diff --git a/0001-Revert-units-drop-runlevel-0-6-.target.patch b/0001-Revert-units-drop-runlevel-0-6-.target.patch deleted file mode 100644 index faf8341..0000000 --- a/0001-Revert-units-drop-runlevel-0-6-.target.patch +++ /dev/null @@ -1,88 +0,0 @@ -From 61750e265ce3f7783a8dba831e91140f84ad89f2 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= -Date: Wed, 5 Nov 2025 17:52:16 +0100 -Subject: [PATCH 1/3] Revert "units: drop runlevel[0-6].target" - -This partially reverts commit e58ba80a40fb6e96543d56774a5bc5aa9cdadbf3. -The unit are still needed for compat. ---- - units/meson.build | 27 ++++++++++++++++++++++----- - 1 file changed, 22 insertions(+), 5 deletions(-) - -diff --git a/units/meson.build b/units/meson.build -index 2e04c4aa2b..46eaac4073 100644 ---- a/units/meson.build -+++ b/units/meson.build -@@ -1,5 +1,7 @@ - # SPDX-License-Identifier: LGPL-2.1-or-later - -+with_runlevels = conf.get('HAVE_SYSV_COMPAT') == 1 -+ - units = [ - { 'file' : 'basic.target' }, - { 'file' : 'blockdev@.target' }, -@@ -49,7 +51,7 @@ units = [ - }, - { - 'file' : 'graphical.target', -- 'symlinks' : ['default.target'], -+ 'symlinks' : ['default.target'] + (with_runlevels ? ['runlevel5.target'] : []), - }, - { 'file' : 'halt.target' }, - { -@@ -142,7 +144,10 @@ units = [ - 'conditions' : ['ENABLE_MACHINED'], - }, - { 'file' : 'modprobe@.service' }, -- { 'file' : 'multi-user.target' }, -+ { -+ 'file' : 'multi-user.target', -+ 'symlinks' : with_runlevels ? ['runlevel2.target', 'runlevel3.target', 'runlevel4.target'] : [], -+ }, - { - 'file' : 'systemd-mute-console.socket', - 'symlinks' : ['sockets.target.wants/'] -@@ -155,7 +160,10 @@ units = [ - { 'file' : 'nss-lookup.target' }, - { 'file' : 'nss-user-lookup.target' }, - { 'file' : 'paths.target' }, -- { 'file' : 'poweroff.target' }, -+ { -+ 'file' : 'poweroff.target', -+ 'symlinks' : with_runlevels ? ['runlevel0.target'] : [], -+ }, - { 'file' : 'printer.target' }, - { - 'file' : 'proc-sys-fs-binfmt_misc.automount', -@@ -180,7 +188,7 @@ units = [ - }, - { - 'file' : 'reboot.target', -- 'symlinks' : ['ctrl-alt-del.target'], -+ 'symlinks' : ['ctrl-alt-del.target'] + (with_runlevels ? ['runlevel6.target'] : []), - }, - { - 'file' : 'remote-cryptsetup.target', -@@ -200,7 +208,10 @@ units = [ - 'symlinks' : ['initrd-root-device.target.wants/'], - }, - { 'file' : 'rescue.service.in' }, -- { 'file' : 'rescue.target' }, -+ { -+ 'file' : 'rescue.target', -+ 'symlinks' : with_runlevels ? ['runlevel1.target'] : [], -+ }, - { 'file' : 'rpcbind.target' }, - { 'file' : 'serial-getty@.service.in' }, - { 'file' : 'shutdown.target' }, -@@ -1001,4 +1012,10 @@ else - dbussessionservicedir / 'org.freedesktop.systemd1.service')) - endif - -+if conf.get('HAVE_SYSV_COMPAT') == 1 -+ foreach i : [1, 2, 3, 4, 5] -+ install_emptydir(systemunitdir / 'runlevel@0@.target.wants'.format(i)) -+ endforeach -+endif -+ - subdir('user') diff --git a/0001-core-create-userdb-root-directory-with-correct-label.patch b/0001-core-create-userdb-root-directory-with-correct-label.patch new file mode 100644 index 0000000..9cc2cbd --- /dev/null +++ b/0001-core-create-userdb-root-directory-with-correct-label.patch @@ -0,0 +1,42 @@ +From 64a0066cfaa4dfcf25c5f6d3ae58df4f24dd1108 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= +Date: Sat, 30 Aug 2025 13:55:56 +0200 +Subject: [PATCH 1/2] core: create userdb root directory with correct label + +Set up the /run/systemd/userdb directory with the default SELinux context +on creation. + +With version 257.7-1 on Debian the directory was automatically created with the +correct label. Starting with version 258 (only tested with 258~rc3-1) it no +longer is. Regression introduced in 736349958efe34089131ca88950e2e5bb391d36a. + +[zjs: edited the patch to apply comments from review and update the description.] +--- + src/core/varlink.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/core/varlink.c b/src/core/varlink.c +index 6074c55ab1..acd51fc47e 100644 +--- a/src/core/varlink.c ++++ b/src/core/varlink.c +@@ -8,6 +8,7 @@ + #include "json-util.h" + #include "manager.h" + #include "metrics.h" ++#include "mkdir.h" + #include "path-util.h" + #include "pidref.h" + #include "string-util.h" +@@ -514,7 +515,11 @@ static int varlink_server_listen_many_idempotent_sentinel( + if (!known_fresh && varlink_server_contains_socket(s, address)) + continue; + +- r = sd_varlink_server_listen_address(s, address, 0666 | SD_VARLINK_SERVER_MODE_MKDIR_0755); ++ r = mkdir_parents_label(address, 0755); ++ if (r < 0) ++ log_warning_errno(r, "Failed to create parent directory of '%s', ignoring: %m", address); ++ ++ r = sd_varlink_server_listen_address(s, address, 0666); + if (r < 0) { + log_error_errno(r, "Failed to bind to varlink socket '%s': %m", address); + break; diff --git a/0002-machined-continue-without-resolve.hook-socket.patch b/0002-machined-continue-without-resolve.hook-socket.patch index 2903c5e..7de7adf 100644 --- a/0002-machined-continue-without-resolve.hook-socket.patch +++ b/0002-machined-continue-without-resolve.hook-socket.patch @@ -1,17 +1,17 @@ -From 8d6d86d1d7e45eeae921e88adde55d6524027c96 Mon Sep 17 00:00:00 2001 +From 786d3f382308d0119cce020e2c88a03ff96a25d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 26 Nov 2025 22:29:53 +0100 -Subject: [PATCH 3/3] machined: continue without resolve.hook socket +Subject: [PATCH 2/2] machined: continue without resolve.hook socket --- src/machine/machined-varlink.