Michael Biebl [Thu, 15 Oct 2020 21:11:01 +0000 (23:11 +0200)]
Move sysusers.d/sysctl.d/binfmt.d/modules-load.d back to /usr
In Debian, late mounting of /usr is no longer supported, so it is safe
to install those files in /usr.
We want those facilities in /usr, not /, as this will make an eventual
switch to a merged-usr setup easier.
Closes: #971282
Gbp-Pq: Topic debian
Gbp-Pq: Name Move-sysusers.d-sysctl.d-binfmt.d-modules-load.d-back-to-.patch
Michael Biebl [Mon, 17 Aug 2020 20:11:19 +0000 (22:11 +0200)]
Keep journal files compatible with older versions
Disable the KEYED-HASH journal feature by default and keep LZ4 (instead
of ZSTD) as default compression for new journal files. Otherwise journal
files are incompatible and can't be read by older journalctl
implementations.
This patch can be dropped in bullseye+1, as journalctl from bullseye
will then be able to read journal files with those features.
Closes: #968055
Gbp-Pq: Topic debian
Gbp-Pq: Name Keep-journal-files-compatible-with-older-versions.patch
Michael Biebl [Tue, 19 Nov 2019 08:10:23 +0000 (09:10 +0100)]
udev: drop SystemCallArchitectures=native from systemd-udevd.service
We can't really control what helper programs are run from other udev
rules. E.g. running i386 binaries under amd64 is a valid use case and
should not trigger a SIGSYS failure.
Closes: #869719
Gbp-Pq: Topic debian
Gbp-Pq: Name udev-drop-SystemCallArchitectures-native-from-systemd-ude.patch
Michael Biebl [Wed, 18 Jul 2018 21:49:16 +0000 (23:49 +0200)]
Drop seccomp system call filter for udev
The seccomp based system call whitelist requires at least systemd 239 to
be the active init and during a dist-upgrade we can't guarantee that
systemd has been fully configured before udev is restarted.
Martin Pitt [Wed, 18 Jan 2017 10:21:35 +0000 (11:21 +0100)]
Add env variable for machine ID path
During package build, in minimal chroots, or other systems which do not already
have an /etc/machine-id we get six test failures. Introduce a
$SYSTEMD_MACHINE_ID_PATH environment variable which can specify a location
other than /etc/machine-id, so that the unit tests are independent from the
environment.
Also adjust test-fs-util to not assume that /etc/machine-id exists. Use
/etc/passwd instead which is created by base-files.
Martin Pitt [Sat, 27 Feb 2016 11:27:06 +0000 (12:27 +0100)]
Revert "core: set RLIMIT_CORE to unlimited by default"
Partially revert commit 15a900327ab as this completely breaks core dumps
without systemd-coredump. It's also contradicting core(8), and it's not
systemd's place to redefine the kernel definitions of core files.
Commit bdfd7b2c now honours the process' RLIMIT_CORE for systemd-coredump. This
isn't what RLIMIT_CORE is supposed to do (it limits the size of the core
*file*, but the kernel deliberately ignores it for piping), so set a static
2^63 core size limit for systemd-coredump to go back to the previous behaviour
(otherwise the change above would break systemd-coredump).
Bug-Debian: https://bugs.debian.org/815020
Gbp-Pq: Topic debian
Gbp-Pq: Name Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch
Martin Pitt [Mon, 27 Apr 2015 13:29:13 +0000 (15:29 +0200)]
Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it"
Didier Roche [Fri, 22 May 2015 11:04:38 +0000 (13:04 +0200)]
fsckd daemon for inter-fsckd communication
Global logic:
Add systemd-fsckd multiplexer which accepts multiple (via systemd-fsck's
/run/systemd/fsck.progress socket) fsck instances to connect to it and sends
progress report. systemd-fsckd then computes and writes to /dev/console the
number of devices currently being checked and the minimum fsck progress.
Plymouth and user interaction:
Forward the progress to plymouth and support canellation of in progress fsck.
Try to connect and send to plymouth (if running) some checked report progress,
using direct plymouth protocole.
