gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

systemd: drop most patches (#488508)

Browse Source
This commit is contained in:
Ryan Lahfa
2026-04-10 21:42:03 +00:00
committed by GitHub
parent 2ffd1496cd 61d3aeeea1
commit d3aa6844e5
16 changed files with 39 additions and 574 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/doc/manual/release-notes/rl-2605.section.md
+11
View File
@@ -135,6 +135,17 @@
- `services.pyload` has been removed because the package it relies on does not exist anymore in nixpkgs due to vulnerabilities and being unmaintained.
- Removed the ability from systemd to start units installed via `nix-env -i`.
This feature is hardly used and most units do not work without NixOS specific
changes anyways. Removing this allows us to drop a custom systemd patch
improving systemd maintainability and update speed.
- Removed the ability from systemd to depend on open-yet-unformatted dm-crypt
devices as systemd device units. For example you cannot call systemd-makefs
on such devices. This was never implemented upstream but patched into
Nixpkgs's systemd. Removing this allows us to drop a custom systemd patch
improving systemd maintainability and update speed.
- `linux_hardened` kernel has been removed due to a lack of maintenance.
- `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).
nixos/modules/system/boot/systemd.nix
+4
View File
@@ -604,6 +604,10 @@ in
environment.systemPackages = [ cfg.package ];
environment.variables = {
SYSTEMD_XKB_DIRECTORY = "/etc/X11/xkb";
};
environment.etc =
let
# generate contents for /etc/systemd/${dir} from attrset of links and packages
nixos/tests/systemd.nix
-12
View File
@@ -125,17 +125,6 @@
# wait for user services
machine.wait_for_unit("default.target", "alice")
with subtest("systemctl edit suggests --runtime"):
# --runtime is suggested when using `systemctl edit`
ret, out = machine.execute("systemctl edit testservice1.service 2>&1")
assert ret == 1
assert out.rstrip("\n") == "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead."
# editing w/o `--runtime` is possible for user-services, however
# it's not possible because we're not in a tty when grepping
# (i.e. hacky way to ensure that the error from above doesn't appear here).
_, out = machine.execute("systemctl --user edit testservice2.service 2>&1")
assert out.rstrip("\n") == "Cannot edit units interactively if not on a tty."
# Regression test for https://github.com/NixOS/nixpkgs/issues/105049
with subtest("systemd reads timezone database in /etc/zoneinfo"):
timer = machine.succeed("TZ=UTC systemctl show --property=TimersCalendar oncalendar-test.timer")
@@ -179,7 +168,6 @@
# Regression test for https://github.com/NixOS/nixpkgs/pull/91232
with subtest("setting transient hostnames works"):
machine.succeed("hostnamectl set-hostname --transient machine-transient")
machine.fail("hostnamectl set-hostname machine-all")
with subtest("systemd-shutdown works"):
machine.shutdown()
pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
-29
View File
@@ -1,29 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Tue, 8 Jan 2013 15:46:30 +0100
Subject: [PATCH] Start device units for uninitialised encrypted devices
This is necessary because the NixOS service that initialises the
filesystem depends on the appearance of the device unit. Also, this
makes more sense to me: the device is ready; it's the filesystem
that's not, but taking care of that is the responsibility of the mount
unit. (However, this ignores the fsck unit, so it's not perfect...)
---
rules.d/99-systemd.rules.in | 4 ----
1 file changed, 4 deletions(-)
diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
index bebc4d7d09..60278a0da7 100644
--- a/rules.d/99-systemd.rules.in
+++ b/rules.d/99-systemd.rules.in
@@ -30,10 +30,6 @@ SUBSYSTEM=="block", ACTION=="add", KERNEL=="dm-*", ENV{DM_NAME}!="?*", ENV{SYSTE
# Import previous SYSTEMD_READY state.
SUBSYSTEM=="block", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}=="", IMPORT{db}="SYSTEMD_READY"
-# Ignore encrypted devices with no identified superblock on it, since
-# we are probably still calling mke2fs or mkswap on it.
-SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
-
# Ignore raid devices that are not yet assembled and started
SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
-31
View File
@@ -1,31 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Wed, 16 Apr 2014 10:59:28 +0200
Subject: [PATCH] Fix NixOS containers
In NixOS containers, the init script is bind-mounted into the
container, so checking early whether it exists will fail.
---
src/nspawn/nspawn.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 84e94e845a..a0052c1c88 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -6368,6 +6368,7 @@ static int run(int argc, char *argv[]) {
goto finish;
}
} else {
+#if 0
_cleanup_free_ char *p = NULL;
if (arg_pivot_root_new)
@@ -6387,6 +6388,7 @@ static int run(int argc, char *argv[]) {
log_error_errno(r, "Unable to determine if %s looks like it has an OS tree (i.e. whether /usr/ exists): %m", arg_directory);
goto finish;
}
+#endif
}
if (userns_fd >= 0) {
pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
-129
View File
@@ -1,129 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Mon, 19 Jun 2023 02:13:42 +0200
Subject: [PATCH] Add some NixOS-specific unit directories
Look in `/nix/var/nix/profiles/default/lib/systemd/{system,user}` for
units provided by packages installed into the default profile via
`nix-env -iA nixos.$package`.
Also, remove /usr and /lib as these don't exist on NixOS.
Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
---
src/core/systemd.pc.in | 8 ++++----
src/libsystemd/sd-path/path-lookup.c | 20 +++-----------------
2 files changed, 7 insertions(+), 21 deletions(-)
diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
index 862d57dcb6..8ba0ca4486 100644
--- a/src/core/systemd.pc.in
+++ b/src/core/systemd.pc.in
@@ -46,10 +46,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
systemd_user_conf_dir=${sysconfdir}/systemd/user
systemduserconfdir=${systemd_user_conf_dir}
-systemd_system_unit_path=${systemd_system_conf_dir}:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:${systemd_system_unit_dir}:/usr/lib/systemd/system:/lib/systemd/system
+systemd_system_unit_path=${systemd_system_conf_dir}:/etc/systemd/system:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/system:${systemd_system_unit_dir}
systemdsystemunitpath=${systemd_system_unit_path}
-systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemd_user_unit_dir}:/usr/lib/systemd/user:/usr/share/systemd/user
+systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemd_user_unit_dir}
systemduserunitpath=${systemd_user_unit_path}
systemd_system_generator_dir=${prefix}/lib/systemd/system-generators
@@ -58,10 +58,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
systemdusergeneratordir=${systemd_user_generator_dir}
-systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:/usr/local/lib/systemd/system-generators:${systemd_system_generator_dir}
+systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:${systemd_system_generator_dir}
systemdsystemgeneratorpath=${systemd_system_generator_path}
-systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:/usr/local/lib/systemd/user-generators:${systemd_user_generator_dir}
+systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:${systemd_user_generator_dir}
systemdusergeneratorpath=${systemd_user_generator_path}
systemd_sleep_dir=${prefix}/lib/systemd/system-sleep
diff --git a/src/libsystemd/sd-path/path-lookup.c b/src/libsystemd/sd-path/path-lookup.c
index 32c14fb14a..7f0bf62844 100644
--- a/src/libsystemd/sd-path/path-lookup.c
+++ b/src/libsystemd/sd-path/path-lookup.c
@@ -102,11 +102,7 @@ int runtime_directory(RuntimeScope scope, const char *fallback_suffix, char **re
}
