Changes:
```
654ae8c1e4 base-filesystem.c: add trailing zero byte for s390x entry
e4a19eef33 basic/missing_loop.h: fix missing lo_flags LO_FLAGS_DIRECT_IO
24238be484 mount-util: fix error code
1b1ad8c79f udev: certainly restart event for previously locked device
7dacfb3fb4 stub: Use EfiLoaderCode for kernel memory
eaeaf4f6ef network: do not silently stop to process configuration on activation failure
bb803856bc bus: use inline trace argument for ANONYMOUS auth
6349062326 Fix ObjectManager interface emitted for non-manager objects
c90ab07fa0 test-bus-objects: Test interfaces added/removed signal interfaces
e32fe1b457 Fix GetManagedObjects returning ObjectManager interface for non-manager objects
efd8e39f4a test-bus-objects: Test GetManagedObjects interfaces are correct
344efd022a coredump: when parsing json, optionally copy the string first
de08edca17 systemctl: color ignored exit status in yellow, not red
1531a496e3 manager: make clear internal Dump() logic is debugging only.
c4fd38f7d2 man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
140fee4627 resolve: do not cache mDNS goodbye packet
1a2d93a770 kbd-model-map: correct variants for cz-qwerty to include comma
9d1ebb2247 resolve: persist DNSOverTLS configuration in state file
3137ac6ef5 udev: support by-path devlink for multipath nvme block devices
c948091cc5 run: make --working-directory= work for --scope too
7bb204620d kbd-model-map: add a mapping for switched czech qwerty/us
e5157050d1 test: add more test cases for mkdir_p_safe() and mkdir_p_root()
b3a9f7b5cb mkdir: chase_symlinks_and_stat() does not return 0
0bfdc91807 units: make sure that initrd-switch-root.service pulls in .target
45fb64c54b units: add dependency ordering for emergency.service conflicts
6535813084 units: add ordering dependencies on initrd-switch-root.target
09c90224f1 units/systemd-network-generator.service: add forgotten ordering for shutdown
1dd723a3b8 units: reorder/split unit dependency blocks
054cad0097 man: explicitly document that "reboot -f" is different from "systemctl reboot -f"
c5b0ae86b1 watchdog: use /dev/watchdog0 only if it exists
ac805eac15 journalctl: respect --quiet flag during file concistency verification
c1d729795d xdg-autostart-service: expand tilde in Exec lines
35c5f5d688 unit: drop ProtectClock=yes from systemd-udevd.service
175ba30cf6 busctl: Fix warning about invaild introspection data
6c7b91372d udev/rules,hwdb: filter out mostly meaningless default strings
8b89e677e9 units: prolong the stop timeout for homed
202a79e7c5 homed: don't wait indefinitely for workers on exit
44660d2e12 man: fix static bridge example
e0dde8a14f log: don't attempt to duplicate closed fd
254b77e73c condition: fix device-tree firmware path
96da39ddb1 udev-util: minor cleanups for on_ac_power()
3345520512 docs: fix incorrect env var name for credentials directory
49f9fa87b2 shell-completion: drop unused $mode
1e29d934de oomd: fix off-by-one when dumping kill candidates
b00cb050c8 on-ac-power: ignore devices with scope==Device
9886011356 on-ac-power: rework logic
1fc74d251e sd-device: add helper to read a unsigned int attribute
6d4c138534 shared/udev-util: say "ignoring device", not "ignoring"
cd2fad2300 virt: Support detection of Apple Virtualization.framework guests
6e47e75c86 virt: align tables
951e99231e check-os-release.py compatible with Python < 3.8
d572a74163 core/mount: adjust deserialized state based on /proc/self/mountinfo
2e372afc35 Allow uneven length BootXXXX variables
8ad143e684 gpt: fix native uuids for s390x
2bb9a0a29b udev: fix inversed inequality for timeout of retrying event
cf67d5ed1b bash-completion: add systemd-sysext support
ada437cfb1 sysext: add missing COMMAND to the help output and man synopsis
58bc1e8e04 hostname: make chassis type actually obtained from ACPI when nothing from DMI
4ffde70981 booctl: do not say uuids differ if one of the uuids is unset
5219a99ccb bash-completion: autocomplete cgroup names in systemd-cgtop
9f2f391153 sysusers: add fsync for passwd (#24324)
c966377c51 dhcp6: do not append ORO option when no option requested
97474b03e7 dhcp6: gracefully handle NoBinding error
c67a388aef udev/cdrom_id: check last track info
52c631b02e firstboot: fix can't overwrite timezone
f279a6f4d1 cryptenroll: fix memory leak
66b060225d sd-device-enumerator: drop noisy log messages
6e1acfe818 sd-device-monitor: actually refuse to send invalid devices
81339c45e8 sd-device-monitor: fix inversed condition
1760559918 resolvctl: only remove protocol after last dot when mangling ifname for resolvconf
a3348ba748 oom: drop invalid %m in the log message
b3dd66f32b meson: Test correct efi linker for supported args
f9d936b865 sysusers: properly process user entries with an explicit GID
ec5a46ca34 sysusers: only check whether the requested GID is available
037b1a8acc dhcp: fix potential buffer overflow
ed2955f8fe udev-util: assume system is running on AC power when no battery found
37b54927d3 Fix issue with system time set back (#24131)
4fdca1ab9e shared/generator: Ensure growfs unit runs after repart
32f9d70f8b manager: optionally, do a full preset on first boot
```
When we initially applied the openembedded patchset to make systemd
build with musl, these options had to be disabled for it to work.
