diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/Manifest
index 3e28df35ce..92dcc309d4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/Manifest
@@ -1,2 +1,6 @@
 DIST util-linux-2.39.3.tar.sign 833 BLAKE2B 433b9ad6e97d9e2ffbd516addf8406587d009d9c7661ac126ae89b370f22a39f1f1243e86ef383133d656833d3ad35054397d60e0e0c67bd1e9402939903570b SHA512 d9993d7a77531ca8fe3e58458d65e7d721c38aa53838547479fea169941a69b1c07fb02ac90ed5a0360025814b0999167621dbc4215348810584947a9e67756d
 DIST util-linux-2.39.3.tar.xz 8526168 BLAKE2B cd7b2b3c820e920d4a6ecd46fd807e018fc8e54439292f5e62c5f6863dd0f2505df3ec02c470d9be255a437c6ee8e4077908ac78d19a0d1273854d99eb571df0 SHA512 a2de1672f06ca5d2d431db1265a8499808770c3781019ec4a3a40170df4685826d8e3ca120841dcc5df4681ca8c935a993317bd0dc70465b21bf8e0efef65afa
+DIST util-linux-2.39.4.tar.sign 833 BLAKE2B cbefaa4968ac82491c9eaa467c5e84e9b4a0c8dac74855aa04536a08f2c924e5f027f1a6389bd75e4366671addfe10a292f293295734041da7dc90971209134c SHA512 3f29551913cf8206c144edb0f3575beabf6e228564cf4aaf8f83d44d45ec8f24c22c7d178cc225804ecdfc66f6c24ee790e3b3660622975fdeec98fe7e2500aa
+DIST util-linux-2.39.4.tar.xz 8541176 BLAKE2B 53fef6f36b802d5e4c1112376c77e5cd832280d9eaeb9a6a98b2371334a1a3a8a48f5589d16f67c623a5050ae3b16dafc43ee26a9e8cb77079f9b6a2ee6c9480 SHA512 94e0282ac9705ca666d3c3864f2656bd1a21d879339164edd2c413ae7665b1cfec01f9c58a83b3148b8c4b4e857653447e5523c3b27230b175dd39f75ac6fae0
+DIST util-linux-2.40.1.tar.sign 833 BLAKE2B 2f8537cd4f52e0c203360d081a91f17c2db13c0f6054ef02f967e8fdf03099bb8c42604864003bfb911ea7804033f4020e2f56a933667fc84ac9c4b8d01e9ed5 SHA512 ab73a27fc8601041bf7b8a088586b78c49ca83cf9c8cfe5877280c0b5c607e95695512804335a8c0ac1d243e4433595f44256407fdbfb053451b8ab40d605502
+DIST util-linux-2.40.1.tar.xz 8823784 BLAKE2B a51fcf9b63c033e470da4f4f0094f0f923fdeb5a649a5c59d2d44888e5e741dfd95e589247355296e050d9ec8dc4334c5898453af055abcb30082af6b835a3e3 SHA512 58ec6eb41d4b6bfc544a80e95c71b5f3798ab4d2a9435d3ee9e5edd56f9b3f09bcb154bdd70e002dc018938937e2e946ae731dcda0f86b362fc43423689e41fc
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/util-linux-2.39.4-umount-readonly.patch b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/util-linux-2.39.4-umount-readonly.patch
new file mode 100644
index 0000000000..57c8903348
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/util-linux-2.39.4-umount-readonly.patch
@@ -0,0 +1,35 @@
+https://github.com/util-linux/util-linux/commit/9ba8eb5d89f0ebba8b3a542c041a5838e10a0d75
+https://bugs.gentoo.org/573760#c11
+
+From 9ba8eb5d89f0ebba8b3a542c041a5838e10a0d75 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Tue, 23 Apr 2024 10:29:37 +0200
+Subject: [PATCH] libmount: fix umount --read-only
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported-by: Krzysztof Olędzki <ole@ans.pl>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit a20e7e23a8565e01b1c84de6924d1fbbdb1cfccc)
+--- a/libmount/src/context_umount.c
++++ b/libmount/src/context_umount.c
+@@ -267,6 +267,9 @@ static int lookup_umount_fs_by_statfs(struct libmnt_context *cxt, const char *tg
+ 	 * So, let's use statfs() if possible (it's bad idea for --lazy/--force
+ 	 * umounts as target is probably unreachable NFS, also for --detach-loop
+ 	 * as this additionally needs to know the name of the loop device).
++	 *
++	 * For the "umount --read-only" command, we need to read the mountinfo
++	 * to obtain the mount source.
+ 	 */
+ 	if (mnt_context_is_restricted(cxt)
+ 	    || *tgt != '/'
+@@ -275,6 +278,7 @@ static int lookup_umount_fs_by_statfs(struct libmnt_context *cxt, const char *tg
+ 	    || mnt_context_is_lazy(cxt)
+ 	    || mnt_context_is_nocanonicalize(cxt)
+ 	    || mnt_context_is_loopdel(cxt)
++	    || mnt_context_is_rdonly_umount(cxt)
+ 	    || mnt_safe_stat(tgt, &st) != 0 || !S_ISDIR(st.st_mode)
+ 	    || has_utab_entry(cxt, tgt))
+ 		return 1; /* not found */
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/uuidd.initd b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/uuidd.initd
new file mode 100644
index 0000000000..3ddedc3f3b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/uuidd.initd
@@ -0,0 +1,17 @@
+#!/sbin/openrc-run
+# Copyright 2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+command=/usr/sbin/uuidd
+command_args_foreground="-FP"
+command_user=uuidd
+pidfile=/run/uuidd/uuidd.pid
+
+depend() {
+	need clock localmount
+}
+
+start_pre() {
+	checkpath -d -m 2755 -o uuidd:uuidd /run/uuidd &&
+	checkpath -d -m 0755 -o uuidd:uuidd /var/lib/libuuid
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/metadata.xml
index 2d9b8b837f..291587be54 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/metadata.xml
@@ -24,6 +24,7 @@
 		su: non-root users may become root
 		</flag>
 		<flag name="tty-helpers">install the mesg/wall/write tools for talking to local users</flag>
+		<flag name="uuidd">build uuidd daemon</flag>
 	</use>
 	<upstream>
 		<remote-id type="cpe">cpe:/a:andries_brouwer:util-linux</remote-id>
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r2.ebuild
index 33249fda2a..03c9e04f67 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r2.ebuild
@@ -236,6 +236,9 @@ multilib_src_configure() {
 		$(use_enable static-libs static)
 		$(use_with ncurses tinfo)
 		$(use_with selinux)
+
+		# TODO: Wire this up (bug #931118)
+		--without-econf
 	)
 
