Commit graph

392 commits

Author SHA1 Message Date
Andreas Rammhold
64556974b6
systemd: 247.6 -> 249.4
This updates systemd to version v249.4 from version v247.6.

Besides the many new features that can be found in the upstream
repository they also introduced a bunch of cleanup which ended up
requiring a few more patches on our side.

a) 0022-core-Handle-lookup-paths-being-symlinks.patch:
  The way symlinked units were handled was changed in such that the last
  name of a unit file within one of the unit directories
  (/run/systemd/system, /etc/systemd/system, ...) is used as the name
  for the unit. Unfortunately that code didn't take into account that
  the unit directories themselves could already be symlinks and thus
  caused all our units to be recognized slightly different.

  There is an upstream PR for this new patch:
    https://github.com/systemd/systemd/pull/20479

b) The way the APIVFS is setup has been changed in such a way that we
   now always have /run. This required a few changes to the
   confinement tests which did assert that they didn't exist. Instead of
   adding another patch we can just adopt the upstream behavior. An
   empty /run doesn't seem harmful.

   As part of this work I refactored the confinement test just a little
   bit to allow better debugging of test failures. Previously it would
   just fail at some point and it wasn't obvious which of the many
   commands failed or what the unexpected string was. This should now be
   more obvious.

c) Again related to the confinement tests the way a file was tested for
   being accessible was optimized. Previously systemd would in some
   situations open a file twice during that check. This was reduced to
   one operation but required the procfs to be mounted in a units
   namespace.

   An upstream bug was filed and fixed. We are now carrying the
   essential patch to fix that issue until it is backported to a new
   release (likely only version 250). The good part about this story is
   that upstream systemd now has a test case that looks very similar to
   one of our confinement tests. Hopefully that will lead to less
   friction in the long run.

   https://github.com/systemd/systemd/issues/20514
   https://github.com/systemd/systemd/pull/20515

d) Previously we could grep for dlopen( somewhat reliably but now
   upstream started using a wrapper around dlopen that is most of the
   time used with linebreaks. This makes using grep not ergonomic
   anymore.

   With this bump we are grepping for anything that looks like a
   dynamic library name (in contrast to a dlopen(3) call) and replace
   those instead. That seems more robust. Time will tell if this holds.

   I tried using coccinelle to patch all those call sites using its
   tooling but unfornately it does stumble upon the _cleanup_
   annotations that are very common in the systemd code.

e) We now have some machinery for libbpf support in our systemd build.
   That being said it doesn't actually work as generating some skeletons
   doesn't work just yet. It fails with the below error message and is
   disabled by default (in both minimal and the regular build).

   > FAILED: src/core/bpf/socket_bind/socket-bind.skel.h
   > /build/source/tools/build-bpf-skel.py --clang_exec /nix/store/x1bi2mkapk1m0zq2g02nr018qyjkdn7a-clang-wrapper-12.0.1/bin/clang --llvm_strip_exec /nix/store/zm0kqan9qc77x219yihmmisi9g3sg8ns-llvm-12.0.1/bin/llvm-strip --bpftool_exec /nix/store/l6dg8jlbh8qnqa58mshh3d8r6999dk0p-bpftools-5.13.11/bin/bpftool --arch x86_64 ../src/core/bpf/socket_bind/socket-bind.bpf.c src/core/bpf/socket_bind/socket-bind.skel.h
   > libbpf: elf: socket_bind_bpf is not a valid eBPF object file
   > Error: failed to open BPF object file: BPF object format invalid
   > Traceback (most recent call last):
   >   File "/build/source/tools/build-bpf-skel.py", line 128, in <module>
   >     bpf_build(args)
   >   File "/build/source/tools/build-bpf-skel.py", line 92, in bpf_build
   >     gen_bpf_skeleton(bpftool_exec=args.bpftool_exec,
   >   File "/build/source/tools/build-bpf-skel.py", line 63, in gen_bpf_skeleton
   >     skel = subprocess.check_output(bpftool_args, universal_newlines=True)
   >   File "/nix/store/81lwy2hfqj4c1943b1x8a0qsivjhdhw9-python3-3.9.6/lib/python3.9/subprocess.py", line 424, in check_output
   >     return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
   >   File "/nix/store/81lwy2hfqj4c1943b1x8a0qsivjhdhw9-python3-3.9.6/lib/python3.9/subprocess.py", line 528, in run
   >     raise CalledProcessError(retcode, process.args,
   > subprocess.CalledProcessError: Command '['/nix/store/l6dg8jlbh8qnqa58mshh3d8r6999dk0p-bpftools-5.13.11/bin/bpftool', 'g', 's', '../src/core/bpf/socket_bind/socket-bind.bpf.o']' returned non-zero exit status 255.
   > [102/1457] Compiling C object src/journal/libjournal-core.a.p/journald-server.c.oapture output)put)ut)
   > ninja: build stopped: subcommand failed.