Now they seem to work fine, so re-enabling.
The NixOS systemd module has to include some upstream unit files
depending on if the systemd package was built with utmp support.
This makes it possible for the NixOS systemd module to detect if the
systemd package was built with utmp support.
So far, we have been building Systemd without `BPF_FRAMEWORK`. As a
result, some Systemd features like `RestrictNetworkInterfaces=` cannot
work. To make things worse, Systemd doesn't even complain when using a
feature which requires `+BPF_FRAMEWORK`; yet, the option has no effect:
# systemctl --version | grep -o "\-BPF_FRAMEWORK"
-BPF_FRAMEWORK
# systemd-run -t -p RestrictNetworkInterfaces="lo" ping -c 1 8.8.8.8
This commit enables `BPF_FRAMEWORK` by default. This is in line with
other distros (e.g., Fedora). Also note that BPF does not support stack
protector: https://lkml.org/lkml/2020/2/21/1000. To that end, I added a
small `CFLAGS` patch to the BPF building to keep using stack protector
as a default.
I also added an appropriate NixOS test.
The ConditionFileNotEmpty override patch wasn't correct for stage1, which
does have the modules in /lib. So, remove the patch and set
the right path with overrides in the final system.
Also, make sure systemd-tmpfiles-setup-dev is pulled in to create
all the necessary symlinks.
patchShebangs was writing a build platform bash shebang to
systemd-update-helper, which ends up in the output. To fix this, this patch
restricts patchShebangs to only run on certain directories.
Also, remove a comment stating that patchShebangs will no longer be necessary
after the next systemd release. This is not the case because /usr/bin/env
doesn't exist within the sandbox and will still need to be patched.
Account for all `with*` options causing their respective unit files to
not be built, just like the current code `withCryptsetup` already does.
This fixes build errors like the following:
```
missing /nix/store/5fafsfms64fn3ywv274ky7arhm9yq2if-systemd-250.4/example/systemd/system/systemd-importd.service
error: builder for '/nix/store/67rdli5q5akzwmqgf8q0a1yp76jgr0px-system-units.drv' failed with exit code 1
```
Found by using a customised systemd package as follows:
```
systemd.package = pkgs.systemd-small;
nixpkgs.config.packageOverrides = pkgs: {
"systemd-small" = pkgs.systemd.override {
withImportd = false;
withMachined = false;
...
};
};
```
In Issue #169693 we found out that systemd-bootaa64.efi does not have
required `#### LoaderInfo: systemd-boot 250.4 ####` marking.
It is destroyed by `nixpkgs`'s `_doStrip` hook (part of `fixupOutputHooks`).
It makes sense as PE32+ is a bit different from ELF where `.sdmagic` section
is inserted.
The change avoids stripping EFI files altogether by moving them out
of default strip directories of _doStrip for the time while `fixupPhase`
is running.