Update message is the following:
fsckd:<num_devices>:<progress>:<string>
* num_devices corresponds to the current number of devices being checked (int)
* progress corresponds to the current minimum percentage of all devices being
checked (float, from 0 to 100)
* string is a translated message ready to be displayed by the plymouth theme
displaying the information above. It can be overridden by plymouth themes
supporting i18n.
Grab in fsckd plymouth watch key Control+C, and propagate this cancel request
to systemd-fsck which will terminate fsck.
Send a message to signal to user what key we are grabbing for fsck cancel.
Message is: fsckd-cancel-msg:<string>
Where string is a translated string ready to be displayed by the plymouth theme
indicating that Control+C can be used to cancel current checks. It can be
overridden (matching only fsckd-cancel-msg prefix) for themes supporting i18n.
Misc:
systemd-fsckd stops on idle when no fsck is connected.
Add man page explaining the plymouth theme protocol, usage of the daemon
as well as the socket activation part. Adapt existing fsck man page.
Note that fsckd had lived in the upstream tree for a while, but was removed.
More information at
http://lists.freedesktop.org/archives/systemd-devel/2015-April/030175.html
-
Gbp-Pq: Topic debian
Gbp-Pq: Name fsckd-daemon-for-inter-fsckd-communication.patch
Martin Pitt [Mon, 9 Feb 2015 09:53:43 +0000 (10:53 +0100)]
Only start logind if dbus is installed
logind fails to start in environments without dbus, such as LXC containers or
servers. Add a startup condition to avoid the very noisy startup failure.
Part of #772700
Gbp-Pq: Topic debian
Gbp-Pq: Name Only-start-logind-if-dbus-is-installed.patch
for details. Once we grow a journal.conf.d/ directory, sysloggers can be moved
to pulling from the journal one by one and disable forwarding again in such a
conf.d snippet.
Gbp-Pq: Topic debian
Gbp-Pq: Name Re-enable-journal-forwarding-to-syslog.patch
systemd does not support non-mainline kernel features so upstream rejected this
patch.
It is however required for systemd integration by tuxonice-userui package.
Michael Biebl [Thu, 4 Sep 2014 23:15:16 +0000 (01:15 +0200)]
Make /run/lock tmpfs an API fs
The /run/lock directory is world-writable in Debian due to historic
reasons. To avoid user processes filling up /run, we mount a separate
tmpfs for /run/lock. As this directory needs to be available during
early boot, we make it an API fs.
Drop it from tmpfiles.d/legacy.conf to not clobber the permissions.
Closes: #751392
Gbp-Pq: Topic debian
Gbp-Pq: Name Make-run-lock-tmpfs-an-API-fs.patch
Upgrading to qemu 5.2 breaks TEST-36-NUMAPOLICY like:
qemu-system-x86_64: total memory for NUMA nodes (0x0) should
equal RAM size (0x20000000)
Use the new (as in >=2014) form of memdev in test 36:
-object memory-backend-ram,id=mem0,size=512M -numa node,memdev=mem0,nodeid=0
Since some target systems are as old as qemu 1.5.3 (CentOS7) but the new
kind to specify was added in qemu 2.1 this needs to add version parsing and
add the argument only when qemu is >=5.2.
So the currentl and only fd_is_mount_point() check is actually entirely
bogus: it passes "/" as filename argument, but that's not actually a
a valid filename, but an absolute path.
fd_is_mount_point() is written in a way tha the fd refers to a directory
and the specified path is a file directly below it that shall be
checked. The test call actually violated that rule, but still expected
success.
Let's fix this, and check for this explicitly, and refuse it.
Let's extend the test and move it to test-mountpoint-util.c where the
rest of the tests for related calls are placed.
Michael Biebl [Sat, 2 Jan 2021 16:06:01 +0000 (16:06 +0000)]
systemd (247.2-4) unstable; urgency=medium
* Move libraries and NSS modules from /lib to /usr/lib.
Keep libpam_systemd.so installed in /lib, as PAM doesn't support
loading PAM modules from /usr/lib on a split-usr system.
