openssl has some assembler code that has PAC and BTI hints but not GCS. The
systemd recipe then links to libcrypto from openssl with GCS enabled (as
that is a distro-wide setting) and it - correctly - warns that it is being
told to use GCS but one of the inputs does not have GCS. This would not
be a problem but systemd also links with —fatal-warnings, so the build
explodes.
libcrypto.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
| collect2: error: ld returned 1 exit status
(From OE-Core rev: 295e30eac69e152778246c7271b72f7e8498a40a)
Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If extra-utils package is not included in the image, you'll always see a
warning that password agent is missing whenever you start/stop a service:
Failed to execute /usr/bin/systemd-tty-ask-password-agent: No such file or directory
(From OE-Core rev: a87d523ab24e4ea87d1b19ea3a0c515cc47db1b6)
Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The systemd-serialgetty recipe generates explicit units for consoles
that are defined in SERIAL_CONSOLES, and if that variable is not defined
then just produces an empty package.
Even when systemd has been configured to use the getty generator, if
there are explicit consoles defined then we should respect them. Don't
conditionalise the dependency on systemd-serialgetty so that we always
pull in the explicit consoles.
(From OE-Core rev: a7036173acdb84d516f17257e02a936f04c584d8)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Until recently, even when the getty generator was disabled in the
systemd recipe it was actually still active. This was because the old
behaviour was to delete the serial-getty template unit if the generator
was disabled, but the systemd-serialgetty package shipped then shipped
the same files so the generator continued to run. This was a bug in the
original commit[1] so this behaviour has been present since 2016.
My recent fixes[2] changed this: if the getty generator was disabled
then the generator itself is deleted. This makes the actual behaviour
match the intention, but the consequence was to demonstrate that some
modern platforms were relying on this unexpected behaviour: specifically
the genericarm64 BSP which intends to support a number of virtual and
physical boards with a number of serial console ports that are not
really suitable to be hardcoded into SERIAL_CONSOLES:
- ttyS0
- ttyAMA0 (AMBA PL011 uart)
- ttyS2 (BeagleBone Play, S0 and S1 are internal)
- hvc0 (KVM)
- ttyPS1 (AMD KV260)
- And most likely more
Restore the existing behaviour by explicitly enabling the serial getty
generator: this means that systemd will automatically bring up a getty
on the first serial console it finds.
In the future we should extend some level of dynamic console-finding to
sysvinit-based systems by searching for a console device in inittab, but
for now this reverts the unintentional regression.
[1] oe-core 2a8d0df47c9 ("systemd: make systemd-serialgetty optional")
[2] oe-core 2beb3170af6 ("systemd: if getty generator is disabled remove
the generator, not the units")
(From OE-Core rev: af15f9d1609708443ed036fdb611cea92f566620)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These classes/recipes inherit qemu.bbclass but do not use anything from it.
What they use is qemuwrapper-cross, which is needed at do_rootfs time and
needs to be pulled-in by PACKAGE_WRITE_DEPS.
Also, in meta/conf/layer.conf, exclude qemuwrapper-cross deps for all arch
recipes that depend on it. This it ensure allarch recipes have the same
signature across different machines.
(From OE-Core rev: 6f3ce94f4c03e7b26f1fcdf78ea969f57717ec56)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The tmpfiles config for systemd-resolve has been split out [1],
so correct tmpfile.d file for resolv.conf in our recipe accordingly.
[ YOCTO # 15768]
[1] b15f6eae42
(From OE-Core rev: a3020c11c91304b7400bc19f80e44e7d3720281d)
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In order to facilitate oe-core users who wish to use e.g. dbus-broker
as their runtime D-Bus implementation, change the Freedesktop.org
specific D-Bus runtime dependency to honor the new VIRTUAL-RUNTIME_dbus
variable.
(From OE-Core rev: f9a41652f7b40edf84278c0f3922321a613297f7)
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is no reason to use EXTRA_OEMESON:append when += will do.
(From OE-Core rev: 2ebd45d351dbf801a5aef0cc4a0a1c684e544412)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of the python re-implementation build the actual systemctl from
the systemd source tree. The python script was used when systemd didn't
provide an option to build individual executables. It is possible in the
meantime, so instead of always adapting the script when there's a new
functionality, we simply use upstream implementation.
License-Update: Base recipe is used
(From OE-Core rev: 7a580800db391891a3a0f838c4ae6e1513c710a2)
Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Now that systemd isn't deleting the serial-getty@.service unit template
files, we can simply symlink to the files provided by systemd instead of
shipping a copy of them in this recipe.
This ensures that the getty units triggered by the systemd are identical,
be them via SERIAL_CONSOLES or the generator.
