diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/Manifest deleted file mode 100644 index 3ab21e1dc8..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/Manifest +++ /dev/null @@ -1,2 +0,0 @@ -DIST systemd-233-man.tar.gz 31386 SHA256 825e62eb82c4e23997061fc8f56f7ec9bb1e6ac1111d279c76c926cc2bfbf1dc SHA512 cc5215d3590ffc3c9203a64c14d6adeb0148c421c1396b8c1e43dcb58763b687ce99bdee327dd8a00abab7198171e73b22109a3f2032e4cec6adf2dcc85acf40 WHIRLPOOL ff1f36beff377f675047271df38503e8b71d615ea73c5fdfebf465edaf1fe29b4f89e3194d65cdf84eec9b7c3156de597627fdaffa4b86018520aaa127a7a159 -DIST systemd-233.tar.gz 4660737 SHA256 8b3e99da3d4164b66581830a7f2436c0c8fe697b5fbdc3927bdb960646be0083 SHA512 5ad5329ea116d973cf67096f7e7ad28e9ea0905696e9451291f1d25e5064f4a9bfcfae87e912996c6a38397e9f4a148d4ccecfa9b70f7ecdf04deadb61784c8e WHIRLPOOL ce19f6a546b8f899cfa952e49d47f063fd29186be4a53391bc30ea2c487eb2c140a74ad843a1dc499bb61bba3e9ca055613852291e38b85af5d79c59409dc176 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/218-Dont-enable-audit-by-default.patch b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/218-Dont-enable-audit-by-default.patch deleted file mode 100644 index f44b4be85d..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/218-Dont-enable-audit-by-default.patch +++ /dev/null @@ -1,30 +0,0 @@ -From: Martin Pitt -Date: Sun, 28 Dec 2014 12:49:35 +0100 -Subject: Don't enable audit by default - -It causes flooding of dmesg and syslog, suppressing actually important -messages. - -Don't enable it for now, until a better solution is found: -http://lists.freedesktop.org/archives/systemd-devel/2014-December/026591.html - -Bug-Debian: https://bugs.debian.org/773528 ---- - src/journal/journald-audit.c | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/src/journal/journald-audit.c b/src/journal/journald-audit.c -index 69742fa..25ef743 100644 ---- a/src/journal/journald-audit.c -+++ b/src/journal/journald-audit.c -@@ -542,10 +542,5 @@ int server_open_audit(Server *s) { - if (r < 0) - return log_error_errno(r, "Failed to add audit fd to event loop: %m"); - -- /* We are listening now, try to enable audit */ -- r = enable_audit(s->audit_fd, true); -- if (r < 0) -- log_warning_errno(r, "Failed to issue audit enable call: %m"); -- - return 0; - } diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/228-noclean-tmp.patch b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/228-noclean-tmp.patch deleted file mode 100644 index 769aa04ccf..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/228-noclean-tmp.patch +++ /dev/null @@ -1,28 +0,0 @@ -From b23c098d5787e06770872b19f83fffa14d8a7d14 Mon Sep 17 00:00:00 2001 -From: Mike Gilbert -Date: Fri, 25 Sep 2015 10:26:18 -0400 -Subject: [PATCH] tmpfiles: Disable cleaning of /tmp and /var/tmp - -Bug: https://bugs.gentoo.org/490676 ---- - tmpfiles.d/tmp.conf | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/tmpfiles.d/tmp.conf b/tmpfiles.d/tmp.conf -index 6bbd1aa..a361062 100644 ---- a/tmpfiles.d/tmp.conf -+++ b/tmpfiles.d/tmp.conf -@@ -8,8 +8,8 @@ - # See tmpfiles.d(5) for details - - # Clear tmp directories separately, to make them easier to override --q /tmp 1777 root root 10d --q /var/tmp 1777 root root 30d -+q /tmp 1777 root root -+q /var/tmp 1777 root root - - # Exclude namespace mountpoints created with PrivateTmp=yes - x /tmp/systemd-private-%b-* --- -2.4.10 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/233-systemd-user-pam.patch b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/233-systemd-user-pam.patch deleted file mode 100644 index eb2223e52f..