The test is flaky and times out lately in ppc64el CI runners:
exec-dynamicuser-statedir.service: Control group is empty.
exec-dynamicuser-statedir.service: User lookup succeeded: uid=65325 gid=65325
Test timeout when testing exec-dynamicuser-statedir.service
Bump the timeout also when in a CI, as they are often over subscribed
This no longer matched with any MSI Claw device after c65efd4145
("(hwdb) Update MSI Claw Entries") because of the modalias structure:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvrE1T52IMS.112:bd12/04/2025:br1.18:svnMicro-StarInternationalCo.,Ltd.:pnClaw8AI+A2VM:pvrREV1.0:rvnMicro-StarInternationalCo.,Ltd.:rnMS-1T52:rvrREV1.0:cvnMicro-StarInternationalCo.,Ltd.:ct30:cvrN/A:sku1T52.1:
Fix this by matching against board vendor field rather than system
vendor.
Reviewed-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
When libdevmapper is built without UDEV_SYNC_SUPPORT (e.g. on Alpine/postmarketOS),
it creates a device node under /dev/mapper/ instead of relying on udev to create a symlink.
Fixes the following build error:
```
ninja: job failed: cc (snip) -o test-bpf-restrict-fsaccess.p/src_test_test-bpf-restrict-fsaccess.c.o -c ../src/test/test-bpf-restrict-fsaccess.c
In file included from ../src/test/test-bpf-restrict-fsaccess.c:96:
src/bpf/restrict-fsaccess-skel.h:19:10: fatal error: restrict-fsaccess.bpf.skel.h: No such file or directory
19 | #include "restrict-fsaccess.bpf.skel.h" /* IWYU pragma: export */
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
ninja: subcommand failed
```
Follow-up for e6fc73350f.
The quota test takes ~30 seconds on my poor laptop, and randomly fails
with timeout. Let's extend the timeout and skip the test case when slow
tests are disabled.
lsns scans all of /proc/*/ns/* even when a single PID is specified which
can be racy. Let's just read and compare the procfs symlinks directly to
both avoid doing the whole procfs scan and to, hopefully, get rid of the
occasional test fail where lsns fails to resolve the namespace for the
"old" process:
[ 1517.791471] TEST-07-PID1.sh[22279]: + systemd-run --unit=oldservice --property=Type=notify --property=NotifyAccess=all --property=PrivateUsers=true --property=PrivateNetwork=true bash -c 'systemd-notify --ready; exec sleep>
[ 1517.839514] TEST-07-PID1.sh[22329]: Running as unit: oldservice.service; invocation ID: 840ba49490f349c8b3b2116a43fb6f54
[ 1517.840403] TEST-07-PID1.sh[22335]: ++ systemctl show oldservice -p MainPID
[ 1517.841707] TEST-07-PID1.sh[22336]: ++ awk -F= '{print $2}'
[ 1517.849691] TEST-07-PID1.sh[22279]: + OLD_PID=22330
[ 1517.849691] TEST-07-PID1.sh[22279]: + systemd-run --unit=newservice --property=Type=notify --property=NotifyAccess=all --property=UserNamespacePath=/proc/22330/ns/user --property=NetworkNamespacePath=/proc/22330/ns/net bas>
[ 1517.951239] TEST-07-PID1.sh[22337]: Running as unit: newservice.service; invocation ID: 515b7f71240344aba2864e8510a18cbf
[ 1517.951475] TEST-07-PID1.sh[22343]: ++ awk -F= '{print $2}'
[ 1517.951915] TEST-07-PID1.sh[22342]: ++ systemctl show newservice -p MainPID
[ 1517.972557] TEST-07-PID1.sh[22279]: + NEW_PID=22338
[ 1517.972696] TEST-07-PID1.sh[22344]: ++ lsns -p 22330 -o NS -t net -n
[ 1518.003546] TEST-07-PID1.sh[22345]: ++ lsns -p 22338 -o NS -t net -n
[ 1518.030831] TEST-07-PID1.sh[22279]: + assert_eq '' 4026532280
[ 1518.031106] TEST-07-PID1.sh[22348]: + set +ex
[ 1518.031106] TEST-07-PID1.sh[22348]: FAIL: expected: '4026532280' actual: ''
[ 1518.031342] TEST-07-PID1.sh[111]: + echo 'Subtest /usr/lib/systemd/tests/testdata/units/TEST-07-PID1.user-namespace-path.sh failed'
Also, don't swallow the exit code from the command substitution in case
readlink fails, which could lead to a false-positive test result if it
happened for both readlinks.
