To make use of the hardware watchdog it is sufficient to set
the RuntimeWatchdogSec= option in /etc/systemd/system.conf.
It defaults to 0 (i.e. no hardware watchdog use). Set it to
a value like 20s and the watchdog is enabled.
ref: https://0pointer.de/blog/projects/watchdog.html
(From OE-Core rev: 1c61a1eb9c4faa9ab32b0440bbdd88c22c3cd945)
Signed-off-by: Benjamin Szőke <egyszeregy@freemail.hu>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Patch changes:
* 0003-coredump-set-ProtectHome-to-read-only.patch is drop as it's a backported patch.
* 0009-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch is drop as
AT_SYMLINK_NOFOLLOW has been supportd in musl.
* Other patches are either refreshed or changed to fit the current version.
systemd-boot changes:
* Use src/boot instead src/boot/efi in do_install and do_deploy. See upstream
change 97318131fd06 (Rename src/boot/efi to just src/boot).
(From OE-Core rev: 4891f47cdaf919033bf1c02cc12e4805e5db99a0)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
To enable FIDO support.
meta-oe can provide libfido2 but it depends on udev
which creates a dependency loop between systemd (provider of udev)
and libfido2 which is currently unresolved. systemd recipe
could split udev to a separate recipe to solve this, or libfido2
could be compiled in systemd source tree after udev but before
rest of systemd.
(From OE-Core rev: 1e347c36b0d3910cd71b24a4e4ab8e2dd49063d1)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
systemd.inc is used by systemd, systemd-boot and
systemd-tools-native recipes so make sure all
match to "systemd" product in CVE database. The
split between systemd, systemd-boot and
systemd-tools-native is specific to oe-core and
upstream just refers to systemd. Not limiting
to "systemd_project" vendor since multiple
vendor names have been used in the past.
(From OE-Core rev: eb46ad379170f0a80ac2d061fa02c118f5ed1d31)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently pni-names PACKAGECONFIG option adds "mac" names policy if
selected, but nothing otherwise. In systemd Predictable Network Interface
Names are applied by default which leads to inconsistend behaviour.
One could think that pni-names in DISTRO_FEATURES would enable or disable
Predictable Network Interface Names, but currently if not present it's
only actively disabled for QEMU via kernel command line
(commit 9e9c33d51e40
("qemuboot/runqemu: Fix 6.2 and later kernel network device naming")).
It has no effect on the real HW. If the option is present, it merely adds
"mac" into default NamePolicy, which may or may not have observable
effects.
Make pni-names semantics more consistent by actively suppressing
Predictable Network Interface Names if the feature is not present.
(From OE-Core rev: 37b98bc93bc404823cc4bbf9039e4d114aac33fa)
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is a race here where postinst relies on existence of
various files from other packages on the target rootfs to
operate properly, but doesn't ensure that it runs after all
of those packages have been installed. Adding dependencies
on those packages is not a solution as the recipe
is not supposed to bring them into rootfs, only make
adjustments if they are present.
This commit moves postinst execution to the first boot; another
solution would be to replace the whole recipe with ROOTFS_POSTPROCESS_COMMAND.
This was exposed with rpm 4.20 which rearranges the order
in which packages are installed, and exposes the issue.
(From OE-Core rev: e88f22da19a7f3f9bf23f2a607ffde6b5b1a3265)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The rootprefix build option was deprecated in systemd 255, making the
custom rootlibexecdir unnecessary, so remove it in favor of the standard
nonarch_libdir definition.
(From OE-Core rev: c89b34401dfbe65de5a32bf8b4ef32902d868ce1)
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Support for split-usr and unmerged-usr were both removed as part of the
systemd 255 release, so remove the current deprecated rootlibdir,
rootprefix and split-usr options from the recipe.
(From OE-Core rev: 94ec821600c36baaeeb81f3d2ce0cc6d2d22082a)
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
intltool was dropped as a dependency in v236
See commit for reference:
c81217920e
(From OE-Core rev: c82a1b71fd21b4f1299c7610342c5d821de7f1bb)
Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
intltool was dropped as a dependency in v236
See commit for reference:
c81217920e
(From OE-Core rev: bd7353f2794120bc2b88adfea0ee06361a0b7dd5)
Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There are two behavioural differences between the objcopy in binutils
and llvm which resulted in build failures when building systemd with
clang:
1) If the section specified in --dump-section doesn't exist, binutils
set an exit code of 0 whereas llvm sets 1. This means we need to handle
the exit code so that we raise exceptions on unexpected failures, but
return an empty byte string if the segment isn't found.
2) binutils writes the section to the file name directly, whereas llvm
writes to a temporary file and renames. This means we can't read the
open fd directly, and instead need to re-open the file to read it.
(From OE-Core rev: 98879a8dbd1b7887b43a074193925bf1a55d44e7)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
First, this is likely not the final implementation, but a RFC and
prototype.