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/machine/machined-varlink.c b/src/machine/machined-varlink.c -index f83cbb8562..0b30cd0531 100644 +index acc2137f83..d1c9453e41 100644 --- a/src/machine/machined-varlink.c +++ b/src/machine/machined-varlink.c -@@ -894,9 +894,15 @@ static int manager_varlink_init_resolve_hook(Manager *m) { +@@ -904,9 +904,15 @@ static int manager_varlink_init_resolve_hook(Manager *m) { r = sd_varlink_server_listen_address(s, VARLINK_PATH_MACHINED_RESOLVE_HOOK, 0666 | SD_VARLINK_SERVER_MODE_MKDIR_0755); diff --git a/20-yama-ptrace.conf b/20-yama-ptrace.conf deleted file mode 100644 index 4fbaf97..0000000 --- a/20-yama-ptrace.conf +++ /dev/null @@ -1,42 +0,0 @@ -# The ptrace system call is used for interprocess services, -# communication and introspection (like synchronisation, signaling, -# debugging, tracing and profiling) of processes. -# -# Usage of ptrace is restricted by normal user permissions. Normal -# unprivileged processes cannot use ptrace on processes that they -# cannot send signals to or processes that are running set-uid or -# set-gid. Nevertheless, processes running under the same uid will -# usually be able to ptrace one another. -# -# Fedora enables the Yama security mechanism which restricts ptrace -# even further. Sysctl setting kernel.yama.ptrace_scope can have one -# of the following values: -# -# 0 - Normal ptrace security permissions. -# 1 - Restricted ptrace. Only child processes plus normal permissions. -# 2 - Admin-only attach. Only executables with CAP_SYS_PTRACE. -# 3 - No attach. No process may call ptrace at all. Irrevocable. -# -# For more information see Documentation/security/Yama.txt in the -# kernel sources. -# -# The default is 1., which allows tracing of child processes, but -# forbids tracing of arbitrary processes. This allows programs like -# gdb or strace to work when the most common way of having the -# debugger start the debuggee is used: -# gdb /path/to/program ... -# Attaching to already running programs is NOT allowed: -# gdb -p ... -# This default setting is suitable for the common case, because it -# reduces the risk that one hacked process can be used to attack other -# processes. (For example, a hacked firefox process in a user session -# will not be able to ptrace the keyring process and extract passwords -# stored only in memory.) -# -# Developers and administrators might want to disable those protections -# to be able to attach debuggers to existing processes. Use -# sysctl kernel.yama.ptrace_scope=0 -# for change the setting temporarily, or copy this file to -# /etc/sysctl.d/20-yama-ptrace.conf to set it for future boots. - -kernel.yama.ptrace_scope = 0 diff --git a/38769.patch b/38769.patch deleted file mode 100644 index 09a7423..0000000 --- a/38769.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 00d70f36a0866660693347009446b7f872a05bf4 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= -Date: Sat, 30 Aug 2025 13:55:56 +0200 -Subject: [PATCH] core: create userdb root directory with correct label - -Set up the /run/systemd/userdb directory with the default SELinux context -on creation. - -With version 257.7-1 on Debian the directory was automatically created with the -correct label. Starting with version 258 (only tested with 258~rc3-1) it no -longer is. Regression introduced in 736349958efe34089131ca88950e2e5bb391d36a. - -[zjs: edited the patch to apply comments from review and update the description.] ---- - src/core/varlink.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/src/core/varlink.c b/src/core/varlink.c -index 99f12c59e5..71a8ffd0e5 100644 ---- a/src/core/varlink.c -+++ b/src/core/varlink.c -@@ -5,6 +5,7 @@ - #include "constants.h" - #include "errno-util.h" - #include "manager.h" -+#include "mkdir-label.h" - #include "path-util.h" - #include "pidref.h" - #include "string-util.h" -@@ -441,7 +442,11 @@ static int manager_varlink_init_system(Manager *m) { - if (!fresh && varlink_server_contains_socket(m->varlink_server, address)) - continue; - -- r = sd_varlink_server_listen_address(m->varlink_server, address, 0666 | SD_VARLINK_SERVER_MODE_MKDIR_0755); -+ r = mkdir_parents_label(address, 0755); -+ if (r < 0) -+ log_warning_errno(r, "Failed to create parent directory of '%s', ignoring: %m", address); -+ -+ r = sd_varlink_server_listen_address(m->varlink_server, address, 0666); - if (r < 0) - return log_error_errno(r, "Failed to bind to varlink socket '%s': %m", address); - } diff --git a/42668.patch b/42668.patch new file mode 100644 index 0000000..4754a3a --- /dev/null +++ b/42668.patch @@ -0,0 +1,44 @@ +From e6f1190eb6be465432cfbab267a59c851ae990c5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Fri, 19 Jun 2026 21:38:44 +0200 +Subject: [PATCH] crypto-util: prefer openssl-4 + +Fedora has switched to openssl 4, and we generate a Requires dependency +on libcrypto for the systemd-udev subpackage, so preferring openssl-3 +does the wrong thing. So the order in the dlopen note needs to be switched. +But in general, we want to get rid of openssl-3, so we want to load +openssl-4 in preference. Change the order in both places. + +(The "compat" order can stay in 261-stable for other distros.) +--- + src/shared/crypto-util.c | 3 +-- + src/shared/crypto-util.h | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/shared/crypto-util.c b/src/shared/crypto-util.c +index ed6d2a269c772..b345475fa4043 100644 +--- a/src/shared/crypto-util.c ++++ b/src/shared/crypto-util.c +@@ -339,8 +339,7 @@ int dlopen_libcrypto(int log_level) { + + LIBCRYPTO_NOTE(SD_ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED); + +- // FIXME: switch order to prefer libcrypto.so.4 in a future version once it has stabilized +- FOREACH_STRING(soname, "libcrypto.so.3", "libcrypto.so.4") { ++ FOREACH_STRING(soname, "libcrypto.so.4", "libcrypto.so.3") { + r = dlopen_many_sym_or_warn( + &libcrypto_dl, + soname, +diff --git a/src/shared/crypto-util.h b/src/shared/crypto-util.h +index 980c1c60a2a5f..bd0cb7b67b8dd 100644 +--- a/src/shared/crypto-util.h ++++ b/src/shared/crypto-util.h +@@ -37,7 +37,7 @@ int dlopen_libcrypto(int log_level); + SD_ELF_NOTE_DLOPEN("libcrypto", \ + "Support for cryptographic operations", \ + priority, \ +- "libcrypto.so.3", "libcrypto.so.4") ++ "libcrypto.so.4", "libcrypto.so.3") + + #define