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/233-systemd-user-pam.patch +++ /dev/null @@ -1,16 +0,0 @@ ---- a/src/login/systemd-user.m4 -+++ b/src/login/systemd-user.m4 -@@ -2,11 +2,7 @@ - # - # Used by systemd --user instances. - --account required pam_unix.so --m4_ifdef(`HAVE_SELINUX', --session required pam_selinux.so close --session required pam_selinux.so nottys open --)m4_dnl --session required pam_loginuid.so -+account include system-auth -+session include system-auth - session optional pam_keyinit.so force revoke - session optional pam_systemd.so diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/nsswitch.conf b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/nsswitch.conf deleted file mode 100644 index 00667c0c08..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/nsswitch.conf +++ /dev/null @@ -1,27 +0,0 @@ -# Sample nss configuration for systemd - -# systemd-specific modules -# See the manual pages fore further information. -# nss-myhostname - host resolution for the local hostname -# nss-mymachines - host, user, group resolution for containers -# nss-resolve - host resolution using resolved -# nss-systemd - dynamic user/group resolution (DynamicUser in unit files) - -passwd: compat mymachines systemd -shadow: compat -group: compat mymachines systemd -gshadow: files - -hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname -networks: files - -services: db files -protocols: db files -rpc: db files -ethers: db files -netmasks: files -netgroup: files -bootparams: files - -automount: files -aliases: files diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-9999.ebuild index 76a3dd24f6..dfc7caaeb0 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-9999.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-9999.ebuild @@ -3,17 +3,24 @@ EAPI=6 +CROS_WORKON_PROJECT="coreos/systemd" +CROS_WORKON_REPO="git://github.com" + if [[ ${PV} == 9999 ]]; then - EGIT_REPO_URI="https://github.com/systemd/systemd.git" - inherit git-r3 + # Use ~arch instead of empty keywords for compatibility with cros-workon + KEYWORDS="~amd64 ~arm64 ~arm ~x86" else - SRC_URI="https://github.com/systemd/systemd/archive/v${PV}.tar.gz -> ${P}.tar.gz - !doc? ( https://dev.gentoo.org/~floppym/dist/${P}-man.tar.gz )" - KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86" + CROS_WORKON_COMMIT="6b646f36fa62ec55660daab07ec5c347730f8469" # v233-coreos + KEYWORDS="~amd64 ~arm64 ~arm ~x86" fi PYTHON_COMPAT=( python{3_4,3_5,3_6} ) +# cros-workon must be imported first, in cases where cros-workon and +# another eclass exports the same function (say src_compile) we want +# the later eclass's version to win. Only need src_unpack from workon. +inherit cros-workon + inherit autotools bash-completion-r1 linux-info multilib-minimal pam python-any-r1 systemd toolchain-funcs udev user DESCRIPTION="System and service manager for Linux" @@ -25,6 +32,9 @@ IUSE="acl apparmor audit build cryptsetup curl doc elfutils +gcrypt gnuefi http idn importd +kmod +lz4 lzma nat pam policykit qrcode +seccomp selinux ssl sysv-utils test vanilla xkb" +# CoreOS specific use flags +IUSE+=" symlink-usr" + REQUIRED_USE="importd? ( curl gcrypt lzma )" MINKV="3.11" @@ -63,10 +73,7 @@ COMMON_DEPEND=">=sys-apps/util-linux-2.27.1:0=[${MULTILIB_USEDEP}] abi_x86_32? ( !<=app-emulation/emul-linux-x86-baselibs-20130224-r9 !