Some binaries don't dynamically link to libraries, but instead at runtime
dlopen() them. This means extra work for distributions as the dependencies
are not detected automatically, so libraries may be missing.
systemd is one such project which does this, and in an attempt to solve
the packaging problem it also embeds the names of the libraries that can
potentially be opened at runtime into ELF notes. These can be read to
generate package dependencies. For example:
packages/cortexa57-poky-linux/systemd/libsystemd-shared: RRECOMMENDS: added "libkmod (['>= 33']) libzstd (['>= 1.5.6'])"
packages/cortexa57-poky-linux/systemd/libsystemd: RRECOMMENDS: added "libzstd (['>= 1.5.6'])"
I expect this code to be changed before merging. Whilst systemd is the
main user of his approach right now, I expect to see it used in more
places in the future so there's a reasonably good argument to merge it
into the core shlibs code. Also it currently manually extracts and
parses the data, whereas maybe we should incorporate pyelftools into
meta/lib/oe and use that to parse ELF files across all of OE.
This also means we can remove the explicit dependency on libkmod in udev,
which now comes in via libsystemd-shared.
(From OE-Core rev: 905da779bcfe98f105adac708e0045ce8ffe5636)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Recently the systemd recipe grew support for setting the epoch time
at image build time. Unfortunately this is unconditional, and our
use case for the set-time-epoch PACKAGECONFIG is we have a system
requirement that our product boot with the time set to the UNIX
epoch.
Instead of trying to complicate things with either an image hook or
overriding the systemd recipe, just make setting the epoch at image
time optional, with the same PACKAGECONFIG that controls hardcoding
the systemd build time as the default epoch.
(From OE-Core rev: ae433b35fb2d5475e33dea61e6bc65d83d3af56a)
Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When systemd is started, it sets the system clock to epoch to ensure the
system clock is reasonably initialized if no working RTC.
As init process, systemd sets epoch very early to the more recent
timestamp of[1]:
- the build time of systemd (-Dtime-epoch)
- the modification time ("mtime") of /var/lib/systemd/timesync/clock
(systemd-timesyncd)
- the modification time ("mtime") of /usr/lib/clock-epoch (systemd)
The first epoch timestamp is hard-coded at build-time by the systemd
recipe (using either SOURCE_DATE_EPOCH, git-tag, or NEWS modification
time[2]).
The second epoch timestamp is maintained at run-time if the system runs
systemd-timesyncd.
This implements the third epoch timestamp at image build-time, by
touching the timestamp file /usr/lib/clock-epoch from the package
post-install script.
[1]: 863098fdc9
[2]: https://github.com/systemd/systemd/blob/v256/meson.build#L804-L825
(From OE-Core rev: 0f51fee4a5408c17cbaf827053f13d6c3b9dbc2c)
Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since commit[1], PACKAGECONFIG[sysvinit] is not enabled by default when
sysvinit is not in DISTRO_FEATURES, which causes the following
sysvinit-compatible commands/services to not be built and installed:
runlevel
telinit
rc-local.service
systemd-initctl
systemd-initctl.service
systemd-rc-local-generator
systemd-sysv-generator
systemd-update-utmp-runlevel.service
Therefore, links to these commands/services should only be created when
PACKAGECONFIG[sysvinit] is enabled.
[1] https://git.openembedded.org/openembedded-core/commit/?id=3668235fd60a9027608f37251c4b453ed21b3687
(From OE-Core rev: a20b698f1acdee972cf1ff570b09a2e2c36bef1a)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As of systemd 256, libsystemd-shared.so doesn't directly link to a number
of libraries but instead dlopen()'s them as needed to reduce the size of
the attack surface.
Instead the .so has a .note.dlopen segment that lists the libraries that
may be opened, with the intention that these are transformed into package
recommendation fields.
We don't yet have support for these (see #15595) so explicit dependencies
have been added to the systemd package itself. However, in an initramfs
with udev but without systemd and no recommendations you end up without
libkmod, so module loading is impossible.
Add an explicit hard dependency on libkmod to udev, because modules are
critical functionality.
(From OE-Core rev: 12fadefe11ed9f09171087608c3c4b83c7302b3f)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The sysvinit PACKAGECONFIG knob enables various legacy/compatibility
code that may not be needed or even desired. If DISTRO_FEATURES
includes systemd (as it must for this recipe to build) but not
sysvinit, there is no point building and installing that legacy
support.
As most other changes, this can cause breakage, but given that
sysvinit not being in DISTRO_FEATURES requires explicit opt-out (due
to backfill), I think the risk is low. Moreover, it is generally
easier to add to than to remove from PACKAGECONFIG.
(From OE-Core rev: 3668235fd60a9027608f37251c4b453ed21b3687)
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In 924453c225
ProtectHome was set to true for systemd-coredump in order to reduce risk, since an attacker could craft a malicious binary in order to compromise systemd-coredump.
At that point the object analysis was done in the main systemd-coredump process.
Because of this systemd-coredump is unable to product symbolicated call-stacks for binaries running under /home ("n/a" is shown instead of function names).
However, later in 61aea456c1 systemd-coredump was changed to do the object analysis in a forked process,
covering those security concerns.
Let's set ProtectHome to read-only so that systemd-coredump produces symbolicated call-stacks for processes running under /home.