 	if use build ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r7.ebuild
index c8676b6387..139ddab7c6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r7.ebuild
@@ -22,7 +22,7 @@ else
 	inherit verify-sig
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos"
 	fi
 
 	SRC_URI="https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.xz"
@@ -241,6 +241,9 @@ multilib_src_configure() {
 		$(use_enable static-libs static)
 		$(use_with ncurses tinfo)
 		$(use_with selinux)
+
+		# TODO: Wire this up (bug #931118)
+		--without-econf
 	)
 
 	if use build ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r6.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r6.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild
index 256c7ca3c7..e61811263e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild
@@ -99,12 +99,11 @@ RESTRICT="!test? ( test )"
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.39.2-fincore-test.patch
-	"${FILESDIR}"/${PN}-2.39.2-backport-pr2251.patch
 	"${FILESDIR}"/${PN}-2.39.2-backport-1d4456d.patch
-	"${FILESDIR}"/${PN}-2.39.3-libblkid-luks.patch
 	"${FILESDIR}"/${PN}-2.39.3-musl-1.2.5-basename.patch
 	"${FILESDIR}"/${PN}-2.39.3-libmount-Fix-export-of-mnt_context_is_lazy-and-mnt_c.patch
-	"${FILESDIR}"/${PN}-2.39.3-CVE-2024-28085.patch
+	"${FILESDIR}"/${PN}-2.39.3-fix-use-after-free.patch
+	"${FILESDIR}"/${PN}-2.39.4-umount-readonly.patch
 )
 
 pkg_pretend() {
@@ -156,6 +155,9 @@ src_prepare() {
 			# Fails with network-sandbox at least in nspawn
 			lsfd/option-inet
 			utmp/last-ipv6
+
+			# Flaky
+			rename/subdir
 		)
 
 		local known_failing_test
@@ -240,6 +242,9 @@ multilib_src_configure() {
 		$(use_enable static-libs static)
 		$(use_with ncurses tinfo)
 		$(use_with selinux)
+
+		# TODO: Wire this up (bug #931118)
+		--without-econf
 	)
 
 	if use build ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild
similarity index 86%
rename from sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r5.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild
index 30a4c80b43..1205062fed 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild
@@ -4,9 +4,10 @@
 EAPI=8
 