static const char* const user_data_unit_paths[] = {
- "/usr/local/lib/systemd/user",
- "/usr/local/share/systemd/user",
USER_DATA_UNIT_DIR,
- "/usr/lib/systemd/user",
- "/usr/share/systemd/user",
NULL
};
@@ -519,16 +515,13 @@ int lookup_paths_init(
persistent_config,
SYSTEM_CONFIG_UNIT_DIR,
"/etc/systemd/system",
+ "/nix/var/nix/profiles/default/lib/systemd/system",
ASSERT_PTR(persistent_attached),
ASSERT_PTR(runtime_config),
"/run/systemd/system",
ASSERT_PTR(runtime_attached),
STRV_IFNOTNULL(generator),
- "/usr/local/lib/systemd/system",
SYSTEM_DATA_UNIT_DIR,
- "/usr/lib/systemd/system",
- /* To be used ONLY for images which might be legacy split-usr */
- FLAGS_SET(flags, LOOKUP_PATHS_SPLIT_USR) ? "/lib/systemd/system" : STRV_IGNORE,
STRV_IFNOTNULL(generator_late));
break;
@@ -546,13 +539,10 @@ int lookup_paths_init(
add = strv_new(persistent_config,
USER_CONFIG_UNIT_DIR,
"/etc/systemd/user",
+ "/nix/var/nix/profiles/default/lib/systemd/user",
ASSERT_PTR(runtime_config),
"/run/systemd/user",
- "/usr/local/share/systemd/user",
- "/usr/share/systemd/user",
- "/usr/local/lib/systemd/user",
- USER_DATA_UNIT_DIR,
- "/usr/lib/systemd/user");
+ USER_DATA_UNIT_DIR);
break;
case RUNTIME_SCOPE_USER:
@@ -692,7 +682,6 @@ void lookup_paths_log(LookupPaths *lp) {
static const char* const system_generator_paths[] = {
"/run/systemd/system-generators",
"/etc/systemd/system-generators",
- "/usr/local/lib/systemd/system-generators",
SYSTEM_GENERATOR_DIR,
NULL,
};
@@ -700,7 +689,6 @@ static const char* const system_generator_paths[] = {
static const char* const user_generator_paths[] = {
"/run/systemd/user-generators",
"/etc/systemd/user-generators",
- "/usr/local/lib/systemd/user-generators",
USER_GENERATOR_DIR,
NULL,
};
@@ -708,7 +696,6 @@ static const char* const user_generator_paths[] = {
static const char* const system_env_generator_paths[] = {
"/run/systemd/system-environment-generators",
"/etc/systemd/system-environment-generators",
- "/usr/local/lib/systemd/system-environment-generators",
SYSTEM_ENV_GENERATOR_DIR,
NULL,
};
@@ -716,7 +703,6 @@ static const char* const system_env_generator_paths[] = {
static const char* const user_env_generator_paths[] = {
"/run/systemd/user-environment-generators",
"/etc/systemd/user-environment-generators",
- "/usr/local/lib/systemd/user-environment-generators",
USER_ENV_GENERATOR_DIR,
NULL,
};
pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
-28
View File
@@ -1,28 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Mon, 11 May 2015 15:39:38 +0200
Subject: [PATCH] Get rid of a useless message in user sessions
Namely lots of variants of
Unit nix-var-nix-db.mount is bound to inactive unit dev-disk-by\x2dlabel-nixos.device. Stopping, too.
in containers.
---
src/core/manager.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/core/manager.c b/src/core/manager.c
index 79fa19d976..2115d74595 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -1579,7 +1579,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
if (!unit_is_bound_by_inactive(u, &culprit))
continue;
- log_unit_debug(u, "Unit is stopped because bound to inactive unit %s.", culprit->id);
+ if (u->type != UNIT_MOUNT || detect_container() <= 0)
+ log_unit_debug(u, "Unit is stopped because bound to inactive unit %s.", culprit->id);
/* If stopping a unit fails continuously we might enter a stop loop here, hence stop acting on the
* service being unnecessary after a while. */
pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
-105
View File
@@ -1,105 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Gabriel Ebner <gebner@gebner.org>
Date: Sun, 6 Dec 2015 14:26:36 +0100
Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
system settings.