Note: it still does not work in /tmp (because of PrivateTmp=yes) and in /root (for unknown reasons).
Before the change (with minidebuginfo enabled):
root@qemux86-64:~# /home/sleep 1000 &
[1] 426
root@qemux86-64:~# kill -11 $(pidof sleep)
root@qemux86-64:~# coredumpctl info
PID: 426 (sleep)
UID: 0 (root)
GID: 0 (root)
Signal: 11 (SEGV)
Timestamp: Fri 2024-09-06 17:25:18 UTC (3s ago)
Command Line: /home/sleep 1000
Executable: /home/sleep
Control Group: /system.slice/system-serial\x2dgetty.slice/serial-getty@ttyS0.service
Unit: serial-getty@ttyS0.service
Slice: system-serial\x2dgetty.slice
Boot ID: 44ef4ddfaad249ceaa29d1e9f330d3b5
Machine ID: fb279f18f2c849c59768754c7a274ee3
Hostname: qemux86-64
Storage: /var/lib/systemd/coredump/core.sleep.0.44ef4ddfaad249ceaa29d1e9f330d3b5.426.1725643518000000.zst (present)
Size on Disk: 16.5K
Message: Process 426 (sleep) of user 0 dumped core.
Stack trace of thread 426:
#0 0x00007f365f3849a7 clock_nanosleep (libc.so.6 + 0xd49a7)
#1 0x00007f365f38f667 __nanosleep (libc.so.6 + 0xdf667)
#2 0x0000561fee703737 n/a (/home/sleep + 0x7737)
#3 0x000000003a6227c5 n/a (n/a + 0x0)
ELF object binary architecture: AMD x86-64
[1]+ Segmentation fault (core dumped) /home/sleep 1000
After the change (with minidebuginfo enabled):
root@qemux86-64:~# /home/sleep 1000 &
[1] 450
root@qemux86-64:~# kill -11 $(pidof sleep)
root@qemux86-64:~# coredumpctl info
PID: 450 (sleep)
UID: 0 (root)
GID: 0 (root)
Signal: 11 (SEGV)
Timestamp: Fri 2024-09-06 17:30:12 UTC (4s ago)
Command Line: /home/sleep 1000
Executable: /home/sleep
Control Group: /system.slice/system-serial\x2dgetty.slice/serial-getty@ttyS0.service
Unit: serial-getty@ttyS0.service
Slice: system-serial\x2dgetty.slice
Boot ID: 44ef4ddfaad249ceaa29d1e9f330d3b5
Machine ID: fb279f18f2c849c59768754c7a274ee3
Hostname: qemux86-64
Storage: /var/lib/systemd/coredump/core.sleep.0.44ef4ddfaad249ceaa29d1e9f330d3b5.450.1725643812000000.zst (present)
Size on Disk: 16.5K
Message: Process 450 (sleep) of user 0 dumped core.
Stack trace of thread 450:
#0 0x00007f795dd689a7 clock_nanosleep (libc.so.6 + 0xd49a7)
#1 0x00007f795dd73667 __nanosleep (libc.so.6 + 0xdf667)
#2 0x0000561965c9d737 rpl_nanosleep (sleep + 0x7737)
#3 0x0000561965c9d0c1 xnanosleep (sleep + 0x70c1)
#4 0x0000561965c985c8 main (sleep + 0x25c8)
#5 0x00007f795dcba01b __libc_start_call_main (libc.so.6 + 0x2601b)
#6 0x00007f795dcba0d9 __libc_start_main (libc.so.6 + 0x260d9)
#7 0x0000561965c98685 _start (sleep + 0x2685)
ELF object binary architecture: AMD x86-64
[1]+ Segmentation fault (core dumped) /home/sleep 1000
(From OE-Core rev: b8c1f999038b7cd6fc2e80ed215541c8a4d9e19f)
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
${MIMEDIR} (aka ${datadir}/mime) is packaged in ${PN}-mime and the
reference to ${datadir}/mime/packages/io.systemd.xml for FILES:${PN}
should have been removed in commit
5560243137f772683e53b614f134dd632b62be8b.
(From OE-Core rev: 3dba1443ef123714a4b1c77ade1ea3b2d0ad3f21)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Drop VOLATILE_TMP_DIR, use FILESYSTEM_PERMS_TABLES instead. By default,
FILESYSTEM_PERMS_TABLES ?= "files/fs-perms.txt \
files/fs-perms-volatile-log.txt \
files/fs-perms-volatile-tmp.txt"
it contains 'files/fs-perms-volatile-tmp.txt', which means volatile tmp
is enabled. User can disable volatile tmp by remove
'files/fs-perms-volatile-tmp.txt' from FILESYSTEM_PERMS_TABLES.
* If volatile tmp is disabled, both /tmp and /var/tmp are persistent
(From OE-Core rev: 8d1ae67b89c45f78162e070228086c7ef88c3264)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop VOLATILE_LOG_DIR, use FILESYSTEM_PERMS_TABLES instead. By default,
it contains 'files/fs-perms-volatile-log.txt', which means volatile log
is enabled. User can disable volatile log by remove
'files/fs-perms-volatile-log.txt' from FILESYSTEM_PERMS_TABLES.