 PYTHON_COMPAT=( python3_{10..12} )
+TMPFILES_OPTIONAL=1
 
 inherit toolchain-funcs libtool flag-o-matic bash-completion-r1 \
-	pam python-r1 multilib-minimal multiprocessing systemd
+	pam python-r1 multilib-minimal multiprocessing systemd tmpfiles
 
 MY_PV="${PV/_/-}"
 MY_P="${PN}-${MY_PV}"
@@ -22,7 +23,7 @@ else
 	inherit verify-sig
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
 	fi
 
 	SRC_URI="https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.xz"
@@ -33,7 +34,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="GPL-2 GPL-3 LGPL-2.1 BSD-4 MIT public-domain"
 SLOT="0"
-IUSE="audit build caps +cramfs cryptsetup fdformat +hardlink kill +logger magic ncurses nls pam python +readline rtas selinux slang static-libs +su +suid systemd test tty-helpers udev unicode"
+IUSE="audit build caps +cramfs cryptsetup fdformat +hardlink kill +logger magic ncurses nls pam python +readline rtas selinux slang static-libs +su +suid systemd test tty-helpers udev unicode uuidd"
 
 # Most lib deps here are related to programs rather than our libs,
 # so we rarely need to specify ${MULTILIB_USEDEP}.
@@ -84,6 +85,10 @@ RDEPEND+="
 		!<sys-apps/shadow-4.7-r2
 		!>=sys-apps/shadow-4.7-r2[su]
 	)
+	uuidd? (
+		acct-user/uuidd
+		systemd? ( virtual/tmpfiles )
+	)
 	!net-wireless/rfkill
 "
 
@@ -97,15 +102,6 @@ fi
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} ) su? ( pam )"
 RESTRICT="!test? ( test )"
 
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.39.2-fincore-test.patch
-	"${FILESDIR}"/${PN}-2.39.2-backport-pr2251.patch
-	"${FILESDIR}"/${PN}-2.39.2-backport-1d4456d.patch
-	"${FILESDIR}"/${PN}-2.39.3-libblkid-luks.patch
-	"${FILESDIR}"/${PN}-2.39.3-musl-1.2.5-basename.patch
-	"${FILESDIR}"/${PN}-2.39.3-libmount-Fix-export-of-mnt_context_is_lazy-and-mnt_c.patch
-)
-
 pkg_pretend() {
 	if use su && ! use suid ; then
 		elog "su will be installed as suid despite USE=-suid (bug #832092)"
@@ -114,27 +110,20 @@ pkg_pretend() {
 }
 
 src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-		return
+        if [[ ${PV} == 9999 ]] ; then
+                git-r3_src_unpack
+                return
+        fi
+
+	# Upstream sign the decompressed .tar
+	if use verify-sig; then
+		einfo "Unpacking ${MY_P}.tar.xz ..."
+		verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
+			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+		assert "Unpack failed"
+	else
+		default
 	fi
-
-	if use verify-sig ; then
-		mkdir "${T}"/verify-sig || die
-		pushd "${T}"/verify-sig &>/dev/null || die
-
-		# Upstream sign the decompressed .tar
-		# Let's do it separately in ${T} then cleanup to avoid external
-		# effects on normal unpack.
-		cp "${DISTDIR}"/${MY_P}.tar.xz . || die
-		xz -d ${MY_P}.tar.xz || die
-		verify-sig_verify_detached ${MY_P}.tar "${DISTDIR}"/${MY_P}.tar.sign
-
-		popd &>/dev/null || die
-		rm -r "${T}"/verify-sig || die
-	fi
-
-	default
 }
 
 src_prepare() {
@@ -142,19 +131,26 @@ src_prepare() {
 
 	if use test ; then
 		# Known-failing tests
-		# TODO: investigate these
 		local known_failing_tests=(
 			# Subtest 'options-maximum-size-8192' fails
 			hardlink/options
 
