mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-22 15:01:00 +02:00
sys-apps/systemd: apply CoreOS changes to the v233 ebuild
Changes include: * Add cros_workon bits * Define and use the symlink-usr flag * Drop SELinux policy and udev init scripts dependencies * Drop all patches since the source is from Git * Switch /etc/resolv.conf to the old one * Drop the D-Bus policy path to keep the default * Use CoreOS NTP servers * Install PAM files into /usr * Set the timesyncd epoch * Don't use default DNS servers * Use legacy cgroups (https://github.com/docker/docker/issues/28109) * Rewrite basically the entire install step * Drop the systemd-bus-proxy user since the program is long gone
This commit is contained in:
David Michael
parent
49bc54fc8c
commit
c2340eba7f
@ -1,2 +0,0 @@
|
||||
DIST systemd-233-man.tar.gz 31386 SHA256 825e62eb82c4e23997061fc8f56f7ec9bb1e6ac1111d279c76c926cc2bfbf1dc SHA512 cc5215d3590ffc3c9203a64c14d6adeb0148c421c1396b8c1e43dcb58763b687ce99bdee327dd8a00abab7198171e73b22109a3f2032e4cec6adf2dcc85acf40 WHIRLPOOL ff1f36beff377f675047271df38503e8b71d615ea73c5fdfebf465edaf1fe29b4f89e3194d65cdf84eec9b7c3156de597627fdaffa4b86018520aaa127a7a159
|
||||
DIST systemd-233.tar.gz 4660737 SHA256 8b3e99da3d4164b66581830a7f2436c0c8fe697b5fbdc3927bdb960646be0083 SHA512 5ad5329ea116d973cf67096f7e7ad28e9ea0905696e9451291f1d25e5064f4a9bfcfae87e912996c6a38397e9f4a148d4ccecfa9b70f7ecdf04deadb61784c8e WHIRLPOOL ce19f6a546b8f899cfa952e49d47f063fd29186be4a53391bc30ea2c487eb2c140a74ad843a1dc499bb61bba3e9ca055613852291e38b85af5d79c59409dc176
|
||||
@ -1,30 +0,0 @@
|
||||
From: Martin Pitt <martin.pitt@ubuntu.com>
|
||||
Date: Sun, 28 Dec 2014 12:49:35 +0100
|
||||
Subject: Don't enable audit by default
|
||||
|
||||
It causes flooding of dmesg and syslog, suppressing actually important
|
||||
messages.
|
||||
|
||||
Don't enable it for now, until a better solution is found:
|
||||
http://lists.freedesktop.org/archives/systemd-devel/2014-December/026591.html
|
||||
|
||||
Bug-Debian: https://bugs.debian.org/773528
|
||||
---
|
||||
src/journal/journald-audit.c | 5 -----
|
||||
1 file changed, 5 deletions(-)
|
||||
|
||||
diff --git a/src/journal/journald-audit.c b/src/journal/journald-audit.c
|
||||
index 69742fa..25ef743 100644
|
||||
--- a/src/journal/journald-audit.c
|
||||
+++ b/src/journal/journald-audit.c
|
||||
@@ -542,10 +542,5 @@ int server_open_audit(Server *s) {
|
||||
if (r < 0)
|
||||
return log_error_errno(r, "Failed to add audit fd to event loop: %m");
|
||||
|
||||
- /* We are listening now, try to enable audit */
|
||||
- r = enable_audit(s->audit_fd, true);
|
||||
- if (r < 0)
|
||||
- log_warning_errno(r, "Failed to issue audit enable call: %m");
|
||||
-
|
||||
return 0;
|
||||
}
|
||||
@ -1,28 +0,0 @@
|
||||
From b23c098d5787e06770872b19f83fffa14d8a7d14 Mon Sep 17 00:00:00 2001
|
||||
From: Mike Gilbert <floppym@gentoo.org>
|
||||
Date: Fri, 25 Sep 2015 10:26:18 -0400
|
||||
Subject: [PATCH] tmpfiles: Disable cleaning of /tmp and /var/tmp
|
||||
|
||||
Bug: https://bugs.gentoo.org/490676
|
||||
---
|
||||
tmpfiles.d/tmp.conf | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/tmpfiles.d/tmp.conf b/tmpfiles.d/tmp.conf