Closes: https://github.com/NixOS/nixpkgs/issues/169693
- Fix the name of the env
- Add the correct kmod to the initrd
- Add `less` to make journalctl usable
- Fix SYSTEMD_SULOGIN_FORCe for rescue.target
- Add some missing binaries
Among other things fixes build failure on linux-headers-5.17:
../src/basic/meson.build:389:8: ERROR: Problem encountered: found unknown filesystem(s) defined in kernel headers:
Filesystem found in kernel header but not in filesystems-gperf.gperf: CIFS_SUPER_MAGIC
Filesystem found in kernel header but not in filesystems-gperf.gperf: SMB2_SUPER_MAGIC
As reported in
https://github.com/NixOS/nixpkgs/pull/156096#pullrequestreview-900986176,
this fails to build on EFI enabled RISC-V because the requested EFI
linker (efi-ld=gold) is unsupported. According to Wikipedia gold only
supports x86, x86-64, ARM, PowerPC, TileGX.
Removing this option alltogether will cause meson to figure out the
default linker by itself.
This helps systemd during runtime to make decisions about the sanity of
the system clock. See the references news article for more details on
the matter.
We don't have to do that as we already set all the feature flags to
null. Setting individual libraries to null instead of disabling their
feature flag will lead with bad example that will cause each of the
features to be disabled with multiple flags in the systemdMinimal
variant.
If a dependency is pulled in via another feature we should disable that
rather than setting it to null. Overriding a given package should be the
last resort.
It was originally moved because of nixops autoLuks feature which
has been unsupported for a while.
See:
* https://github.com/NixOS/nixpkgs/issues/62211
* https://github.com/NixOS/nixops/pull/1156#issuecomment-605339705
systemd-tmpfiles-setup-dev.service needs to run very early (even before
udev runs) because udev rules assume static device nodes already exist
even before udev is started. If these static device nodes do not exist;
systemd might have trouble mounting filesystems that require static
device nodes (like loopfs and btrfs).
Fixes build of pkgsMusl.systemdMinimal (and pkgsMusl.systemd if combined with
other fixes).
These patches are applied conditionally on purpose: They are not checked to
be properly guarded. They should not block future systemd upgrades.
Also see the original RFC section around musl systemd:
https://github.com/NixOS/rfcs/blob/master/rfcs/0023-musl-libc.md#systemd
This updates systemd to version v249.4 from version v247.6.
Besides the many new features that can be found in the upstream
repository they also introduced a bunch of cleanup which ended up
requiring a few more patches on our side.
a) 0022-core-Handle-lookup-paths-being-symlinks.patch:
The way symlinked units were handled was changed in such that the last
name of a unit file within one of the unit directories
(/run/systemd/system, /etc/systemd/system, ...) is used as the name
for the unit. Unfortunately that code didn't take into account that
the unit directories themselves could already be symlinks and thus
caused all our units to be recognized slightly different.
There is an upstream PR for this new patch:
https://github.com/systemd/systemd/pull/20479
b) The way the APIVFS is setup has been changed in such a way that we
now always have /run. This required a few changes to the
confinement tests which did assert that they didn't exist. Instead of
adding another patch we can just adopt the upstream behavior. An
empty /run doesn't seem harmful.
As part of this work I refactored the confinement test just a little
bit to allow better debugging of test failures. Previously it would
just fail at some point and it wasn't obvious which of the many
commands failed or what the unexpected string was. This should now be
more obvious.
c) Again related to the confinement tests the way a file was tested for
being accessible was optimized. Previously systemd would in some
situations open a file twice during that check. This was reduced to
one operation but required the procfs to be mounted in a units
namespace.
An upstream bug was filed and fixed. We are now carrying the
essential patch to fix that issue until it is backported to a new
release (likely only version 250). The good part about this story is
that upstream systemd now has a test case that looks very similar to
one of our confinement tests. Hopefully that will lead to less
friction in the long run.
https://github.com/systemd/systemd/issues/20514https://github.com/systemd/systemd/pull/20515
d) Previously we could grep for dlopen( somewhat reliably but now
upstream started using a wrapper around dlopen that is most of the
time used with linebreaks. This makes using grep not ergonomic
anymore.
With this bump we are grepping for anything that looks like a
dynamic library name (in contrast to a dlopen(3) call) and replace
those instead. That seems more robust. Time will tell if this holds.
I tried using coccinelle to patch all those call sites using its
tooling but unfornately it does stumble upon the _cleanup_
annotations that are very common in the systemd code.
e) We now have some machinery for libbpf support in our systemd build.