(From OE-Core rev: 91128c6517066715f2afe6b46aa3206c7cf3653e)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes:
566210c272 meson: Bump version to 256.4
16de138427 mkosi: update debian commit reference
b731debea9 hwdb: update to main@{2024-07-24}
a78a524652 add udev rules for trezor hw wallet devices
b825a8be0b core: reliably check if varlink socket has been deserialized
83c9043727 mkosi: Bump device timeout even more
e60d01bdbf man/systemd-repart: extend description and reword some sentences
766af3f782 Document that MemorySwapMax supports % configuration
1922d49fd6 Make vcs-tag do something useful for non-developer mode as well
5b9ad0bbb8 tools/fetch-distro: switch to the target branch
8334be48a3 tools/fetch-distro: only fetch the configured branch
92890d56e8 tools/update-distro-hash: rename, fetch the repository if appropriate
1f079607f8 Merge pull request #33803 from bluca/v256-stable
e05f93b5c4 mkosi: update arch commit reference
c9d39eea98 mkosi: update fedora commit reference
dbeed95d76 mkosi: Use the Fedora Rawhide spec for CentOS
6108f13fc0 mkosi: Switch back to PKG_SUBDIR instead of symlinks
fd2a6ea0a8 zsh/_networkctl: remove duplicated argument for completion (#31926)
995c702a34 import-creds: when we hit ENOENT on SMBIOS 11 do not even debug log
6a3cb4cd11 core/unit: ignore dropins for masked units completely when checking need_reload
f81659f5f3 test: add a reproducer for #33672
7fcfb73d71 shared: log error when execve fail
7da84cc154 test-execute: ExecStop= and friends should not get credentials
8f58652f5e test: override blocking localed policy in TEST-73-LOCALE
d6f8575f1e meson: fix missing failure if bpf-framework was enabled
e274de4b74 zsh: add varlinkctl completions
cae58967a5 docs: Document how to do stable releases
468b064634 man: Mention Type=oneshot timeout directive
d870f2335b l10n: fix credits for the French translation
8aa9e60f89 sd-device: remove debug log message when dirs are missing
86ec58a55c id128: refuse --app-specific= if we're listing GPT types
b60d5bc1b7 gpt: add more architecture aliases
b786185406 kernel-install: Remove existing loader entries and UKIs
e63ae80a89 bootspec: correct log level for fatal errors
3736e21341 bootspec: implement sorting by tries left/done, to match what sd-boot does
18143edf3e boot: compare filename suffixes without case
78fcf31f08 man: some fixes
bcda6d4637 man: fix typo in unit options section
1747350ffd fsck: do not pull down mount units on soft-reboot
a68188e985 man: fix typo in the alias symlink name
15c236806c vmspawn: define default machines for mips targets
fa2b2da146 path: drop IN_ATTRIB from parent directory watches
35e2f62967 Remove extra period at the end of systemd-bsod's unit description. (#33632)
a40eb432cb test: Set priority for TEST-73-LOCALE
172ffeb813 TEST-06-SELINUX: Disable RuntimeBuildSources=
2fd3514456 test: Add missing --no-rebuild to doc
69c9044525 meson: Bump version to 256.3
16b12506a6 core/cgroup: check root cgroup earlier for unit_get_memory_accounting
06c2ee3979 core/cgroup: make unit_has_host_root_cgroup take const Unit*
15732ee31f core: unify reset_accounting handling
50a0a55066 core: do not drop CGroupRuntime when unit stops, but only on GC
b08b5996d3 core/cgroup: use > 0 comparison rather than == 1
ffd90200b2 core/cgroup: actually make use of the cached accounting values
7684f52839 test-install-root: introduce test case for #33411
a42db16a1c shared/install: correctly report changes in install_info_symlink_alias()
bb83650f96 shared/install: propagate all errors in install_info_apply()
908edce5b6 shared/install: drop unneeded initialization
f414ca0ee3 systemctl: do not try to acquire triggering units for template units
67e0d09368 systemctl: skip triggering unit warning if unit vanished
bb71d5dfb4 man/systemctl: --no-reload is honored by mask/unmask/preset too
7122e226c3 logind-dbus: set gc_mode to USER_GC_BY_PIN when disable linger
5d6bf58cf2 logind-user: take gc_mode into account when reporting user state
bcb13a3fa2 test_ukify: do not use files from /boot
88264411b6 test_ukify: use sha384 in the signing tests
8b3bedd821 test_ukify: add instructions
168b788104 terminal-util: don't issue "ESC c" sequence on reset, but only when erasing the screen
5e4464bb64 mkosi: Bump default device timeout a little
0009ed8ee1 meson: Drop version from 256.3 to v256.2
1354f6194c meson: Drop ~devel suffix from systemd-stable version
fe37213c55 Merge pull request #33774 from DaanDeMeyer/mkosi-backport
677126d300 mkosi: Fix indentation
