Commit Graph

752 Commits

Author SHA1 Message Date
Niko Mauno
c4b1070d55 systemd: Support using alternative runtime D-Bus
In order to facilitate oe-core users who wish to use e.g. dbus-broker
as their runtime D-Bus implementation, change the Freedesktop.org
specific D-Bus runtime dependency to honor the new VIRTUAL-RUNTIME_dbus
variable.

(From OE-Core rev: f9a41652f7b40edf84278c0f3922321a613297f7)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-04-01 22:05:54 +01:00
Peter Kjellerstedt
41ec3e8bff systemd-systemctl-native: Use += instead of :append
There is no reason to use EXTRA_OEMESON:append when += will do.

(From OE-Core rev: 2ebd45d351dbf801a5aef0cc4a0a1c684e544412)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-04-01 11:58:25 +01:00
Wang Mingyu
8ba702dcd7 systemd: upgrade 257.3 -> 257.4
(From OE-Core rev: 4c3f6657467dafb529ab1ef7f7576ddca91cbeb7)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-03-19 11:49:45 +00:00
Daniel Ammann
2e09710198 systemd: Fix typo in 00-create-volatile.conf
Also do a minor white space tweak.

(From OE-Core rev: 0e0e3b9474a88c62810d87268765aadea97714c0)

Signed-off-by: Daniel Ammann <daniel.ammann@bytesatwork.ch>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-03-13 11:00:36 +00:00
Alexander Kanavin
6bc68a4e28 systemd-systemctl-native: correctly set PV
(From OE-Core rev: 8514809f0ce06dc146774d753d8eb061620b5bb5)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-03-11 21:29:50 +00:00
Vyacheslav Yurkov
03b8e2ec1e systemd: Build the systemctl executable
Instead of the python re-implementation build the actual systemctl from
the systemd source tree. The python script was used when systemd didn't
provide an option to build individual executables. It is possible in the
meantime, so instead of always adapting the script when there's a new
functionality, we simply use upstream implementation.

License-Update: Base recipe is used

(From OE-Core rev: 7a580800db391891a3a0f838c4ae6e1513c710a2)

Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-03-09 20:10:06 +00:00
Ross Burton
d1eaffbd6b systemd-serialgetty: use existing unit files in systemd
Now that systemd isn't deleting the serial-getty@.service unit template
files, we can simply symlink to the files provided by systemd instead of
shipping a copy of them in this recipe.

This ensures that the getty units triggered by the systemd are identical,
be them via SERIAL_CONSOLES or the generator.

(From OE-Core rev: b6a7617145c3acf9f79888e7555e7706cd55a350)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-03-06 11:16:46 +00:00
Ross Burton
5935e0ab57 systemd: if getty generator is disabled remove the generator, not the units
If the getty generator is disabled then it's neater to remove just the
generator tool instead of the unit files as the unit files are still
useful.

(From OE-Core rev: 2beb3170af6ebf3a6fff6953a2d48f70f61b959f)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-03-06 11:16:46 +00:00
Ross Burton
69dc1fb011 systemd-serialgetty: don't set a default SERIAL_CONSOLES
bitbake.conf defines a default value, so there's no value in setting
another default here that doesn't match the rest of the system.

(From OE-Core rev: 86586f4956879ad1b906f198dc258c88f64ef179)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-03-06 11:16:46 +00:00
Bastian Krause
ffdc020519 systemd: move sysusers.d systemd-remote to PN-journal-remote
systemd's sysusers.d/systemd-remote.conf contains the user
"systemd-journal-remote" [1]. This file is currently not part of any
specific package.

To make this match the corresponding USERADD_PARAM:${PN}-journal-remote
for the same user, move the file to the correct package.

This prevents warnings in case PACKAGECONFIG contains "microhttpd" but
systemd-journal-remote is not installed, such as:

  WARNING: some-image-1.0-r0 do_rootfs: User systemd-journal-remote has never been defined

[1] https://github.com/systemd/systemd/blob/v257.3/sysusers.d/systemd-remote.conf

(From OE-Core rev: 2d50d3595502e65e3b0997800a6dc60ca3e10100)

Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-02-27 10:55:17 +00:00
Alexis Cellier
cbde82f70b systemd: Fix man page indices generation
The dependency on python3-lxml-native was missing, so the generation of
man page indices was skipped (systemd.index and systemd.directives).