 			# Fails in sandbox
+			# re ioctl_ns: https://github.com/util-linux/util-linux/issues/2967
 			lsns/ioctl_ns
-
+			lsfd/mkfds-inotify
 			lsfd/mkfds-symlink
 			lsfd/mkfds-rw-character-device
 			# Fails with network-sandbox at least in nspawn
 			lsfd/option-inet
 			utmp/last-ipv6
+
+			# Flaky
+			rename/subdir
+
+			# Permission issues on /dev/random
+			lsfd/mkfds-eventpoll
+			lsfd/column-xmode
 		)
 
 		local known_failing_test
@@ -214,10 +210,6 @@ multilib_src_configure() {
 		--localstatedir="${EPREFIX}/var"
 		--runstatedir="${EPREFIX}/run"
 		--enable-fs-paths-extra="${EPREFIX}/usr/sbin:${EPREFIX}/bin:${EPREFIX}/usr/bin"
-
-		# Temporary workaround until ~2.39.2. 2.39.x introduced a big rewrite.
-		# https://github.com/util-linux/util-linux/issues/2287#issuecomment-1576640373
-		--disable-libmount-mountfd-support
 	)
 
 	local myeconfargs=(
@@ -239,6 +231,15 @@ multilib_src_configure() {
 		$(use_enable static-libs static)
 		$(use_with ncurses tinfo)
 		$(use_with selinux)
+		$(multilib_native_use_enable uuidd)
+
+		# TODO: Wire this up (bug #931118)
+		--without-econf
+
+		# TODO: Wire this up (bug #931297)
+		# TODO: investigate build failure w/ 2.40.1_rc1
+		--disable-liblastlog2
+		--disable-pam-lastlog2
 	)
 
 	if use build ; then
@@ -270,6 +271,7 @@ multilib_src_configure() {
 			--enable-rfkill
 			--enable-schedutils
 			--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
+			--with-tmpfilesdir="${EPREFIX}"/usr/lib/tmpfiles.d
 			$(use_enable caps setpriv)
 			$(use_enable cramfs)
 			$(use_enable fdformat)
@@ -303,6 +305,9 @@ multilib_src_configure() {
 			--enable-libsmartcols
 			--enable-libfdisk
 			--enable-libmount
+
+			# Support uuidd for non-native libuuid
+			$(use_enable uuidd libuuid-force-uuidd)
 		)
 	fi
 
@@ -358,7 +363,8 @@ multilib_src_install() {
 	fi
 
 	# This needs to be called AFTER python_install call, bug #689190
-	emake DESTDIR="${D}" install
+	# XXX: -j1 as temporary workaround for bug #931301
+	emake DESTDIR="${D}" install -j1
 }
 
 multilib_src_install_all() {
@@ -387,6 +393,10 @@ multilib_src_install_all() {
 		fperms u+s /bin/su
 	fi
 
+	if use uuidd; then
+		newinitd "${FILESDIR}/uuidd.initd" uuidd
+	fi
+
 	# Note:
 	# Bash completion for "runuser" command is provided by same file which
 	# would also provide bash completion for "su" command. However, we don't
@@ -411,4 +421,8 @@ pkg_postinst() {
 		elog "The agetty util now clears the terminal by default. You"
 		elog "might want to add --noclear to your /etc/inittab lines."
 	fi
+
+	if use systemd && use uuidd; then
+		tmpfiles_process uuidd-tmpfiles.conf
+	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
index f25f71aca3..8e74d1439e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
@@ -4,9 +4,10 @@
 EAPI=8
 
 PYTHON_COMPAT=( python3_{10..12} )
+TMPFILES_OPTIONAL=1
 
 inherit toolchain-funcs libtool flag-o-matic bash-completion-r1 \
-	pam python-r1 multilib-minimal multiprocessing systemd
+	pam python-r1 multilib-minimal multiprocessing systemd tmpfiles
 
 MY_PV="${PV/_/-}"
 MY_P="${PN}-${MY_PV}"
@@ -33,7 +34,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="GPL-2 GPL-3 LGPL-2.1 BSD-4 MIT public-domain"
 SLOT="0"
-IUSE="audit build caps +cramfs cryptsetup fdformat +hardlink kill +logger magic ncurses nls pam python +readline rtas selinux slang static-libs +su +suid systemd test tty-helpers udev unicode"
+IUSE="audit build caps +cramfs cryptsetup fdformat +hardlink kill +logger magic ncurses nls pam python +readline rtas selinux slang static-libs +su +suid systemd test tty-helpers udev unicode uuidd"
 