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)] )" -# baselayout-2.2 has /run RDEPEND="${COMMON_DEPEND} - >=sys-apps/baselayout-2.2 - selinux? ( sec-policy/selinux-base-policy[systemd] ) !build? ( || ( sys-apps/util-linux[kill(-)] sys-process/procps[kill(+)] @@ -80,7 +87,6 @@ RDEPEND="${COMMON_DEPEND} # sys-apps/dbus: the daemon only (+ build-time lib dep for tests) PDEPEND=">=sys-apps/dbus-1.9.8[systemd] >=sys-apps/hwids-20150417[udev] - >=sys-fs/udev-init-scripts-25 policykit? ( sys-auth/polkit ) !vanilla? ( sys-apps/gentoo-systemd-integration )" @@ -142,23 +148,14 @@ pkg_setup() { src_unpack() { default - [[ ${PV} != 9999 ]] || git-r3_src_unpack + cros-workon_src_unpack } src_prepare() { # Bug 463376 sed -i -e 's/GROUP="dialout"/GROUP="uucp"/' rules/*.rules || die - - local PATCHES=( - ) - - if ! use vanilla; then - PATCHES+=( - "${FILESDIR}/218-Dont-enable-audit-by-default.patch" - "${FILESDIR}/228-noclean-tmp.patch" - "${FILESDIR}/233-systemd-user-pam.patch" - ) - fi + # Use the resolv.conf managed by systemd-resolved + sed -i -e 's,/usr/lib/systemd/resolv.conf,/run/systemd/resolve/resolv.conf,' tmpfiles.d/etc.conf.m4 || die [[ -d "${WORKDIR}"/patches ]] && PATCHES+=( "${WORKDIR}"/patches ) @@ -254,11 +251,23 @@ multilib_src_configure() { EFI_CC="$(tc-getCC)" # dbus paths - --with-dbuspolicydir="${EPREFIX}/etc/dbus-1/system.d" --with-dbussessionservicedir="${EPREFIX}/usr/share/dbus-1/services" --with-dbussystemservicedir="${EPREFIX}/usr/share/dbus-1/system-services" - --with-ntp-servers="0.gentoo.pool.ntp.org 1.gentoo.pool.ntp.org 2.gentoo.pool.ntp.org 3.gentoo.pool.ntp.org" + --with-ntp-servers="0.coreos.pool.ntp.org 1.coreos.pool.ntp.org 2.coreos.pool.ntp.org 3.coreos.pool.ntp.org" + + --with-pamconfdir=/usr/share/pam.d + + # The CoreOS epoch, Mon Jul 1 00:00:00 UTC 2013. Used by timesyncd + # as a sanity check for the minimum acceptable time. Explicitly set + # to avoid using the current build time. + --with-time-epoch=1372636800 + + # no default name servers + --with-dns-servers= + + # Breaks Docker + --with-default-hierarchy=legacy # Breaks screen, tmux, etc. --without-kill-user-processes @@ -322,19 +331,18 @@ multilib_src_install() { } multilib_src_install_all() { + local unitdir=$(systemd_get_systemunitdir) + prune_libtool_files --modules einstalldocs - dodoc "${FILESDIR}"/nsswitch.conf - - if [[ ${PV} != 9999 ]]; then - use doc || doman "${WORKDIR}"/man/systemd.{directives,index}.7 - fi if use sysv-utils; then + local prefix + use symlink-usr && prefix=/usr for app in halt poweroff reboot runlevel shutdown telinit; do - dosym "..${ROOTPREFIX-/usr}/bin/systemctl" /sbin/${app} + dosym "${ROOTPREFIX-/usr}/bin/systemctl" ${prefix}/sbin/${app} done - dosym "..${ROOTPREFIX-/usr}/lib/systemd/systemd" /sbin/init + dosym "${ROOTPREFIX-/usr}/lib/systemd/systemd" ${prefix}/sbin/init else # we just keep sysvinit tools, so no need for the mans rm "${D}"/usr/share/man/man8/{halt,poweroff,reboot,runlevel,shutdown,telinit}.8 \ @@ -342,21 +350,72 @@ multilib_src_install_all() { rm "${D}"/usr/share/man/man1/init.1 || die fi - # Preserve empty dirs in /etc & /var, bug #437008 - keepdir /etc/binfmt.d /etc/modules-load.d /etc/tmpfiles.d \ - /etc/systemd/ntp-units.d /etc/systemd/user /var/lib/systemd \ - /var/log/journal/remote + # Ensure journal directory has correct ownership/mode in inital image. + # This is fixed by systemd-tmpfiles *but* journald starts before that + # and will create the journal if the filesystem is already read-write. + # Conveniently the systemd Makefile sets this up completely wrong. + dodir /var/log/journal + fowners