Resolves: #39546
On alpha '.set' is overridden to mean something else, so the build
fails:
/tmp/ccckEb4p.s:11442: Warning: Tried to .set unrecognized mode `sd_dlopen:[{"feature":"lzma","description":"Support lzma compression in journal and coredump files","priority":"suggested","soname":["liblzma.so.5"]}]'
/tmp/ccckEb4p.s:11442: Error: junk at end of line, first unrecognized character is `,'
Switch to '.equ' which seems to do the job just as well, and builds
on alpha too.
Follow-up for 56a7febca7
systemd-resolved has 2 contradictory ELF notes for libcrypto:
```
$ systemd-analyze dlopen-metadata /usr/lib/systemd/systemd-resolved
FEATURE DESCRIPTION SONAME PRIORITY
libcrypto Support for cryptographic operations libcrypto.so.3 recommended
idn Support for internationalized domain names libidn2.so.0 recommended
libcrypto Support for cryptographic operations libcrypto.so.3 required
libssl Support for TLS libssl.so.3 required
```
In order to have a single note, condition its priority based on whether
DNS-over-TLS is enabled.
Build packages on OBS against the PR and reports status back
to Github. This just builds the systemd package for now, next
step is to also build particleos images.
Like done in c7113f6b3c,
sometimes we want to create mkosi.local.conf in a sub-mkosi directory,
e.g. mkosi.tools.conf.d/mkosi.local.conf, and of course we should not
take these files into git repository.
* cde07547ab Update changelog for 261~rc3-1 release
* 13a29e5eda Drop unused Lintian overrides
* 84c4af7e23 Drop now-autogenerated dlopen recommends/suggests
* 76995069a0 Drop dlopen:Depends from libsystemd-dev
* 91bb1e5423 Add ${dlopen:Depends} placeholder to all packages shipping ELF binaries
* 7e333f2b9c Drop bpftool build-dep workaround for Jammy/Noble
* 8a17f61489 Update changelog for 261~rc2-1 release
* 58ad925b52 Drop patches, all merged upstream
* e53db5cc8f Move conflict with runit helper to sd-sysv
* adb081fde6 Workaround piuparts issue with / permissions
* 457f16e3cf Clean up autovt@ alias on purge
* bc0bd48fc8 Update changelog for 261~rc1-1 release
* 537d92f8ae Force linking against libm
* 87622cc5ee Backport patch to skip test-pressure in autopkgtest
* 5b7253e3f9 Update symbols file for new version
* bcf39279f8 Backport patch to fix unit test in gitlab CI
* e654d67b76 Install new files for upstream release
* 9b724fd2c1 Bump Standards-version to 4.7.4, no changes
The build dependency is dropped from the package as it breaks
resolute builds, pull in manually in jammy/noble, as it's
needed for the 'real' bpftool binary
* 60ed8c964f ubuntu: Don't treat linux-tools-xxx as a kernel package
* 24e5e532ab obs: enable PR CI workflow
* 5edcd2c5ca action: skip install of unavailable packages
* 4c18bc115b sandbox: Make seccomp work on alternative arches
* a91c8730e2 tests: Mark install tests and run them separately
* 923f72ea63 Fix linter unit tests at package build time
* 3f4bee3392 tests: Avoid leading underscore in helper function
* b2f04776c4 docs: Document debugging of failed sandbox commands
* 461a1dd290 run: Show complete sandbox command, factor out its logging
* d74c0b03d9 Don't add El Torito boot catalog for BIOS/grub images by default
* b0f9525c2c tests: Move unit tests from GitHub workflow into pytest
* 2889b5599b run: Add `cwd` kwarg to run()/spawn()
* 3f7de100b8 sandbox: Fix pyright "possibly unbound variable" errors
* 4cb9f337e2 gitignore: Add generated man pages and zipapp builddir
* 49c1c78f3f pytest: Restrict discovery to tests/
* a9d7ab5e64 finalize_scripts: tighten the PATH-strip condition to actual self-exec
* 145f4c259b sandbox: Add --debug option
* df43e4007d Mount /etc/resolv.conf symlink into sandbox
This has been observed to get stuck in an ASAN run, so wrap it
in a timeout call to at least get it to fail fast and hopefully
get better logs rather than a testbed timeout.
The measurement that systemd-pcrnvdone corresponds to
`src/pcrlock/pcrlock.d/770-nvpcr-separator.pcrlock`, and 770 is supposed to
happen in the initrd (which ends at 800).
- Add support for MSI Claw A8 BZ2EM.
- Switch to using rn vice pn as MSI uses a unique pn for variants of the
same model. This prevents needing to update this file when a low volume
variant is released (I.E. Polar White AI 8+).
A bind mount inherits the mount flags of the file system the source
directory resides on. For root=bind: the source typically lives below
/run/ (e.g. a freshly unpacked tar image in /run/machines/), which is
mounted nosuid,nodev, so those flags propagated to /sysroot and broke
suid binaries (e.g. sudo) and device nodes on the booted system.