4c25e572a9 mkosi: Fix typo
400222fa1c mkosi: Drop util-linux from centos/fedora packages
dc3543a391 mkosi: Drop udev from Packages= list
82e2a5f47f mkosi: Fix formatting
11f065d3ee mkosi: Build CentOS Stream 10 images by default
c54eab5dd0 mkosi: Streamline running the integration tests without building systemd
3bde2db7a4 meson: Drop genkey target
baad1c0d0e mkosi: Skip sync script if NO_BUILD is enabled
102ed56c61 mkosi: Remove enforcing=0 from default kernel command line
611e82e660 mkosi: Stop setting apparmor=0
fa7892a690 docs: update mkosi version mentioned in HACKING.md (#33723)
ad444842e0 Merge pull request #33735 from DaanDeMeyer/backport-mkosi
a63e82ca4a repart: Allow overriding fstype per partition designator
9d05f2d559 mkosi: List library packages explicitly in VolatilePackages=
4a55046779 mkosi: Build initrd as a subimage
81bafc8dd9 mkosi: Drop CacheOnly=always from two subimages
1be0b1f54b TEST-13-NSPAWN: make sure we don't load libnss_systemd
0b9df91ce2 mkosi: Disable unique debug source names
89904fc10c systemd-networkd-tests: Skip tests requiring dhcpd if it is not available
c3342c3dc7 TEST-55-OOMD: Remove the opensuse user@ dropin
127f8362c1 mkosi: Install binutils
1a995b9d66 TEST-64-UDEV-STORAGE: Use max_ioqpairs instead of num_queues
367ad876a6 mkosi: Use clang --print-runtime-dir
8b859fa29d mkosi: Extend arch build script comment about symlinks
a8a7a6716e test: do not attempt to set xattr on tmpfs
3fc259ae25 mkosi: Add CI for CentOS Stream 10
945013a092 mkosi: Use squashfs for sysext if mkfs.erofs is not available
480f8fa839 mkosi: Make epel repositories optional for CentOS Stream 9
76e14148f6 mkosi: Introduce build image
abc3a61e59 mkosi: update fedora commit reference
748cd5a703 mkosi: Update to latest
6d07d59237 Merge pull request #33691 from DaanDeMeyer/backport-mkosi
180814f22f mkosi: Switch back to code.opensuse.org for opensuse
976a0d998e test: install split-out sshd-session binary if present
ca97b9a7e6 mkosi: update opensuse commit reference
fef4746218 tools/update-distro-hash: Fix path
54eb9b9301 TEST-06-SELINUX: Various fixes
de6c473b40 mkosi: Don't fail if /var/log/journal does not exist
74475a5169 test: Switch to ncat instead of nc
0c51e28088 TEST-55-OOMD: Switch to stress-ng
0c7d634157 docs: Simplify update commands in HACKING.md
5685a59371 mkosi: Update to latest
370bf11ec4 mkosi: Build a sysext if SYSEXT=1 is specified
0bdb879b3c mkosi: Check for configured build directory if WIPE=1
880c32b7e3 mkosi: Install erofs-utils
cd357eb029 Merge pull request #33674 from DaanDeMeyer/backport-mkosi
c350e02631 mkosi: Fix git commit
00bcc619db mkosi: Adapt configuration to take into account configuration rework
3cf12f4f9a mkosi: use apt pinning for locally built debian/ubuntu packages
7ab51fef1f mkosi: Make .autorelabel file empty
0123dbee1b mkosi: Update to latest
32981c454c build(deps): bump actions/checkout from 4.1.6 to 4.1.7
ab11d7e177 mkosi: policykit-1 was renamed to polkitd
8dd54e5adc mkosi: Use the "default" root filesystem for each distribution
d28aa922fd meson: add option to build systemd-executor "statically"
c3b4032fc3 meson: build libsystemd-core via an intermediate static library
9be2fe707e meson: rename libbasic to libbasic_static
fcbafc3ffe Bump meson version to 256.3~devel
c7e144eb4a Finalize v256.2
709655ea0d mkosi: switch debian to ci/v256-stable branch
e8bbe635cd workflows/labeler: do not set labels on stable backport PRs
aa1eb0b066 labeler: match all mkosi files
32f2b9bba6 labeler: remove matches for dropped files (Makefile)
9a2f16e4ed vmm: make sure we can handle smbios objects without variable part
c32f71aa14 README: update requirements for signed dm-verity
abba1e6bc2 sysusers: handle NSS errors gracefully
df1ed3fbe2 man: fully adopt ~/.local/state/
9d40e5c9c6 man: mention that distinction between /usr/lib/ and /usr/share/ is really about shared *ownership*
8dbb7e2a72 man: drop version info from file hiearchy man page
160b539a9d os-util: avoid matching on the wrong extension-release file
0ff6d2cf47 load-fragment: allow MountImages= with paths starting with /dev
cc4472c31e zsh: add run0 completions
d0a9cf084d docs: Update HACKING
a50e6c5709 README: add missing CONFIG_MEMCG kernel config option for oomd
71de25f2df boot: cover for hardware keys on phones/tablets
243276f008 core/manager: invoke special targets on signal only for system manager
efc44e0c3e core/dbus-manager: refuse SoftReboot() for user managers
399e788553 meson: Define __TARGET_ARCH macros required by bpf