(From OE-Core rev: be19e4cd6466cbf967e5301c1a3cdd853d22d250)

Signed-off-by: Alexis Cellier <alexis.cellier@smile.fr>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-02-21 13:08:44 +00:00
Mikko Rapeli
305326079b systemd: depend on util-linux-mkswap
busybox mkswap doesn't support all needed options.
Fixes:

systemd[1]: Activating swap /dev/disk/by-uuid/38d0b388-9989-4744-8a0a-3e6be1135f5a...
swapon[210]: swapon: /dev/sda3: swap format pagesize does not match.
swapon[210]: swapon: /dev/sda3: reinitializing the swap.
swapon[212]: mkswap: invalid option -- 'U'
swapon[212]: BusyBox v1.37.0 () multi-call binary.
swapon[212]: Usage: mkswap [-L LBL] BLOCKDEV [KBYTES]
systemd[1]: dev-disk-by\x2duuid-38d0b388\x2d9989\x2d4744\x2d8a0a\x2d3e6be1135f5a.swap: Swap process exited, code=exited,

(From OE-Core rev: 50d139f5748432e68b8f66cd4ecfd6e2ad677ed3)

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-02-21 13:08:44 +00:00
Chen Qi
a75a919592 systemd/systemd-boot: upgrade from 257.1 to 257.3
0001-ukify-measure-Revert-changes-to-use-SizeOfImage-from.patch is
dropped as it is in the new version.

(From OE-Core rev: 5c72734dc99d1287e805530d925a37c9aa70ba9d)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-02-18 12:04:03 +00:00
Mikko Rapeli
3582905ff9 systemd-boot-native: fix kernel signature for secureboot
systemd update from 256 to 257 broke kernel secureboot signatures
inside signed UKI files with u-boot based UEFI firmware, e.g.
meta-arm and qemuarm64-secureboot machine config and secureboot:

$ cd meta-arm
$ kas build ci/poky.yml:ci/qemuarm64-secureboot.yml:ci/uefi-secureboot.yml:ci/testimage.yml

systemd-boot itself is secureboot signed and verified by firmware.
Same for the UKI file which combines kernel, initramfs etc.
Then kernel from UKI is additionally executed using UEFI firmware calls
which check signatures so the kernel binary inside signed UKI
needs to be signed with same keys too. PE file padding added
to systemd ukify in 257 release broke kernel signature validation
for u-boot and sbsign/sbverify tools. EDK2 based firmware like
OVMF may not be affected because systemd-boot is able to disable
signature checking after a signed UKI has been loaded. This feature
is not supported by u-boot.

Upstream systemd bug report:

https://github.com/systemd/systemd/issues/35851

Backport of:

38801c9129

Cc: Jon Mason <jdmason@kudzu.us>
Cc: meta-arm@lists.yoctoproject.org
(From OE-Core rev: 979d8b16a5238ea368b2ee39d436b6e13d94b076)

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-02-10 13:03:58 +00:00
Mikko Rapeli
29bccf5ae1 systemd-boot-native: move do_install() to after do_patch()
The tasks were deleted and do_patch() was run after do_install()
which means that patches applied in SRC_URI were not in the
ukify.py binary installed. Moving do_install() to after do_patch()
fixes this.

(From OE-Core rev: 0218a7a7dbf12ef817608881a3a17d9670c0778a)

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-02-10 13:03:58 +00:00
Ross Burton
a86627cffa systemd-serialgetty: add comments explaining use
Add some comments to clarify exactly what this recipe is for.

