Skip to content

v254 batch up to b858433a79633bdef1ebea7d5ea4cc2585dcbaab#472

Merged
bluca merged 74 commits intosystemd:v254-stablefrom
bluca:v254-stable
Mar 5, 2025
Merged

v254 batch up to b858433a79633bdef1ebea7d5ea4cc2585dcbaab#472
bluca merged 74 commits intosystemd:v254-stablefrom
bluca:v254-stable

Conversation

@bluca
Copy link
Member

@bluca bluca commented Mar 5, 2025

No description provided.

poettering and others added 30 commits February 13, 2025 17:14
(cherry picked from commit 1d87727)
(cherry picked from commit 827d2a3)
auto_fs4.h is a trivial wrapper of auto_fs.h, and it is already included
by auto_dev-ioctl.h.

(cherry picked from commit 834afa1)
(cherry picked from commit 2718cce)
(cherry picked from commit 5bb67d1)
The CIs apparently have rally old headers, where KEY_BRIGHTNESS_AUTO is
missing, let's hence ship our own copies from a current kernel.

(cherry picked from commit 0a73c8e)
(cherry picked from commit 2e13790)
(cherry picked from commit 4ae0c3f)
Let's clarify more explicitly that privileged calls to
systemd-notify --pid= and sd_pid_notify() effectively override any
configured NotifyAccess=main|exec for a service.

(cherry picked from commit bbe9e03)
(cherry picked from commit 9b186fc)
(cherry picked from commit 196bd85)
(cherry picked from commit e10bf30)
(cherry picked from commit ff83795)
(cherry picked from commit 05a135c)
(cherry picked from commit c1092e0)
(cherry picked from commit 8d87145)
Unfortunately kernel reports EOF if there's an inconsistency between efivarfs var list
and what's actually stored in firmware, c.f. #34304. A zero size env var is not allowed in
efi and hence the variable doesn't really exist in the backing store as long as it is zero
sized, and the kernel calls this "uncommitted". Hence we translate EOF back to ENOENT here,
as with kernel behavior before
torvalds/linux@3fab70c

If the kernel changes behaviour (to flush dentries on resume), we can drop
this at some point in the future. But note that the commit is 11
years old at this point so we'll need to deal with the current behaviour for
a long time.

Fix #34304.

(cherry picked from commit 6013dee)
(cherry picked from commit 87df05b)
(cherry picked from commit 537b527)
(cherry picked from commit 7ab4191)
…ANTS=

Let consider the following udev rules:
===
PROGRAM="/usr/bin/systemd-escape foo-bar-baz", ENV{SYSTEMD_WANTS}+="test1@$result.service"
PROGRAM="/usr/bin/systemd-escape aaa-bbb-ccc", ENV{SYSTEMD_WANTS}+="test2@$result.service"
===
Then, a device expectedly gains a property:
===
SYSTEMD_WANTS=test1@foo\x2dbar\x2dbaz.service test2@aaa\x2dbbb\x2dccc.service
===
After the event being processed by udevd, PID1 processes the device, the
property previously was parsed with extract_first_word(EXTRACT_UNQUOTE),
then the device unit gained the following dependencies:
===
Wants=test1@foox2dbarx2dbaz.service test2@aaax2dbbbx2dccc.service
===
So both '%i' and '%I' for the template services did not match with the original
data, and it was hard to use systemd-escape in PROGRAM= udev rule token.

This makes the property parsed with extract_first_word(EXTRACT_UNQUOTE|EXTRACT_RETAIN_ESCAPE),
hence the device unit now gains the following dependencies:
===
Wants=test1@foo\x2dbar\x2dbaz.service test2@aaa\x2dbbb\x2dccc.service
===
and '%I' for the template services match with the original data.

Fixes a bug caused by ceed8f0 (v233).

Fixes #16735.
Replaces #16737 and #35768.

(cherry picked from commit a467358)
(cherry picked from commit 0c1daaf)
(cherry picked from commit cfa5775)
(cherry picked from commit a783d12)
This was added originally as it was thought that Windows applied
the same cap. Nowadays the specs do not mention it, and it is
believed Windows no longer applies it either, so drop it in order
to allow an arbitrary number of DTBs to be included

Fixes systemd/systemd#35943

(cherry picked from commit 8c5b359)
(cherry picked from commit 9518481)
(cherry picked from commit 5cbe2b8)
(cherry picked from commit e79cea6)
We were missing one service result (oom-kill), and the ratelimit one is
called differently. Correct that so that we generate proper log messages
for these cases.