---
src/hostname/hostnamed.c | 6 ++++++
src/locale/localed.c | 9 +++++++++
src/timedate/timedated.c | 10 ++++++++++
3 files changed, 25 insertions(+)
diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
index 04c72e8137..1f9f296d56 100644
--- a/src/hostname/hostnamed.c
+++ b/src/hostname/hostnamed.c
@@ -1421,6 +1421,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
if (r < 0)
return r;
+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
+ "Changing system settings via systemd is not supported on NixOS.");
+
name = empty_to_null(name);
context_read_etc_hostname(c);
@@ -1487,6 +1490,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
if (r < 0)
return r;
+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
+ "Changing system settings via systemd is not supported on NixOS.");
+
name = empty_to_null(name);
context_read_machine_info(c);
diff --git a/src/locale/localed.c b/src/locale/localed.c
index 041ba29cd8..02fbe3e278 100644
--- a/src/locale/localed.c
+++ b/src/locale/localed.c
@@ -221,6 +221,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
use_localegen = locale_gen_check_available();
+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
+ "Changing system settings via systemd is not supported on NixOS.");
+
/* If single locale without variable name is provided, then we assume it is LANG=. */
if (strv_length(l) == 1 && !strchr(l[0], '=')) {
if (!locale_is_valid(l[0]))
@@ -338,6 +341,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
if (r < 0)
return bus_log_parse_error(r);
+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
+ "Changing system settings via systemd is not supported on NixOS.");
+
vc_context_empty_to_null(&in);
r = vc_context_verify_and_warn(&in, LOG_ERR, error);
@@ -455,6 +461,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
if (r < 0)
return bus_log_parse_error(r);
+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
+ "Changing system settings via systemd is not supported on NixOS.");
+
x11_context_empty_to_null(&in);
r = x11_context_verify_and_warn(&in, LOG_ERR, error);
diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
index 43cf3fddb9..1455830cba 100644
--- a/src/timedate/timedated.c
+++ b/src/timedate/timedated.c
@@ -680,6 +680,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
if (r < 0)
return r;
+ if (getenv("NIXOS_STATIC_TIMEZONE"))
+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
+ "Changing timezone via systemd is not supported when it is set in NixOS configuration.");
+
if (!timezone_is_valid(z, LOG_DEBUG))
return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
@@ -758,6 +762,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
if (r < 0)
return r;
+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
+ "Changing system settings via systemd is not supported on NixOS.");
+
if (lrtc == c->local_rtc && !fix_system)
return sd_bus_reply_method_return(m, NULL);
@@ -956,6 +963,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
if (r < 0)
return r;
+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
+ "Changing system settings via systemd is not supported on NixOS.");
+
r = context_update_ntp_status(c, bus, m);
if (r < 0)
return r;
pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
-24
View File
@@ -1,24 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Imuli <i@imu.li>
Date: Wed, 19 Oct 2016 08:46:47 -0400
Subject: [PATCH] localectl: use /etc/X11/xkb for list-x11-*
NixOS has an option to link the xkb data files to /etc/X11, but not to
/usr/share/X11.
---
src/locale/localectl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/locale/localectl.c b/src/locale/localectl.c
index 63703007ad..50def81940 100644
--- a/src/locale/localectl.c
+++ b/src/locale/localectl.c
@@ -295,7 +295,7 @@ static const char* xkb_directory(void) {
static const char *cached = NULL;
if (!cached)
- cached = secure_getenv("SYSTEMD_XKB_DIRECTORY") ?: "/usr/share/X11/xkb";
+ cached = secure_getenv("SYSTEMD_XKB_DIRECTORY") ?: "/etc/X11/xkb";
return cached;
}
pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
-23
View File
@@ -1,23 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Nikolay Amiantov <ab@fmap.me>
Date: Thu, 25 Jul 2019 20:45:55 +0300
Subject: [PATCH] systemd-shutdown: execute scripts in
/etc/systemd/system-shutdown
This is needed for NixOS to use such scripts as systemd directory is immutable.