a946258e9d coredump: correctly take tmpfs size into account for compression
05dcd242dc docs: update RELEASE.md to use same repository for stable branches
0a97db8789 docs: Add section to HACKING.md on distribution packages
3c91ea49d2 docs/CODING_STYLE: document that we nowadays prefer (const char*) for func ret type
ea92f16422 test: fix TEST-74-AUX-UTILS.ssh.sh on SUSE
f52475dcf3 test: preserve symlink in inst_recursive()
10b7e0a0af test: fix TEST-24-CRYPTSETUP on SUSE
4f7d6885a1 test: install /etc/hosts
e94e33b566 test: split the resolved test suite into separate test cases
4d561a0e08 mkosi: update debian commit reference
05c9bc547b units: add dep on systemd-logind.service by user@.service
d1cd66ca97 repart: add sections to --help text
c2f74defaa Conditional PSI check to reflect changes done in 5.13
df990be913 core: try again bind mounting if the destination was already created
24987eb3cc mkfs-util: Set sector size for btrfs as well
e34f436433 repart: Don't set filesystem sector size to 512
3c88c94432 repart: Log more about filesystem sector size
86d47d63b0 core/unit: follow merged units before updating SourcePath= timestamp too
9dec66fc5f meson: use less verbose quoting
6c8e99dedd TEST-54-CREDS: Use UEFI firmware if available
78631dcafd TEST-18-FAILUREACTION: Set auto firmware
71fb49d02c TEST-09-REBOOT: Set auto firmware
938f7b6f29 TEST-06-SELINUX: Explicitly pull in autorelabel.service
37412c952d TEST-70-TPM2: Use UEFI firmware if available
7ee60a8614 resolved: correct parsing of OPT extended RCODEs
711f843e3a TEST-45-TIMEDATE: Use syslog identifier journalctl match
6ead24fcac resolved: allow the full TTL to be used by OPT records
dc0167b674 TEST-64-UDEV-STORAGE: Make nvme_subsystem expected pci symlinks more generic
fb747bd8cd LICENSES/README: expand text to summarize state for binaries and libs
ffc8126cc6 test: pull in multi-user.target explicitly
b908f492bc TEST-64-UDEV-STORAGE: Fix python 3.9 compatibility
1c4f25c296 TEST-64-UDEV-STORAGE: Use bus pci slot 1 instead of 0
9663bb7410 TEST-58-REPART: reverse order of diff args
2f455914f7 man/tmpfiles: remove outdated behavior regarding symlink ownership
24dd273402 test-mountpoint-util: add a test for bind mounted symlinks
99cb4bdbbb mountpoint-util: do not assume symlinks are not mountpoints
4437967cab hostnamed: if polkit authentication fails for Varlink Describe() call, don't reply to client with an error
fb7ec285c9 core/exec-invoke: use sched_setattr instead of sched_setscheduler
5911f1ec25 cryptsetup: improve TPM2 blob display
57661f4ea9 util: make file_read() 64bit offset safe
e2fb3dda24 man/capsule@.service: the capsule user is prefixed with "c-" rather than "p_"
2547de4629 man/capsule@.service.xml: fix typo
98928cf0a7 nspawn, vmspawn: honor the new window title switch
9cbb3aadd5 run: add environment variable to prevent the setting of terminal title
81acc5b39a test-execute: add a test case for issue #33299
d008b3fb26 core: do not filter out write() if required in the very late stage
d580b1f850 core: use write() to send handoff timestamp
52eeeb7d3d seccomp-util: split out seccomp_filter_set_add_by_name()
8e775590f1 Fix typo in CAP_BPF description (#33464)
54910267ba test-network: check if static routes not overridden by NDisc routes
4fda6e8f34 network/ndisc: do not remove static routes when received RA with zero lifetime
34bef8dfac network/ndisc: do not override conflicting static routes
0b909bf685 core/exec-invoke: reopen OpenFile= fds with O_NOCTTY
52371fe526 core: verify WorkingDirectory= is outside of API VFS only under mount namespacing
ec5ac3ea53 terminal-util: use colon as separator for specifying color
421ccd7094 man: fix double is typo in systemd-tmpfiles
778034f42e test: skip test-cgroup-id on ENOSYS from cg_cgroupid_open
3174fae67b meson: bpf: propagate 'sysroot' for cross compilation
a6906475be kernel-install: correct the place where it works in man and help text
3e435e970d man/systemd.exec: list inaccessible files for ProtectKernelTunables
90b5cb35e9 Use consistent spelling of systemd.condition_first_boot argument
b6316b8fac login/user-runtime-dir: free ignored sd_bus_error, avoid triggering assertion
71546deef5 login/user-runtime-dir: use STRLEN where appropriate
fbfc88af5e pretty-print: take console glyph width into account when drawing progress bar
058fca7e6c mkosi: add support for TEST_SAVE_JOURNAL to integration test wrapper
50ae476efd semaphore: pin packaging to ci/v256/stable branch
771bb489bf test: skip TEST-69-SHUTDOWN on Debian