(cherry picked from commit a7620f5)
(cherry picked from commit 13ce2fd)
(cherry picked from commit dbc791b)
(cherry picked from commit 760afe6)
(cherry picked from commit 390dffb)
(cherry picked from commit a347496)
(cherry picked from commit edae238)
(cherry picked from commit 6494368)
Follow-up for 656bbff

The commit reworked job merging logic so that reload jobs
won't get merged. However, they might get dropped from
transaction due to being deemed redundant, i.e. way before
it even hits job_install(). Let's make sure reload jobs
are always kept during transaction construction stage, too.

(cherry picked from commit 7b940d8)
(cherry picked from commit 1e7b1ce)
(cherry picked from commit d770304)
(cherry picked from commit 42082ed)
(cherry picked from commit abe0033)
(cherry picked from commit 44ae7b8)
(cherry picked from commit 9b12f7e)
(cherry picked from commit 4877342)
It is supported in the arch mapping at the top and in elf2efi, so add it here too

(cherry picked from commit d142928)
(cherry picked from commit 48537b3)
(cherry picked from commit c377b09)
(cherry picked from commit 87ae637)
(cherry picked from commit 829f570)
(cherry picked from commit d215c93)
(cherry picked from commit cffa558)
(cherry picked from commit 81751d0)
Fixes a bug introduced by adb6cd9.

Fixes #36178.

(cherry picked from commit 08570f2)
(cherry picked from commit 0240c4a)
(cherry picked from commit 6a1b9af)
(cherry picked from commit e820e23)
Fixes the following error:
```
../src/basic/random-util.c: In function "fallback_random_bytes":
../src/basic/random-util.c:45:26: error: initializer-string for array of "char" is too long [-Werror=unterminated-string-initialization]
   45 |                 .label = "systemd fallback random bytes v1",
      |                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
```

(cherry picked from commit e722fe7)
(cherry picked from commit 8f2f04b)
(cherry picked from commit 57d2446)
(cherry picked from commit 85eafb5)
legionus/kbd#127 adds a Georgian mapping
to kbd. console-setup already has one. Let's support it here, so
it's used for Georgian installs on distros that use this table.

Signed-off-by: Adam Williamson <awilliam@redhat.com>
(cherry picked from commit f89d4c5)
(cherry picked from commit 52b5a79)
(cherry picked from commit c9e1a4a)
(cherry picked from commit 48fd2d3)
Useful for debugging, given it's already logging and the trigger
is known, add it

(cherry picked from commit 6566b43)
(cherry picked from commit b6b2878)
(cherry picked from commit d139f17)
(cherry picked from commit 15be4c0)
(cherry picked from commit 3e1d7b6)
(cherry picked from commit e5bf5f0)
(cherry picked from commit a041c53)
(cherry picked from commit a3c50cf)
otherwise it will use the system input.h which will fail to build if
newer than the bundled version

Fixes: 0a73c8e ("linux: import input.h and friends")
(cherry picked from commit bc996fd)
(cherry picked from commit a485c92)
(cherry picked from commit f3d5204)
(cherry picked from commit 00c2000)
This is printed by bus_manager_log_shutdown() in logind-dbus.c,
near the start of the shutdown process.

Clarify that events *will* happen, long after this message is sent.

(cherry picked from commit 6c45c5a)
(cherry picked from commit 6936658)
(cherry picked from commit c25f8b9)
(cherry picked from commit 8b516d4)
The UKI file has to be writable to be able to do boot counting in
the UEFI firmware which involves renaming the file by writing to
the file metadata which requires the file to be writable in the FAT
filesystem.

Fixes #36170

(cherry picked from commit 0e470e1)
(cherry picked from commit 7358b67)
(cherry picked from commit dcffc79)
(cherry picked from commit 9d0ad1a)
(cherry picked from commit e8e778e)
(cherry picked from commit c6bab8d)
(cherry picked from commit 6a42224)
(cherry picked from commit d264fe7)
(cherry picked from commit df9c5c1)
(cherry picked from commit e24bc34)
(cherry picked from commit f7ef061)
(cherry picked from commit 1a8d5c5)
Skip unsupport/invalid `DS` and `DNSKEY` combinations during verification.