|
||||
index 6bbd1aa..a361062 100644
|
||||
--- a/tmpfiles.d/tmp.conf
|
||||
+++ b/tmpfiles.d/tmp.conf
|
||||
@@ -8,8 +8,8 @@
|
||||
# See tmpfiles.d(5) for details
|
||||
|
||||
# Clear tmp directories separately, to make them easier to override
|
||||
-q /tmp 1777 root root 10d
|
||||
-q /var/tmp 1777 root root 30d
|
||||
+q /tmp 1777 root root
|
||||
+q /var/tmp 1777 root root
|
||||
|
||||
# Exclude namespace mountpoints created with PrivateTmp=yes
|
||||
x /tmp/systemd-private-%b-*
|
||||
--
|
||||
2.4.10
|
||||
|
||||
@ -1,16 +0,0 @@
|
||||
--- a/src/login/systemd-user.m4
|
||||
+++ b/src/login/systemd-user.m4
|
||||
@@ -2,11 +2,7 @@
|
||||
#
|
||||
# Used by systemd --user instances.
|
||||
|
||||
-account required pam_unix.so
|
||||
-m4_ifdef(`HAVE_SELINUX',
|
||||
-session required pam_selinux.so close
|
||||
-session required pam_selinux.so nottys open
|
||||
-)m4_dnl
|
||||
-session required pam_loginuid.so
|
||||
+account include system-auth
|
||||
+session include system-auth
|
||||
session optional pam_keyinit.so force revoke
|
||||
session optional pam_systemd.so
|
||||
@ -1,27 +0,0 @@
|
||||
# Sample nss configuration for systemd
|
||||
|
||||
# systemd-specific modules
|
||||
# See the manual pages fore further information.
|
||||
# nss-myhostname - host resolution for the local hostname
|
||||
# nss-mymachines - host, user, group resolution for containers
|
||||
# nss-resolve - host resolution using resolved
|
||||
# nss-systemd - dynamic user/group resolution (DynamicUser in unit files)
|
||||
|
||||
passwd: compat mymachines systemd
|
||||
shadow: compat
|
||||
group: compat mymachines systemd
|
||||
gshadow: files
|
||||
|
||||
hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname
|
||||
networks: files
|
||||
|
||||
services: db files
|
||||
protocols: db files
|
||||
rpc: db files
|
||||
ethers: db files
|
||||
netmasks: files
|
||||
netgroup: files
|
||||
bootparams: files
|
||||
|
||||
automount: files
|
||||
aliases: files
|
||||
@ -3,17 +3,24 @@
|
||||
|
||||
EAPI=6
|
||||
|
||||
CROS_WORKON_PROJECT="coreos/systemd"
|
||||
CROS_WORKON_REPO="git://github.com"
|
||||
|
||||
if [[ ${PV} == 9999 ]]; then
|
||||
EGIT_REPO_URI="https://github.com/systemd/systemd.git"
|
||||
inherit git-r3
|
||||
# Use ~arch instead of empty keywords for compatibility with cros-workon
|
||||
KEYWORDS="~amd64 ~arm64 ~arm ~x86"
|
||||
else
|
||||
SRC_URI="https://github.com/systemd/systemd/archive/v${PV}.tar.gz -> ${P}.tar.gz
|
||||
!doc? ( https://dev.gentoo.org/~floppym/dist/${P}-man.tar.gz )"
|
||||
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
|
||||
CROS_WORKON_COMMIT="6b646f36fa62ec55660daab07ec5c347730f8469" # v233-coreos
|
||||
KEYWORDS="~amd64 ~arm64 ~arm ~x86"
|
||||
fi
|
||||
|
||||
PYTHON_COMPAT=( python{3_4,3_5,3_6} )
