sys-apps/systemd: apply CoreOS changes to the v233 ebuild

Changes include:

  * Add cros_workon bits
  * Define and use the symlink-usr flag
  * Drop SELinux policy and udev init scripts dependencies
  * Drop all patches since the source is from Git
  * Switch /etc/resolv.conf to the old one
  * Drop the D-Bus policy path to keep the default
  * Use CoreOS NTP servers
  * Install PAM files into /usr
  * Set the timesyncd epoch
  * Don't use default DNS servers
  * Use legacy cgroups (https://github.com/docker/docker/issues/28109)
  * Rewrite basically the entire install step
  * Drop the systemd-bus-proxy user since the program is long gone

sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/Manifest

@@ -1,2 +0,0 @@
-DIST systemd-233-man.tar.gz 31386 SHA256 825e62eb82c4e23997061fc8f56f7ec9bb1e6ac1111d279c76c926cc2bfbf1dc SHA512 cc5215d3590ffc3c9203a64c14d6adeb0148c421c1396b8c1e43dcb58763b687ce99bdee327dd8a00abab7198171e73b22109a3f2032e4cec6adf2dcc85acf40 WHIRLPOOL ff1f36beff377f675047271df38503e8b71d615ea73c5fdfebf465edaf1fe29b4f89e3194d65cdf84eec9b7c3156de597627fdaffa4b86018520aaa127a7a159
-DIST systemd-233.tar.gz 4660737 SHA256 8b3e99da3d4164b66581830a7f2436c0c8fe697b5fbdc3927bdb960646be0083 SHA512 5ad5329ea116d973cf67096f7e7ad28e9ea0905696e9451291f1d25e5064f4a9bfcfae87e912996c6a38397e9f4a148d4ccecfa9b70f7ecdf04deadb61784c8e WHIRLPOOL ce19f6a546b8f899cfa952e49d47f063fd29186be4a53391bc30ea2c487eb2c140a74ad843a1dc499bb61bba3e9ca055613852291e38b85af5d79c59409dc176

sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/218-Dont-enable-audit-by-default.patch

@@ -1,30 +0,0 @@
-From: Martin Pitt <martin.pitt@ubuntu.com>
-Date: Sun, 28 Dec 2014 12:49:35 +0100
-Subject: Don't enable audit by default
-
-It causes flooding of dmesg and syslog, suppressing actually important
-messages.
-
-Don't enable it for now, until a better solution is found:
-http://lists.freedesktop.org/archives/systemd-devel/2014-December/026591.html
-
-Bug-Debian: https://bugs.debian.org/773528
----
- src/journal/journald-audit.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/src/journal/journald-audit.c b/src/journal/journald-audit.c
-index 69742fa..25ef743 100644
---- a/src/journal/journald-audit.c
-+++ b/src/journal/journald-audit.c
-@@ -542,10 +542,5 @@ int server_open_audit(Server *s) {
-         if (r < 0)
-                 return log_error_errno(r, "Failed to add audit fd to event loop: %m");
- 
--        /* We are listening now, try to enable audit */
--        r = enable_audit(s->audit_fd, true);
--        if (r < 0)
--                log_warning_errno(r, "Failed to issue audit enable call: %m");
--
-         return 0;
- }

sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/228-noclean-tmp.patch

@@ -1,28 +0,0 @@
-From b23c098d5787e06770872b19f83fffa14d8a7d14 Mon Sep 17 00:00:00 2001
-From: Mike Gilbert <floppym@gentoo.org>
-Date: Fri, 25 Sep 2015 10:26:18 -0400
-Subject: [PATCH] tmpfiles: Disable cleaning of /tmp and /var/tmp
-
-Bug: https://bugs.gentoo.org/490676
----
- tmpfiles.d/tmp.conf | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tmpfiles.d/tmp.conf b/tmpfiles.d/tmp.conf
-index 6bbd1aa..a361062 100644
---- a/tmpfiles.d/tmp.conf
-+++ b/tmpfiles.d/tmp.conf
-@@ -8,8 +8,8 @@
- # See tmpfiles.d(5) for details
- 
- # Clear tmp directories separately, to make them easier to override
--q /tmp 1777 root root 10d
--q /var/tmp 1777 root root 30d
-+q /tmp 1777 root root
-+q /var/tmp 1777 root root
- 
- # Exclude namespace mountpoints created with PrivateTmp=yes
- x /tmp/systemd-private-%b-*
--- 
-2.4.10
-

sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/233-systemd-user-pam.patch