(From OE-Core rev: b6a7617145c3acf9f79888e7555e7706cd55a350)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If the getty generator is disabled then it's neater to remove just the
generator tool instead of the unit files as the unit files are still
useful.
(From OE-Core rev: 2beb3170af6ebf3a6fff6953a2d48f70f61b959f)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
bitbake.conf defines a default value, so there's no value in setting
another default here that doesn't match the rest of the system.
(From OE-Core rev: 86586f4956879ad1b906f198dc258c88f64ef179)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
systemd's sysusers.d/systemd-remote.conf contains the user
"systemd-journal-remote" [1]. This file is currently not part of any
specific package.
To make this match the corresponding USERADD_PARAM:${PN}-journal-remote
for the same user, move the file to the correct package.
This prevents warnings in case PACKAGECONFIG contains "microhttpd" but
systemd-journal-remote is not installed, such as:
WARNING: some-image-1.0-r0 do_rootfs: User systemd-journal-remote has never been defined
[1] https://github.com/systemd/systemd/blob/v257.3/sysusers.d/systemd-remote.conf
(From OE-Core rev: 2d50d3595502e65e3b0997800a6dc60ca3e10100)
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The dependency on python3-lxml-native was missing, so the generation of
man page indices was skipped (systemd.index and systemd.directives).
(From OE-Core rev: be19e4cd6466cbf967e5301c1a3cdd853d22d250)
Signed-off-by: Alexis Cellier <alexis.cellier@smile.fr>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
systemd update from 256 to 257 broke kernel secureboot signatures
inside signed UKI files with u-boot based UEFI firmware, e.g.
meta-arm and qemuarm64-secureboot machine config and secureboot:
$ cd meta-arm
$ kas build ci/poky.yml:ci/qemuarm64-secureboot.yml:ci/uefi-secureboot.yml:ci/testimage.yml
systemd-boot itself is secureboot signed and verified by firmware.
Same for the UKI file which combines kernel, initramfs etc.
Then kernel from UKI is additionally executed using UEFI firmware calls
which check signatures so the kernel binary inside signed UKI
needs to be signed with same keys too. PE file padding added
to systemd ukify in 257 release broke kernel signature validation
for u-boot and sbsign/sbverify tools. EDK2 based firmware like
OVMF may not be affected because systemd-boot is able to disable
signature checking after a signed UKI has been loaded. This feature
is not supported by u-boot.
Upstream systemd bug report:
https://github.com/systemd/systemd/issues/35851
Backport of:
38801c9129
Cc: Jon Mason <jdmason@kudzu.us>
Cc: meta-arm@lists.yoctoproject.org
(From OE-Core rev: 979d8b16a5238ea368b2ee39d436b6e13d94b076)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The tasks were deleted and do_patch() was run after do_install()
which means that patches applied in SRC_URI were not in the
ukify.py binary installed. Moving do_install() to after do_patch()
fixes this.
(From OE-Core rev: 0218a7a7dbf12ef817608881a3a17d9670c0778a)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add some comments to clarify exactly what this recipe is for.
(From OE-Core rev: bbaafe11189b4b14ab84576e5eddd709b7f0ef1b)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fixes handling of units with instance name in theirs filenames such
as `gnome-shell@wayland.service` or `gnome-shell@x11.service`. Such
files cause template file to be ignored (for the specific instance).
Thanks to Markus Volk <f_l_k@t-online.de> for noticing the breakage when
building images with gnome-shell:
| Error: Systemctl preset_all issue in org.gnome.Shell@wayland.service
| WARNING: /home/flk/poky/build/tmp/work/intel_corei7_64-poky-linux/gnome-image/1.0/temp/run.systemd_preset_all.2011511:158 exit 1 from 'systemctl --root="/home/flk/poky/build/tmp/work/intel_corei7_64-poky-linux/gnome-image/1.0/rootfs" --global --preset-mode=enable-only preset-all'
The problem manifested after cdc3b3028f6d71788b5fdd99436f69fbf18f613e
because we enabled preset-all for user units -
org.gnome.Shell@wayland.service is a user service, so prior to that
change the file wasn't processed at all.
The error was triggered because there is no org.gnome.Shell@.service
file. With this patch applied systemctl script looks for instance unit
file and falls back to template unit in case of lack thereof, keeping
the same behavior upstream systemctl does.
(From OE-Core rev: 7eaad7c2a118b3d9db8b694730535afcd3ca985e)
Signed-off-by: Artur Kowalski <arturkow2000@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Commit f82d9c997ba (systemd: enable create-log-dirs) removed the
creation of the /var/log/README symbolic link by using sed. However, the
update to 257 changed the target line and the sed expression no longer
matches. Rather than correcting the sed expression, use a patch to
remove /var/log/README so that any future changes do not go unnoticed.
