Merge pull request #32498 from DaanDeMeyer/mkosi

mkosi: Set CleanPackageMetadata=yes for minimal-base

mkosi.images/minimal-base/mkosi.conf

@@ -7,6 +7,7 @@ Format=directory
 Bootable=no
 @Locale=C.UTF-8
 WithDocs=no
+CleanPackageMetadata=yes
 
 BuildSources=
 Packages=

src/libsystemd/sd-daemon/sd-daemon.c

@@ -513,16 +513,6 @@ static int pid_notify_with_fds_internal(
         }
 
         if (address.sockaddr.sa.sa_family == AF_VSOCK) {
-                /* If we shut down a virtual machine the kernel might not flush the buffers of the vsock
-                 * socket before shutting down. Set SO_LINGER so that we wait until the buffers are flushed
-                 * when the socket is closed. */
-                struct linger l = {
-                        .l_onoff = true,
-                        .l_linger = 10,
-                };
-                if (setsockopt(fd, SOL_SOCKET, SO_LINGER, &l, sizeof(l)) < 0)
-                        log_debug_errno(errno, "Failed to set SO_LINGER on vsock notify socket, ignoring: %m");
-
                 r = vsock_bind_privileged_port(fd);
                 if (r < 0 && !ERRNO_IS_PRIVILEGE(r))
                         return log_debug_errno(r, "Failed to bind socket to privileged port: %m");
@@ -604,6 +594,19 @@ static int pid_notify_with_fds_internal(
                 }
         } while (!iovec_increment(msghdr.msg_iov, msghdr.msg_iovlen, n));
 
+        if (address.sockaddr.sa.sa_family == AF_VSOCK && IN_SET(type, SOCK_STREAM, SOCK_SEQPACKET)) {
+                /* For AF_VSOCK, we need to close the socket to signal the end of the message. */
+                if (shutdown(fd, SHUT_WR) < 0)
+                        return log_error_errno(errno, "Failed to shutdown notify socket: %m");
+
+                char buf[1];
+                n = recv(fd, buf, sizeof(buf), MSG_NOSIGNAL);
+                if (n > 0)
+                        return log_error_errno(errno, "Unexpectedly received data on notify socket: %m");
+                if (n < 0)
+                        return log_error_errno(errno, "Failed to wait for EOF on notify socket: %m");
+        }
+
         return 1;
 }
 

test/units/testsuite-50.dissect.sh

@@ -670,8 +670,8 @@ systemctl stop test-root-ephemeral
 timeout 10 bash -c 'until test -z "$(ls -A /var/lib/systemd/ephemeral-trees)"; do sleep .5; done'
 test ! -f /tmp/img/abc
 
-systemd-dissect --mtree /tmp/img
-systemd-dissect --list /tmp/img
+systemd-dissect --mtree /tmp/img >/dev/null
+systemd-dissect --list /tmp/img >/dev/null
 
 read -r SHA256SUM1 _ < <(systemd-dissect --copy-from /tmp/img etc/os-release | sha256sum)
 test "$SHA256SUM1" != ""

test/units/testsuite-50.mountnfsd.sh

@@ -45,7 +45,7 @@ SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs \
 systemd-dissect --rmdir --umount /tmp/unpriv/mount
 
 systemd-dissect --image-policy='root=unprotected:=absent+unused' /var/tmp/unpriv.raw
-systemd-dissect --image-policy='root=unprotected:=absent+unused' --mtree /var/tmp/unpriv.raw | tee /tmp/unpriv.raw.mtree
+systemd-dissect --image-policy='root=unprotected:=absent+unused' --mtree /var/tmp/unpriv.raw >/tmp/unpriv.raw.mtree
 
 # Run unpriv, should fail due to lack of privs
 (! runas testuser systemd-dissect /var/tmp/unpriv.raw)
@@ -65,7 +65,7 @@ cp /tmp/test-50-unpriv-cert.crt /run/verity.d
 
 # Now run unpriv again, should be OK now.
 runas testuser systemd-dissect /var/tmp/unpriv.raw
-runas testuser systemd-dissect --mtree /var/tmp/unpriv.raw | tee /tmp/unpriv2.raw.mtree
+runas testuser systemd-dissect --mtree /var/tmp/unpriv.raw >/tmp/unpriv2.raw.mtree
 
 # Check that unpriv and priv run yielded same results
 cmp /tmp/unpriv.raw.mtree /tmp/unpriv2.raw.mtree