Fixes: #12545
(cherry picked from commit cac3b43)
(cherry picked from commit bb22ed0)
(cherry picked from commit 49f7ac9)
(cherry picked from commit 758a152)
(cherry picked from commit 8b413ae)
(cherry picked from commit 2b9914b)
(cherry picked from commit 10c5fa5)
(cherry picked from commit 818c33b)
errno handling for NSS is always a bit weird since NSS modules generally
are not particularly careful with it. Hence let's initialize errno
explicitly before we invoke getpwent() so that we know it's in a
reasonable state afterwards on failure, or zero if not.

We do this in most places we use NSS, including in userdb when it comes
to getgrent(), just for getpwent() we don't so far. Address that.

(cherry picked from commit 83e3b96)
(cherry picked from commit 4fc9748)
(cherry picked from commit 443dbf4)
(cherry picked from commit c1d49aa)
…ltiple interfaces

For issue #36244.

(cherry picked from commit f7ae28f)
(cherry picked from commit 0af0e37)
(cherry picked from commit 9724602)
(cherry picked from commit 82dc706)
Give access to USB/Bluetooth lights such as the Logitech Litra family of
devices.

The Logitech devices in particular are accessible through USB
and Bluetooth.

(cherry picked from commit 106f64c)
(cherry picked from commit 2e14f59)
(cherry picked from commit 3b5543a)
(cherry picked from commit ac023ef)
Trundle and others added 13 commits March 5, 2025 12:17
When hardlink recreation is requested, it creates temporary files that
will be deleted once the context is destroyed. The deletion
(potentially) updates the directory's timestamps, so it's crucial that
the deletion happens before the directory timestamps are restored when
`COPY_RESTORE_DIRECTORY_TIMESTAMPS` is requested.

(cherry picked from commit b662914)
(cherry picked from commit 9e2ba7e)
(cherry picked from commit 9ade693)
(cherry picked from commit 0ef8791)
There is a typo passing flags to `install_file()`, if `IMPORT_READ_ONLY` is set,
`IMPORT_SYNC` is never checked.

(cherry picked from commit 5d2d0c0)
(cherry picked from commit 6d3621d)
(cherry picked from commit b7109d7)
(cherry picked from commit 4963abe)
…Y=1 when notify-reload

Follow-up for 3bd28bf

SERVICE_RELOAD_SIGNAL state can only be reached via explicit reload jobs,
and we have a clear distinction between that and plain RELOADING=1
notifications, the latter of which is issued by clients doing reload
outside of our job engine. I.e. upon SERVICE_RELOAD_SIGNAL + RELOADING=1
we don't propagate reload jobs again, since that's done during transaction
construction stage already. The handling of combined RELOADING=1 + READY=1
so far is bogus however, as it tries to propagate duplicate reload jobs.
Amend this by following the logic for standalone RELOADING=1.

(cherry picked from commit c337a13)
(cherry picked from commit aef4add)
(cherry picked from commit 7e6e8b3)
(cherry picked from commit f6b973d)
All dbus programs have to be up-to-date for update-dbus-docs to
produce the expected output, so add the missing dependency.

(cherry picked from commit 461bd92)
(cherry picked from commit cd727da)
(cherry picked from commit c5e562c)
(cherry picked from commit bf899b7)
fido2_generate_hmac_hash() sets req->keyring to "fido2-pin" when
calling ask_password_auto(), suggesting that a key by this name
can be read from the kernel keyring. But the keyring is never
opened because the ASK_PASSWORD_ACCEPT_CACHED flag is not set.

Set ASK_PASSWORD_ACCEPT_CACHED to allow automated / scripted
setup of encrypted volumes with FIDO2. If the PIN turns out to
be invalid, clear ASK_PASSWORD_ACCEPT_CACHED to avoid retrying
and possible lockout.

(cherry picked from commit 505c2f2)
(cherry picked from commit f2054b8)
(cherry picked from commit 012cde1)
(cherry picked from commit 993f1e9)
When using UEFI with bhyve it behaves similarly to qemu, and provides
a product_uuid. Use it if found, just like with qemu.

(cherry picked from commit 113c159)
(cherry picked from commit 4cdaff2)
(cherry picked from commit ebdb1df)
(cherry picked from commit 4c70218)
Fixes a bug in b5a07e5 (v250).