(From OE-Core rev: 76cf5994262f9fd76cf27e111eb67ad1645541f1)
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
The flag is similar to --user flag as it causes systemctl to operate on
user units, but it performs operations globally for all users. This is
required for user presets support.
(From OE-Core rev: ab6476d28485598ae842472a7b15ca7bf244c776)
Signed-off-by: Artur Kowalski <arturkow2000@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
systemd v256 introduces `mountfsd` and `nsresourced` as meson options,
make them PACKAGECONFIG so recipes could enable or disable the feature
by selecting PACKAGECONFIGs.
(From OE-Core rev: b091917424ac31fc9c188a16e653501d3a8b0afd)
Signed-off-by: Lei YU <yulei.sh@bytedance.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
To make use of the hardware watchdog it is sufficient to set
the RuntimeWatchdogSec= option in /etc/systemd/system.conf.
It defaults to 0 (i.e. no hardware watchdog use). Set it to
a value like 20s and the watchdog is enabled.
ref: https://0pointer.de/blog/projects/watchdog.html
(From OE-Core rev: 1c61a1eb9c4faa9ab32b0440bbdd88c22c3cd945)
Signed-off-by: Benjamin Szőke <egyszeregy@freemail.hu>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Patch changes:
* 0003-coredump-set-ProtectHome-to-read-only.patch is drop as it's a backported patch.
* 0009-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch is drop as
AT_SYMLINK_NOFOLLOW has been supportd in musl.
* Other patches are either refreshed or changed to fit the current version.
systemd-boot changes:
* Use src/boot instead src/boot/efi in do_install and do_deploy. See upstream
change 97318131fd06 (Rename src/boot/efi to just src/boot).
(From OE-Core rev: 4891f47cdaf919033bf1c02cc12e4805e5db99a0)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
To enable FIDO support.
meta-oe can provide libfido2 but it depends on udev
which creates a dependency loop between systemd (provider of udev)
and libfido2 which is currently unresolved. systemd recipe
could split udev to a separate recipe to solve this, or libfido2
could be compiled in systemd source tree after udev but before
rest of systemd.
(From OE-Core rev: 1e347c36b0d3910cd71b24a4e4ab8e2dd49063d1)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
systemd.inc is used by systemd, systemd-boot and
systemd-tools-native recipes so make sure all
match to "systemd" product in CVE database. The
split between systemd, systemd-boot and
systemd-tools-native is specific to oe-core and
upstream just refers to systemd. Not limiting
to "systemd_project" vendor since multiple
vendor names have been used in the past.
(From OE-Core rev: eb46ad379170f0a80ac2d061fa02c118f5ed1d31)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently pni-names PACKAGECONFIG option adds "mac" names policy if
selected, but nothing otherwise. In systemd Predictable Network Interface
Names are applied by default which leads to inconsistend behaviour.
One could think that pni-names in DISTRO_FEATURES would enable or disable
Predictable Network Interface Names, but currently if not present it's
only actively disabled for QEMU via kernel command line
(commit 9e9c33d51e40
("qemuboot/runqemu: Fix 6.2 and later kernel network device naming")).
It has no effect on the real HW. If the option is present, it merely adds
"mac" into default NamePolicy, which may or may not have observable
effects.
Make pni-names semantics more consistent by actively suppressing
Predictable Network Interface Names if the feature is not present.
(From OE-Core rev: 37b98bc93bc404823cc4bbf9039e4d114aac33fa)
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is a race here where postinst relies on existence of
various files from other packages on the target rootfs to
operate properly, but doesn't ensure that it runs after all
of those packages have been installed. Adding dependencies
on those packages is not a solution as the recipe
is not supposed to bring them into rootfs, only make
adjustments if they are present.
This commit moves postinst execution to the first boot; another
solution would be to replace the whole recipe with ROOTFS_POSTPROCESS_COMMAND.
This was exposed with rpm 4.20 which rearranges the order
in which packages are installed, and exposes the issue.
(From OE-Core rev: e88f22da19a7f3f9bf23f2a607ffde6b5b1a3265)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The rootprefix build option was deprecated in systemd 255, making the
custom rootlibexecdir unnecessary, so remove it in favor of the standard
nonarch_libdir definition.
(From OE-Core rev: c89b34401dfbe65de5a32bf8b4ef32902d868ce1)
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Support for split-usr and unmerged-usr were both removed as part of the
systemd 255 release, so remove the current deprecated rootlibdir,
rootprefix and split-usr options from the recipe.