|
||||
|
||||
# cros-workon must be imported first, in cases where cros-workon and
|
||||
# another eclass exports the same function (say src_compile) we want
|
||||
# the later eclass's version to win. Only need src_unpack from workon.
|
||||
inherit cros-workon
|
||||
|
||||
inherit autotools bash-completion-r1 linux-info multilib-minimal pam python-any-r1 systemd toolchain-funcs udev user
|
||||
|
||||
DESCRIPTION="System and service manager for Linux"
|
||||
@ -25,6 +32,9 @@ IUSE="acl apparmor audit build cryptsetup curl doc elfutils +gcrypt gnuefi http
|
||||
idn importd +kmod +lz4 lzma nat pam policykit
|
||||
qrcode +seccomp selinux ssl sysv-utils test vanilla xkb"
|
||||
|
||||
# CoreOS specific use flags
|
||||
IUSE+=" symlink-usr"
|
||||
|
||||
REQUIRED_USE="importd? ( curl gcrypt lzma )"
|
||||
|
||||
MINKV="3.11"
|
||||
@ -63,10 +73,7 @@ COMMON_DEPEND=">=sys-apps/util-linux-2.27.1:0=[${MULTILIB_USEDEP}]
|
||||
abi_x86_32? ( !<=app-emulation/emul-linux-x86-baselibs-20130224-r9
|
||||
!app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)] )"
|
||||
|
||||
# baselayout-2.2 has /run
|
||||
RDEPEND="${COMMON_DEPEND}
|
||||
>=sys-apps/baselayout-2.2
|
||||
selinux? ( sec-policy/selinux-base-policy[systemd] )
|
||||
!build? ( || (
|
||||
sys-apps/util-linux[kill(-)]
|
||||
sys-process/procps[kill(+)]
|
||||
@ -80,7 +87,6 @@ RDEPEND="${COMMON_DEPEND}
|
||||
# sys-apps/dbus: the daemon only (+ build-time lib dep for tests)
|
||||
PDEPEND=">=sys-apps/dbus-1.9.8[systemd]
|
||||
>=sys-apps/hwids-20150417[udev]
|
||||
>=sys-fs/udev-init-scripts-25
|
||||
policykit? ( sys-auth/polkit )
|
||||
!vanilla? ( sys-apps/gentoo-systemd-integration )"
|
||||
|
||||
@ -142,23 +148,14 @@ pkg_setup() {
|
||||
|
||||
src_unpack() {
|
||||
default
|
||||
[[ ${PV} != 9999 ]] || git-r3_src_unpack
|
||||
cros-workon_src_unpack
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
# Bug 463376
|
||||
sed -i -e 's/GROUP="dialout"/GROUP="uucp"/' rules/*.rules || die
|
||||
|
||||
local PATCHES=(
|
||||
)
|
||||
|
||||
if ! use vanilla; then
|
||||
PATCHES+=(
|
||||
"${FILESDIR}/218-Dont-enable-audit-by-default.patch"
|
||||
"${FILESDIR}/228-noclean-tmp.patch"
|
||||
"${FILESDIR}/233-systemd-user-pam.patch"
|
||||
)
|
||||
fi
|
||||
# Use the resolv.conf managed by systemd-resolved
|
||||
sed -i -e 's,/usr/lib/systemd/resolv.conf,/run/systemd/resolve/resolv.conf,' tmpfiles.d/etc.conf.m4 || die
|
||||
|
||||
[[ -d "${WORKDIR}"/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
|
||||
|
||||
@ -254,11 +251,23 @@ multilib_src_configure() {
|
||||
EFI_CC="$(tc-getCC)"
|
||||
|
||||
# dbus paths
|
||||
--with-dbuspolicydir="${EPREFIX}/etc/dbus-1/system.d"
|
||||
--with-dbussessionservicedir="${EPREFIX}/usr/share/dbus-1/services"
|
||||
--with-dbussystemservicedir="${EPREFIX}/usr/share/dbus-1/system-services"
|
||||
|
||||
--with-ntp-servers="0.gentoo.pool.ntp.org 1.gentoo.pool.ntp.org 2.gentoo.pool.ntp.org 3.gentoo.pool.ntp.org"
|
||||
--with-ntp-servers="0.coreos.pool.ntp.org 1.coreos.pool.ntp.org 2.coreos.pool.ntp.org 3.coreos.pool.ntp.org"