@@ -1,16 +0,0 @@
---- a/src/login/systemd-user.m4
-+++ b/src/login/systemd-user.m4
-@@ -2,11 +2,7 @@
- #
- # Used by systemd --user instances.
- 
--account required pam_unix.so
--m4_ifdef(`HAVE_SELINUX',
--session required pam_selinux.so close
--session required pam_selinux.so nottys open
--)m4_dnl
--session required pam_loginuid.so
-+account include system-auth
-+session include system-auth
- session optional pam_keyinit.so force revoke
- session optional pam_systemd.so

sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/files/nsswitch.conf

@@ -1,27 +0,0 @@
-# Sample nss configuration for systemd
-
-# systemd-specific modules
-# See the manual pages fore further information.
-# nss-myhostname - host resolution for the local hostname
-# nss-mymachines - host, user, group resolution for containers
-# nss-resolve - host resolution using resolved
-# nss-systemd - dynamic user/group resolution (DynamicUser in unit files)
-
-passwd:		compat mymachines systemd
-shadow:		compat
-group:		compat mymachines systemd
-gshadow:	files
-
-hosts:		files mymachines resolve [!UNAVAIL=return] dns myhostname
-networks:	files
-
-services:	db files
-protocols:	db files
-rpc:		db files
-ethers:		db files
-netmasks:	files
-netgroup:	files
-bootparams:	files
-
-automount:	files
-aliases:	files

sdk_container/src/third_party/coreos-overlay/sys-apps/systemd/systemd-9999.ebuild

@@ -3,17 +3,24 @@
 
 EAPI=6
 
+CROS_WORKON_PROJECT="coreos/systemd"
+CROS_WORKON_REPO="git://github.com"
+
 if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://github.com/systemd/systemd.git"
+	# Use ~arch instead of empty keywords for compatibility with cros-workon
-	inherit git-r3
+	KEYWORDS="~amd64 ~arm64 ~arm ~x86"
 else
-	SRC_URI="https://github.com/systemd/systemd/archive/v${PV}.tar.gz -> ${P}.tar.gz
+	CROS_WORKON_COMMIT="6b646f36fa62ec55660daab07ec5c347730f8469" # v233-coreos
-		!doc? ( https://dev.gentoo.org/~floppym/dist/${P}-man.tar.gz )"
+	KEYWORDS="~amd64 ~arm64 ~arm ~x86"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
 fi
 
 PYTHON_COMPAT=( python{3_4,3_5,3_6} )
 
+# cros-workon must be imported first, in cases where cros-workon and
+# another eclass exports the same function (say src_compile) we want
+# the later eclass's version to win. Only need src_unpack from workon.
+inherit cros-workon
+
 inherit autotools bash-completion-r1 linux-info multilib-minimal pam python-any-r1 systemd toolchain-funcs udev user
 
 DESCRIPTION="System and service manager for Linux"
@@ -25,6 +32,9 @@ IUSE="acl apparmor audit build cryptsetup curl doc elfutils +gcrypt gnuefi http
 	idn importd +kmod +lz4 lzma nat pam policykit
 	qrcode +seccomp selinux ssl sysv-utils test vanilla xkb"
 
+# CoreOS specific use flags
+IUSE+=" symlink-usr"
+
 REQUIRED_USE="importd? ( curl gcrypt lzma )"
 
 MINKV="3.11"
@@ -63,10 +73,7 @@ COMMON_DEPEND=">=sys-apps/util-linux-2.27.1:0=[${MULTILIB_USEDEP}]
 	abi_x86_32? ( !<=app-emulation/emul-linux-x86-baselibs-20130224-r9
 		!app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)] )"
 
-# baselayout-2.2 has /run
 RDEPEND="${COMMON_DEPEND}
-	>=sys-apps/baselayout-2.2
-	selinux? ( sec-policy/selinux-base-policy[systemd] )
 	!build? ( || (
 		sys-apps/util-linux[kill(-)]
 		sys-process/procps[kill(+)]
@@ -80,7 +87,6 @@ RDEPEND="${COMMON_DEPEND}
 # sys-apps/dbus: the daemon only (+ build-time lib dep for tests)
 PDEPEND=">=sys-apps/dbus-1.9.8[systemd]
 	>=sys-apps/hwids-20150417[udev]
-	>=sys-fs/udev-init-scripts-25
 	policykit? ( sys-auth/polkit )
 	!vanilla? ( sys-apps/gentoo-systemd-integration )"
 