Michael Biebl [Thu, 15 Oct 2020 21:11:01 +0000 (23:11 +0200)]
Move sysusers.d/sysctl.d/binfmt.d/modules-load.d back to /usr
In Debian, late mounting of /usr is no longer supported, so it is safe
to install those files in /usr.
We want those facilities in /usr, not /, as this will make an eventual
switch to a merged-usr setup easier.
Closes: #971282
Gbp-Pq: Topic debian
Gbp-Pq: Name Move-sysusers.d-sysctl.d-binfmt.d-modules-load.d-back-to-.patch
Michael Biebl [Mon, 17 Aug 2020 20:11:19 +0000 (22:11 +0200)]
Keep journal files compatible with older versions
Disable the KEYED-HASH journal feature by default and keep LZ4 (instead
of ZSTD) as default compression for new journal files. Otherwise journal
files are incompatible and can't be read by older journalctl
implementations.
This patch can be dropped in bullseye+1, as journalctl from bullseye
will then be able to read journal files with those features.
Closes: #968055
Gbp-Pq: Topic debian
Gbp-Pq: Name Keep-journal-files-compatible-with-older-versions.patch
Michael Biebl [Tue, 19 Nov 2019 08:10:23 +0000 (09:10 +0100)]
udev: drop SystemCallArchitectures=native from systemd-udevd.service
We can't really control what helper programs are run from other udev
rules. E.g. running i386 binaries under amd64 is a valid use case and
should not trigger a SIGSYS failure.
Closes: #869719
Gbp-Pq: Topic debian
Gbp-Pq: Name udev-drop-SystemCallArchitectures-native-from-systemd-ude.patch
Michael Biebl [Wed, 18 Jul 2018 21:49:16 +0000 (23:49 +0200)]
Drop seccomp system call filter for udev
The seccomp based system call whitelist requires at least systemd 239 to
be the active init and during a dist-upgrade we can't guarantee that
systemd has been fully configured before udev is restarted.
Martin Pitt [Wed, 18 Jan 2017 10:21:35 +0000 (11:21 +0100)]
Add env variable for machine ID path
During package build, in minimal chroots, or other systems which do not already
have an /etc/machine-id we get six test failures. Introduce a
$SYSTEMD_MACHINE_ID_PATH environment variable which can specify a location
other than /etc/machine-id, so that the unit tests are independent from the
environment.
Also adjust test-fs-util to not assume that /etc/machine-id exists. Use
/etc/passwd instead which is created by base-files.
Martin Pitt [Sat, 27 Feb 2016 11:27:06 +0000 (12:27 +0100)]
Revert "core: set RLIMIT_CORE to unlimited by default"
Partially revert commit 15a900327ab as this completely breaks core dumps
without systemd-coredump. It's also contradicting core(8), and it's not
systemd's place to redefine the kernel definitions of core files.
Commit bdfd7b2c now honours the process' RLIMIT_CORE for systemd-coredump. This
isn't what RLIMIT_CORE is supposed to do (it limits the size of the core
*file*, but the kernel deliberately ignores it for piping), so set a static
2^63 core size limit for systemd-coredump to go back to the previous behaviour
(otherwise the change above would break systemd-coredump).
Bug-Debian: https://bugs.debian.org/815020
Gbp-Pq: Topic debian
Gbp-Pq: Name Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch
Martin Pitt [Mon, 27 Apr 2015 13:29:13 +0000 (15:29 +0200)]
Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it"
Didier Roche [Fri, 22 May 2015 11:04:38 +0000 (13:04 +0200)]
fsckd daemon for inter-fsckd communication
Global logic:
Add systemd-fsckd multiplexer which accepts multiple (via systemd-fsck's
/run/systemd/fsck.progress socket) fsck instances to connect to it and sends
progress report. systemd-fsckd then computes and writes to /dev/console the
number of devices currently being checked and the minimum fsck progress.
Plymouth and user interaction:
Forward the progress to plymouth and support canellation of in progress fsck.
Try to connect and send to plymouth (if running) some checked report progress,
using direct plymouth protocole.