(From OE-Core rev: bbaafe11189b4b14ab84576e5eddd709b7f0ef1b)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-02-05 12:49:55 +00:00
Artur Kowalski
aab0fdf3b7 systemd-systemctl: fix handling of instance unit files
This fixes handling of units with instance name in theirs filenames such
as `gnome-shell@wayland.service` or `gnome-shell@x11.service`. Such
files cause template file to be ignored (for the specific instance).

Thanks to Markus Volk <f_l_k@t-online.de> for noticing the breakage when
building images with gnome-shell:

| Error: Systemctl preset_all issue in org.gnome.Shell@wayland.service
| WARNING: /home/flk/poky/build/tmp/work/intel_corei7_64-poky-linux/gnome-image/1.0/temp/run.systemd_preset_all.2011511:158 exit 1 from 'systemctl --root="/home/flk/poky/build/tmp/work/intel_corei7_64-poky-linux/gnome-image/1.0/rootfs" --global --preset-mode=enable-only preset-all'

The problem manifested after cdc3b3028f6d71788b5fdd99436f69fbf18f613e
because we enabled preset-all for user units -
org.gnome.Shell@wayland.service is a user service, so prior to that
change the file wasn't processed at all.

The error was triggered because there is no org.gnome.Shell@.service
file. With this patch applied systemctl script looks for instance unit
file and falls back to template unit in case of lack thereof, keeping
the same behavior upstream systemctl does.

(From OE-Core rev: 7eaad7c2a118b3d9db8b694730535afcd3ca985e)

Signed-off-by: Artur Kowalski <arturkow2000@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-02-05 12:49:55 +00:00
Peter Kjellerstedt
73a7cb2701 systemd: Remove /var/log/README using a patch
Commit f82d9c997ba (systemd: enable create-log-dirs) removed the
creation of the /var/log/README symbolic link by using sed. However, the
update to 257 changed the target line and the sed expression no longer
matches. Rather than correcting the sed expression, use a patch to
remove /var/log/README so that any future changes do not go unnoticed.

(From OE-Core rev: 76cf5994262f9fd76cf27e111eb67ad1645541f1)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
2025-01-23 12:14:29 +00:00
Artur Kowalski
1bb9a3caf3 systemd-systemctl: add support for --global flag
The flag is similar to --user flag as it causes systemctl to operate on
user units, but it performs operations globally for all users. This is
required for user presets support.

(From OE-Core rev: ab6476d28485598ae842472a7b15ca7bf244c776)

Signed-off-by: Artur Kowalski <arturkow2000@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-01-21 12:07:56 +00:00
Lei YU
47d5dcef90 systemd: PACKAGECONFIG mountfsd and nsresourced
systemd v256 introduces `mountfsd` and `nsresourced` as meson options,
make them PACKAGECONFIG so recipes could enable or disable the feature
by selecting PACKAGECONFIGs.

(From OE-Core rev: b091917424ac31fc9c188a16e653501d3a8b0afd)

Signed-off-by: Lei YU <yulei.sh@bytedance.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-01-14 11:57:52 +00:00
Benjamin Szőke
7f9b94a8a2 systemd: Add WATCHDOG_RUNTIME_SEC optional variable
To make use of the hardware watchdog it is sufficient to set
the RuntimeWatchdogSec= option in /etc/systemd/system.conf.
It defaults to 0 (i.e. no hardware watchdog use). Set it to
a value like 20s and the watchdog is enabled.

ref: https://0pointer.de/blog/projects/watchdog.html
(From OE-Core rev: 1c61a1eb9c4faa9ab32b0440bbdd88c22c3cd945)

Signed-off-by: Benjamin Szőke <egyszeregy@freemail.hu>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-01-08 13:25:11 +00:00
Changqing Li
f1f926c70a systemd: enable create-log-dirs
By default, create-log-dirs  is enabled in systemd, and a link
/var/log/README will be created, point to {{DOC_DIR}}/README.logs, but,
for oe, there are two problems here, firstly, DOC_DIR is packaged in
another package systemd-doc, so /var/log/README is a dead link when
systemd-doc is not installed, secondly, even systemd-doc is installed,
when volatile log is used, DOC_DIR is a wrong relateive path, Refer [1].