@@ -142,23 +148,14 @@ pkg_setup() {
 
 src_unpack() {
 	default
-	[[ ${PV} != 9999 ]] || git-r3_src_unpack
+	cros-workon_src_unpack
 }
 
 src_prepare() {
 	# Bug 463376
 	sed -i -e 's/GROUP="dialout"/GROUP="uucp"/' rules/*.rules || die
-
+	# Use the resolv.conf managed by systemd-resolved
-	local PATCHES=(
+	sed -i -e 's,/usr/lib/systemd/resolv.conf,/run/systemd/resolve/resolv.conf,' tmpfiles.d/etc.conf.m4 || die
-	)
-
-	if ! use vanilla; then
-		PATCHES+=(
-			"${FILESDIR}/218-Dont-enable-audit-by-default.patch"
-			"${FILESDIR}/228-noclean-tmp.patch"
-			"${FILESDIR}/233-systemd-user-pam.patch"
-		)
-	fi
 
 	[[ -d "${WORKDIR}"/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
 
@@ -254,11 +251,23 @@ multilib_src_configure() {
 		EFI_CC="$(tc-getCC)"
 
 		# dbus paths
-		--with-dbuspolicydir="${EPREFIX}/etc/dbus-1/system.d"
 		--with-dbussessionservicedir="${EPREFIX}/usr/share/dbus-1/services"
 		--with-dbussystemservicedir="${EPREFIX}/usr/share/dbus-1/system-services"
 
-		--with-ntp-servers="0.gentoo.pool.ntp.org 1.gentoo.pool.ntp.org 2.gentoo.pool.ntp.org 3.gentoo.pool.ntp.org"
+		--with-ntp-servers="0.coreos.pool.ntp.org 1.coreos.pool.ntp.org 2.coreos.pool.ntp.org 3.coreos.pool.ntp.org"
+
+		--with-pamconfdir=/usr/share/pam.d
+
+		# The CoreOS epoch, Mon Jul  1 00:00:00 UTC 2013. Used by timesyncd
+		# as a sanity check for the minimum acceptable time. Explicitly set
+		# to avoid using the current build time.
+		--with-time-epoch=1372636800
+
+		# no default name servers
+		--with-dns-servers=
+
+		# Breaks Docker
+		--with-default-hierarchy=legacy
 
 		# Breaks screen, tmux, etc.
 		--without-kill-user-processes
@@ -322,19 +331,18 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	local unitdir=$(systemd_get_systemunitdir)
+
 	prune_libtool_files --modules
 	einstalldocs
-	dodoc "${FILESDIR}"/nsswitch.conf
-
-	if [[ ${PV} != 9999 ]]; then
-		use doc || doman "${WORKDIR}"/man/systemd.{directives,index}.7
-	fi
 
 	if use sysv-utils; then
+		local prefix
+		use symlink-usr && prefix=/usr
 		for app in halt poweroff reboot runlevel shutdown telinit; do
-			dosym "..${ROOTPREFIX-/usr}/bin/systemctl" /sbin/${app}
+			dosym "${ROOTPREFIX-/usr}/bin/systemctl" ${prefix}/sbin/${app}
 		done
-		dosym "..${ROOTPREFIX-/usr}/lib/systemd/systemd" /sbin/init
+		dosym "${ROOTPREFIX-/usr}/lib/systemd/systemd" ${prefix}/sbin/init
 	else
 		# we just keep sysvinit tools, so no need for the mans
 		rm "${D}"/usr/share/man/man8/{halt,poweroff,reboot,runlevel,shutdown,telinit}.8 \
@@ -342,21 +350,72 @@ multilib_src_install_all() {
 		rm "${D}"/usr/share/man/man1/init.1 || die
 	fi
 
-	# Preserve empty dirs in /etc & /var, bug #437008
+	# Ensure journal directory has correct ownership/mode in inital image.
-	keepdir /etc/binfmt.d /etc/modules-load.d /etc/tmpfiles.d \
+	# This is fixed by systemd-tmpfiles *but* journald starts before that
-		/etc/systemd/ntp-units.d /etc/systemd/user /var/lib/systemd \
+	# and will create the journal if the filesystem is already read-write.
-		/var/log/journal/remote
+	# Conveniently the systemd Makefile sets this up completely wrong.
+	dodir /var/log/journal
+	fowners root:systemd-journal /var/log/journal
+	fperms 2755 /var/log/journal
 