Update message is the following:
fsckd:<num_devices>:<progress>:<string>
* num_devices corresponds to the current number of devices being checked (int)
* progress corresponds to the current minimum percentage of all devices being
checked (float, from 0 to 100)
* string is a translated message ready to be displayed by the plymouth theme
displaying the information above. It can be overridden by plymouth themes
supporting i18n.
Grab in fsckd plymouth watch key Control+C, and propagate this cancel request
to systemd-fsck which will terminate fsck.
Send a message to signal to user what key we are grabbing for fsck cancel.
Message is: fsckd-cancel-msg:<string>
Where string is a translated string ready to be displayed by the plymouth theme
indicating that Control+C can be used to cancel current checks. It can be
overridden (matching only fsckd-cancel-msg prefix) for themes supporting i18n.
Misc:
systemd-fsckd stops on idle when no fsck is connected.
Add man page explaining the plymouth theme protocol, usage of the daemon
as well as the socket activation part. Adapt existing fsck man page.
Note that fsckd had lived in the upstream tree for a while, but was removed.
More information at
http://lists.freedesktop.org/archives/systemd-devel/2015-April/030175.html
-
Gbp-Pq: Topic debian
Gbp-Pq: Name fsckd-daemon-for-inter-fsckd-communication.patch
Martin Pitt [Mon, 9 Feb 2015 09:53:43 +0000 (10:53 +0100)]
Only start logind if dbus is installed
logind fails to start in environments without dbus, such as LXC containers or
servers. Add a startup condition to avoid the very noisy startup failure.
Part of #772700
Gbp-Pq: Topic debian
Gbp-Pq: Name Only-start-logind-if-dbus-is-installed.patch
for details. Once we grow a journal.conf.d/ directory, sysloggers can be moved
to pulling from the journal one by one and disable forwarding again in such a
conf.d snippet.
Gbp-Pq: Topic debian
Gbp-Pq: Name Re-enable-journal-forwarding-to-syslog.patch
systemd does not support non-mainline kernel features so upstream rejected this
patch.
It is however required for systemd integration by tuxonice-userui package.
Michael Biebl [Thu, 4 Sep 2014 23:15:16 +0000 (01:15 +0200)]
Make /run/lock tmpfs an API fs
The /run/lock directory is world-writable in Debian due to historic
reasons. To avoid user processes filling up /run, we mount a separate
tmpfs for /run/lock. As this directory needs to be available during
early boot, we make it an API fs.
Drop it from tmpfiles.d/legacy.conf to not clobber the permissions.
Closes: #751392
Gbp-Pq: Topic debian
Gbp-Pq: Name Make-run-lock-tmpfs-an-API-fs.patch
Michael Biebl [Thu, 3 Dec 2020 22:53:29 +0000 (22:53 +0000)]
systemd (247.1-3) unstable; urgency=medium
* d/t/timedated: Ignore return code of dbus-monitor in wait_mon()
We are not really interested in the return code and error messages from
dbus-monitor after killing it, so ignore them to avoid undesired
autopkgtest failures.
Michael Biebl [Thu, 15 Oct 2020 21:11:01 +0000 (23:11 +0200)]
Move sysusers.d/sysctl.d/binfmt.d/modules-load.d back to /usr
In Debian, late mounting of /usr is no longer supported, so it is safe
to install those files in /usr.
We want those facilities in /usr, not /, as this will make an eventual
switch to a merged-usr setup easier.
Closes: #971282
Gbp-Pq: Topic debian
Gbp-Pq: Name Move-sysusers.d-sysctl.d-binfmt.d-modules-load.d-back-to-.patch
Michael Biebl [Mon, 17 Aug 2020 20:11:19 +0000 (22:11 +0200)]
Keep journal files compatible with older versions
Disable the KEYED-HASH journal feature by default and keep LZ4 (instead
of ZSTD) as default compression for new journal files. Otherwise journal
files are incompatible and can't be read by older journalctl
implementations.
This patch can be dropped in bullseye+1, as journalctl from bullseye
will then be able to read journal files with those features.