DLOPEN_LIBCRYPTO(log_level, priority) \ + ({ \ diff --git a/7be9032019015ddd61985e6a6721d813d62dad0b.patch b/7be9032019015ddd61985e6a6721d813d62dad0b.patch new file mode 100644 index 0000000..c1de086 --- /dev/null +++ b/7be9032019015ddd61985e6a6721d813d62dad0b.patch @@ -0,0 +1,38 @@ +From 7be9032019015ddd61985e6a6721d813d62dad0b Mon Sep 17 00:00:00 2001 +From: Luca Boccassi +Date: Sat, 20 Jun 2026 15:21:26 +0100 +Subject: [PATCH] ssl-util: prefer OpenSSL 4 + +For the next version we can switch to preferring the new version +--- + src/shared/ssl-util.c | 3 +-- + src/shared/ssl-util.h | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/shared/ssl-util.c b/src/shared/ssl-util.c +index 226120c70e66f..4b7ab2ec29f74 100644 +--- a/src/shared/ssl-util.c ++++ b/src/shared/ssl-util.c +@@ -40,8 +40,7 @@ int dlopen_libssl(int log_level) { + + LIBSSL_NOTE(SD_ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED); + +- // FIXME: switch order to prefer libssl.so.4 in a future version once it has stabilized +- FOREACH_STRING(soname, "libssl.so.3", "libssl.so.4") { ++ FOREACH_STRING(soname, "libssl.so.4", "libssl.so.3") { + r = dlopen_many_sym_or_warn( + &libssl_dl, + soname, +diff --git a/src/shared/ssl-util.h b/src/shared/ssl-util.h +index aa3b8308665ba..77b5c049f9e3a 100644 +--- a/src/shared/ssl-util.h ++++ b/src/shared/ssl-util.h +@@ -12,7 +12,7 @@ int dlopen_libssl(int log_level); + SD_ELF_NOTE_DLOPEN("libssl", \ + "Support for TLS", \ + priority, \ +- "libssl.so.3", "libssl.so.4") ++ "libssl.so.4", "libssl.so.3") + + #define DLOPEN_LIBSSL(log_level, priority) \ + ({ \ diff --git a/99-kernel-hardening.conf b/99-kernel-hardening.conf new file mode 100644 index 0000000..bf42b85 --- /dev/null +++ b/99-kernel-hardening.conf @@ -0,0 +1,66 @@ +# This file is disabled by default. It provides a few kernel +# hardening settings. This file is automatically updated. +# +# Please read the Fedora hardening page for further information +# about this file (section 'Fedora-maintained (self-updating) +# hardening for general and average use cases' and +# section 'Fedora-maintained self-updating kernel hardening'): +# https://docs.fedoraproject.org/en-US/security/topics/hardening +# +# If you want to enable the hardening, create a symlink: +# sudo ln -s /usr/share/doc/systemd/99-kernel-hardening.conf /etc/sysctl.d/ +# -> do NOT copy or move or hardlink this file because +# this would break the automatic updates! +# +# +# Enabling this ptrace restriction can cause issues to some software +# developers: the need to use ptrace is restricted in the hardening +# because of the security issues it may cause in some +# circumstances: to use applications like gdb or strace when the +# hardening is enabled, users need to temporarily enable ptrace +# during the runtime of their ptrace-dependent application. +# Enabling ptrace implies disabling yama.ptrace_scope (which is +# the security measure enabled below). +# You can enable temporarily ptrace with: +# sysctl kernel.yama.ptrace_scope=0 +# You can subsequently disable it again with: +# sysctl kernel.yama.ptrace_scope=2 +# -> it will be reset automatically after reboot. +# For more information, read the Fedora hardening page +# mentioned above. +# +# Details: https://docs.kernel.org/admin-guide/sysctl/net.html +# Details: https://wiki.archlinux.org/title/Security#BPF_hardening +# Minor / partially-related side note: Fedora's kernel is compiled +# with CONFIG_BPF_JIT_ALWAYS_ON=True +net.core.bpf_jit_harden = 2 + +# Details: https://docs.kernel.org/admin-guide/LSM/Yama.html +# Details: https://wiki.archlinux.org/title/Security#ptrace_scope +# Side note: 'setsebool -P deny_ptrace on' can add a +# largely-overlapping security layer to achieve redundancy in +# restricting ptrace: it is suggested to read the Fedora hardening +# page (link above) section 'Fedora-maintained (self-updating) +# hardening for general and average use cases' and section +# 'Fedora-maintained 'enable & forget' SELinux & firewalld hardening' +# for further information about this. +kernel.yama.ptrace_scope = 2 + +# Details: https://docs.kernel.org/admin-guide/sysctl/kernel.html#kptr-restrict +# Details: https://wiki.archlinux.org/title/Security#Restricting_access_to_kernel_pointers_in_the_proc_filesystem +# This is formally not adding security because Fedora and its +# downstream use pre-compiled kernels, but it increases +# the knowledge required for successful exploitation. +kernel.kptr_restrict = 2 + +# This is unlikely to cause exploitable attack surface in average use +# cases of OS that are appropriately pre-configured, but for the same +# reason it is unlikely to cause issues to the users. +# In case of a doubt, it mitigates some potential for attack surface, +# including some attack surface the user might create themselves by +# accident. Even if the latter applies, it is unlikely to cause an +# impact except mitigate exploitation +# Details: https://docs.kernel.org/admin-guide/sysctl/fs.html#protected-fifos +fs.protected_fifos = 2 +# Details: https://docs.kernel.org/admin-guide/sysctl/fs.html#protected-regular +fs.protected_regular = 2 diff --git a/plans/run-integration-tests.sh b/plans/run-integration-tests.sh index 6d2ee37..dab8525 100755 --- a/plans/run-integration-tests.sh +++ b/plans/run-integration-tests.sh @@ -89,16 +89,23 @@ if [[ ! -e /dev/kvm ]]; then fi NPROC="$(nproc)" -if [[ "$NPROC" -ge 10 ]]; then - export TEST_JOURNAL_USE_TMP=1 - NPROC="$((NPROC / 3))" -else - NPROC="$((NPROC - 1))" +if [[ "$NPROC" -gt 4 ]]; then + # Cap the number of parallel tests to 4 to not overwhelm larger hosts + NPROC=4 fi +# Workaround for a kernel 7.x virtio/vsock bug, where a patch for a potential overflow inadvertently shrunk +# the receive buffer's effective size below what was configured, which eventually causes the vsock connection +# to get reset with ENOBUFS, that kills the journal forwarding over vsock +# +# Pending fix: https://lore.kernel.org/netdev/20260518090656.134588-3-sgarzare@redhat.com/ +sysctl -w net.core.rmem_max=16777216 +sysctl -w net.core.wmem_max=16777216 + # This test is only really useful if we're building with sanitizers and takes a long time, so let's skip it # for now. export TEST_SKIP="TEST-21-DFUZZER ${TEST_SKIP:-}" +export TEST_JOURNAL_USE_TMP=1 mkosi genkey mkosi summary diff --git a/plans/upstream.fmf b/plans/upstream.fmf index 494e816..d6edac5 100644 --- a/plans/upstream.fmf +++ b/plans/upstream.fmf @@ -17,6 +17,10 @@ prepare: exclude: - systemd-standalone-.