root:systemd-journal /var/log/journal + fperms 2755 /var/log/journal - # Symlink /etc/sysctl.conf for easy migration. - dosym ../sysctl.conf /etc/sysctl.d/99-sysctl.conf + systemd_dotmpfilesd "${FILESDIR}"/systemd-coreos.conf + systemd_dotmpfilesd "${FILESDIR}"/systemd-resolv.conf - # If we install these symlinks, there is no way for the sysadmin to remove them - # permanently. - rm "${D}"/etc/systemd/system/multi-user.target.wants/systemd-networkd.service || die - rm -f "${D}"/etc/systemd/system/multi-user.target.wants/systemd-resolved.service || die - rm -r "${D}"/etc/systemd/system/network-online.target.wants || die - rm -r "${D}"/etc/systemd/system/sockets.target.wants || die - rm -r "${D}"/etc/systemd/system/sysinit.target.wants || die + # Path masking and FEATURES aren't catching this + use doc || rm -r "${D}${ROOTPREFIX-/usr}/share/man" + + # Don't default to graphical.target + rm "${D}${unitdir}"/default.target || die + dosym multi-user.target "${unitdir}"/default.target + + # Don't set any extra environment variables by default + rm "${D}${ROOTPREFIX-/usr}/lib/environment.d/99-environment.conf" || die + + # Don't install the compatibility policy rules in /var (Fixed: @37377227) + rm "${D}"/var/lib/polkit-1/localauthority/10-vendor.d/systemd-networkd.pkla + rmdir "${D}"/var/lib/polkit-1{/localauthority{/10-vendor.d,},} + + # Move a few services enabled in /etc to /usr, delete files individually + # so builds fail if systemd adds any new unexpected stuff to /etc + local f + for f in \ + getty.target.wants/getty@tty1.service \ + multi-user.target.wants/machines.target \ + multi-user.target.wants/remote-fs.target \ + multi-user.target.wants/systemd-networkd.service \ + multi-user.target.wants/systemd-resolved.service \ + network-online.target.wants/systemd-networkd-wait-online.service \ + sockets.target.wants/systemd-networkd.socket \ + sysinit.target.wants/systemd-timesyncd.service + do + local s="${f#*/}" t="${f%/*}" + local u="${s/@*.service/@.service}" + + # systemd_enable_service doesn't understand template units + einfo "Enabling ${s} via ${t}" + dodir "${unitdir}/${t}" + dosym "../${u}" "${unitdir}/${t}/${s}" + + rm "${D}/etc/systemd/system/${f}" || die + done + f=dbus-org.freedesktop.resolve1.service + rm "${D}/etc/systemd/system/${f}" || die + dosym systemd-resolved.service "${unitdir}/${f}" + rmdir "${D}"/etc/systemd/system/*.wants || die + + # Do not enable random services if /etc was detected as empty!!! + rm "${D}"/usr/lib/systemd/system-preset/90-systemd.preset + insinto /usr/lib/systemd/system-preset + doins "${FILESDIR}"/99-default.preset + + # Disable the "First Boot Wizard" by default, it isn't very applicable to CoreOS + rm "${D}${unitdir}"/sysinit.target.wants/systemd-firstboot.service + + # Do not ship distro-specific files (nsswitch.conf pam.d) + rm -rf "${D}"/usr/share/factory + sed -i "${D}"/usr/lib/tmpfiles.d/etc.conf \ + -e '/^C \/etc\/nsswitch\.conf/d' \ + -e '/^C \/etc\/pam\.d/d' } migrate_locale() { @@ -411,7 +470,6 @@ pkg_postinst() { enewgroup input enewgroup systemd-journal - newusergroup systemd-bus-proxy newusergroup systemd-coredump newusergroup systemd-journal-gateway newusergroup systemd-journal-remote @@ -440,11 +498,6 @@ pkg_postinst() { eerror "systemd again." eerror fi - - if [[ $(readlink "${ROOT}"etc/resolv.conf) == */run/systemd/* ]]; then - ewarn "You should replace the resolv.conf symlink:" - ewarn "ln -snf ${ROOTPREFIX-/usr}/lib/systemd/resolv.conf ${ROOT}etc/resolv.conf" - fi } pkg_prerm() {