|
||||
|
||||
--with-pamconfdir=/usr/share/pam.d
|
||||
|
||||
# The CoreOS epoch, Mon Jul 1 00:00:00 UTC 2013. Used by timesyncd
|
||||
# as a sanity check for the minimum acceptable time. Explicitly set
|
||||
# to avoid using the current build time.
|
||||
--with-time-epoch=1372636800
|
||||
|
||||
# no default name servers
|
||||
--with-dns-servers=
|
||||
|
||||
# Breaks Docker
|
||||
--with-default-hierarchy=legacy
|
||||
|
||||
# Breaks screen, tmux, etc.
|
||||
--without-kill-user-processes
|
||||
@ -322,19 +331,18 @@ multilib_src_install() {
|
||||
}
|
||||
|
||||
multilib_src_install_all() {
|
||||
local unitdir=$(systemd_get_systemunitdir)
|
||||
|
||||
prune_libtool_files --modules
|
||||
einstalldocs
|
||||
dodoc "${FILESDIR}"/nsswitch.conf
|
||||
|
||||
if [[ ${PV} != 9999 ]]; then
|
||||
use doc || doman "${WORKDIR}"/man/systemd.{directives,index}.7
|
||||
fi
|
||||
|
||||
if use sysv-utils; then
|
||||
local prefix
|
||||
use symlink-usr && prefix=/usr
|
||||
for app in halt poweroff reboot runlevel shutdown telinit; do
|
||||
dosym "..${ROOTPREFIX-/usr}/bin/systemctl" /sbin/${app}
|
||||
dosym "${ROOTPREFIX-/usr}/bin/systemctl" ${prefix}/sbin/${app}
|
||||
done
|
||||
dosym "..${ROOTPREFIX-/usr}/lib/systemd/systemd" /sbin/init
|
||||
dosym "${ROOTPREFIX-/usr}/lib/systemd/systemd" ${prefix}/sbin/init
|
||||
else
|
||||
# we just keep sysvinit tools, so no need for the mans
|
||||
rm "${D}"/usr/share/man/man8/{halt,poweroff,reboot,runlevel,shutdown,telinit}.8 \