Closes: #968055
Gbp-Pq: Topic debian
Gbp-Pq: Name Keep-journal-files-compatible-with-older-versions.patch
Michael Biebl [Tue, 19 Nov 2019 08:10:23 +0000 (09:10 +0100)]
udev: drop SystemCallArchitectures=native from systemd-udevd.service
We can't really control what helper programs are run from other udev
rules. E.g. running i386 binaries under amd64 is a valid use case and
should not trigger a SIGSYS failure.
Closes: #869719
Gbp-Pq: Topic debian
Gbp-Pq: Name udev-drop-SystemCallArchitectures-native-from-systemd-ude.patch
Michael Biebl [Wed, 18 Jul 2018 21:49:16 +0000 (23:49 +0200)]
Drop seccomp system call filter for udev
The seccomp based system call whitelist requires at least systemd 239 to
be the active init and during a dist-upgrade we can't guarantee that
systemd has been fully configured before udev is restarted.
Martin Pitt [Wed, 18 Jan 2017 10:21:35 +0000 (11:21 +0100)]
Add env variable for machine ID path
During package build, in minimal chroots, or other systems which do not already
have an /etc/machine-id we get six test failures. Introduce a
$SYSTEMD_MACHINE_ID_PATH environment variable which can specify a location
other than /etc/machine-id, so that the unit tests are independent from the
environment.
Also adjust test-fs-util to not assume that /etc/machine-id exists. Use
/etc/passwd instead which is created by base-files.
Martin Pitt [Sat, 27 Feb 2016 11:27:06 +0000 (12:27 +0100)]
Revert "core: set RLIMIT_CORE to unlimited by default"
Partially revert commit 15a900327ab as this completely breaks core dumps
without systemd-coredump. It's also contradicting core(8), and it's not
systemd's place to redefine the kernel definitions of core files.
Commit bdfd7b2c now honours the process' RLIMIT_CORE for systemd-coredump. This
isn't what RLIMIT_CORE is supposed to do (it limits the size of the core
*file*, but the kernel deliberately ignores it for piping), so set a static
2^63 core size limit for systemd-coredump to go back to the previous behaviour
(otherwise the change above would break systemd-coredump).
Bug-Debian: https://bugs.debian.org/815020
Gbp-Pq: Topic debian
Gbp-Pq: Name Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch
Martin Pitt [Mon, 27 Apr 2015 13:29:13 +0000 (15:29 +0200)]
Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it"
Didier Roche [Fri, 22 May 2015 11:04:38 +0000 (13:04 +0200)]
fsckd daemon for inter-fsckd communication
Global logic:
Add systemd-fsckd multiplexer which accepts multiple (via systemd-fsck's
/run/systemd/fsck.progress socket) fsck instances to connect to it and sends
progress report. systemd-fsckd then computes and writes to /dev/console the
number of devices currently being checked and the minimum fsck progress.
Plymouth and user interaction:
Forward the progress to plymouth and support canellation of in progress fsck.
Try to connect and send to plymouth (if running) some checked report progress,
using direct plymouth protocole.
Update message is the following:
fsckd:<num_devices>:<progress>:<string>
* num_devices corresponds to the current number of devices being checked (int)
* progress corresponds to the current minimum percentage of all devices being
checked (float, from 0 to 100)
* string is a translated message ready to be displayed by the plymouth theme
displaying the information above. It can be overridden by plymouth themes
supporting i18n.
Grab in fsckd plymouth watch key Control+C, and propagate this cancel request
to systemd-fsck which will terminate fsck.
Send a message to signal to user what key we are grabbing for fsck cancel.
Message is: fsckd-cancel-msg:<string>
Where string is a translated string ready to be displayed by the plymouth theme
indicating that Control+C can be used to cancel current checks. It can be
overridden (matching only fsckd-cancel-msg prefix) for themes supporting i18n.
Misc:
systemd-fsckd stops on idle when no fsck is connected.
Add man page explaining the plymouth theme protocol, usage of the daemon
as well as the socket activation part. Adapt existing fsck man page.
Note that fsckd had lived in the upstream tree for a while, but was removed.