(cherry picked from commit 91421f8)
(cherry picked from commit 349012c)
(cherry picked from commit 786f94f)
(cherry picked from commit 68f7289)
…ocked

In various scenarios we invoke containers with access to the kernel
keyring blocked. Let's make sure we can handle this properly: when the
invocation ID is stored in in the kernel keyring and we try to read it
and get EPERM we should handle it gracefully, like EOPNOTSUPP.

(cherry picked from commit f2e38b0)
(cherry picked from commit a2abc3b)
(cherry picked from commit 9cd3101)
(cherry picked from commit e52806d)
The test expects _not_ to find the patterns but the run_and_grep would
still print 'FAIL:' message. Use the dedicated -n option that inverts
the semantics cleaner than shell's !.

(cherry picked from commit c4b7596)
(cherry picked from commit f45b42e)
(cherry picked from commit 63725bc)
(cherry picked from commit ec3def8)
Fixes CID#1564787.

(cherry picked from commit b0e5cde)
(cherry picked from commit dce29c0)
(cherry picked from commit b7b0f1c)
(cherry picked from commit b5bc721)
The values assigned to 'r' were never used, and overwritten by the next
call of read_line_full().

Fixes CID#1548043 and CID#1548064.

(cherry picked from commit 00575cf)
(cherry picked from commit 244790a)
(cherry picked from commit f92b518)
(cherry picked from commit 8858f69)
Import thew new key from https://data.iana.org/root-anchors/root-anchors.xml.

The old one remains valid, as per provided data.

Fixes: #36260
(cherry picked from commit 8113361)
(cherry picked from commit 961e351)
(cherry picked from commit 6cb60bb)
(cherry picked from commit 6a97871)
If we use TCP fastopen to connect to a DNS server via TCP, and it
responds really quickly between our connection attempt and our immediate
check back, then we have not identified the peer yet, and will not be
able to use the peer metadata to fill in our packet info.

Let's fix that, and simply not read from the socket until identification
is complete.

Fixes: #34956
(cherry picked from commit facc943)
(cherry picked from commit 11da527)
(cherry picked from commit 9bf15a2)
(cherry picked from commit e22b61d)
@packit-as-a-service
Copy link

We were not able to find or create Copr project packit/systemd-systemd-stable-472 specified in the config with the following error:

Cannot create a new Copr project (owner=packit project=systemd-systemd-stable-472 chroots=[]): chroots: '[]' is not a valid choice for this field..

Unless the HTTP status code above is >= 500, please check your configuration for:

  1. typos in owner and project name (groups need to be prefixed with @)
  2. whether the project name doesn't contain not allowed characters (only letters, digits, underscores, dashes and dots must be used)
  3. whether the project itself exists (Packit creates projects only in its own namespace)
  4. whether Packit is allowed to build in your Copr project
  5. whether your Copr project/group is not private

1 similar comment
@packit-as-a-service
Copy link

We were not able to find or create Copr project packit/systemd-systemd-stable-472 specified in the config with the following error:

Cannot create a new Copr project (owner=packit project=systemd-systemd-stable-472 chroots=[]): chroots: '[]' is not a valid choice for this field..

Unless the HTTP status code above is >= 500, please check your configuration for:

  1. typos in owner and project name (groups need to be prefixed with @)
  2. whether the project name doesn't contain not allowed characters (only letters, digits, underscores, dashes and dots must be used)
  3. whether the project itself exists (Packit creates projects only in its own namespace)
  4. whether Packit is allowed to build in your Copr project
  5. whether your Copr project/group is not private

@bluca bluca changed the title v254 batch up to 44a978a22e0d196eb0f0d2870227008524182e19 v254 batch up to b858433a79633bdef1ebea7d5ea4cc2585dcbaab Mar 5, 2025
daandemeyer and others added 9 commits March 5, 2025 13:53
(cherry picked from commit d5474f7)
(cherry picked from commit d006e13)
/usr/bin/pacman-key: line 31: /usr/share/makepkg/util/message.sh: No such file or directory
/usr/bin/pacman-key: line 32: /usr/share/makepkg/util/parseopts.sh: No such file or directory
/usr/bin/pacman-key: line 620: parseopts: command not found