So in commit [2], we disable create-log-dirs for above issue. with this
change, /var/log/journal is not created, and /run/log is used, this
makes systemd log always non persistent, refer [3][4]. if user need
persistent log, they need to disable volatile log, and also  change
journald.conf, make "Storage" to "persistent". This is a behavoir change.
Previously, to make systemd log persistent, user only need to disable
volatile log.

This commit reenable create-log-dirs to revert the behavior change, and
since README is not very userful, just remove it.

[ YOCTO #15678 ]

[1] https://github.com/systemd/systemd/blob/main/tmpfiles.d/legacy.conf.in#L16
[2] https://git.openembedded.org/openembedded-core/commit/?id=18d46e11d85da1f6feaba5a135931e43060024d6
[3] https://github.com/systemd/systemd/blob/main/src/journal/meson.build#L189
[4] https://www.freedesktop.org/software/systemd/man/journald.conf.html
[5] https://bugzilla.yoctoproject.org/show_bug.cgi?id=15678

(From OE-Core rev: f82d9c997ba8cc23b472d44a43489c597bf452af)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-01-03 11:05:03 +00:00
Wang Mingyu
577d978f9c systemd: upgrade 257 -> 257.1
(From OE-Core rev: 4c4f4798862d80f44e03ccbbe7efc2d8b723968c)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-01-03 11:05:03 +00:00
Chen Qi
4fe8c5de06 systemd: upgrade from 256.9 to 257
Patch changes:
* 0003-coredump-set-ProtectHome-to-read-only.patch is drop as it's a backported patch.
* 0009-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch is drop as
  AT_SYMLINK_NOFOLLOW has been supportd in musl.
* Other patches are either refreshed or changed to fit the current version.

systemd-boot changes:
* Use src/boot instead src/boot/efi in do_install and do_deploy. See upstream
  change 97318131fd06 (Rename src/boot/efi to just src/boot).

(From OE-Core rev: 4891f47cdaf919033bf1c02cc12e4805e5db99a0)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-01-03 11:05:03 +00:00
Mikko Rapeli
7a1f8970a8 systemd: add fido to PACKAGECONFIG options
To enable FIDO support.

meta-oe can provide libfido2 but it depends on udev
which creates a dependency loop between systemd (provider of udev)
and libfido2 which is currently unresolved. systemd recipe
could split udev to a separate recipe to solve this, or libfido2
could be compiled in systemd source tree after udev but before
rest of systemd.

(From OE-Core rev: 1e347c36b0d3910cd71b24a4e4ab8e2dd49063d1)

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-12-23 11:35:35 +00:00
Mikko Rapeli
30000c1b3d systemd: add apparmor PACKAGECONFIG support
For meta-security to enable with "apparmor" in DISTRO_FEATURES.

(From OE-Core rev: 804b462b826edf04182c77b6405a52a1c9b9b1f6)

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-12-23 11:35:35 +00:00
Mikko Rapeli
16f1f4d63f systemd: set CVE_PRODUCT
systemd.inc is used by systemd, systemd-boot and
systemd-tools-native recipes so make sure all
match to "systemd" product in CVE database. The
split between systemd, systemd-boot and
systemd-tools-native is specific to oe-core and
upstream just refers to systemd. Not limiting
to "systemd_project" vendor since multiple
vendor names have been used in the past.

(From OE-Core rev: eb46ad379170f0a80ac2d061fa02c118f5ed1d31)

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-12-17 11:41:52 +00:00
Adrian Freihofer
4920a08a2b systemd: split networkd into its own package
Support of images with different network management implementations
without having to recompile systemd and other components.

Fedora does this as well since systemd version 246.6-2:
https://src.fedoraproject.org/rpms/systemd/blob/rawhide/f/systemd.spec#_578
This proves that it is technically possible and officially supported by
systemd.

