linux/poky.git/meta/recipes-core/systemd, branch styhead-5.1.3

systemd: set CVE_PRODUCT

2025-02-12T14:29:33+00:00

systemd.inc is used by systemd, systemd-boot and systemd-tools-native recipes so make sure all match to "systemd" product in CVE database. The split between systemd, systemd-boot and systemd-tools-native is specific to oe-core and upstream just refers to systemd. Not limiting to "systemd_project" vendor since multiple vendor names have been used in the past. (From OE-Core rev: d92c1ca1c89f140a731aec9f3389c2dad2f59829) Signed-off-by: Mikko Rapeli Signed-off-by: Richard Purdie (cherry picked from commit eb46ad379170f0a80ac2d061fa02c118f5ed1d31) Signed-off-by: Steve Sakoman

systemd-boot: drop intltool-native from DEPENDS

2024-12-17T20:58:11+00:00

intltool was dropped as a dependency in v236 See commit for reference: https://github.com/systemd/systemd/pull/7313/commits/c81217920effddc93fb780cf8f9eb699d6fe1319 (From OE-Core rev: 0df327ea64ec6a9e99c8f96e1dab52d3db3711b3) Signed-off-by: Guðni Már Gilbert Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

systemd: drop intltool-native from DEPENDS

2024-12-17T20:58:11+00:00

intltool was dropped as a dependency in v236 See commit for reference: https://github.com/systemd/systemd/pull/7313/commits/c81217920effddc93fb780cf8f9eb699d6fe1319 (From OE-Core rev: 5c6254279c8b7faf76809024ebbc02856030179e) Signed-off-by: Guðni Már Gilbert Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

systemd: fix broken links for sysvinit-compatible commands

2024-11-30T13:41:59+00:00

Since commit[1], PACKAGECONFIG[sysvinit] is not enabled by default when sysvinit is not in DISTRO_FEATURES, which causes the following sysvinit-compatible commands/services to not be built and installed: runlevel telinit rc-local.service systemd-initctl systemd-initctl.service systemd-rc-local-generator systemd-sysv-generator systemd-update-utmp-runlevel.service Therefore, links to these commands/services should only be created when PACKAGECONFIG[sysvinit] is enabled. [1] https://git.openembedded.org/openembedded-core/commit/?id=3668235fd60a9027608f37251c4b453ed21b3687 (From OE-Core rev: 681e3d20c2ac16778e302b468ec278aed9562639) Signed-off-by: Yi Zhao Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit a20b698f1acdee972cf1ff570b09a2e2c36bef1a) Signed-off-by: Steve Sakoman

systemd: add missing dependency on libkmod to udev

2024-09-13T06:15:49+00:00

As of systemd 256, libsystemd-shared.so doesn't directly link to a number of libraries but instead dlopen()'s them as needed to reduce the size of the attack surface. Instead the .so has a .note.dlopen segment that lists the libraries that may be opened, with the intention that these are transformed into package recommendation fields. We don't yet have support for these (see #15595) so explicit dependencies have been added to the systemd package itself. However, in an initramfs with udev but without systemd and no recommendations you end up without libkmod, so module loading is impossible. Add an explicit hard dependency on libkmod to udev, because modules are critical functionality. (From OE-Core rev: 12fadefe11ed9f09171087608c3c4b83c7302b3f) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

systemd: include sysvinit in default PACKAGECONFIG only if in DISTRO_FEATURES

2024-09-13T06:15:49+00:00

The sysvinit PACKAGECONFIG knob enables various legacy/compatibility code that may not be needed or even desired. If DISTRO_FEATURES includes systemd (as it must for this recipe to build) but not sysvinit, there is no point building and installing that legacy support. As most other changes, this can cause breakage, but given that sysvinit not being in DISTRO_FEATURES requires explicit opt-out (due to backfill), I think the risk is low. Moreover, it is generally easier to add to than to remove from PACKAGECONFIG. (From OE-Core rev: 3668235fd60a9027608f37251c4b453ed21b3687) Signed-off-by: Rasmus Villemoes Signed-off-by: Richard Purdie

