Daan De MeyerandClaude Opus 4.6
af5126568a
Both setup_boot_id() and setup_kmsg() previously created temporary files in /run, bind mounted them over their respective /proc targets, and then immediately unlinked the backing files. While the bind mount keeps the inode alive, the kernel marks the dentry as deleted. This is a problem because bind mounts backed by unlinked files cannot be replicated: both the old mount API (mount(MS_BIND)) and the new mount API (open_tree(OPEN_TREE_CLONE) + move_mount()) fail with ENOENT when the source mount references a deleted dentry. This affects mount_private_apivfs() in namespace.c, which needs to replicate these submounts when setting up a fresh /proc instance for services with ProtectProc= or similar sandboxing options — with an unlinked backing file, the boot_id submount simply gets lost. Fix this by using fixed paths (/run/proc-sys-kernel-random-boot-id and /run/proc-kmsg) instead of randomized tempfiles, and not unlinking them after the bind mount. The files live in /run which is cleaned up on shutdown anyway. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release