(From OE-Core rev: 3664d14ef97281961d166f16e7d47996370e405d)

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-12-17 11:41:52 +00:00
Wang Mingyu
a7c0cf3fab systemd: upgrade 256.8 -> 256.9
(From OE-Core rev: 454cd1073bd5df167c284a34d6d1259263a859bb)

Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-12-15 11:10:38 +00:00
Alexander Sverdlin
5a3b4300f8 systemd: actively disable Predictable Network Interface Names if !pni-names
Currently pni-names PACKAGECONFIG option adds "mac" names policy if
selected, but nothing otherwise. In systemd Predictable Network Interface
Names are applied by default which leads to inconsistend behaviour.

One could think that pni-names in DISTRO_FEATURES would enable or disable
Predictable Network Interface Names, but currently if not present it's
only actively disabled for QEMU via kernel command line
(commit 9e9c33d51e40
("qemuboot/runqemu: Fix 6.2 and later kernel network device naming")).
It has no effect on the real HW. If the option is present, it merely adds
"mac" into default NamePolicy, which may or may not have observable
effects.

Make pni-names semantics more consistent by actively suppressing
Predictable Network Interface Names if the feature is not present.

(From OE-Core rev: 37b98bc93bc404823cc4bbf9039e4d114aac33fa)

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-12-12 13:40:49 +00:00
Alexander Kanavin
21a9165058 systemd-compat-units: execute postinst on target
There is a race here where postinst relies on existence of
various files from other packages on the target rootfs to
operate properly, but doesn't ensure that it runs after all
of those packages have been installed. Adding dependencies
on those packages is not a solution as the recipe
is not supposed to bring them into rootfs, only make
adjustments if they are present.

This commit moves postinst execution to the first boot; another
solution would be to replace the whole recipe with ROOTFS_POSTPROCESS_COMMAND.

This was exposed with rpm 4.20 which rearranges the order
in which packages are installed, and exposes the issue.

(From OE-Core rev: e88f22da19a7f3f9bf23f2a607ffde6b5b1a3265)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-12-12 13:22:08 +00:00
Ricardo Salveti
d79a5c051e systemd: remove custom rootlibexecdir and replace with nonarch_libdir
The rootprefix build option was deprecated in systemd 255, making the
custom rootlibexecdir unnecessary, so remove it in favor of the standard
nonarch_libdir definition.

(From OE-Core rev: c89b34401dfbe65de5a32bf8b4ef32902d868ce1)

Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-12-05 17:07:10 +00:00
Ricardo Salveti
f05edfa08a systemd: split long line in pkg_postinst
Cosmetic change only to avoid max line length patchset failures when
changing the target line.

(From OE-Core rev: c6267b247a53c7e1a6befd2f04b440fbf8918028)

Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-12-05 17:07:09 +00:00
Ricardo Salveti
eac509b9ed systemd: drop deprecated rootlibdir, rootprefix and split-usr options
Support for split-usr and unmerged-usr were both removed as part of the
systemd 255 release, so remove the current deprecated rootlibdir,
rootprefix and split-usr options from the recipe.

(From OE-Core rev: 94ec821600c36baaeeb81f3d2ce0cc6d2d22082a)

Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-12-05 17:07:09 +00:00
Wang Mingyu
f0674490bd systemd: upgrade 256.7 -> 256.8
(From OE-Core rev: 796f64dfc462b22b4ed240611f8ecbd2eb8fb399)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-11-27 16:44:48 +00:00
Guðni Már Gilbert
234edf918a systemd-boot: drop intltool-native from DEPENDS
intltool was dropped as a dependency in v236
See commit for reference:
c81217920e

(From OE-Core rev: c82a1b71fd21b4f1299c7610342c5d821de7f1bb)

Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-11-25 22:23:25 +00:00
Guðni Már Gilbert
3b4343285f systemd: drop intltool-native from DEPENDS
intltool was dropped as a dependency in v236
See commit for reference:
c81217920e

(From OE-Core rev: bd7353f2794120bc2b88adfea0ee06361a0b7dd5)

Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-11-25 22:23:25 +00:00
Ross Burton
e7d470c04f systemd: handle llvm-objcopy behaviour when reading .note.dlopen section
There are two behavioural differences between the objcopy in binutils
and llvm which resulted in build failures when building systemd with
clang:

1) If the section specified in --dump-section doesn't exist, binutils
set an exit code of 0 whereas llvm sets 1.  This means we need to handle
the exit code so that we raise exceptions on unexpected failures, but
return an empty byte string if the segment isn't found.