(From OE-Core rev: 94ec821600c36baaeeb81f3d2ce0cc6d2d22082a)
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
intltool was dropped as a dependency in v236
See commit for reference:
c81217920e
(From OE-Core rev: c82a1b71fd21b4f1299c7610342c5d821de7f1bb)
Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
intltool was dropped as a dependency in v236
See commit for reference:
c81217920e
(From OE-Core rev: bd7353f2794120bc2b88adfea0ee06361a0b7dd5)
Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There are two behavioural differences between the objcopy in binutils
and llvm which resulted in build failures when building systemd with
clang:
1) If the section specified in --dump-section doesn't exist, binutils
set an exit code of 0 whereas llvm sets 1. This means we need to handle
the exit code so that we raise exceptions on unexpected failures, but
return an empty byte string if the segment isn't found.
2) binutils writes the section to the file name directly, whereas llvm
writes to a temporary file and renames. This means we can't read the
open fd directly, and instead need to re-open the file to read it.
(From OE-Core rev: 98879a8dbd1b7887b43a074193925bf1a55d44e7)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
First, this is likely not the final implementation, but a RFC and
prototype.
Some binaries don't dynamically link to libraries, but instead at runtime
dlopen() them. This means extra work for distributions as the dependencies
are not detected automatically, so libraries may be missing.
systemd is one such project which does this, and in an attempt to solve
the packaging problem it also embeds the names of the libraries that can
potentially be opened at runtime into ELF notes. These can be read to
generate package dependencies. For example:
packages/cortexa57-poky-linux/systemd/libsystemd-shared: RRECOMMENDS: added "libkmod (['>= 33']) libzstd (['>= 1.5.6'])"
packages/cortexa57-poky-linux/systemd/libsystemd: RRECOMMENDS: added "libzstd (['>= 1.5.6'])"
I expect this code to be changed before merging. Whilst systemd is the
main user of his approach right now, I expect to see it used in more
places in the future so there's a reasonably good argument to merge it
into the core shlibs code. Also it currently manually extracts and
parses the data, whereas maybe we should incorporate pyelftools into
meta/lib/oe and use that to parse ELF files across all of OE.
This also means we can remove the explicit dependency on libkmod in udev,
which now comes in via libsystemd-shared.
(From OE-Core rev: 905da779bcfe98f105adac708e0045ce8ffe5636)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Recently the systemd recipe grew support for setting the epoch time
at image build time. Unfortunately this is unconditional, and our
use case for the set-time-epoch PACKAGECONFIG is we have a system
requirement that our product boot with the time set to the UNIX
epoch.
Instead of trying to complicate things with either an image hook or
overriding the systemd recipe, just make setting the epoch at image
time optional, with the same PACKAGECONFIG that controls hardcoding
the systemd build time as the default epoch.
(From OE-Core rev: ae433b35fb2d5475e33dea61e6bc65d83d3af56a)
Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When systemd is started, it sets the system clock to epoch to ensure the
system clock is reasonably initialized if no working RTC.
As init process, systemd sets epoch very early to the more recent
timestamp of[1]:
- the build time of systemd (-Dtime-epoch)
- the modification time ("mtime") of /var/lib/systemd/timesync/clock
(systemd-timesyncd)
- the modification time ("mtime") of /usr/lib/clock-epoch (systemd)
The first epoch timestamp is hard-coded at build-time by the systemd
recipe (using either SOURCE_DATE_EPOCH, git-tag, or NEWS modification
time[2]).
The second epoch timestamp is maintained at run-time if the system runs
systemd-timesyncd.
This implements the third epoch timestamp at image build-time, by
touching the timestamp file /usr/lib/clock-epoch from the package
post-install script.
[1]: 863098fdc9
[2]: https://github.com/systemd/systemd/blob/v256/meson.build#L804-L825
(From OE-Core rev: 0f51fee4a5408c17cbaf827053f13d6c3b9dbc2c)
Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since commit[1], PACKAGECONFIG[sysvinit] is not enabled by default when
sysvinit is not in DISTRO_FEATURES, which causes the following
sysvinit-compatible commands/services to not be built and installed:
runlevel
telinit
rc-local.service
systemd-initctl
systemd-initctl.service
systemd-rc-local-generator
systemd-sysv-generator
systemd-update-utmp-runlevel.service
Therefore, links to these commands/services should only be created when
PACKAGECONFIG[sysvinit] is enabled.
[1] https://git.openembedded.org/openembedded-core/commit/?id=3668235fd60a9027608f37251c4b453ed21b3687
(From OE-Core rev: a20b698f1acdee972cf1ff570b09a2e2c36bef1a)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