69c51768ef meson: Bump version to 256.2~devel
273b5622ac meson: Fix various versions
9150ffc98a src/boot/efi/meson.build: ensure VERSION_TAG exists in case of cross build
1eb122033f mkosi: Build a disk image by default again
84d6fec8f9 meson: Deal with potential stable versions
851f991b1c mkosi: bump to latest commit
3d3bc1d999 mkosi: Switch back to btrfs
ce41fdbfdc mkosi: Install btrfs-progs on CentOS as well
1566c15fe4 mkosi: Enable hyperscale-packages-experimental for CentOS
33ad0ea834 mkosi: Drop leftover systemd-coredump-debuginfo package for opensuse
2286ae91f4 mkosi: Drop s390x console patch from opensuse spec
7404ba69cf mkosi: use new standalone-shutdown package for debian's exitrd
3f0763b5a6 mkosi: update debian commit reference
9d0259e5bc mkosi: bump Debian Salsa commit to latest
87fc64db36 mkosi: install new split-out systemd packages
245d17d8dd mkosi: update arch commit reference
8717dc0dd4 mkosi: switch opensuse to devel branch
6f720b609a mkosi: update fedora commit reference
a09800cd16 mkosi: update fedora commit reference
e3703f4327 mkosi: Install zypper in opensuse images
a7da351f39 mkosi: Fix sync script git command
a39473aac7 mkosi: Clean up old packages from the build directory
2e0af5f6fe mkosi: remove conflicting deb packages from builddir
6a898c35da mkosi: Copy packages to the build directory as well
16ea64e2be mkosi: Make sure we don't hide errors from git merge-base
3f42d88faa mkosi: Install perf
f2c782c043 mkosi: Install pciutils
054fc83a23 mkosi: move variable to the right scope
8abb2e0f55 mkosi: Don't touch the packaging checkout if work is being done
59ab01d32f vmspawn: define QEMU_MACHINE_TYPE for loongarch64
ba28889c65 vmspawn: define QEMU_MACHINE_TYPE for riscv
715d146a3a docs: fix dead link to GNOME documentation
34ba18b012 logs-show: do not use _SOURCE_MONOTONIC_TIMESTAMP field
f8f669fd69 repart: fix memory leak
7b18adadde mkosi: restrict noble-backports to noble builds
08b8237303 tmpfiles: move --purge to command section in --help text where it belongs
e760157389 tmpfiles: insist on at least one configuration file being specified on --purge
90ec026570 tmpfiles: honour --dry-run when removing directories
c26e56d08f install: allow removing symlinks even for units that are gone
a776dcf7af NEWS: fix typo
d89c99c7ad mkosi: bump to latest
b455006ae1 CI: disable secure boot in mkosi GHA runs
4cc6da9a5d test-network: mention that the captive portal option is supported since v2.20
f7d55cc801 core/service: fix accept-socket deserialization
7d65709901 test: use 'auto' instead of 'uefi' for automated fallback
6178aa4bbc test: support TEST_NO_QEMU in mkosi integration wrapper
a36cb5660e test: support TEST_NO_KVM
df1e7d9572 test: drop obsolete comment
51a2e7be5e test: drop unneeded firmware: uefi setting
50b53b8221 test: check the skip condition before installing additional files
9802a28b36 mkosi: install EFI packages only on EFI architectures
21feae324e mkosi: use ports.ubuntu.com for non-x86 backports
9f5f3c2f8b mkosi: enable unprivileged user ns for integration tests
1a0e6961cf man,units: drop "temporary" from description of systemd-tmpfiles
aedeaf7450 man: add a bit of a warning to systemd-tmpfiles --purge
3706b5e8e9 fundamental: declare flex array updated for gcc15 and clang 19
51390a1f41 analyze: show pcrs also in sha384 bank
a61a83a22b CODING_STYLE: document "reterr_" return parameters
2034de6157 shell-completion: only offer devices for completion
4ebcdcb136 NEWS: note that new stable releases will be in the main repo
d316aed5d8 repart: Use CRYPT_ACTIVATE_PRIVATE
4a468387ac test: dump a simple summary at the end of TEST-02-UNITTEST
70f5fb2f7a repart: Use crypt_reencrypt_run() if available
ba031f1fe8 resolved: permit dnssec rrtype questions when we aren't validating
30df42a927 tpm2-setup: Don't fail if we can't access the TPM due to authorization failure
514ef0f93b strbuf: use GREEDY_REALLOC to grow the buffer
a3d94332a2 rules: Limit the number of device units generated for serial ttys
0d573787ea sd-dhcp-server: clear buffer before receive
f2b5c1ff51 hostnamed: don't allow hostnamed to exit on idle if varlink connections are still ongoing
d918804408 man/systemd: reorder content a bit
1c27c902ad Create CNAME
Dropped merged patches:
0001-src-boot-efi-meson.build-ensure-VERSION_TAG-exists-i.patch
0003-meson-bpf-propagate-sysroot-for-cross-compilation.patch
Changed git repo back to systemd main one since that is going to
be used for v256-stable branch and newer releases instead of the
systemd-stable git repo.