That being said it doesn't actually work as generating some skeletons
doesn't work just yet. It fails with the below error message and is
disabled by default (in both minimal and the regular build).
> FAILED: src/core/bpf/socket_bind/socket-bind.skel.h
> /build/source/tools/build-bpf-skel.py --clang_exec /nix/store/x1bi2mkapk1m0zq2g02nr018qyjkdn7a-clang-wrapper-12.0.1/bin/clang --llvm_strip_exec /nix/store/zm0kqan9qc77x219yihmmisi9g3sg8ns-llvm-12.0.1/bin/llvm-strip --bpftool_exec /nix/store/l6dg8jlbh8qnqa58mshh3d8r6999dk0p-bpftools-5.13.11/bin/bpftool --arch x86_64 ../src/core/bpf/socket_bind/socket-bind.bpf.c src/core/bpf/socket_bind/socket-bind.skel.h
> libbpf: elf: socket_bind_bpf is not a valid eBPF object file
> Error: failed to open BPF object file: BPF object format invalid
> Traceback (most recent call last):
> File "/build/source/tools/build-bpf-skel.py", line 128, in <module>
> bpf_build(args)
> File "/build/source/tools/build-bpf-skel.py", line 92, in bpf_build
> gen_bpf_skeleton(bpftool_exec=args.bpftool_exec,
> File "/build/source/tools/build-bpf-skel.py", line 63, in gen_bpf_skeleton
> skel = subprocess.check_output(bpftool_args, universal_newlines=True)
> File "/nix/store/81lwy2hfqj4c1943b1x8a0qsivjhdhw9-python3-3.9.6/lib/python3.9/subprocess.py", line 424, in check_output
> return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
> File "/nix/store/81lwy2hfqj4c1943b1x8a0qsivjhdhw9-python3-3.9.6/lib/python3.9/subprocess.py", line 528, in run
> raise CalledProcessError(retcode, process.args,
> subprocess.CalledProcessError: Command '['/nix/store/l6dg8jlbh8qnqa58mshh3d8r6999dk0p-bpftools-5.13.11/bin/bpftool', 'g', 's', '../src/core/bpf/socket_bind/socket-bind.bpf.o']' returned non-zero exit status 255.
> [102/1457] Compiling C object src/journal/libjournal-core.a.p/journald-server.c.oapture output)put)ut)
> ninja: build stopped: subcommand failed.
f) We do now have support for TPM2 based disk encryption in our
systemd build. The actual bits and pieces to make use of that are
missing but there are various ongoing efforts in that direction.
There is also the story about systemd in our initrd to enable this
being used for root volumes. None of this will yet work out of the
box but we can start improving on that front.
g) FIDO2 support was added systemd and consequently we can now use
that. Just with TPM2 there hasn't been any integration work with
NixOS and instead this just adds that capability to work on that.
Co-Authored-By: Jörg Thalheim <joerg@thalheim.io>
This has only been used by Dysnomia, which has been removed from Nixpkgs
in https://github.com/NixOS/nixpkgs/pull/110799 after being broken for
more than a year.
If Dysnomia comes back, it can probably just use
/nix/var/nix/profiles/default/lib/systemd/system, or set its own systemd
flavour looking in that location via the `systemd.package`.
This was recently introduced, and apparently not nixpkgs-fmt'ed.
While there's no global consensus on nixpkgs-fmt'ing everything,
indenting this by 2 more spaces won't hurt.
continuation of #109595
pkgconfig was aliased in 2018, however, it remained in
all-packages.nix due to its wide usage. This cleans
up the remaining references to pkgs.pkgsconfig and
moves the entry to aliases.nix.
python3Packages.pkgconfig remained unchanged because
it's the canonical name of the upstream package
on pypi.
This ensures that all the features that are implemented via dlopen(3)
are available (or explicitly deactivated) by pointing dlopen to the
absolute store path instead of relying on the linkers runtime lookup
code.
All of the dlopen calls have to be handled. When new ones are introduced
by upstream (or one of our patches) those must be explicitly declared,
otherwise the build will fail.
As of systemd version 247 we've seen a few errors like `libpcre2.… not
found` when using e.g. --grep with journalctl. Those errors should
become less unexpected now.