Default bind root mounts to dev,suid,exec instead, unless the user
overrides this via rootflags=.
Fixes: https://github.com/systemd/systemd/issues/41352
Co-developed-by: Claude Opus 4.8 <noreply@anthropic.com>
keyfile-erase only erases a key file explicitly configured in the third
field of crypttab. Key files automatically discovered in
/etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/ are considered shared
resources not owned by an individual volume, and are never erased. Make
this explicit in the documentation and add a code comment clarifying the
intent.
Fixes: https://github.com/systemd/systemd/issues/41127
Co-developed-by: Claude Opus 4.8 <noreply@anthropic.com>
Since this was introduced I constantly find myself waiting for VMs to
shut down at the end of a test. This not only happens with mkosi
integration tests, but with other VM-based tests like for example
autopkgtest. In this example, this dracut test suite runtime is tripled
due to the artificial delay:
```
[ 5.813234] systemd-shutdown[1]: Syncing filesystems and block devices.
[ 5.814635] systemd-shutdown[1]: Delaying shutdown for 9s, in order to reach minimum uptime of 15s.
[ 8.816855] systemd-shutdown[1]: Delaying shutdown for 6s, in order to reach minimum uptime of 15s.
[ 11.819747] systemd-shutdown[1]: Delaying shutdown for 3s, in order to reach minimum uptime of 15s.
[ 14.822660] systemd-shutdown[1]: Delaying shutdown for 601ms, in order to reach minimum uptime of 15s.
[ 15.427777] systemd-shutdown[1]: Powering off.
[ 15.429681] sd 0:0:0:0: [sda] Synchronizing SCSI cache
[ 15.433620] ACPI: PM: Preparing to enter system sleep state S5
[ 15.435148] reboot: Power down
TEST: root filesystem on a ext4 filesystem with systemd and extensions [OK]
autopkgtest [19:39:12]: test 46-systemd-sysext: -----------------------]
autopkgtest [19:39:13]: test 46-systemd-sysext: - - - - - - - - - - results - - - - - - - - - -
46-systemd-sysext PASS
```
Contrary to what the comment claimed, the scrollback of a VM is _not_
cleared, EDK2 just prints many pages, and one can just scroll up (a
lot).
Do not delay by default on VMs. Move the check so that in both
containers and VMs users can override and force a delay with the env
var.
Follow-up for 0874eea302
$ mkdir /var/tmp/files
$ touch /var/tmp/files/a
$ mkdir /var/tmp/conf
$ cat >>/var/tmp/conf/esp.conf
[Partition]
Type=esp
Format=vfat
CopyFiles=/var/tmp/files:/
$ truncate /var/tmp/disk -s 300M
$ sudo systemd-repart --dry-run=no --empty=require --definitions=/var/tmp/conf /var/tmp/disk
...
Populating vfat filesystem.
Failed to copy '...' to '/run/systemd/mount-root/': Operation not permitted
(sd-copy) failed with exit status 1.
The issue is that if there's a file owned by non-root and we try to copy
it into a newly-created DOS partition, fchown fails:
fchown(11</run/systemd/mount-root/...>, 1000, 1000) = -1 EPERM (Operation not permitted)
We want to ignore file ownership in such cases, so pass our own UID/GID
to copy_tree_at(), which turns the fchown into a noop and let's the
operation pass through.
Fixes#38863.
I was running repart in a VM, and if failed because mkfs.vfat was
not available. But if fails quite late in the process, possibly wasting
quite a bit of work. So add a check that catches some obvious cases
where repart would fail.
The condition of whether we have the root directory is complex,
determined in part by partition_target_prepare(). I didn't think it
was worth it to recreate the full logic in the check, so in some cases
it'll not miss cases. But that's still better than having no check ;)
This was likely a typo as the other timeouts are '30' instead of '3'. This
test occasionally fails with sanitizers which make everything slow. Bump it
to 30s like other timeouts in the same test.
Follow-up for 985a6fa44b
Currently almost all the dlopens happen in libbasic or libshared code,
so the ELF dlopen notes all end up in libsystemd-shared. Many
distributions split this library and various binaries in separate
packages, and the library ends up with soft-dependencies, even though
many binaries are either completely useless or do not work at all with
the dlopen dependency. This also makes it impossible to know which
executable uses which dlopen dependency without inspecting the source
code.