systemd: make home directory readable by systemd-coredump

2024-09-09T16:04:15+00:00

In https://github.com/systemd/systemd/commit/924453c22599cc246746a0233b2f52a27ade0819 ProtectHome was set to true for systemd-coredump in order to reduce risk, since an attacker could craft a malicious binary in order to compromise systemd-coredump. At that point the object analysis was done in the main systemd-coredump process. Because of this systemd-coredump is unable to product symbolicated call-stacks for binaries running under /home ("n/a" is shown instead of function names). However, later in https://github.com/systemd/systemd/commit/61aea456c12c54f49c4a76259af130e576130ce9 systemd-coredump was changed to do the object analysis in a forked process, covering those security concerns. Let's set ProtectHome to read-only so that systemd-coredump produces symbolicated call-stacks for processes running under /home. Note: it still does not work in /tmp (because of PrivateTmp=yes) and in /root (for unknown reasons). Before the change (with minidebuginfo enabled): root@qemux86-64:~# /home/sleep 1000 & [1] 426 root@qemux86-64:~# kill -11 $(pidof sleep) root@qemux86-64:~# coredumpctl info PID: 426 (sleep) UID: 0 (root) GID: 0 (root) Signal: 11 (SEGV) Timestamp: Fri 2024-09-06 17:25:18 UTC (3s ago) Command Line: /home/sleep 1000 Executable: /home/sleep Control Group: /system.slice/system-serial\x2dgetty.slice/serial-getty@ttyS0.service Unit: serial-getty@ttyS0.service Slice: system-serial\x2dgetty.slice Boot ID: 44ef4ddfaad249ceaa29d1e9f330d3b5 Machine ID: fb279f18f2c849c59768754c7a274ee3 Hostname: qemux86-64 Storage: /var/lib/systemd/coredump/core.sleep.0.44ef4ddfaad249ceaa29d1e9f330d3b5.426.1725643518000000.zst (present) Size on Disk: 16.5K Message: Process 426 (sleep) of user 0 dumped core. Stack trace of thread 426: #0 0x00007f365f3849a7 clock_nanosleep (libc.so.6 + 0xd49a7) #1 0x00007f365f38f667 __nanosleep (libc.so.6 + 0xdf667) #2 0x0000561fee703737 n/a (/home/sleep + 0x7737) #3 0x000000003a6227c5 n/a (n/a + 0x0) ELF object binary architecture: AMD x86-64 [1]+ Segmentation fault (core dumped) /home/sleep 1000 After the change (with minidebuginfo enabled): root@qemux86-64:~# /home/sleep 1000 & [1] 450 root@qemux86-64:~# kill -11 $(pidof sleep) root@qemux86-64:~# coredumpctl info PID: 450 (sleep) UID: 0 (root) GID: 0 (root) Signal: 11 (SEGV) Timestamp: Fri 2024-09-06 17:30:12 UTC (4s ago) Command Line: /home/sleep 1000 Executable: /home/sleep Control Group: /system.slice/system-serial\x2dgetty.slice/serial-getty@ttyS0.service Unit: serial-getty@ttyS0.service Slice: system-serial\x2dgetty.slice Boot ID: 44ef4ddfaad249ceaa29d1e9f330d3b5 Machine ID: fb279f18f2c849c59768754c7a274ee3 Hostname: qemux86-64 Storage: /var/lib/systemd/coredump/core.sleep.0.44ef4ddfaad249ceaa29d1e9f330d3b5.450.1725643812000000.zst (present) Size on Disk: 16.5K Message: Process 450 (sleep) of user 0 dumped core. Stack trace of thread 450: #0 0x00007f795dd689a7 clock_nanosleep (libc.so.6 + 0xd49a7) #1 0x00007f795dd73667 __nanosleep (libc.so.6 + 0xdf667) #2 0x0000561965c9d737 rpl_nanosleep (sleep + 0x7737) #3 0x0000561965c9d0c1 xnanosleep (sleep + 0x70c1) #4 0x0000561965c985c8 main (sleep + 0x25c8) #5 0x00007f795dcba01b __libc_start_call_main (libc.so.6 + 0x2601b) #6 0x00007f795dcba0d9 __libc_start_main (libc.so.6 + 0x260d9) #7 0x0000561965c98685 _start (sleep + 0x2685) ELF object binary architecture: AMD x86-64 [1]+ Segmentation fault (core dumped) /home/sleep 1000 (From OE-Core rev: b8c1f999038b7cd6fc2e80ed215541c8a4d9e19f) Signed-off-by: Etienne Cordonnier Signed-off-by: Richard Purdie

systemd: Remove a leftover reference to ${datadir}/mime

2024-09-05T20:48:47+00:00

${MIMEDIR} (aka ${datadir}/mime) is packaged in ${PN}-mime and the reference to ${datadir}/mime/packages/io.systemd.xml for FILES:${PN} should have been removed in commit 5560243137f772683e53b614f134dd632b62be8b. (From OE-Core rev: 3dba1443ef123714a4b1c77ade1ea3b2d0ad3f21) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie

systemd: dont set polkit permissions manually

2024-09-01T11:28:10+00:00

According to this commit polkit rules should go to ${datadir} instead of ${sysconfdir}: https://git.openembedded.org/meta-openembedded/commit/?h=master-next&id=d5e90541f8e35916abc930b2da6de037b23d51a1 Theres no need to adjust the permissions for ${datadir} anymore: https://git.openembedded.org/meta-openembedded/commit/?h=master-next&id=6da0fd21c900e32a0693a6b27d38182f19c8c76c Dont set polkit permissions manually. This allows to drop the manually set polkit permissions for all files in meta-openembedded and also for libvirt in meta-virtualization. In addition, manually setting the permissions would not be needed for new recipes anymore. (From OE-Core rev: d27961962d2c8456d9a90148943d4282494146c2) Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

bitbake.conf: drop VOLATILE_TMP_DIR, use FILESYSTEM_PERMS_TABLES instead

2024-08-28T08:14:26+00:00

* Drop VOLATILE_TMP_DIR, use FILESYSTEM_PERMS_TABLES instead. By default, FILESYSTEM_PERMS_TABLES ?= "files/fs-perms.txt \ files/fs-perms-volatile-log.txt \ files/fs-perms-volatile-tmp.txt" it contains 'files/fs-perms-volatile-tmp.txt', which means volatile tmp is enabled. User can disable volatile tmp by remove 'files/fs-perms-volatile-tmp.txt' from FILESYSTEM_PERMS_TABLES. * If volatile tmp is disabled, both /tmp and /var/tmp are persistent (From OE-Core rev: 8d1ae67b89c45f78162e070228086c7ef88c3264) Signed-off-by: Changqing Li Signed-off-by: Richard Purdie