2) binutils writes the section to the file name directly, whereas llvm
writes to a temporary file and renames.  This means we can't read the
open fd directly, and instead need to re-open the file to read it.

(From OE-Core rev: 98879a8dbd1b7887b43a074193925bf1a55d44e7)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-11-23 14:44:54 +00:00
Ross Burton
5a524fe4aa systemd: extract dependencies from .note.dlopen ELF segments
First, this is likely not the final implementation, but a RFC and
prototype.

Some binaries don't dynamically link to libraries, but instead at runtime
dlopen() them. This means extra work for distributions as the dependencies
are not detected automatically, so libraries may be missing.

systemd is one such project which does this, and in an attempt to solve
the packaging problem it also embeds the names of the libraries that can
potentially be opened at runtime into ELF notes.  These can be read to
generate package dependencies.  For example:

packages/cortexa57-poky-linux/systemd/libsystemd-shared: RRECOMMENDS: added "libkmod (['>= 33']) libzstd (['>= 1.5.6'])"
packages/cortexa57-poky-linux/systemd/libsystemd: RRECOMMENDS: added "libzstd (['>= 1.5.6'])"

I expect this code to be changed before merging. Whilst systemd is the
main user of his approach right now, I expect to see it used in more
places in the future so there's a reasonably good argument to merge it
into the core shlibs code.  Also it currently manually extracts and
parses the data, whereas maybe we should incorporate pyelftools into
meta/lib/oe and use that to parse ELF files across all of OE.

This also means we can remove the explicit dependency on libkmod in udev,
which now comes in via libsystemd-shared.

(From OE-Core rev: 905da779bcfe98f105adac708e0045ce8ffe5636)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-11-21 12:16:28 +00:00
Daniel McGregor
392658c663 systemd: wrap mtime based time with packageconfig
Recently the systemd recipe grew support for setting the epoch time
at image build time. Unfortunately this is unconditional, and our
use case for the set-time-epoch PACKAGECONFIG is we have a system
requirement that our product boot with the time set to the UNIX
epoch.

Instead of trying to complicate things with either an image hook or
overriding the systemd recipe, just make setting the epoch at image
time optional, with the same PACKAGECONFIG that controls hardcoding
the systemd build time as the default epoch.

(From OE-Core rev: ae433b35fb2d5475e33dea61e6bc65d83d3af56a)

Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-11-21 12:16:28 +00:00
Gaël PORTAY
7c03445fb7 systemd: set better sane time at startup
When systemd is started, it sets the system clock to epoch to ensure the
system clock is reasonably initialized if no working RTC.

As init process, systemd sets epoch very early to the more recent
timestamp of[1]:
 - the build time of systemd (-Dtime-epoch)
 - the modification time ("mtime") of /var/lib/systemd/timesync/clock
   (systemd-timesyncd)
 - the modification time ("mtime") of /usr/lib/clock-epoch (systemd)

The first epoch timestamp is hard-coded at build-time by the systemd
recipe (using either SOURCE_DATE_EPOCH, git-tag, or NEWS modification
time[2]).

The second epoch timestamp is maintained at run-time if the system runs
systemd-timesyncd.

This implements the third epoch timestamp at image build-time, by
touching the timestamp file /usr/lib/clock-epoch from the package
post-install script.