* execute: - how: tmt - script: exec plans/run-integration-tests.sh - duration: 2h + how: tmt + script: exec plans/run-integration-tests.sh + duration: 2h +adjust: + - when: distro == fedora-eln + execute: + script: echo skipped diff --git a/rpminspect.yaml b/rpminspect.yaml index 6318820..e080618 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,4 +1,10 @@ - # Disable badfuncs check that has tons of false positives. +annocheck: + ignore: + # This test is intentionally compiled with a minimal set of hardcoded + # options, so it always generates a predictable stack trace + - /usr/lib/systemd/tests/unit-tests/manual/test-coredump-stacktrace + +# Disable badfuncs check that has tons of false positives. badfuncs: allowed: /usr/lib/systemd/tests/unit-tests/*: diff --git a/sources b/sources index 323604e..43d70f2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-259.1.tar.gz) = 7cbeca5dad6413a876809200583854ddc706b7a69deff958eb1ca1afb726cf4dec014006c10d1945c450b754811d4b95a80fe1778cb3136997f6d11b11c0560e +SHA512 (systemd-261.2.tar.gz) = 876f043970cb65b39ae15fba39f23bf94c7c3d80569503d6e8ea2c8013c30ee40ce43cb55cbcb1cf14d5c3021aafc09c0f67473bbf742d8964bf9fa30693b971 diff --git a/split-files.py b/split-files.py index 38bde60..52fa5c1 100644 --- a/split-files.py +++ b/split-files.py @@ -1,7 +1,11 @@ import re, sys, os, collections buildroot = sys.argv[1] -no_bootloader = '--no-bootloader' in sys.argv + +potentially_empty_outputs = [ + 'standalone-report', + *(['boot'] if '--no-bootloader' in sys.argv else []), +] known_files = ''' %ghost %config(noreplace) /etc/crypttab @@ -26,8 +30,8 @@ known_files = ''' %ghost %dir /var/lib/private/systemd %ghost %dir /var/lib/private/systemd/journal-upload %ghost /var/lib/private/systemd/journal-upload/state -%ghost %dir /var/lib/systemd/timesync -%ghost /var/lib/systemd/timesync/clock +%ghost %dir %verify(not user group) /var/lib/systemd/timesync +%ghost %verify(not user group) /var/lib/systemd/timesync/clock %ghost %dir /var/lib/systemd/backlight %ghost /var/lib/systemd/catalog/database %ghost %dir /var/lib/systemd/coredump @@ -73,6 +77,7 @@ outputs = {suffix: open(f'.file-list-{suffix}', 'w') 'resolve', 'tests', 'standalone-repart', + 'standalone-report', 'standalone-tmpfiles', 'standalone-sysusers', 'standalone-shutdown', @@ -94,10 +99,11 @@ for file in files(buildroot): /usr/lib.*/(security|pkgconfig)$| /usr/lib/rpm(/macros.d|)$| /usr/lib/firewalld(/services|)$| - /usr/share/(locale|licenses|doc)| # no $ + /usr/share/(locale|licenses)| # no $ + LICENSE| /etc(/pam\.d|/xdg|/X11|/X11/xinit|/X11.*\.d|)$| /etc/(dnf|dnf/protected.d)$| - /usr/(src|lib/debug)| # no $ + /usr/(src|lib/debug)| # no $ /run$| /var(/cache|/log|/lib|/run|)$ ''', n, re.X): @@ -106,6 +112,8 @@ for file in files(buildroot): if n.endswith('.standalone'): if 'repart' in n: o = outputs['standalone-repart'] + elif 'report' in n: + o = outputs['standalone-report'] elif 'tmpfiles' in n: o = outputs['standalone-tmpfiles'] elif 'sysusers' in n: @@ -113,7 +121,7 @@ for file in files(buildroot): elif 'shutdown' in n: o = outputs['standalone-shutdown'] else: - assert False, 'Found .standalone not belonging to known packages' + assert False, f'Found {n} not belonging to known standalone packages' elif '/security/pam_' in n or '/man8/pam_' in n: o = outputs['pam'] @@ -121,7 +129,7 @@ for file in files(buildroot): o = outputs['rpm-macros'] elif '/usr/lib/systemd/tests' in n: o = outputs['tests'] - elif 'ukify' in n and '/man/' not in n: + elif ('ukify' in n or '/hwids/' in n) and '/man/' not in n: o = outputs['ukify'] elif re.search(r'/libsystemd-core-.*\.so$', n): o = outputs['main'] @@ -151,6 +159,7 @@ for file in files(buildroot): mount.ddi| importctl| portablectl| + portabled|portable1| systemd-nspawn| systemd\.nspawn| systemd-vmspawn| @@ -233,8 +242,12 @@ for file in files(buildroot): integritysetup| integritytab| remount-fs| + tpm2| /initrd| + systemd-sysinstall| systemd[.-]pcr| + systemd-imdsd| + systemd-loop| /pcrlock\.d| systemd-measure| /boot$| @@ -244,17 +257,15 @@ for file in files(buildroot): binfmt| sysctl| coredump| + homectl| homed|home1| - sysupdate|updatctl| - oomd| - portabled|portable1 - ''', n, re.X): # coredumpctl, homectl, portablectl are included in the main package because - # they can be used to interact with remote daemons. Also, the user could be - # confused if those user-facing binaries are not available. + sysupdate|updatectl| + oomd + ''', n, re.X): o = outputs['udev'] elif re.search(r'''/boot/efi| - /usr/lib/systemd/boot| + /usr/lib/systemd/boot/efi| sd-boot|systemd-boot\.|loader.conf ''', n, re.X): o = outputs['boot'] @@ -273,7 +284,8 @@ for file in files(buildroot): prefix = known_files[n].split()[:-1] elif file.is_dir(follow_symlinks=False): prefix = ['%dir'] - elif 'README' in n: + # Allow .conf files to be linked as config. They must not be %doc. + elif ('README' in n or '/doc/' in n) and not n.endswith('.conf'): prefix = ['%doc'] elif n.startswith('/etc'): prefix = ['%config(noreplace)'] @@ -290,9 +302,10 @@ for file in files(buildroot): for file in o: print(f'{prefix}{n}{suffix}', file=file) -if [print(f'ERROR: no file names were written to {o.name}') - for name, o in outputs.items() - if (o.tell() == 0 and - not (no_bootloader and name == 'boot')) - ]: + +if [ + print(f'ERROR: no file names were written to {o.name}') + for name, o in outputs.items() + if o.tell() == 0 and name not in potentially_empty_outputs +]: sys.exit(1) diff --git a/systemd.spec b/systemd.spec index 3b20779..6a028bd 100644 --- a/systemd.spec +++ b/systemd.spec @@ -7,11 +7,6 @@ %global system_unit_dir %{pkgdir}/system %global user_unit_dir %{pkgdir}/user -%if 0%{?