If someone only wants to add the soft dependencies from libshared they
can just avoid parsing the executable binaries. By design the code in
libbasic/libshared still does the stamping too, at lower priorities, so
that libsystemd-shared will always list all the optional dependencies,
and if one wants to build a minimal system by default, they can just
parse libsystemd-shared dlopen notes, and ignore the individual
executables. But for many distribution the current setup is insufficient
and requires adding a ton of manual library dependencies, as many
executables become effectively broken or useless without the dlopen
dependencies installed (eg: resolved fails to start without libssl,
repart can do basically nothing without blkid, etc).
Add a new set of DLOPEN_<LIB> macros that wrap the dlopen_lib and also
pull in the ELF note voodoo, so that the callers get their ELF binaries
stamped too. Convert a bunch of callers to use the macro, and use
`required` dependencies for the callers that do not work without the
dlopen library being available.
The one caveat is that, in order to avoid duplicating the exact same
note in a binary due to multiple call sites, some `asm` voodoo is done
instead of the previous bare-C section-creating macro. The drawback of
this approach is that if `--gc-sections` is used to link the binary (as
we do), then binutils >= 2.36 is required for the `SHF_GNU_RETAIN` flag.
This effectively cuts off CentOS 9, so what I did here is adding an
override in meson to detect missing support, and drop `SHF_GNU_RETAIN`.
The build works, but on CentOS 9 there's no dlopen ELF notes anymore.
Given it's just that version, and it goes EOL next year, that seems ok
to me. The alternative is to drop the usage of `--gc-sections` on CentOS
9, or to accept duplicated notes everywhere, and both seem worse.
End result:
```
$ readelf --notes build/systemd-executor
Displaying notes found in: .note.gnu.property
Owner Data size Description
GNU 0x00000010 NT_GNU_PROPERTY_TYPE_0
Properties: x86 ISA needed: x86-64-baseline
Displaying notes found in: .note.gnu.build-id
Owner Data size Description
GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring)
Build ID: 8a0c3db54adb79ae54e1432255011aa4ab583742
Displaying notes found in: .note.ABI-tag
Owner Data size Description
GNU 0x00000010 NT_GNU_ABI_TAG (ABI version tag)
OS: Linux, ABI: 3.2.0
Displaying notes found in: .note.dlopen
Owner Data size Description
FDO 0x0000006b FDO_DLOPEN_METADATA
Dlopen Metadata: [{"feature":"pam","description":"Support for LinuxPAM","priority":"recommended","soname":["libpam.so.0"]}]
FDO 0x0000007c FDO_DLOPEN_METADATA
Dlopen Metadata: [{"feature":"seccomp","description":"Support for Seccomp Sandboxes","priority":"recommended","soname":["libseccomp.so.2"]}]
FDO 0x00000090 FDO_DLOPEN_METADATA
Dlopen Metadata: [{"feature":"bpf","description":"Support firewalling and sandboxing with BPF","priority":"recommended","soname":["libbpf.so.1","libbpf.so.0"]}]
FDO 0x000000a0 FDO_DLOPEN_METADATA
Dlopen Metadata: [{"feature":"cryptsetup","description":"Support for disk encryption, integrity, and authentication","priority":"recommended","soname":["libcryptsetup.so.12"]}]
FDO 0x00000078 FDO_DLOPEN_METADATA
Dlopen Metadata: [{"feature":"mount","description":"Support for mount enumeration","priority":"recommended","soname":["libmount.so.1"]}]
$ readelf --notes build/systemd
Displaying notes found in: .note.gnu.property
Owner Data size Description
GNU 0x00000010 NT_GNU_PROPERTY_TYPE_0
Properties: x86 ISA needed: x86-64-baseline
Displaying notes found in: .note.gnu.build-id
Owner Data size Description
GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring)
Build ID: dcd4568842e32da3e71be27db3def51c6b459994
Displaying notes found in: .note.ABI-tag
Owner Data size Description
GNU 0x00000010 NT_GNU_ABI_TAG (ABI version tag)
OS: Linux, ABI: 3.2.0
Displaying notes found in: .note.dlopen
Owner Data size Description
FDO 0x00000075 FDO_DLOPEN_METADATA
Dlopen Metadata: [{"feature":"mount","description":"Support for mount enumeration","priority":"required","soname":["libmount.so.1"]}]
FDO 0x00000072 FDO_DLOPEN_METADATA
Dlopen Metadata: [{"feature":"selinux","description":"Support for SELinux","priority":"recommended","soname":["libselinux.so.1"]}]
```
Lennart Poettering
Luca Boccassi
Марко Костић (Marko Kostić)
Martin Srebotnjak
Matthew Schwartz
Yu Watanabe
Frantisek Sumsal
Antonio Alvarez Feijoo
Valentin David
Moisticules
Derek J. Clark
AsciiWolf
Daan De Meyer
Zbigniew Jędrzejewski-Szmek
nikstur