[1]: 863098fdc9
[2]: https://github.com/systemd/systemd/blob/v256/meson.build#L804-L825

(From OE-Core rev: 0f51fee4a5408c17cbaf827053f13d6c3b9dbc2c)

Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-11-19 11:26:24 +00:00
Ross Burton
377685c166 systemd: don't use deprecated meson option values
(From OE-Core rev: 853414760741530356355826b97f14c95a2144e4)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-11-12 11:31:48 +00:00
Yi Zhao
b520496b96 systemd: fix broken links for sysvinit-compatible commands
Since commit[1], PACKAGECONFIG[sysvinit] is not enabled by default when
sysvinit is not in DISTRO_FEATURES, which causes the following
sysvinit-compatible commands/services to not be built and installed:

  runlevel
  telinit
  rc-local.service
  systemd-initctl
  systemd-initctl.service
  systemd-rc-local-generator
  systemd-sysv-generator
  systemd-update-utmp-runlevel.service

Therefore, links to these commands/services should only be created when
PACKAGECONFIG[sysvinit] is enabled.

[1] https://git.openembedded.org/openembedded-core/commit/?id=3668235fd60a9027608f37251c4b453ed21b3687

(From OE-Core rev: a20b698f1acdee972cf1ff570b09a2e2c36bef1a)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-10-29 11:19:57 +00:00
Wang Mingyu
c71cbbdd3d systemd: upgrade 256.6 -> 256.7
(From OE-Core rev: e54b11c36cd140674ad4eca4eacd34b863706518)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-10-29 11:19:57 +00:00
Mikko Rapeli
ba0e556e07 systemd-boot-native: add runtime dependency to python3-pefile-native
It's needed to run the ukify script.

(From OE-Core rev: 67a248f911626330c20b55de1cd52f83f00a0df1)

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-10-01 12:40:48 +01:00
Wang Mingyu
586df77d26 systemd: upgrade 256.5 -> 256.6
(From OE-Core rev: 5761748a0c98bb05849df71b43609f82f4235e51)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-30 17:07:18 +01:00
Khem Raj
8d5ab60943 systemd-boot: Enable on RISCV
(From OE-Core rev: 68246e1f80a17b12774e2eb77adc9301dbe6385d)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-30 17:00:50 +01:00
Ross Burton
64a1a07f03 systemd: add missing dependency on libkmod to udev
As of systemd 256, libsystemd-shared.so doesn't directly link to a number
of libraries but instead dlopen()'s them as needed to reduce the size of
the attack surface.

Instead the .so has a .note.dlopen segment that lists the libraries that
may be opened, with the intention that these are transformed into package
recommendation fields.

We don't yet have support for these (see #15595) so explicit dependencies
have been added to the systemd package itself. However, in an initramfs
with udev but without systemd and no recommendations you end up without
libkmod, so module loading is impossible.

Add an explicit hard dependency on libkmod to udev, because modules are
critical functionality.

(From OE-Core rev: 12fadefe11ed9f09171087608c3c4b83c7302b3f)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-13 07:15:49 +01:00
Rasmus Villemoes
462b0c114a systemd: include sysvinit in default PACKAGECONFIG only if in DISTRO_FEATURES
The sysvinit PACKAGECONFIG knob enables various legacy/compatibility
code that may not be needed or even desired. If DISTRO_FEATURES
includes systemd (as it must for this recipe to build) but not
sysvinit, there is no point building and installing that legacy
support.

As most other changes, this can cause breakage, but given that
sysvinit not being in DISTRO_FEATURES requires explicit opt-out (due
to backfill), I think the risk is low. Moreover, it is generally
easier to add to than to remove from PACKAGECONFIG.

(From OE-Core rev: 3668235fd60a9027608f37251c4b453ed21b3687)

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-13 07:15:49 +01:00
Etienne Cordonnier
4fc8427a6c systemd: make home directory readable by systemd-coredump
In 924453c225
ProtectHome was set to true for systemd-coredump in order to reduce risk, since an attacker could craft a malicious binary in order to compromise systemd-coredump.
At that point the object analysis was done in the main systemd-coredump process.
Because of this systemd-coredump is unable to product symbolicated call-stacks for binaries running under /home ("n/a" is shown instead of function names).

However, later in 61aea456c1 systemd-coredump was changed to do the object analysis in a forked process,
covering those security concerns.

Let's set ProtectHome to read-only so that systemd-coredump produces symbolicated call-stacks for processes running under /home.