__isa_bits} == 64 -%global elf_bits (64bit) -%global elf_suffix ()%{elf_bits} -%endif - %bcond bzip2 1 %bcond gnutls 1 %bcond lz4 1 @@ -23,7 +18,16 @@ # e.g. when re-building cryptsetup on a json-c SONAME-bump. %bcond bootstrap 0 %bcond tests 1 -%bcond lto 1 + +# When enabled, rely on filesystem(unmerged-sbin-symlinks) file triggers to +# create /usr/sbin symlinks instead of shipping them in the package. This +# avoids file conflicts when installing on merged-sbin systems and eliminates +# bootstrap ordering issues with the bin/sbin merge. +%bcond sbin_compat 1 + +# riscv64 has LTO disabled globally +%bcond lto %["%_arch" != "riscv64"] + # Build docs on 64-bit architectures only %bcond docs %[%{?__isa_bits} >= 64] @@ -66,6 +70,11 @@ %define noarch_requires_version %{version}-%{release} %endif +%if 0%{?__isa_bits} == 64 +%global elf_bits (64bit) +%global elf_suffix ()%{elf_bits} +%endif + Name: systemd Url: https://systemd.io # Allow users to specify the version and release when building the rpm by @@ -73,7 +82,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:259.1} +Version: %{?version_override}%{!?version_override:261.2} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif @@ -81,6 +90,9 @@ Release: %autorelease %global stable %(c="%version"; [ "$c" = "${c#*.*}" ]; echo $?) +# Temporary macro to enable systemd-report.standalone +%bcond report_standalone %[ v"%{version}" >= v"261.999" || %{defined commit} ] + # For a breakdown of the licensing, see README License: LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later Summary: System and Service Manager @@ -107,7 +119,6 @@ Source6: inittab Source7: sysctl.conf.README Source8: systemd-journal-remote.xml Source9: systemd-journal-gatewayd.xml -Source10: 20-yama-ptrace.conf Source11: systemd-udev-trigger-no-reload.conf # https://fedoraproject.org/wiki/How_to_filter_libabigail_reports Source13: libabigail.abignore @@ -117,7 +128,7 @@ Source15: 10-oomd-per-slice-defaults.conf Source16: 10-timeout-abort.conf Source17: 10-map-count.conf Source18: 60-block-scheduler.rules - +Source19: 99-kernel-hardening.conf Source20: macros.sysusers.compat Source21: macros.sysusers Source22: sysusers.attr @@ -142,17 +153,16 @@ Patch: https://github.com/systemd/systemd/pull/26494.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2251843 Patch: 30846.patch -# Again create runlevelX.target. Dropping those files breaks upgrades. -# https://bugzilla.redhat.com/show_bug.cgi?id=2411195 -Patch: 0001-Revert-units-drop-runlevel-0-6-.target.patch - # userdb: create userdb root directory with correct label # We can drop this after SELinux policy is updated to handle the transition. -Patch: 38769.patch +Patch: 0001-core-create-userdb-root-directory-with-correct-label.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701 Patch: 0002-machined-continue-without-resolve.hook-socket.patch +# We want to depend on and load openssl-4 in preference +Patch: https://github.com/systemd/systemd/pull/42668.patch +Patch: https://github.com/systemd/systemd/commit/7be9032019015ddd61985e6a6721d813d62dad0b.patch %endif %ifarch %{ix86} x86_64 aarch64 riscv64 @@ -177,6 +187,13 @@ BuildRequires: cryptsetup-devel # We use the %%systemd_{post,preun,…} macros for various services. BuildRequires: systemd-rpm-macros %endif + +%if !%{defined rhel} || 0%{?rhel} > 10 +# Use dlopen-notes to generate Requires/Recommends from embedded metadata. +# Currently, package-notes are not available on Centos Stream 9 or 10. +BuildRequires: package-notes >= 0.20 +%endif + BuildRequires: dbus-devel BuildRequires: util-linux # /usr/bin/getfacl is needed by test-acl-util @@ -203,7 +220,7 @@ BuildRequires: libcurl-devel BuildRequires: kmod-devel BuildRequires: elfutils-devel BuildRequires: openssl-devel -%if 0%{?fedora} >= 41 +%if 0%{?fedora} >= 41 && 0%{?fedora} < 45 BuildRequires: openssl-devel-engine %endif %if %{with gnutls} @@ -230,7 +247,6 @@ BuildRequires: docbook-style-xsl BuildRequires: pkgconfig BuildRequires: gperf BuildRequires: gawk -BuildRequires: tree BuildRequires: hostname BuildRequires: python3 BuildRequires: python3-devel @@ -288,9 +304,15 @@ Requires: systemd-libs%{_isa} = %{version}-%{release} %{?fedora:Recommends: systemd-resolved = %{version}-%{release}} Requires: systemd-shared%{_isa} = %{version}-%{release} Requires: /usr/bin/systemd-sysusers + # The standalone version doesn't Provide the _isa suffix, # so this biases towards the common version. Recommends: systemd-sysusers%{_isa} = %{version}-%{release} + +%if %{defined rhel} && 0%{?rhel} <= 10 +Requires: libzstd.so.1%{?elf_suffix} +%endif + Recommends: diffutils Requires: (util-linux-core or util-linux) Requires: (libbpf >= 2:1.4.7 if libbpf) @@ -307,7 +329,7 @@ Conflicts: initscripts < 9.56.1 %if 0%{?fedora} Conflicts: fedora-release < 23-0.12 %endif -%if 0%{?fedora} >= 41 +%if 0%{?fedora} >= 41 || 0%{?rhel} >= 11 BuildRequires: setup >= 2.15.0-3 BuildRequires: python3 Conflicts: setup < 2.15.0-3 @@ -323,12 +345,16 @@ Conflicts: dracut < 060-2 Conflicts: dracut < 059-16 %endif +%if %{with report_standalone} +Conflicts: systemd-standalone-report +Provides: systemd-report = %{version}-%{release} +%endif Conflicts: systemd-standalone-tmpfiles Provides: systemd-tmpfiles = %{version}-%{release} Conflicts: systemd-standalone-shutdown Provides: systemd-shutdown = %{version}-%{release} -%if "%{_sbindir}" == "%{_bindir}" +%if %{with sbin_compat} || "%{_sbindir}" == "%{_bindir}" # Compat