More information at
http://lists.freedesktop.org/archives/systemd-devel/2015-April/030175.html
-
Gbp-Pq: Topic debian
Gbp-Pq: Name fsckd-daemon-for-inter-fsckd-communication.patch
Martin Pitt [Mon, 9 Feb 2015 09:53:43 +0000 (10:53 +0100)]
Only start logind if dbus is installed
logind fails to start in environments without dbus, such as LXC containers or
servers. Add a startup condition to avoid the very noisy startup failure.
Part of #772700
Gbp-Pq: Topic debian
Gbp-Pq: Name Only-start-logind-if-dbus-is-installed.patch
for details. Once we grow a journal.conf.d/ directory, sysloggers can be moved
to pulling from the journal one by one and disable forwarding again in such a
conf.d snippet.
Gbp-Pq: Topic debian
Gbp-Pq: Name Re-enable-journal-forwarding-to-syslog.patch
systemd does not support non-mainline kernel features so upstream rejected this
patch.
It is however required for systemd integration by tuxonice-userui package.
Michael Biebl [Thu, 4 Sep 2014 23:15:16 +0000 (01:15 +0200)]
Make /run/lock tmpfs an API fs
The /run/lock directory is world-writable in Debian due to historic
reasons. To avoid user processes filling up /run, we mount a separate
tmpfs for /run/lock. As this directory needs to be available during
early boot, we make it an API fs.
Drop it from tmpfiles.d/legacy.conf to not clobber the permissions.
Closes: #751392
Gbp-Pq: Topic debian
Gbp-Pq: Name Make-run-lock-tmpfs-an-API-fs.patch
Benjamin Berg [Mon, 12 Oct 2020 09:02:26 +0000 (11:02 +0200)]
xdg-autostart: Lower most info messages to debug level
It is expected for numerous autostart files to not be convertible to
corresponding units. The information is only useful for someone
debugging why a file might not be started, but it is not generally
useful for users in most situations.
As such, lower the warnings. Anyone wondering why an application is not
started will easily notice that the unit is not generated. From there it
will be somewhat harder to figure out why, but the overall trade-off is
still improved.
Benjamin Berg [Thu, 8 Oct 2020 13:58:37 +0000 (15:58 +0200)]
xdg-autostart: Ignore more common XDG Desktop Entry fields
It makes sense to ignore all the common fields that are expected and
that we can safely ignore. Note that it is fine to ignore URL as we will
already warn about the type= being wrong in that case.
Aurelien Jarno [Wed, 19 Aug 2020 20:44:15 +0000 (22:44 +0200)]
seccomp: add support for riscv64
This patch adds seccomp support to the riscv64 architecture. seccomp
support is available in the riscv64 kernel since version 5.5, and it
has just been added to the libseccomp library.
riscv64 uses generic syscalls like aarch64, so I used that architecture
as a reference to find which code has to be modified.
With this patch, the testsuite passes successfully, including the
test-seccomp test. The system boots and works fine with kernel 5.4 (i.e.
without seccomp support) and kernel 5.5 (i.e. with seccomp support). I
have also verified that the "SystemCallFilter=~socket" option prevents a
service to use the ping utility when running on kernel 5.5.
Michael Biebl [Fri, 28 Aug 2020 15:21:27 +0000 (17:21 +0200)]
test-network: stop networkd and its socket
With the changes from 2c0dffe82db574b6b9e850e48f444674e4e1d7ea, starting
systemd-networkd.service will also activate systemd-networkd.socket.
When tearing down a test, we need to stop the socket as well, to make
sure networkd can't be activated accidentally with the wrong
configuration.
Michael Biebl [Wed, 26 Aug 2020 14:54:45 +0000 (16:54 +0200)]
networkd: use socket activation when starting networkd
Add After=systemd-networkd.socket to avoid a race condition and networkd
falling back to the non-socket activation code.
Also add Wants=systemd-networkd.socket, so the socket is started when
networkd is started via `systemctl start systemd-networkd.service`.
A Requires is not strictly necessary, as networkd still ships the
non-socket activation code. Should this code be removed one day, the
Wants should be bumped to Requires accordingly.