  f) We do now have support for TPM2 based disk encryption in our
     systemd build. The actual bits and pieces to make use of that are
     missing but there are various ongoing efforts in that direction.
     There is also the story about systemd in our initrd to enable this
     being used for root volumes. None of this will yet work out of the
     box but we can start improving on that front.

  g) FIDO2 support was added systemd and consequently we can now use
     that. Just with TPM2 there hasn't been any integration work with
     NixOS and instead this just adds that capability to work on that.

Co-Authored-By: Jörg Thalheim <joerg@thalheim.io>
2021-09-12 23:45:49 +02:00
Alyssa Ross
071a7a4583
Merge remote-tracking branch 'nixpkgs/master' into staging-next 2021-09-03 18:23:45 +00:00
Graham Christensen
3677d4bc22 kexec-tools: rename from kexectools to match the project name 2021-09-03 10:17:21 -04:00
Sandro Jäckel
b6ac1dedf5 systemd: remove patchelf, coreutils from nativeBuildInputs as it is part of the stdenv 2021-07-26 13:18:38 +02:00
Sandro Jäckel
444292aae8 systemd: push version further down, use rec 2021-07-26 13:16:51 +02:00
Florian Klink
c5f0c9273b systemd: nixpkgs-fmt 2021-07-26 13:16:50 +02:00
Janne Heß
b361dcf0bd
systemd: Patch CVE-2021-33910 2021-07-20 15:27:15 +02:00
Alyssa Ross
24e4a4e40f systemd: don't manually enableParallelBuilding
This is automatic for Meson builds.
2021-05-12 11:57:35 +00:00
github-actions[bot]
e21fb16f9a
Merge master into staging-next 2021-05-08 06:20:05 +00:00
Silvan Mosberger
08d94fd2b0
Merge pull request from oxalica/lib/platform-support-check
lib.meta: introduce `availableOn` to check package availability on given platform
2021-05-08 03:54:36 +02:00
Alyssa Ross
a7dd5ca90f systemd: fix build 2021-04-30 14:06:53 +00:00
oxalica
354d262db8
lib.meta: introduce availableOn 2021-04-02 19:20:23 +08:00
Jörg Thalheim
1c3a4dbc0d systemd: 247.3 -> 247.6 2021-04-01 13:03:28 +02:00
Graham Christensen
e7d9750b5c
systemd: correct path to modprobe@.service
The unit hard-codes a path to modprobe which is obviously invalid.
2021-03-09 12:38:54 -05:00
Florian Klink
e373b423c7 systemd: drop /etc/systemd-mutable
This has only been used by Dysnomia, which has been removed from Nixpkgs
in https://github.com/NixOS/nixpkgs/pull/110799 after being broken for
more than a year.

If Dysnomia comes back, it can probably just use
/nix/var/nix/profiles/default/lib/systemd/system, or set its own systemd
flavour looking in that location via the `systemd.package`.
2021-02-12 12:53:20 +01:00
Florian Klink
2a19c18a74 systemd: add note about nixpkgs-fmt 2021-02-03 20:25:52 +01:00
Florian Klink
f61a3bf8e8 systemd: nixpkgs-fmt
This was recently introduced, and apparently not nixpkgs-fmt'ed.

While there's no global consensus on nixpkgs-fmt'ing everything,
indenting this by 2 more spaces won't hurt.
2021-02-03 18:56:07 +01:00
Florian Klink
49cb525712 systemd: 247.2 -> 247.3 2021-02-03 18:56:06 +01:00
Jonathan Ringer
9bb3fccb5b treewide: pkgs.pkgconfig -> pkgs.pkg-config, move pkgconfig to alias.nix
continuation of 

pkgconfig was aliased in 2018, however, it remained in
all-packages.nix due to its wide usage. This cleans
up the remaining references to pkgs.pkgsconfig and
moves the entry to aliases.nix.

python3Packages.pkgconfig remained unchanged because
it's the canonical name of the upstream package
on pypi.
2021-01-19 01:16:25 -08:00
Ben Siraphob
16d91ee628 pkgs/os-specific: stdenv.lib -> lib 2021-01-17 23:26:08 +07:00
Andreas Rammhold
494ed4d6ee
systemd: patch runtime dlopen calls
This ensures that all the features that are implemented via dlopen(3)
are available (or explicitly deactivated) by pointing dlopen to the
absolute store path instead of relying on the linkers runtime lookup
code.