symlinks for Requires in other packages. # We rely on filesystem to create the symlinks for us. Requires: filesystem(unmerged-sbin-symlinks) @@ -339,45 +365,42 @@ Provides: /usr/sbin/reboot Provides: /usr/sbin/shutdown %endif +%if %{defined rhel} && 0%{?rhel} <= 10 # libmount is always required, even in containers, so make it a hard dependency. Requires: libmount.so.1%{?elf_suffix} Requires: libmount.so.1(MOUNT_2.26)%{?elf_bits} # Various systemd services have syscall filters so make libseccomp a hard dependency. Requires: libseccomp.so.2%{?elf_suffix} - -# Recommends to replace normal Requires deps for stuff that is dlopen()ed -Recommends: libxkbcommon.so.0%{?elf_suffix} -Recommends: libidn2.so.0%{?elf_suffix} -Recommends: libidn2.so.0(IDN2_0.0.0)%{?elf_bits} -Recommends: libpcre2-8.so.0%{?elf_suffix} -Recommends: libpwquality.so.1%{?elf_suffix} -Recommends: libpwquality.so.1(LIBPWQUALITY_1.0)%{?elf_bits} -%if 0%{?fedora} -Recommends: libqrencode.so.4%{?elf_suffix} +Requires: libacl.so.1%{?elf_suffix} %endif -Recommends: libbpf.so.1%{?elf_suffix} -Recommends: libbpf.so.1(LIBBPF_0.4.0)%{?elf_bits} -# used by systemd-coredump and systemd-analyze -Recommends: libdw.so.1%{?elf_suffix} -Recommends: libdw.so.1(ELFUTILS_0.186)%{?elf_bits} -Recommends: libelf.so.1%{?elf_suffix} -Recommends: libelf.so.1(ELFUTILS_1.7)%{?elf_bits} +%define dlopen_notes_features %{expand: + # Various systemd services have syscall filters so make libseccomp a hard dependency. + systemd:seccomp:required -# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home -Recommends: libcryptsetup.so.12%{?elf_suffix} -Recommends: libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits} + # zstd is used for compression in the journal + systemd:zstd:required -# Libkmod is used to load modules. -Recommends: libkmod.so.2%{?elf_suffix} -# kmod_list_next, kmod_load_resources, kmod_module_get_initstate, -# kmod_module_get_module, kmod_module_get_name, kmod_module_new_from_lookup, -# kmod_module_probe_insert_module, kmod_module_unref, kmod_module_unref_list, -# kmod_new, kmod_set_log_fn, kmod_unref, kmod_validate_resources -# are part of LIBKMOD_5. -Recommends: libkmod.so.2(LIBKMOD_5)%{?elf_bits} + # Libkmod is used to load modules. Assume that if we need udevd, we certainly + # want to load modules, so make this into a hard dependency here. + systemd-udev:kmod:required -Recommends: libarchive.so.13%{?elf_suffix} + # We want to always use idn with resolved. + systemd-resolved:idn:required + + # libcurl is required by systemd-imdsd and systemd-report. + # Downgrade the dep for now. + systemd:curl:recommended + systemd-udev:curl:recommended + + # libssl + libcrypto are required by systemd-resolved/resolvectl. + # Downgrade the dep in the main package. + systemd:libssl:recommended + systemd:libcrypto:recommended + + # Disable qrencode on non-fedora builds + %{!?fedora:*:qrencode:ignored} +} %description systemd is a system and service manager that runs as PID 1 and starts the rest @@ -467,6 +490,18 @@ Requires(preun): systemd%{_isa} = %{version}-%{release} Requires(postun): systemd%{_isa} = %{version}-%{release} Requires(post): grep Requires: kmod >= 18-4 + +%if %{defined rhel} && 0%{?rhel} <= 10 +# Libkmod is used to load modules. Assume that if we need udevd, we certainly +# want to load modules, so make this into a hard dependency here. +Requires: libkmod.so.2%{?elf_suffix} +Requires: libkmod.so.2(LIBKMOD_5)%{?elf_bits} +# udev uses libblkid in various builtins so make it a hard dependency. +Requires: libblkid.so.1%{?elf_suffix} +Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} +Requires: libfdisk.so.1%{?elf_suffix} +%endif + Provides: udev = %{version} Provides: udev%{_isa} = %{version} %if 0%{?fedora} || 0%{?rhel} >= 10 @@ -484,6 +519,7 @@ Provides: systemd-timesyncd = %{version}-%{release} %endif Conflicts: systemd-networkd < %{version}-%{release} +%if %{defined rhel} && 0%{?rhel} <= 10 # Libkmod is used to load modules. Assume that if we need udevd, we certainly # want to load modules, so make this into a hard dependency here. Requires: libkmod.so.2%{?elf_suffix} @@ -491,29 +527,13 @@ Requires: libkmod.so.2(LIBKMOD_5)%{?elf_bits} # udev uses libblkid in various builtins so make it a hard dependency. Requires: libblkid.so.1%{?elf_suffix} Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} - -# Recommends to replace normal Requires deps for stuff that is dlopen()ed -# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home -Recommends: libcryptsetup.so.12%{?elf_suffix} -Recommends: libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits} - -# used by systemd-coredump and systemd-analyze -Recommends: libdw.so.1%{?elf_suffix} -Recommends: libdw.so.1(ELFUTILS_0.186)%{?elf_bits} -Recommends: libelf.so.1%{?elf_suffix} -Recommends: libelf.so.1(ELFUTILS_1.7)%{?elf_bits} - -# used by home, cryptsetup, cryptenroll, logind -Recommends: libfido2.so.1%{?elf_suffix} -Recommends: libp11-kit.so.0%{?elf_suffix} -Recommends: libtss2-esys.so.0%{?elf_suffix} -Recommends: libtss2-mu.so.0%{?elf_suffix} -Recommends: libtss2-rc.so.0%{?elf_suffix} +%endif # https://bugzilla.redhat.com/show_bug.cgi?id=1377733#c9 Suggests: systemd-bootchart -# https://bugzilla.redhat.com/show_bug.cgi?id=1408878 -Requires: kbd + +# v261 handles missing setfont/loadkeys gracefully +Recommends: kbd # https://bugzilla.redhat.com/show_bug.cgi?id=1753381 Provides: u2f-hidraw-policy = 1.0.2-40 @@ -526,7 +546,7 @@ Provides: systemd-repart = %{version}-%{release} Conflicts: xorg-x11-drv-evdev < 2.11.0 Conflicts: xorg-x11-drv-libinput < 1.5.0 -%if "%{_sbindir}" == "%{_bindir}" +%if %{with sbin_compat} || "%{_sbindir}" == "%{_bindir}" # Compat symlinks for Requires in other packages. # We rely on filesystem to create the symlinks for us. Requires: filesystem(unmerged-sbin-symlinks) @@ -626,6 +646,7 @@ Recommends: qemu-kvm-core