|
||||
@ -342,21 +350,72 @@ multilib_src_install_all() {
|
||||
rm "${D}"/usr/share/man/man1/init.1 || die
|
||||
fi
|
||||
|
||||
# Preserve empty dirs in /etc & /var, bug #437008
|
||||
keepdir /etc/binfmt.d /etc/modules-load.d /etc/tmpfiles.d \
|
||||
/etc/systemd/ntp-units.d /etc/systemd/user /var/lib/systemd \
|
||||
/var/log/journal/remote
|
||||
# Ensure journal directory has correct ownership/mode in inital image.
|
||||
# This is fixed by systemd-tmpfiles *but* journald starts before that
|
||||
# and will create the journal if the filesystem is already read-write.
|
||||
# Conveniently the systemd Makefile sets this up completely wrong.
|
||||
dodir /var/log/journal
|
||||
fowners root:systemd-journal /var/log/journal
|
||||
fperms 2755 /var/log/journal
|
||||
|
||||
# Symlink /etc/sysctl.conf for easy migration.
|
||||
dosym ../sysctl.conf /etc/sysctl.d/99-sysctl.conf
|
||||
systemd_dotmpfilesd "${FILESDIR}"/systemd-coreos.conf
|
||||
systemd_dotmpfilesd "${FILESDIR}"/systemd-resolv.conf
|
||||
|
||||
# If we install these symlinks, there is no way for the sysadmin to remove them
|
||||
# permanently.
|
||||
rm "${D}"/etc/systemd/system/multi-user.target.wants/systemd-networkd.service || die
|
||||
rm -f "${D}"/etc/systemd/system/multi-user.target.wants/systemd-resolved.service || die
|
||||
rm -r "${D}"/etc/systemd/system/network-online.target.wants || die
|
||||
rm -r "${D}"/etc/systemd/system/sockets.target.wants || die
|
||||
rm -r "${D}"/etc/systemd/system/sysinit.target.wants || die
|
||||
# Path masking and FEATURES aren't catching this
|
||||
use doc || rm -r "${D}${ROOTPREFIX-/usr}/share/man"
|
||||
|
||||
# Don't default to graphical.target
|
||||
rm "${D}${unitdir}"/default.target || die
|
||||
dosym multi-user.target "${unitdir}"/default.target
|
||||
|
||||
# Don't set any extra environment variables by default
|
||||
rm "${D}${ROOTPREFIX-/usr}/lib/environment.d/99-environment.conf" || die
|
||||
|
||||
# Don't install the compatibility policy rules in /var (Fixed: @37377227)
|
||||
rm "${D}"/var/lib/polkit-1/localauthority/10-vendor.d/systemd-networkd.pkla
|
||||
rmdir "${D}"/var/lib/polkit-1{/localauthority{/10-vendor.d,},}
|
||||
|
||||
# Move a few services enabled in /etc to /usr, delete files individually
|
||||
# so builds fail if systemd adds any new unexpected stuff to /etc
|
||||
local f
|
||||
for f in \
|
||||
getty.target.wants/getty@tty1.service \
|
||||
multi-user.target.wants/machines.target \
|
||||
multi-user.target.wants/remote-fs.target \
|
||||
multi-user.target.wants/systemd-networkd.service \
|
||||
multi-user.target.wants/systemd-resolved.service \
|
||||
network-online.target.wants/systemd-networkd-wait-online.service \
|
||||
sockets.target.wants/systemd-networkd.socket \
|
||||
sysinit.target.wants/systemd-timesyncd.service
|
||||
do
|
||||
local s="${f#*/}" t="${f%/*}"
|
||||
local u="${s/@*.service/@.service}"
|
||||
|
||||
# systemd_enable_service doesn't understand template units
|
||||
einfo "Enabling ${s} via ${t}"
|
||||
dodir "${unitdir}/${t}"
|
||||
dosym "../${u}" "${unitdir}/${t}/${s}"
|
||||
|
||||
rm "${D}/etc/systemd/system/${f}" || die
|
||||
done
|
||||
f=dbus-org.freedesktop.resolve1.service
|
||||
rm "${D}/etc/systemd/system/${f}" || die
|
||||
dosym systemd-resolved.service "${unitdir}/${f}"
|
||||
rmdir "${D}"/etc/systemd/system/*.wants || die
|
||||
|
||||
# Do not enable random services if /etc was detected as empty!!!
|
||||
rm "${D}"/usr/lib/systemd/system-preset/90-systemd.preset
|
||||
insinto /usr/lib/systemd/system-preset
|
||||
doins "${FILESDIR}"/99-default.preset
|
||||
|
||||
# Disable the "First Boot Wizard" by default, it isn't very applicable to CoreOS
|
||||
rm "${D}${unitdir}"/sysinit.target.wants/systemd-firstboot.service
|
||||
|
||||
# Do not ship distro-specific files (nsswitch.conf pam.d)
|
||||
rm -rf "${D}"/usr/share/factory
|
||||
sed -i "${D}"/usr/lib/tmpfiles.d/etc.conf \
|
||||
-e '/^C \/etc\/nsswitch\.conf/d' \
|
||||
-e '/^C \/etc\/pam\.d/d'
|
||||
}
|
||||
|
||||
migrate_locale() {
|
||||
@ -411,7 +470,6 @@ pkg_postinst() {
|
||||
|
||||
enewgroup input
|
||||
enewgroup systemd-journal
|
||||
newusergroup systemd-bus-proxy
|
||||
newusergroup systemd-coredump
|
||||
newusergroup systemd-journal-gateway
|
||||
newusergroup systemd-journal-remote
|
||||
@ -440,11 +498,6 @@ pkg_postinst() {
|
||||
eerror "systemd again."
|
||||
eerror
|
||||
fi
|
||||
|
||||
if [[ $(readlink "${ROOT}"etc/resolv.conf) == */run/systemd/* ]]; then
|
||||
ewarn "You should replace the resolv.conf symlink:"
|
||||
ewarn "ln -snf ${ROOTPREFIX-/usr}/lib/systemd/resolv.conf ${ROOT}etc/resolv.conf"
|
||||
fi
|
||||
}
|
||||
|
||||
pkg_prerm() {
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user