All of the dlopen calls have to be handled. When new ones are introduced
by upstream (or one of our patches) those must be explicitly declared,
otherwise the build will fail.

As of systemd version 247 we've seen a few errors like `libpcre2.… not
found` when using e.g. --grep with journalctl. Those errors should
become less unexpected now.

There are generally two classes of dlopen calls. Those that we want to
support and those that should be deactivated / unsupported. This change
enforces that we handle all dlopen calls explicitly. Meaning: There is
not a single dlopen call in the code source tree that we did not
explicitly handle.

In order to do this I introduced a list of attributes that maps from
shared object name to the package that contains them. The package can be
null meaning the reference should be nuked and the shared object will
never be loadable during runtime (because it points at an invalid store
path location).
2021-01-03 11:50:01 +01:00
Florian Klink
91b8237b48 systemd: 247.1 -> 247.2
Contains the following fixes:

 - 937118a5b2 journalctl: don't skip the entries that have the same seqnum
 - e017ac6a26 sd-bus: use SOCK_CLOEXEC on one more socket
 - db31432861 resolved: create stub-resolv.conf symlink with correct security label
 - f2ec15e2e5 efi: Only use arm flags if supported
 - cd43eee770 core: detect_container() may return negative errno
 - 04be042a1f meson: Fix reallocarray check
 - 5e906f483b network: do not assume address ready callback is always set to static addresses
 - 2ad7a2a96a network: drop assertions to check link state in netlink callback handlers
 - f375c8cbb5 network: do not reconfigure interface when the link gains carrier but udev not initialized it yet
 - 5d4909decf veritysetup: also place udev socket dep
 - 57ddb74245 cryptsetup: Fix crypto device missing issue after bootup
 - d3c224d441 network: fix SIGABRT related to unreachable route with DHCP6
 - c91648cc83 network: revert previous changes to address_compare_func()
 - d8b5d8c8c3 udev: Fix sound.target dependency
 - 669107ae68 meson: specify correct libqrencode version in meson dep
 - c07dc6cedc udev: link_update() should fail if the entry in symlink dir couldn't have been created
 - 367006c806 man: document that automount units are privileged
 - 5129808141 logind: fix closing of button input devices
 - 37f06c91ef Update logind-button.c
 - 9e9fda0a2d async: add trivial cleanup wrapper for asynchronous_close()
 - 4a2ca1ca4a Silence cgroups v1 read-only filesystem warning
 - ed1f8f4ba2 manager: Fix HW watchdog when systemd starts before driver loaded
 - 383a747164 cgroup: Also set blkio.bfq.weight
 - 48d41091ac nss-resolve: varlink_call() set error_id only when r >= 0
 - 56daba2deb missing: Define several syscall numbers for Alpha arch
 - f2a4b96276 Don't assume /run/systemd exists when creating unit-root
 - 553530fdc7 mkosi: Add findutils to Fedora config
 - e42990dfe3 mkosi: Add rpm to Fedora BuildPackages as it's needed by pkg-config
 - 6bacd1d971 mkosi: Replace iptables-dev with libiptc-dev in debian config
 - f1fc515c21 dissect: don't declare unused variables on archs that have no GPT discovery
 - 30d0c3f58c resolved: synthesize NODATA instead of NXDOMAIN if gateway exists, but of other protocol
 - 538ebbd7f3 local-addresses: make returning accumulated list optional
 - 228a22bb63 resolved: improve log message when we use TCP a bit
 - aa31dd9128 network: ignore broadcast address for /31 or /32 addresses
 - 85607cc094 network: fix verification for broadcast address
 - dc6ad6482a network: do not set broadcast if prefixlen is 31 or 32
 - 39ee319c75 stub: don't ever respond to datagrams coming in on non-localhost addreses, on the stub
 - cbea0e5a83 resolved: never allow _gateway lookups to go to the network
 - c4df66816b resolved: lower SERVFAIL cache timeout from 30s to 10s
 - b5e39c20d9 dns-domain: try IDN2003 rules if IDN2008 doesn't work
 - 2c354cedd2 virt: Properly detect nested UML inside another hypervisor
 - 10f2cfb715 resolved: properly check per-link NTA list
 - a8437c07e4 meson: use '_' as separator in fuzz test names
 - 81ef7623c8 man: mention that --key= is about *secret* keys
 - 4ef70ecefc meson: check that cxx variable is set before using it
2020-12-17 07:29:04 +01:00
Charlotte Van Petegem
9b1aa17909
systemd: 247 -> 247.1 2020-12-13 16:35:01 +01:00
Jörg Thalheim
97b412d4a6 systemd: fix pc files
upstream decided to make this non-configurable... Lets' revert to the
version before.
2020-12-11 08:37:42 +01:00
Jörg Thalheim
ef050bc3d1 systemd: 246.6 -> 247-rc2 2020-12-02 23:40:04 +01:00
Frederik Rietdijk
b2a3891e12 Merge master into staging-next 2020-11-27 15:09:19 +01:00
Florian Klink
b92942f466 systemd: use withPortabled in mesonFlags
No matter what withPortabled was being set, we always passed
-Dportabled=false in mesonFlags. Fix this.