Recommends: qemu-device-display-virtio-gpu Recommends: qemu-device-display-virtio-vga %endif + # Bias the system towards libcurl-minimal if nothing pulls in full libcurl (#1997040) Suggests: libcurl-minimal License: LGPL-2.1-or-later @@ -644,6 +665,10 @@ License: LGPL-2.1-or-later Requires: firewalld-filesystem Provides: systemd-journal-gateway = %{version}-%{release} Provides: systemd-journal-gateway%{_isa} = %{version}-%{release} +%if %{defined rhel} && 0%{?rhel} <= 10 +Requires: libmicrohttpd.so.12%{?elf_suffix} +Requires: libcurl.so.4%{?elf_suffix} +%endif # Bias the system towards libcurl-minimal if nothing pulls in full libcurl (#1997040) Suggests: libcurl-minimal @@ -680,8 +705,10 @@ enabled for this to have any effect. %package resolved Summary: Network Name Resolution manager Requires: systemd%{_isa} = %{version}-%{release} +%if %{defined rhel} && 0%{?rhel} <= 10 Requires: libidn2.so.0%{?elf_suffix} Requires: libidn2.so.0(IDN2_0.0.0)%{?elf_bits} +%endif Requires(posttrans): grep %description resolved @@ -723,7 +750,21 @@ RemovePathPostfixes: .standalone %description standalone-repart Standalone systemd-repart binary with no dependencies on the systemd-shared library or other libraries from systemd-libs. This package conflicts with the -main systemd package and is meant for use on systems without systemd. +systemd-udev package and is meant for use on systems without systemd-udev. + +%if %{with report_standalone} +%package standalone-report +Summary: Standalone systemd-report binaries for use on systems without systemd +Provides: systemd-report = %{version}-%{release} +Conflicts: systemd +RemovePathPostfixes: .standalone + +%description standalone-report +Standalone systemd-report, systemd-report-basic, systemd-report-sign-plain, … +binaries with no dependencies on the systemd-shared library or other libraries +from systemd-libs. This package conflicts with the main systemd package and +is meant for use on systems without systemd or with older version of it. +%endif %package standalone-tmpfiles Summary: Standalone systemd-tmpfiles binary for use on systems without systemd @@ -760,7 +801,30 @@ Standalone systemd-shutdown binary with no dependencies on the systemd-shared library or other libraries from systemd-libs. This package conflicts with the main systemd package and is meant for use in exitrds. +%define status %{shrink: + '**' + bzip2=%{?with_bzip2}%{!?with_bzip2:0} + gnutls=%{?with_gnutls}%{!?with_gnutls:0} + lz4=%{?with_lz4}%{!?with_lz4:0} + xz=%{?with_xz}%{!?with_xz:0} + zlib=%{?with_zlib}%{!?with_zlib:0} + zstd=%{?with_zstd}%{!?with_zstd:0} + bootstrap=%{?with_bootstrap}%{!?with_bootstrap:0} + tests=%{?with_tests}%{!?with_tests:0} + lto=%{?with_lto}%{!?with_lto:0} + docs=%{?with_docs}%{!?with_docs:0} + upstream=%{?with_upstream}%{!?with_upstream:0} + obs=%{?with_obs}%{!?with_obs:0} + report_standalone=%{?with_report_standalone}%{!?with_report_standalone:0} + fedora=%{?fedora} + rhel=%{?rhel} + _arch=%{_arch} + '**'} + %prep +# Print varius with's and without's to make it easier to figure out what is going on +echo %{status} + %if %{with obs} # Recipe files in the OBS build are in a distro-specific dir, as they conflict (e.g. with SUSE ones) mv %{_sourcedir}/%{name}.fedora/* %{_sourcedir} @@ -777,7 +841,13 @@ mv %{_sourcedir}/%{name}.fedora/* %{_sourcedir} sed -r -i 's/^u!/u/' sysusers.d/*.conf* %build +echo %{status} + +%if 0%{?eln} +%global ntpvendor fedora +%else %global ntpvendor %(source /etc/os-release; echo ${ID}) +%endif %{!?ntpvendor: echo 'NTP vendor zone is not set!'; exit 1} VMLINUX_H_PATH='' @@ -805,8 +875,6 @@ VMLINUX_H_PATH=$(%python3 -c '%find_vmlinux_h') CONFIGURE_OPTS=( -Dmode=release -Dslow-tests=true - -Dsysvinit-path=/etc/rc.d/init.d - -Drc-local=/etc/rc.d/rc.local -Dntp-servers='0.%{ntpvendor}.pool.ntp.org 1.%{ntpvendor}.pool.ntp.org 2.%{ntpvendor}.pool.ntp.org 3.%{ntpvendor}.pool.ntp.org' -Ddns-servers= -Dservice-watchdog= @@ -837,7 +905,6 @@ CONFIGURE_OPTS=( -Daudit=enabled -Delfutils=enabled -Dlibcryptsetup=%[%{with bootstrap}?"disabled":"enabled"] - -Delfutils=enabled -Drepart=enabled -Dpwquality=enabled -Dqrencode=%[%{defined rhel}?"disabled":"enabled"] @@ -845,7 +912,6 @@ CONFIGURE_OPTS=( -Dmicrohttpd=enabled -Dvmspawn=enabled -Dlibidn2=enabled - -Dlibiptc=disabled -Dlibcurl=enabled -Dlibfido2=enabled -Dxenctrl=%[0%{?have_xen}?"enabled":"disabled"] @@ -965,7 +1031,7 @@ sed -r 's|/system/|/user/|g' %{SOURCE16} >10-timeout-abort.conf.user %meson_install # udev links -%if "%{_sbindir}" != "%{_bindir}" +%if !%{with sbin_compat} && "%{_sbindir}" != "%{_bindir}" mkdir -p %{buildroot}/%{_sbindir} ln -sf ../bin/udevadm %{buildroot}%{_sbindir}/udevadm %endif @@ -1065,9 +1131,8 @@ EOF install -Dm0644 -t %{buildroot}/usr/lib/firewalld/services/ %{SOURCE8} %{SOURCE9} -# Install additional docs -# https://bugzilla.redhat.com/show_bug.cgi?id=1234951 -install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE10} +# Install kernel hardening file. Disabled by default. +install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE19} # https://bugzilla.redhat.com/show_bug.cgi?id=1378974 install -Dm0644 -t %{buildroot}%{system_unit_dir}/systemd-udev-trigger.service.d/ %{SOURCE11} @@ -1095,7 +1160,7 @@ install -Dm0644 -t %{buildroot}%{_prefix}/lib/udev/rules.d/ %{SOURCE18} sed -i 's|#!/usr/bin/env python3|#!