports relative path at execl-envfile
  • New 66-olexec tool:
    • opens, locks a tty and execs a program

In 0.0.2.0

  • Remove deprecated 66-enfvile tools

  • Adapt to skalibs 2.9.1.0, execline 2.5.3.0, oblibs 0.0.3.1