(From OE-Core rev: ab6c94006c1e902d63cdd04d978ea3b74fe811b2)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The base-files recipe provides /var/tmp -> /var/volatile/tmp symlink
which is in conflict with systemd upstream tmpfiles.d/tmp.conf which
defines it as a directory (or subvolume on btrfs).
This generates following error in journal:
Jul 03 15:37:21 qemux86-64 systemd-tmpfiles[158]: "/var/tmp" already exists and is not a directory.
Mitigate the issue by defining /var/tmp as symlink corresponding to
the one created by base-files.
(From OE-Core rev: 1f1f6f45e3cfe24dfee8a09d01a5d32f3080e381)
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The systemd-mime package is added as a recommendation for systemd so
that it is installed by default, but can be excluded, e.g., via
BAD_RECOMMENDATIONS. Excluding it avoids pulling in the MIME database
for products that have no use for it.
(From OE-Core rev: 5560243137f772683e53b614f134dd632b62be8b)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There was a mix of using tabs and spaces for indentation.
(From OE-Core rev: e0442c791578c55c7f198ae389cb820a7bf437d5)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In postinstall we run this script on target
these days systemd-hwdb is recommended
Fixes
...
Configuring udev-hwdb.
udevadm hwdb is deprecated. Use systemd-hwdb instead.
(From OE-Core rev: 16f3eba7f5097976a53e3ffabd3723d889df56e6)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The patch 0001-src-boot-efi-meson.build-ensure-VERSION_TAG-exists-i.patch for
systemd-boot is also required by systemd to resolve VERSION_TAG related build
error.
(From OE-Core rev: dd0100137f5f7bcaea7f665ac08754a682cb2983)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When VOLATILE_LOG_DIR evaluates as True, the base-files recipe provides
/var/log -> /var/volatile/log symlink which is in conflict with systemd
upstream tmpfiles.d/var.conf.in which defines it as a directory.
This generates following error in journal:
Jul 03 14:28:00 qemux86-64 systemd-tmpfiles[165]: "/var/log" already exists and is not a directory.
Mitigate the issue by defining /var/log as symlink corresponding to
the one created by base-files, when appropriate.
(From OE-Core rev: 711ee36e88c8968e3c45ea787b3adcf64352adf9)
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The 'cgroupv2' PACKAGECONFIG is dropped as systemd now only supports
cgroupv2.
The 'kmod' PACKAGECONFIG is now added 'libkmod' as a runtime dependency.
This is because systemd 256 uses dlopen to make use of libkmod, and there's
no way for our library detection codes to know this and add such dependency
automatically. So we add it explicitly.
mime is now inherited because ${datadir}/mime/packages/io.systemd.xml
is a mime type file.
For musl specific patches, most are refreshed. One old patch is dropped,
and four new ones are added.
Newly added:
build-path.c: avoid boot time segfault for musl
adjust header inclusion order to avoid redeclaration
undef stdin for references using stdin as a struct member
include signal.h to avoid the 'undeclared' error
Dropped:
src/basic/missing.h: check for missing strndupa
(drop reason: systemd does not use strndupa any more)
(From OE-Core rev: 89b75b46371d5e9172cb496b461824d8551a2af5)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We're currently encouraging an "arms race" with the FLAGS variables since
a recipe might want to set a specific flag for all variants but to do so,
+= won't work due to the assignment in the native/nativesdk class files. This
means recipes are using append.
Since the default variables are constructed out of TARGET_XXX variables and
we redefine these, there is no need to re-define the un-prefixed variables. If
we drop that, the += appends and similar work and recipes don't have to resort
to append.
Change the classes and cleanup a number of recipes to adapt to the change. This
change will result in some flags appearing to some native/nativesdk variants
but that is probably what was originally expected anyway.
(From OE-Core rev: a157b2f9d93428ca21265cc860a3b58b3698b3aa)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pass the "recipe-sysroot" path via the CFLAGS=--sysroot= to the
compiler used by systemd to build the BPF, so that it can find the
needed system includes.
(From OE-Core rev: 25560c19ac7629615adb2b1a71b05d36b0d157d5)
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The eBPFs are pre-compiled during the systemd-build with a different
compiler than the cross-compiler used to build systemd itself.
This is either a 'clang-native' or a gcc (bpf-unknown-none) which do
not see the BUILD_CFLAGS, that point to the correct include search
patch. To address this have systemd's meson.build "propagate" the
--system from the C_FLAGS into the BPF compiler call.
(From OE-Core rev: 3a4d5b06f8e4ebf7b4738a99fe6b352bb03a64ae)
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
According to meson.build, tmp.mount is installed under
"prefixdir/'lib/systemd/system'", but for 64bit system, rootlibdir is
/usr/lib64/systemd/system, this make tmp.mount not removed, and /tmp
still mounted as tmpfs filesystem. Fixed by using rootlibexecdir, which
is /usr/lib/systemd/system.
(From OE-Core rev: b44734c889b1b09fbbaea4d9195026707c55cbee)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