%{__python3}|' %{buildroot}/usr/lib/systemd/tests/run-unit-tests.py -%if 0%{?fedora} >= 42 +%if 0%{?fedora} >= 42 || 0%{?rhel} >= 11 install -m 0644 -D %{SOURCE21} %{buildroot}%{_rpmconfigdir}/macros.d/macros.sysusers %else install -m 0644 -D %{SOURCE20} %{buildroot}%{_rpmconfigdir}/macros.d/macros.sysusers @@ -1114,20 +1179,20 @@ install -Dm0644 -t %{buildroot}%{_prefix}/lib/systemd/network/ %{SOURCE25} ln -s --relative %{buildroot}%{_bindir}/kernel-install %{buildroot}%{_sbindir}/installkernel %endif -%if "%{_sbindir}" == "%{_bindir}" +%if %{with sbin_compat} || "%{_sbindir}" == "%{_bindir}" # Systemd has the split-sbin option which is also used to select the directory # for alias symlinks. We need to keep split-sbin=true for now, to support # unmerged systems. Move the symlinks here instead. mv -v %{buildroot}/usr/sbin/* %{buildroot}%{_bindir}/ %endif -%if 0%{?fedora} >= 41 +%if 0%{?fedora} >= 41 || 0%{?rhel} >= 11 %if %{without upstream} # This requires https://pagure.io/setup/pull-request/50 # and https://src.fedoraproject.org/rpms/setup/pull-request/10. # We skip this on upstream builds so that new users and groups # can be added without breaking the build. -%if 0%{?fedora} >= 43 +%if 0%{?fedora} >= 43 || 0%{?rhel} >= 11 IGNORED=empower \ %{python3} %{SOURCE4} /usr/lib/sysusers.d/setup.conf %{buildroot}/usr/lib/sysusers.d/basic.conf %else @@ -1188,6 +1253,10 @@ fi \ %post systemd-machine-id-setup &>/dev/null || : +# This is for upgrades from previous versions before getty@.service needed to be enabled +[ $1 -gt 1 ] && systemctl is-enabled getty@tty1.service &>/dev/null && \ + touch %{_localstatedir}/lib/rpm-state/systemd-getty-was-active || : + [ $1 -eq 1 ] || exit 0 # create /var/log/journal only on initial installation, @@ -1215,6 +1284,8 @@ if [ $1 -ge 2 ]; then systemctl daemon-reexec || : systemd-tmpfiles --create &>/dev/null || : + + rm -f %{_localstatedir}/lib/rpm-state/systemd-getty-was-active || : fi %systemd_posttrans_with_restart systemd-timedated.service systemd-hostnamed.service systemd-journald.service systemd-localed.service systemd-userdbd.service @@ -1232,16 +1303,15 @@ fi # This is for upgrades from previous versions before systemd restart was moved to %%postun systemctl daemon-reexec || : -%triggerpostun -- systemd < 253~rc1-2 -# This is for upgrades from previous versions where systemd-journald-audit.socket -# had a static enablement symlink. -# We use %%triggerpostun here because rpm doesn't allow a second %%triggerun with -# a different package version. -systemctl --no-reload preset systemd-journald-audit.socket &>/dev/null || : +%triggerpostun -- systemd < 260~rc1 +if [ -f %{_localstatedir}/lib/rpm-state/systemd-getty-was-active ]; then + systemctl --no-reload enable getty@.service || : +fi %global udev_services %{shrink: cryptsetup-pre.target cryptsetup.target + getty@.service hibernate.target hybrid-sleep.target initrd-cleanup.service @@ -1304,6 +1374,7 @@ systemctl --no-reload preset systemd-journald-audit.socket &>/dev/null || : systemd-pcrlock.socket systemd-pcrlock@.service systemd-pcrmachine.service + systemd-pcrosseparator.service systemd-pcrphase-initrd.service systemd-pcrphase-sysinit.service systemd-pcrphase.service @@ -1320,7 +1391,7 @@ systemctl --no-reload preset systemd-journald-audit.socket &>/dev/null || : systemd-suspend.service systemd-sysctl.service systemd-timesyncd.service - systemd-tmpfiles-clear.service + systemd-tmpfiles-clean.service systemd-tmpfiles-setup-dev-early.service systemd-tmpfiles-setup-dev.service systemd-udev-load-credentials.service @@ -1342,18 +1413,6 @@ systemctl --no-reload preset systemd-journald-audit.socket &>/dev/null || : } %post udev -# Move old stuff around in /var/lib -mv %{_localstatedir}/lib/random-seed %{_localstatedir}/lib/systemd/random-seed &>/dev/null -mv %{_localstatedir}/lib/backlight %{_localstatedir}/lib/systemd/backlight &>/dev/null -if [ -L %{_localstatedir}/lib/systemd/timesync ]; then - rm %{_localstatedir}/lib/systemd/timesync - mv %{_localstatedir}/lib/private/systemd/timesync %{_localstatedir}/lib/systemd/timesync -fi -if [ -f %{_localstatedir}/lib/systemd/clock ]; then - mkdir -p %{_localstatedir}/lib/systemd/timesync - mv %{_localstatedir}/lib/systemd/clock %{_localstatedir}/lib/systemd/timesync/. -fi - systemd-hwdb update &>/dev/null %systemd_post %udev_services @@ -1362,11 +1421,6 @@ systemd-hwdb update &>/dev/null /usr/lib/systemd/systemd-random-seed save 2>&1 | \ grep -v 'Failed to open /dev/urandom' || : -# Replace obsolete keymaps -# https://bugzilla.redhat.com/show_bug.cgi?id=1151958 -grep -q -E '^KEYMAP="?fi-latin[19]"?' /etc/vconsole.conf 2>/dev/null && - sed -i.rpm.bak -r 's/^KEYMAP="?fi-latin[19]"?/KEYMAP="fi"/' /etc/vconsole.conf || : - %preun udev %systemd_preun %udev_services @@ -1405,20 +1459,7 @@ fi } %post networkd -# systemd-networkd was split out in systemd-246.6-2. -# Ideally, we would have a trigger scriptlet to record enablement -# state when upgrading from systemd <= systemd-246.6-1. But, AFAICS, -# rpm doesn't allow us to trigger on another package, short of -# querying the rpm database ourselves, which seems risky. For rpm, -# systemd and systemd-networkd are completely unrelated. So let's use -# a hack to detect if an old systemd version is currently present in -# the file system. -# https://bugzilla.redhat.com/show_bug.cgi?id=1943263 -if [ $1 -eq 1 ] && ls /usr/lib/systemd/libsystemd-shared-24[0-6].so &>/dev/null; then - echo "Skipping presets for systemd-networkd.service, seems we are upgrading from old systemd." -else - %systemd_post %networkd_services -fi +%systemd_post %networkd_services %preun networkd %systemd_preun %networkd_services @@ -1491,10 +1532,10 @@ fi %global _docdir_fmt %{name} %files -f %{name}.lang -f .file-list-main -%doc %{_pkgdocdir} %exclude %{_pkgdocdir}/LICENSE* # Only the licenses texts for the licenses in License line are included. %license LICENSE.GPL2 +%license LICENSE.LGPL2.1 %license LICENSES/MIT.txt %ghost %dir %attr(0755,-,-) /etc/systemd/system/basic.target.wants %ghost %dir %attr(0755,-,-) /etc/systemd/system/bluetooth.target.wants @@ -1557,6 +1598,10 @@ fi %files standalone-repart -f .file-list-standalone-repart +%if %{with report_standalone} +%files standalone-report -f .file-list-standalone-report +%endif + %files standalone-tmpfiles -f .file-list-standalone-tmpfiles %files standalone-sysusers -f .file-list-standalone-sysusers