Michael Biebl [Tue, 24 Nov 2020 20:53:25 +0000 (20:53 +0000)]
systemd (246.6-5) unstable; urgency=medium
* Drop non-functional DefaultTasksMax patch.
This patch was supposed to remove the DefaultTasksMax limit, but lost
its actual logic over 4 years ago, when the patches were rebased for the
v231 release. Since nobody has complained so far, we can assume it is
safe to drop this patch. (Closes: #975335)
* test-seccomp: accept ENOSYS from sysctl(2) too.
It seems that kernel 5.9 started returning that.
* test/test-functions: copy /usr/lib/pam.d into $initdir.
The systemd-user file has been moved from /etc/pam.d into /usr/lib/pam.d,
so test-functions needs to copy it from /usr/lib/pam.d instead.
Michael Biebl [Thu, 15 Oct 2020 21:11:01 +0000 (23:11 +0200)]
Move sysusers.d/sysctl.d/binfmt.d/modules-load.d back to /usr
In Debian, late mounting of /usr is no longer supported, so it is safe
to install those files in /usr.
We want those facilities in /usr, not /, as this will make an eventual
switch to a merged-usr setup easier.
Closes: #971282
Gbp-Pq: Topic debian
Gbp-Pq: Name Move-sysusers.d-sysctl.d-binfmt.d-modules-load.d-back-to-.patch
Michael Biebl [Mon, 17 Aug 2020 20:11:19 +0000 (22:11 +0200)]
Keep journal files compatible with older versions
Disable the KEYED-HASH journal feature by default and keep LZ4 (instead
of ZSTD) as default compression for new journal files. Otherwise journal
files are incompatible and can't be read by older journalctl
implementations.
This patch can be dropped in bullseye+1, as journalctl from bullseye
will then be able to read journal files with those features.
Closes: #968055
Gbp-Pq: Topic debian
Gbp-Pq: Name Keep-journal-files-compatible-with-older-versions.patch
Michael Biebl [Tue, 19 Nov 2019 08:10:23 +0000 (09:10 +0100)]
udev: drop SystemCallArchitectures=native from systemd-udevd.service
We can't really control what helper programs are run from other udev
rules. E.g. running i386 binaries under amd64 is a valid use case and
should not trigger a SIGSYS failure.
Closes: #869719
Gbp-Pq: Topic debian
Gbp-Pq: Name udev-drop-SystemCallArchitectures-native-from-systemd-ude.patch
Michael Biebl [Wed, 18 Jul 2018 21:49:16 +0000 (23:49 +0200)]
Drop seccomp system call filter for udev
The seccomp based system call whitelist requires at least systemd 239 to
be the active init and during a dist-upgrade we can't guarantee that
systemd has been fully configured before udev is restarted.
Martin Pitt [Wed, 18 Jan 2017 10:21:35 +0000 (11:21 +0100)]
Add env variable for machine ID path
During package build, in minimal chroots, or other systems which do not already
have an /etc/machine-id we get six test failures. Introduce a
$SYSTEMD_MACHINE_ID_PATH environment variable which can specify a location
other than /etc/machine-id, so that the unit tests are independent from the
environment.
Also adjust test-fs-util to not assume that /etc/machine-id exists. Use
/etc/passwd instead which is created by base-files.
Introducing a default limit on number of threads broke a lot of software which
regularly needs more, such as MySQL and RabbitMQ, or services that spawn off an
indefinite number of subtasks that are not in a scope, like LXC or cron.
15% is way too much for most "simple" services, and it's too little for others
such as the ones mentioned above. There is also no particular rationale about
any particular global limit, so even if we'd bump it higher we'd just make the
limit even less useful while still breaking software.
It is both much safer and also much more effective in terms of guarding against
berserk programs/bugs/unintended fork bombs etc. to set limits in units
individually. Once someone looks at one, this is then a great time to also flip
on the other resource and privilege limitations that systemd offers.
Martin Pitt [Sat, 27 Feb 2016 11:27:06 +0000 (12:27 +0100)]
Revert "core: set RLIMIT_CORE to unlimited by default"
Partially revert commit 15a900327ab as this completely breaks core dumps
without systemd-coredump. It's also contradicting core(8), and it's not
systemd's place to redefine the kernel definitions of core files.
