From 9a7c5c5eaad09d4c1cdc505ff41ac7b07f18b4a5 Mon Sep 17 00:00:00 2001 From: nikstur Date: Wed, 11 Sep 2024 17:49:48 +0200 Subject: [PATCH 1/7] systemd: use stripExclude instead of manual workaround --- pkgs/os-specific/linux/systemd/default.nix | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 964ebdf07d2b..013ae4ef9df8 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -857,11 +857,7 @@ stdenv.mkDerivation (finalAttrs: { # Avoid *.EFI binary stripping. # At least on aarch64-linux strip removes too much from PE32+ files: # https://github.com/NixOS/nixpkgs/issues/169693 - # The hack is to move EFI file out of lib/ before doStrip run and return it - # after doStrip run. - preFixup = lib.optionalString withBootloader '' - mv $out/lib/systemd/boot/efi $out/dont-strip-me - ''; + stripExclude = [ "lib/systemd/boot/efi/*" ]; # Wrap in the correct path for LUKS2 tokens. postFixup = @@ -871,9 +867,6 @@ stdenv.mkDerivation (finalAttrs: { wrapProgram $out/$f --prefix LD_LIBRARY_PATH : ${placeholder "out"}/lib/cryptsetup done '' - + lib.optionalString withBootloader '' - mv $out/dont-strip-me $out/lib/systemd/boot/efi - '' + lib.optionalString withUkify '' # To cross compile a derivation that builds a UKI with ukify, we need to wrap # ukify with the correct binutils. When wrapping, no splicing happens so we From 863d1924d31f19a0a252700b64b8e3c371d81f10 Mon Sep 17 00:00:00 2001 From: nikstur Date: Wed, 11 Sep 2024 18:02:55 +0200 Subject: [PATCH 2/7] systemd: consistently use lib.getOutput --- pkgs/os-specific/linux/systemd/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 013ae4ef9df8..e1bfa4431f28 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -488,8 +488,8 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonOption "sysvrcnd-path" "") # Login - (lib.mesonOption "sulogin-path" "${util-linux.login}/bin/sulogin") - (lib.mesonOption "nologin-path" "${util-linux.login}/bin/nologin") + (lib.mesonOption "sulogin-path" "${lib.getOutput "login" util-linux}/bin/sulogin") + (lib.mesonOption "nologin-path" "${lib.getOutput "login" util-linux}/bin/nologin") # Mount (lib.mesonOption "mount-path" "${lib.getOutput "mount" util-linux}/bin/mount") From 251a798347aba0d63861525b0eb2adc157e8f8bb Mon Sep 17 00:00:00 2001 From: nikstur Date: Wed, 25 Sep 2024 15:56:54 +0200 Subject: [PATCH 3/7] systemd: remove outdated comment --- pkgs/os-specific/linux/systemd/default.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index e1bfa4431f28..400febccc098 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -204,8 +204,6 @@ stdenv.mkDerivation (finalAttrs: { inherit pname; version = "258"; - # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly - # This has proven to be less error-prone than the previous systemd fork. src = fetchFromGitHub { owner = "systemd"; repo = "systemd"; From 04d41ccd9a4a4105ecf0c2902906c7e45dc5c027 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 12 Oct 2025 23:16:08 +0200 Subject: [PATCH 4/7] systemd: add withVConsole option --- pkgs/os-specific/linux/systemd/default.nix | 11 ++++++----- pkgs/top-level/all-packages.nix | 1 + 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 400febccc098..a10f411fb0f4 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -163,6 +163,7 @@ # on their live NixOS system, we disable it by default. withKernelInstall ? false, withLibarchive ? true, + withVConsole ? true, # tests assume too much system access for them to be feasible for us right now withTests ? false, # build only libudev and libsystemd @@ -466,10 +467,6 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonOption "pkgconfiglibdir" "${placeholder "dev"}/lib/pkgconfig") (lib.mesonOption "pkgconfigdatadir" "${placeholder "dev"}/share/pkgconfig") - # Keyboard - (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys") - (lib.mesonOption "setfont-path" "${kbd}/bin/setfont") - # SBAT (lib.mesonOption "sbat-distro" "nixos") (lib.mesonOption "sbat-distro-summary" "NixOS") @@ -571,6 +568,7 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonEnable "man" true) (lib.mesonEnable "nspawn" withNspawn) + (lib.mesonBool "vconsole" withVConsole) (lib.mesonBool "analyze" withAnalyze) (lib.mesonBool "logind" withLogind) (lib.mesonBool "localed" withLocaled) @@ -597,7 +595,10 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonBool "create-log-dirs" false) (lib.mesonBool "smack" true) (lib.mesonBool "b_pie" true) - + ] + ++ lib.optionals withVConsole [ + (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys") + (lib.mesonOption "setfont-path" "${kbd}/bin/setfont") ] ++ lib.optionals (withShellCompletions == false) [ (lib.mesonOption "bashcompletiondir" "no") diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 81bae1171116..5c1806a5c4ef 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -10351,6 +10351,7 @@ with pkgs; withVmspawn = false; withQrencode = false; withLibarchive = false; + withVConsole = false; }; systemdLibs = systemdMinimal.override { pname = "systemd-minimal-libs"; From 7dfac72d6716d3900b92471338c8c6c22d61677d Mon Sep 17 00:00:00 2001 From: nikstur Date: Mon, 13 Oct 2025 00:35:30 +0200 Subject: [PATCH 5/7] systemd: stop pulling in kmod when kmod is disabled --- pkgs/os-specific/linux/systemd/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index a10f411fb0f4..66cfdc554fe2 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -446,7 +446,6 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonOption "tty-gid" "3") # tty in NixOS has gid 3 (lib.mesonOption "pamconfdir" "${placeholder "out"}/etc/pam.d") (lib.mesonOption "shellprofiledir" "${placeholder "out"}/etc/profile.d") - (lib.mesonOption "kmod-path" "${kmod}/bin/kmod") # /bin/sh is also the upstream default. Explicitly set this so that we're # independent of upstream changes to the default. @@ -600,6 +599,9 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys") (lib.mesonOption "setfont-path" "${kbd}/bin/setfont") ] + ++ lib.optionals withKmod [ + (lib.mesonOption "kmod-path" "${kmod}/bin/kmod") + ] ++ lib.optionals (withShellCompletions == false) [ (lib.mesonOption "bashcompletiondir" "no") (lib.mesonOption "zshcompletiondir" "no") From 9b02e233422a6cf7869ba780f431a1aad1df3cd1 Mon Sep 17 00:00:00 2001 From: nikstur Date: Mon, 13 Oct 2025 00:34:49 +0200 Subject: [PATCH 6/7] systemdMinimal: disable more systemd features --- pkgs/top-level/all-packages.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 5c1806a5c4ef..c6fbba778db1 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -10352,6 +10352,11 @@ with pkgs; withQrencode = false; withLibarchive = false; withVConsole = false; + # withKmod = false; # breaks udevCheckHook of bcache-tools + withFirstboot = false; + withKexectools = false; + withLibseccomp = false; + withNspawn = false; }; systemdLibs = systemdMinimal.override { pname = "systemd-minimal-libs"; From 7081b4f992aad30f653c24bf3d353599f3384d86 Mon Sep 17 00:00:00 2001 From: nikstur Date: Mon, 13 Oct 2025 22:13:26 +0200 Subject: [PATCH 7/7] systemd: re-enable hardening flag The issue was fixed upstream in systemd according to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111523#c9 --- pkgs/os-specific/linux/systemd/default.nix | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 66cfdc554fe2..8a0724e0331e 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -327,17 +327,13 @@ stdenv.mkDerivation (finalAttrs: { separateDebugInfo = true; __structuredAttrs = true; - hardeningDisable = [ - # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111523 - "trivialautovarinit" - ] - ++ (lib.optionals withLibBPF [ + hardeningDisable = lib.optionals withLibBPF [ # breaks clang -target bpf; should be fixed to not use # a wrapped clang? "zerocallusedregs" "shadowstack" "pacret" - ]); + ]; nativeBuildInputs = [ pkg-config