(cherry picked from commit 66ffce7)
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/home/runner/work/_actions/systemd/mkosi/bbe715f42911f9660712377a5b39335b9391ae22/mkosi/__main__.py", line 60, in <module>
    main()
  File "/usr/lib/python3.12/contextlib.py", line 81, in inner
    return func(*args, **kwds)
           ^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/_actions/systemd/mkosi/bbe715f42911f9660712377a5b39335b9391ae22/mkosi/__main__.py", line 52, in main
    run_verb(args, images)
  File "/home/runner/work/_actions/systemd/mkosi/bbe715f42911f9660712377a5b39335b9391ae22/mkosi/__init__.py", line 2789, in run_verb
    become_root()
  File "/home/runner/work/_actions/systemd/mkosi/bbe715f42911f9660712377a5b39335b9391ae22/mkosi/run.py", line 125, in become_root
    os.setresuid(0, 0, 0)
PermissionError: [Errno 1] Operation not permitted

(cherry picked from commit f47a460)
No longer pulled in by default

(cherry picked from commit f30d2ff)
/usr/lib/systemd/systemd: error while loading shared libraries: libz.so.1: cannot open shared object file: No such file or directory

(cherry picked from commit 6fdd047)
F39 doesn't build anymore:

GPG key at https://fedoraproject.org/fedora.gpg (0x31645531) is already installed
Public key for filesystem-3.18-6.fc39.x86_64.rpm is not installed. Failing package is: filesystem-3.18-6.fc39.x86_64
 GPG Keys are configured as: https://fedoraproject.org/fedora.gpg
Public key for setup-2.14.4-1.fc39.noarch.rpm is not installed. Failing package is: setup-2.14.4-1.fc39.noarch
 GPG Keys are configured as: https://fedoraproject.org/fedora.gpg
The GPG keys listed for the "updates" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.. Failing package is: fedora-gpg-keys-39-2.noarch
 GPG Keys are configured as: https://fedoraproject.org/fedora.gpg
Public key for fedora-release-39-36.noarch.rpm is not installed. Failing package is: fedora-release-39-36.noarch
 GPG Keys are configured as: https://fedoraproject.org/fedora.gpg
Public key for fedora-release-common-39-36.noarch.rpm is not installed. Failing package is: fedora-release-common-39-36.noarch
 GPG Keys are configured as: https://fedoraproject.org/fedora.gpg
Public key for fedora-release-identity-basic-39-36.noarch.rpm is not installed. Failing package is: fedora-release-identity-basic-39-36.noarch
 GPG Keys are configured as: https://fedoraproject.org/fedora.gpg
Public key for fedora-repos-39-2.noarch.rpm is not installed. Failing package is: fedora-repos-39-2.noarch
 GPG Keys are configured as: https://fedoraproject.org/fedora.gpg
Error: GPG check FAILED

These are throw-away CI images, so just skip the checks

(cherry picked from commit 44a978a)
Apparently some RTC drivers return EINVAL in that case when we try to
read it. Handle that reasonably gracefully.

Fixes: #31854
(cherry picked from commit 5c81de9)
(cherry picked from commit b858433)
Now, ubuntu-24.04 has mold-2.30.0+dfsg-1build1 .
See https://packages.ubuntu.com/noble/mold .
@packit-as-a-service
Copy link

We were not able to find or create Copr project packit/systemd-systemd-stable-472 specified in the config with the following error:

Cannot create a new Copr project (owner=packit project=systemd-systemd-stable-472 chroots=[]): chroots: '[]' is not a valid choice for this field..

Unless the HTTP status code above is >= 500, please check your configuration for:

  1. typos in owner and project name (groups need to be prefixed with @)
  2. whether the project name doesn't contain not allowed characters (only letters, digits, underscores, dashes and dots must be used)
  3. whether the project itself exists (Packit creates projects only in its own namespace)
  4. whether Packit is allowed to build in your Copr project
  5. whether your Copr project/group is not private

Otherwise mkosi tries to change user and fails
@packit-as-a-service
Copy link

We were not able to find or create Copr project packit/systemd-systemd-stable-472 specified in the config with the following error:

Cannot create a new Copr project (owner=packit project=systemd-systemd-stable-472 chroots=[]): chroots: '[]' is not a valid choice for this field..

Unless the HTTP status code above is >= 500, please check your configuration for:

  1. typos in owner and project name (groups need to be prefixed with @)
  2. whether the project name doesn't contain not allowed characters (only letters, digits, underscores, dashes and dots must be used)
  3. whether the project itself exists (Packit creates projects only in its own namespace)
  4. whether Packit is allowed to build in your Copr project
  5. whether your Copr project/group is not private

@bluca bluca merged commit 067dac4 into systemd:v254-stable Mar 5, 2025
28 of 34 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

Comments