There are generally two classes of dlopen calls. Those that we want to
support and those that should be deactivated / unsupported. This change
enforces that we handle all dlopen calls explicitly. Meaning: There is
not a single dlopen call in the code source tree that we did not
explicitly handle.
In order to do this I introduced a list of attributes that maps from
shared object name to the package that contains them. The package can be
null meaning the reference should be nuked and the shared object will
never be loadable during runtime (because it points at an invalid store
path location).
Contains the following fixes:
- 937118a5b2 journalctl: don't skip the entries that have the same seqnum
- e017ac6a26 sd-bus: use SOCK_CLOEXEC on one more socket
- db31432861 resolved: create stub-resolv.conf symlink with correct security label
- f2ec15e2e5 efi: Only use arm flags if supported
- cd43eee770 core: detect_container() may return negative errno
- 04be042a1f meson: Fix reallocarray check
- 5e906f483b network: do not assume address ready callback is always set to static addresses
- 2ad7a2a96a network: drop assertions to check link state in netlink callback handlers
- f375c8cbb5 network: do not reconfigure interface when the link gains carrier but udev not initialized it yet
- 5d4909decf veritysetup: also place udev socket dep
- 57ddb74245 cryptsetup: Fix crypto device missing issue after bootup
- d3c224d441 network: fix SIGABRT related to unreachable route with DHCP6
- c91648cc83 network: revert previous changes to address_compare_func()
- d8b5d8c8c3 udev: Fix sound.target dependency
- 669107ae68 meson: specify correct libqrencode version in meson dep
- c07dc6cedc udev: link_update() should fail if the entry in symlink dir couldn't have been created
- 367006c806 man: document that automount units are privileged
- 5129808141 logind: fix closing of button input devices
- 37f06c91ef Update logind-button.c
- 9e9fda0a2d async: add trivial cleanup wrapper for asynchronous_close()
- 4a2ca1ca4a Silence cgroups v1 read-only filesystem warning
- ed1f8f4ba2 manager: Fix HW watchdog when systemd starts before driver loaded
- 383a747164 cgroup: Also set blkio.bfq.weight
- 48d41091ac nss-resolve: varlink_call() set error_id only when r >= 0
- 56daba2deb missing: Define several syscall numbers for Alpha arch
- f2a4b96276 Don't assume /run/systemd exists when creating unit-root
- 553530fdc7 mkosi: Add findutils to Fedora config
- e42990dfe3 mkosi: Add rpm to Fedora BuildPackages as it's needed by pkg-config
- 6bacd1d971 mkosi: Replace iptables-dev with libiptc-dev in debian config
- f1fc515c21 dissect: don't declare unused variables on archs that have no GPT discovery
- 30d0c3f58c resolved: synthesize NODATA instead of NXDOMAIN if gateway exists, but of other protocol
- 538ebbd7f3 local-addresses: make returning accumulated list optional
- 228a22bb63 resolved: improve log message when we use TCP a bit
- aa31dd9128 network: ignore broadcast address for /31 or /32 addresses
- 85607cc094 network: fix verification for broadcast address
- dc6ad6482a network: do not set broadcast if prefixlen is 31 or 32
- 39ee319c75 stub: don't ever respond to datagrams coming in on non-localhost addreses, on the stub
- cbea0e5a83 resolved: never allow _gateway lookups to go to the network
- c4df66816b resolved: lower SERVFAIL cache timeout from 30s to 10s
- b5e39c20d9 dns-domain: try IDN2003 rules if IDN2008 doesn't work
- 2c354cedd2 virt: Properly detect nested UML inside another hypervisor
- 10f2cfb715 resolved: properly check per-link NTA list
- a8437c07e4 meson: use '_' as separator in fuzz test names
- 81ef7623c8 man: mention that --key= is about *secret* keys
- 4ef70ecefc meson: check that cxx variable is set before using it
See https://www.redhat.com/sysadmin/fedora-31-control-group-v2 for
details on why this is desirable, and how it impacts containers.
Users that need to keep using the old cgroup hierarchy can re-enable it
by setting `systemd.unifiedCgroupHierarchy` to `false`.
Well-known candidates not supporting that hierarchy, like docker and
hidepid=… will disable it automatically.