Note: it still does not work in /tmp (because of PrivateTmp=yes) and in /root (for unknown reasons).

Before the change (with minidebuginfo enabled):

    root@qemux86-64:~# /home/sleep 1000 &
    [1] 426
    root@qemux86-64:~# kill -11 $(pidof sleep)
    root@qemux86-64:~# coredumpctl info
               PID: 426 (sleep)
               UID: 0 (root)
               GID: 0 (root)
            Signal: 11 (SEGV)
         Timestamp: Fri 2024-09-06 17:25:18 UTC (3s ago)
      Command Line: /home/sleep 1000
        Executable: /home/sleep
     Control Group: /system.slice/system-serial\x2dgetty.slice/serial-getty@ttyS0.service
              Unit: serial-getty@ttyS0.service
             Slice: system-serial\x2dgetty.slice
           Boot ID: 44ef4ddfaad249ceaa29d1e9f330d3b5
        Machine ID: fb279f18f2c849c59768754c7a274ee3
          Hostname: qemux86-64
           Storage: /var/lib/systemd/coredump/core.sleep.0.44ef4ddfaad249ceaa29d1e9f330d3b5.426.1725643518000000.zst (present)
      Size on Disk: 16.5K
           Message: Process 426 (sleep) of user 0 dumped core.

                    Stack trace of thread 426:
                    #0  0x00007f365f3849a7 clock_nanosleep (libc.so.6 + 0xd49a7)
                    #1  0x00007f365f38f667 __nanosleep (libc.so.6 + 0xdf667)
                    #2  0x0000561fee703737 n/a (/home/sleep + 0x7737)
                    #3  0x000000003a6227c5 n/a (n/a + 0x0)
                    ELF object binary architecture: AMD x86-64
    [1]+  Segmentation fault      (core dumped) /home/sleep 1000

After the change (with minidebuginfo enabled):

    root@qemux86-64:~# /home/sleep 1000 &
    [1] 450
    root@qemux86-64:~# kill -11 $(pidof sleep)
    root@qemux86-64:~# coredumpctl info
               PID: 450 (sleep)
               UID: 0 (root)
               GID: 0 (root)
            Signal: 11 (SEGV)
         Timestamp: Fri 2024-09-06 17:30:12 UTC (4s ago)
      Command Line: /home/sleep 1000
        Executable: /home/sleep
     Control Group: /system.slice/system-serial\x2dgetty.slice/serial-getty@ttyS0.service
              Unit: serial-getty@ttyS0.service
             Slice: system-serial\x2dgetty.slice
           Boot ID: 44ef4ddfaad249ceaa29d1e9f330d3b5
        Machine ID: fb279f18f2c849c59768754c7a274ee3
          Hostname: qemux86-64
           Storage: /var/lib/systemd/coredump/core.sleep.0.44ef4ddfaad249ceaa29d1e9f330d3b5.450.1725643812000000.zst (present)
      Size on Disk: 16.5K
           Message: Process 450 (sleep) of user 0 dumped core.

                    Stack trace of thread 450:
                    #0  0x00007f795dd689a7 clock_nanosleep (libc.so.6 + 0xd49a7)
                    #1  0x00007f795dd73667 __nanosleep (libc.so.6 + 0xdf667)
                    #2  0x0000561965c9d737 rpl_nanosleep (sleep + 0x7737)
                    #3  0x0000561965c9d0c1 xnanosleep (sleep + 0x70c1)
                    #4  0x0000561965c985c8 main (sleep + 0x25c8)
                    #5  0x00007f795dcba01b __libc_start_call_main (libc.so.6 + 0x2601b)
                    #6  0x00007f795dcba0d9 __libc_start_main (libc.so.6 + 0x260d9)
                    #7  0x0000561965c98685 _start (sleep + 0x2685)
                    ELF object binary architecture: AMD x86-64
    [1]+  Segmentation fault      (core dumped) /home/sleep 1000

(From OE-Core rev: b8c1f999038b7cd6fc2e80ed215541c8a4d9e19f)

Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-09-09 17:04:15 +01:00