Also, nixpkgs-fmt the file for consistency.
2020-11-25 00:22:37 +01:00
Graham Christensen
bc49a0815a
utillinux: rename to util-linux 2020-11-24 12:42:06 -05:00
Florian Klink
d22b3ed4bc systemd: switch to unified cgroup hierarchy by default
See https://www.redhat.com/sysadmin/fedora-31-control-group-v2 for
details on why this is desirable, and how it impacts containers.

Users that need to keep using the old cgroup hierarchy can re-enable it
by setting `systemd.unifiedCgroupHierarchy` to `false`.

Well-known candidates not supporting that hierarchy, like docker and
hidepid=… will disable it automatically.

Fixes 
2020-11-19 16:56:46 +01:00
Finn Behrens
7787fd2413 systemd: Add an option for homed
This is disabled by default to indicate that is hasn't been adiquately
tested with NixOS yet.
2020-11-03 17:35:26 -05:00
Antoine Eiche
859a44ebc0 systemd: set withRemote true by default
This also adds the libmicrohttpd as a `buildInput` when `withRemote`
is true.
2020-11-02 09:07:52 +01:00
Florian Klink
6dbc23e75d systemd: stop substituting inside fsck.c, stop substituting mke2fs
fsck.c doesn't refer to any of these binaries anymore, and the whole
systmed codebase not to /sbin/mke2fs.
2020-10-28 23:24:18 +01:00
Florian Klink
959cea2e80 systemd: add withPCRE2 option 2020-10-28 23:24:18 +01:00
Florian Klink
93dcbbf69d systemd: add withApparmor option 2020-10-28 23:24:18 +01:00
Florian Klink
065f057d0c systemd: add libgpgerror only to buildInputs if we build with resolved support 2020-10-28 23:24:18 +01:00
Florian Klink
e6dff1d666 systemd: drop libffi from buildInputs
This isn't used anywhere.
2020-10-28 23:24:18 +01:00
Florian Klink
e10a9a8506 systemd: add withMachined flag 2020-10-28 23:24:18 +01:00
Florian Klink
8526662a33 systemd: add withNss flag 2020-10-28 23:24:18 +01:00
Florian Klink
a079a6f026 systemd: add withUserDb flag 2020-10-28 23:24:18 +01:00
Florian Klink
e77326208e systemd: add withDocumentation flag 2020-10-28 23:24:18 +01:00
Florian Klink
f142493a6a systemd: add withShellCompletions flag 2020-10-28 23:24:18 +01:00
Florian Klink
1f9347431c systemd: add withPolkit option 2020-10-28 23:24:18 +01:00
Florian Klink
0b762c02ee systemd: disable efi if we don't build with withEfi is set to false 2020-10-28 23:24:17 +01:00
Florian Klink
54c35f0940 systemd: withEfi: move gnu-efi check into assertion 2020-10-28 23:24:17 +01:00
Florian Klink
13a910e3f6 systemd: make gcrypt optional 2020-10-28 23:24:17 +01:00
Florian Klink
585f4a140b systemd: add withAnalyze flag 2020-10-28 23:24:17 +01:00
Florian Klink
987906aa58 systemd: add withCoredump flag
… and default it to false for systemdMinimal
2020-10-28 23:24:17 +01:00
Florian Klink
c6aada2835 systemd: drop duplicate -Dlocaled=…
This is already configurable above.
2020-10-28 23:24:17 +01:00
Florian Klink
ff07c6b47d systemd: introduce withCompression flag
This will build systemd without some compression utils, useful for
systemdMinimal.
2020-10-28 23:24:17 +01:00
Florian Klink
5f257d7d2c systemd: cleanup cryptsetup input
use lib.getDev to retrieve the dev output. Don't pass it to buildInputs
if we don't build with withCryptsetup set to true.
2020-10-28 23:24:17 +01:00