Fixes#73800
This makes curl optional if both remote and importd are disabled, and
makes some assertions more robust by switching from curl.dev != null to
lib.getDev curl != null.
upstreams TODO mentions iptables-dev (libiptc) is also used for nspawn,
but it seems like it only makes use of this via networkd anyways (or
does these days) - at least systemdMinimal compiles successfully without
iptables in the build closure.
This was only used to patch a circular output reference from lib to out
on aarch64, but was removed in b68bddfbda,
This commit forgot to remove perl, so remove it now.
This was introduced in https://github.com/NixOS/nixpkgs/pull/99621, but
didn't follow the process documented in
pkgs/os-specific/linux/systemd/default.nix, namely, the `git am` and
`git format-patch` workflow, which caused
`0019-revert-get-rid-of-seat_can_multi_session.patch` to not apply with
`git am` due to missing authorship information.
I did apply this patch manually, and copied authorship information from
4e384ddc11.
This reverts commit c778945806.
I believe this is exactly what brings the staging branch into
the right shape after the last merge from master (through staging-next);
otherwise part of staging changes would be lost
(due to being already reachable from master but reverted).
Update to latest stable version. Changes:
d0f0f048ec sd-path: use ROOTPREFIX without suffixed slash
e662cf6d51 hashmap: make sure to initialize shared hash key atomically
da310c6b45 socket: downgrade log warnings about inability to set socket buffer sizes
ab6fcd9135 core: fix securebits setting
4f6925484d capability-util: add new function for raising setpcap
771436884d network: do not add prefix to RA if radv is not configured
fb2afc5f30 man: document the random delay of persistent timers
b2006ddc8f test-network: add test for ENOBUFS issue #17012
8758580ef5 backlight: do not claim that ID_BACKLIGHT_CLAMP= property is not set
57fc184a6c fs-util,tmpfiles: fix error handling of fchmod_opath()
db0f031e70 bootctl: don't accidentally propagate errors in "bootctl status"
3e2c806681 ethtool-util: don't pass error value that isn't used to log_syntax
b671730edb network: don't fail on various config parse errors
0ad86030c5 man: document that sd_bus_message_close_container() may only be called at end of container
f3da018017 cryptsetup: Fix null pointer dereference (#16987)
6f65eaf9c2 core: fix set keep caps for ambient capabilities
08338a234e core: fix comments on ambient capabilities
f0e6d9876d network: make log_link_error() or friends return void
35766dc61b core: make log_unit_error() or friends return void
3ed10b2ee8 core/slice: explicitly specify return value
2f6406914b udev: do not discard const qualifier
07671aa4cc sd-device: make log_device_error() or friends return void
d4bea73972 udev: explicitly specify return value
7db399be1e udev: return negative errno for invalid EVDEV_ABS_XXX= property
8c8d188e85 udev: make log_rule_error() or friends return void
4921375fd3 socket: fix copy/paste error
0f7fd97749 udev: warn if failed to set buffer size for device monitor
fc763d38d8 network: increase receive buffer size for device monitor
3bf7797f1f network: do not start device monitor if /sys is read-only
ebc0729c6a network: honor the buffer size specified in networkd.socket
ef3d2e178b core/socket: use fd_set_{rcv,snd}buf()
5dd4cc4b10 sd-device-monitor: use fd_set_rcvbuf()
fe9b92e566 util: introduce fd_set_{snd,rcv}buf()
4dcae66688 util: try to set with SO_{RCV,SND}BUFFORCE when requested size is larger than the kernel limit
4b6b523946 util: refuse to set too large value for socket buffer size
b4be8edb45 network: ignore error on increasing netlink receive buffer size
5ce47fb491 tree-wide: if get_block_device() returns zero devno, check for it in all cases
8ea6ec18e7 btrfs: if BTRFS_IOC_DEV_INFO returns /dev/root generate a friendly error message
e1ff4947d2 basic/log: make log_{info,warning,...} return void
8019995e9a tree-wide: correct cases where return log_{error,warning} is used without value
932f4c3e8b test-execute/exec-dynamicuser-statedir.service: fix quoting
16b9426f70 man: fix quickhelp listing in sysusers.d(5)
bde903d9e9 network: fix NDisc handling for the case when multiple routers exist
c965063b64 network: expose route_{hash,compare}_func()
6d24a40669 network: expose address_{hash,compare}_func()
054838a2e0 util: expose in6_addr_{hash,compare}_func()
58bd4a70de network: fixes gateway assignment through DHCPv4
8ad5382fe3 bash-completion: resolvectl: support 'log-level' command
a98bd75072 resolvectl: add 'log-level' to help message
78262fe807 core/socket: we may get ENOTCONN from socket_instantiate_service()
fecb3f00c4 homed: remember the secret even when the for_state is FIXATING_FOR_ACQUIRE
This bumps systemd to the latest stable maintenance release.