-	# Symlink /etc/sysctl.conf for easy migration.
+	systemd_dotmpfilesd "${FILESDIR}"/systemd-coreos.conf
-	dosym ../sysctl.conf /etc/sysctl.d/99-sysctl.conf
+	systemd_dotmpfilesd "${FILESDIR}"/systemd-resolv.conf
 
-	# If we install these symlinks, there is no way for the sysadmin to remove them
+	# Path masking and FEATURES aren't catching this
-	# permanently.
+	use doc || rm -r "${D}${ROOTPREFIX-/usr}/share/man"
-	rm "${D}"/etc/systemd/system/multi-user.target.wants/systemd-networkd.service || die
+
-	rm -f "${D}"/etc/systemd/system/multi-user.target.wants/systemd-resolved.service || die
+	# Don't default to graphical.target
-	rm -r "${D}"/etc/systemd/system/network-online.target.wants || die
+	rm "${D}${unitdir}"/default.target || die
-	rm -r "${D}"/etc/systemd/system/sockets.target.wants || die
+	dosym multi-user.target "${unitdir}"/default.target
-	rm -r "${D}"/etc/systemd/system/sysinit.target.wants || die
+
+	# Don't set any extra environment variables by default
+	rm "${D}${ROOTPREFIX-/usr}/lib/environment.d/99-environment.conf" || die
+
+	# Don't install the compatibility policy rules in /var  (Fixed: @37377227)
+	rm "${D}"/var/lib/polkit-1/localauthority/10-vendor.d/systemd-networkd.pkla
+	rmdir "${D}"/var/lib/polkit-1{/localauthority{/10-vendor.d,},}
+
+	# Move a few services enabled in /etc to /usr, delete files individually
+	# so builds fail if systemd adds any new unexpected stuff to /etc
+	local f
+	for f in \
+		getty.target.wants/getty@tty1.service \
+		multi-user.target.wants/machines.target \
+		multi-user.target.wants/remote-fs.target \
+		multi-user.target.wants/systemd-networkd.service \
+		multi-user.target.wants/systemd-resolved.service \
+		network-online.target.wants/systemd-networkd-wait-online.service \
+		sockets.target.wants/systemd-networkd.socket \
+		sysinit.target.wants/systemd-timesyncd.service
+	do
+		local s="${f#*/}" t="${f%/*}"
+		local u="${s/@*.service/@.service}"
+
+		# systemd_enable_service doesn't understand template units
+		einfo "Enabling ${s} via ${t}"
+		dodir "${unitdir}/${t}"
+		dosym "../${u}" "${unitdir}/${t}/${s}"
+
+		rm "${D}/etc/systemd/system/${f}" || die
+	done
+	f=dbus-org.freedesktop.resolve1.service
+	rm "${D}/etc/systemd/system/${f}" || die
+	dosym systemd-resolved.service "${unitdir}/${f}"
+	rmdir "${D}"/etc/systemd/system/*.wants || die
+
+	# Do not enable random services if /etc was detected as empty!!!
+	rm "${D}"/usr/lib/systemd/system-preset/90-systemd.preset
+	insinto /usr/lib/systemd/system-preset
+	doins "${FILESDIR}"/99-default.preset
+
+	# Disable the "First Boot Wizard" by default, it isn't very applicable to CoreOS
+	rm "${D}${unitdir}"/sysinit.target.wants/systemd-firstboot.service
+
+	# Do not ship distro-specific files (nsswitch.conf pam.d)
+	rm -rf "${D}"/usr/share/factory
+	sed -i "${D}"/usr/lib/tmpfiles.d/etc.conf \
+		-e '/^C \/etc\/nsswitch\.conf/d' \
+		-e '/^C \/etc\/pam\.d/d'
 }
 
 migrate_locale() {
@@ -411,7 +470,6 @@ pkg_postinst() {
 
 	enewgroup input
 	enewgroup systemd-journal
-	newusergroup systemd-bus-proxy
 	newusergroup systemd-coredump
 	newusergroup systemd-journal-gateway
 	newusergroup systemd-journal-remote
@@ -440,11 +498,6 @@ pkg_postinst() {
 		eerror "systemd again."
 		eerror
 	fi
-
-	if [[ $(readlink "${ROOT}"etc/resolv.conf) == */run/systemd/* ]]; then
-		ewarn "You should replace the resolv.conf symlink:"
-		ewarn "ln -snf ${ROOTPREFIX-/usr}/lib/systemd/resolv.conf ${ROOT}etc/resolv.conf"
-	fi
 }
 
 pkg_prerm() {