Commit bdfd7b2c now honours the process' RLIMIT_CORE for systemd-coredump. This
isn't what RLIMIT_CORE is supposed to do (it limits the size of the core
*file*, but the kernel deliberately ignores it for piping), so set a static
2^63 core size limit for systemd-coredump to go back to the previous behaviour
(otherwise the change above would break systemd-coredump).
Bug-Debian: https://bugs.debian.org/815020
Gbp-Pq: Topic debian
Gbp-Pq: Name Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch
Martin Pitt [Mon, 27 Apr 2015 13:29:13 +0000 (15:29 +0200)]
Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it"
Didier Roche [Fri, 22 May 2015 11:04:38 +0000 (13:04 +0200)]
fsckd daemon for inter-fsckd communication
Global logic:
Add systemd-fsckd multiplexer which accepts multiple (via systemd-fsck's
/run/systemd/fsck.progress socket) fsck instances to connect to it and sends
progress report. systemd-fsckd then computes and writes to /dev/console the
number of devices currently being checked and the minimum fsck progress.
Plymouth and user interaction:
Forward the progress to plymouth and support canellation of in progress fsck.
Try to connect and send to plymouth (if running) some checked report progress,
using direct plymouth protocole.
Update message is the following:
fsckd:<num_devices>:<progress>:<string>
* num_devices corresponds to the current number of devices being checked (int)
* progress corresponds to the current minimum percentage of all devices being
checked (float, from 0 to 100)
* string is a translated message ready to be displayed by the plymouth theme
displaying the information above. It can be overridden by plymouth themes
supporting i18n.
Grab in fsckd plymouth watch key Control+C, and propagate this cancel request
to systemd-fsck which will terminate fsck.
Send a message to signal to user what key we are grabbing for fsck cancel.
Message is: fsckd-cancel-msg:<string>
Where string is a translated string ready to be displayed by the plymouth theme
indicating that Control+C can be used to cancel current checks. It can be
overridden (matching only fsckd-cancel-msg prefix) for themes supporting i18n.
Misc:
systemd-fsckd stops on idle when no fsck is connected.
Add man page explaining the plymouth theme protocol, usage of the daemon
as well as the socket activation part. Adapt existing fsck man page.
Note that fsckd had lived in the upstream tree for a while, but was removed.
More information at
http://lists.freedesktop.org/archives/systemd-devel/2015-April/030175.html
-
Gbp-Pq: Topic debian
Gbp-Pq: Name fsckd-daemon-for-inter-fsckd-communication.patch
Martin Pitt [Mon, 9 Feb 2015 09:53:43 +0000 (10:53 +0100)]
Only start logind if dbus is installed
logind fails to start in environments without dbus, such as LXC containers or
servers. Add a startup condition to avoid the very noisy startup failure.
Part of #772700
Gbp-Pq: Topic debian
Gbp-Pq: Name Only-start-logind-if-dbus-is-installed.patch
for details. Once we grow a journal.conf.d/ directory, sysloggers can be moved
to pulling from the journal one by one and disable forwarding again in such a
conf.d snippet.
Gbp-Pq: Topic debian
Gbp-Pq: Name Re-enable-journal-forwarding-to-syslog.patch
systemd does not support non-mainline kernel features so upstream rejected this
patch.
It is however required for systemd integration by tuxonice-userui package.
Michael Biebl [Thu, 4 Sep 2014 23:15:16 +0000 (01:15 +0200)]
Make /run/lock tmpfs an API fs
The /run/lock directory is world-writable in Debian due to historic
reasons. To avoid user processes filling up /run, we mount a separate
tmpfs for /run/lock. As this directory needs to be available during
early boot, we make it an API fs.
Drop it from tmpfiles.d/legacy.conf to not clobber the permissions.
Closes: #751392
Gbp-Pq: Topic debian
Gbp-Pq: Name Make-run-lock-tmpfs-an-API-fs.patch
projects / systemd.git / log