- dc2e82af33 core: create per-user inaccessible node from the service manager
- 0b3c497347 nspawn,pid1: pass "inaccessible" nodes from cntr mgr to pid1 payload via /run/host
- 2239965c29 coredump: don't convert s → µs twice
- 61d29b7f8c firstboot: fill empty color if ansi_color unavailable from os-release
- 9678a3daf6 varlink: do not parse invalid messages twice
- 4e516dcbc1 userdbctl: add forgotten --output mode in help
- aee20dfbd8 shared/{user,group}-record-nss: adjust filtering of "valid" passwords
- 5933d77afe doc: cross link sd_listen_fd() docs a bit
- 97fdde3239 Rework how we cache mtime to figure out if units changed
- 0500968241 core: always try to reload not-found unit
- 8ae22f0d64 pid1: use the cache mtime not clock to "mark" load attempts
- 715507c277 core: rename manager_unit_file_maybe_loadable_from_cache()
- 20ad76d0a7 man: document fd ownership for sd-bus fd marshalling
- 38ae73fafd resolved: make sure we initialize t->answer_errno before completing the transaction
- a1ba0fbef6 homed: fix log message to honor real homework path
- d6b1e659b3 src/shared/dissect-image.c: fix build without blkdid (#16901)
- e42f9add21 analyze: fix error handling in one case
- 4804ce1488 units: add missing usb-gadget.target
- 5ad4e68c37 man: extend on the usec/sec discrepancy
- 2fb612371d login/logind: Include sys/stat.h for struct stat usage
- 5e884e7ee0 partition/makefs: Include missing sys/file.h header
- 7bbc3807da network: dhcp6: logs only new address
- 2056429e0f Don't run test-repart when loop devices are not available
- dcbea51c5a man: clarify that several networkctl commands takes device names
- 16e4cfcc82 networkctl: label command does not take any argument
- 2352921244 missing: Add new Linux capability
- 8b29c4a4f9 tty-ask-pw-agent: properly propagate error
- f7ce2e9839 tty-ask-pw-agent: the message string might not be set
- 29cba5c9ef tty-ask-pw-agent: make sure "--list" works correctly
- e1ce367d73 add "list" verb to autocompleted commands
- 1f4cb5da1e shell-completion/zsh: add missing verbs for networkctl
- a4236a2764 path: Improve $PATH search directory case
- b7cef386bd path: Skip directories when finalising $PATH search
- 122945f315 rules: don't install 80-drivers.rules when kmod is disabled
- 42fab2d454 zsh: correct journalctl command completion parsing
- ed3f97f962 basic/missing_syscall: fix syscall numbers for arm64 :(
- ba6e7f7c46 shared/install: fix preset operations for non-service instantiated units
- d39f139348 nss-resolve: treat BUS_ERROR_NO_SUCH_UNIT the same as SD_BUS_ERROR_SERVICE_UNKNOWN too
- 9bb3e64d71 various: treat BUS_ERROR_NO_SUCH_UNIT the same as SD_BUS_ERROR_SERVICE_UNKNOWN
- 6d802dd596 man: drop reference to long gone .busname unit type
- a29656804b man: fix a fix of a typo in systemd.service example
- 21ce0f5b33 network: can: Fix CAN initialization
- cab5cde8c9 man: update autogenerated dbus api lists
- 0d8000522b man: fix invalid tag place
- ea94f218be man: add conditionals to more man pages
- ef91325349 meson: add ENABLE_ANALYZE conditional
- 83f7c0a7ec core: add missing conditions/asserts to unit file parsing
- 716718155d analyze: rework condition testing
- 5c4c7581bc sd-bus: fix error handling on readv()
- 6cd058f305 user-runtime-dir: deal gracefully with missing logind properties
- 6a2d73638d shared/seccomp: do not use ifdef guards around textual syscall names
- 7355ac9689 machine-id-setup: don't use KVM or container manager supplied uuid if in chroot env
- 496a71f444 man: Fix typo in systemd-tmpfiles
- 6c5d216ad8 homework: downgrade chattr failure log message
- 1708f06a00 homework: explicitly close cryptsetup context, to not keep loopback device busy
- a21eaa2a3a homework: correct error passed into log message
- 3a2d169f36 homework: sync everything to disk before we rename LUKS loopback file into place
- 84e1ab74d2 homed: downgrade quota message in containers