 # Most lib deps here are related to programs rather than our libs,
 # so we rarely need to specify ${MULTILIB_USEDEP}.
@@ -84,6 +85,10 @@ RDEPEND+="
 		!<sys-apps/shadow-4.7-r2
 		!>=sys-apps/shadow-4.7-r2[su]
 	)
+	uuidd? (
+		acct-user/uuidd
+		systemd? ( virtual/tmpfiles )
+	)
 	!net-wireless/rfkill
 "
 
@@ -110,22 +115,15 @@ src_unpack() {
 		return
 	fi
 
-	if use verify-sig ; then
-		mkdir "${T}"/verify-sig || die
-		pushd "${T}"/verify-sig &>/dev/null || die
-
-		# Upstream sign the decompressed .tar
-		# Let's do it separately in ${T} then cleanup to avoid external
-		# effects on normal unpack.
-		cp "${DISTDIR}"/${MY_P}.tar.xz . || die
-		xz -d ${MY_P}.tar.xz || die
-		verify-sig_verify_detached ${MY_P}.tar "${DISTDIR}"/${MY_P}.tar.sign
-
-		popd &>/dev/null || die
-		rm -r "${T}"/verify-sig || die
+	# Upstream sign the decompressed .tar
+	if use verify-sig; then
+		einfo "Unpacking ${MY_P}.tar.xz ..."
+		verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
+			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+		assert "Unpack failed"
+	else
+		default
 	fi
-
-	default
 }
 
 src_prepare() {
@@ -133,19 +131,26 @@ src_prepare() {
 
 	if use test ; then
 		# Known-failing tests
-		# TODO: investigate these
 		local known_failing_tests=(
 			# Subtest 'options-maximum-size-8192' fails
 			hardlink/options
 
 			# Fails in sandbox
+			# re ioctl_ns: https://github.com/util-linux/util-linux/issues/2967
 			lsns/ioctl_ns
-
+			lsfd/mkfds-inotify
 			lsfd/mkfds-symlink
 			lsfd/mkfds-rw-character-device
 			# Fails with network-sandbox at least in nspawn
 			lsfd/option-inet
 			utmp/last-ipv6
+
+			# Flaky
+			rename/subdir
+
+			# Permission issues on /dev/random
+			lsfd/mkfds-eventpoll
+			lsfd/column-xmode
 		)
 
 		local known_failing_test
@@ -226,6 +231,15 @@ multilib_src_configure() {
 		$(use_enable static-libs static)
 		$(use_with ncurses tinfo)
 		$(use_with selinux)
+		$(multilib_native_use_enable uuidd)
+
+		# TODO: Wire this up (bug #931118)
+		--without-econf
+
+		# TODO: Wire this up (bug #931297)
+		# TODO: investigate build failure w/ 2.40.1_rc1
+		--disable-liblastlog2
+		--disable-pam-lastlog2
 	)
 
 	if use build ; then
@@ -257,6 +271,7 @@ multilib_src_configure() {
 			--enable-rfkill
 			--enable-schedutils
 			--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
+			--with-tmpfilesdir="${EPREFIX}"/usr/lib/tmpfiles.d
 			$(use_enable caps setpriv)
 			$(use_enable cramfs)
 			$(use_enable fdformat)
@@ -290,6 +305,9 @@ multilib_src_configure() {
 			--enable-libsmartcols
 			--enable-libfdisk
 			--enable-libmount
+
+			# Support uuidd for non-native libuuid
+			$(use_enable uuidd libuuid-force-uuidd)
 		)
 	fi
 
@@ -374,6 +392,10 @@ multilib_src_install_all() {
 		fperms u+s /bin/su
 	fi
 
+	if use uuidd; then
+		newinitd "${FILESDIR}/uuidd.initd" uuidd
+	fi
+
 	# Note:
 	# Bash completion for "runuser" command is provided by same file which
 	# would also provide bash completion for "su" command. However, we don't
@@ -398,4 +420,8 @@ pkg_postinst() {
 		elog "The agetty util now clears the terminal by default. You"
 		elog "might want to add --noclear to your /etc/inittab lines."
 	fi
+
+	if use systemd && use uuidd; then
+		tmpfiles_process uuidd-tmpfiles.conf
+	fi
 }