- 8b62cadf36 analyze-security: do not assign badness to filtered-out syscalls
- 29854a5437 NEWS: clarify two points
- 4cb4fb82f7 meson: add min version for libfdisk
- 76331f86f6 load-fragment: fix grammar in error messages
- 1e53c2d70f Fix function description in logind man page
- 669066564d network: do not fail if UseMTU=yes on DHCP lease lost
- a2a3f16cdc missing_syscall: do not use function name that may conflict with glibc
- 4091dcd469 missing_syscall: fix pidfd_{send_signal,open} numbers for alpha
- 7875daf52b network: wait for previous address removal before configuring static addresses
- 120064b4a1 network: only process non-error message
- f44ec1de15 test: accept that char device 0/0 can now be created witout privileges
- 946e4c43bb tools/make-man-index: fix purpose text that contains tags
- dae0586e91 test-fs-util: skip encrypted path test if we get EACCES
- 0d026c9b0d Newer Glibc use faccessat2 to implement faccessat
- fde6520d46 namespace: fix minor memory leak
- 208ba581f4 man: fix incorrectly placed full stop
- 6c81d57828 man: fix typo
- 53a8d2588e bless-boot: add missing verb to --help
- 4cfa0ac4fd user-record: deal with invalid GECOS fields gracefully
- ae5234ef48 user-util: add mangle_gecos() call for turning strings into fields suitable as GECOS fields
- 972391ac39 fix typo in systemctl help
- 443aacfcda man: clarify that LogNamespace= is for system services only
- 5aec8fe54e _sd-common.h: avoid parsing errors with Coverity
- f9ad4ea2ca analyze: fix 'cat-config systemd/zram-generator.conf'
- dda6fec1df man: describe that changing Storage= does not move existing data
- 2bbd33e476 core: reset bus error before reuse
- b81504a3c7 nspawn: Fix incorrect usage of putenv
- cb263973ac man: fix typo in systemd.service
- 73b432e7ef network: fix DHCPv6 Prefix Delegation example after option rename
This makes things more consistent with how we pass in utillinuxMinimal.
There's already a minimal argument in the gnupg derivation, but this
gnupg is even more minimal. Instead of defining a gnupgSuperMinimal, we
define it inline inside systemd.
systemd 246 started baking in some strings into $lib/lib/libsystemd.so
which points back to $out.
It might be desirable to not have these strings in there, but instead
have systemd ask the running manager for the really active paths via
IPC, or patch in some more mutable paths (like /run/current-system/…) -
but as long as it is as it is, we should probably should just stop
producing the `lib` output for now.
This does increase the runtime closure for installations not pulling in
systemd.out, or linking against multiple libsystemd's, but doesn't
increase the runtime closure for NixOS itself, as it needs systemd
anyways, and doesn't link against multiple variants of it.
We can also remove the aarch64-specific $out/lib/systemd/catalog hack,
and revive it at a later time if the `lib` output is reintroduced.
This package previously did override the systemd package, and instructed
ninja, systemd's previous build system, to only build the
cryptsetup-specific systemd generators (plus some manual rpath
massaging, as ninja install wasn't used).
Afterwards, users were expected to add this package to their
`systemd.generator-packages` (or since
https://github.com/NixOS/nixpkgs/pull/65376/files `systemd.packages`)
NixOS module options, so systemd will use these generators.
As the previous commit added cryptsetup support directly to the systemd
package (and pkgs.systemd now already ships the cryptsetup generators),
we don't need another package shipping the same generators.
There's a circular dependency to systemd via cryptsetup and lvm2
(systemd -> cryptsetup -> lvm2 -> udev=systemd).
However, cryptsetup only really needs the devmapper component shipped
with lvm2. So build `pkgs.cryptsetup` with a lvm2 that doesn't come with
udev.