---
src/shutdown/shutdown.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
index fc6df238be..cb8b45a41b 100644
--- a/src/shutdown/shutdown.c
+++ b/src/shutdown/shutdown.c
@@ -330,6 +330,7 @@ static void notify_supervisor(void) {
int main(int argc, char *argv[]) {
static const char* const dirs[] = {
SYSTEM_SHUTDOWN_PATH,
+ "/etc/systemd/system-shutdown",
NULL
};
_cleanup_free_ char *cgroup = NULL;
pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-22
View File
@@ -1,22 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Nikolay Amiantov <ab@fmap.me>
Date: Thu, 25 Jul 2019 20:46:58 +0300
Subject: [PATCH] systemd-sleep: execute scripts in /etc/systemd/system-sleep
This is needed for NixOS to use such scripts as systemd directory is immutable.
---
src/sleep/sleep.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
index 43aaede5b0..a8e5a75e39 100644
--- a/src/sleep/sleep.c
+++ b/src/sleep/sleep.c
@@ -248,6 +248,7 @@ static int execute(
};
static const char* const dirs[] = {
SYSTEM_SLEEP_PATH,
+ "/etc/systemd/system-sleep",
NULL
};
pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
-39
View File
@@ -1,39 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Yuriy Taraday <yorik.sar@gmail.com>
Date: Fri, 17 Jun 2022 12:45:10 +0000
Subject: [PATCH] inherit systemd environment when calling generators.
Systemd generators need access to the environment configured in
stage-2-init.sh since it schedules fsck and mkfs executions based on
being able to find an appropriate binary for the target filesystem.
With this commit I am altering the systemd behaviour since upstream
tries to gather environments with that they call
"environment-generators" and then seems to pass that on to all the other
executables that are being called from managers.
---
src/core/manager.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/core/manager.c b/src/core/manager.c
index 2115d74595..86f697313b 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -3999,9 +3999,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
* adjust generated units to that. Let's pass down some bits of information that are easy for us to
* determine (but a bit harder for generator scripts to determine), as environment variables. */
+ // On NixOS we must propagate PATH to generators so they are
+ // able to find binaries such as `fsck.${fstype}` and
+ // `mkfs.${fstype}`. That is why we ignore transient_environment that
+ // overrides the PATH variable. This propagates systemd's
+ // environment (e.g. PATH) that was setup
+ // before calling systemd from stage-2-init.sh.
+#if 0
nl = strv_copy(m->transient_environment);
if (!nl)
return -ENOMEM;
+#endif
r = strv_env_assign(&nl, "SYSTEMD_SCOPE", runtime_scope_to_string(m->runtime_scope));
if (r < 0)
pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
-41
View File
@@ -1,41 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sun, 15 Jan 2023 20:15:55 +0800
Subject: [PATCH] tpm2_context_init: fix driver name checking
https://github.com/systemd/systemd/commit/542dbc623e introduced
additional checks for tpm2 driver names, namely ensuring the driver
name, when concated with "libtss2-tcti-" and ".so.0", generates a valid
filename (with no '/' inside).
For example, if the driver is name "device", the line
fn = strjoina("libtss2-tcti-", driver, ".so.0")
would yield "libtss2-tcti-device.so.0", passing the check. And the
filename is then passed to dlopen for loading the driver.
Our current approach for systemd to correctly locate these dynamically
loaded libraries is to patch the filenames to include their absolute
path. Thus the line mentioned above is patched into
fn = strjoina("/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-", driver, ".so.0")
yielding "/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-device.so.0",
tripping the check.
This patch relaxes the check to also accept absolute paths, by replacing
filename_is_valid with path_is_valid.
---
src/shared/tpm2-util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
index 9e05c847ed..c0dd773eee 100644
--- a/src/shared/tpm2-util.c
+++ b/src/shared/tpm2-util.c
@@ -918,7 +918,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
return log_oom_debug();
/* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
- if (!filename_is_valid(fn))
+ if (!path_is_valid(fn))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
const char *dle = NULL;
pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
-45
View File
@@ -1,45 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 1 Sep 2023 09:57:02 +0200
Subject: [PATCH] systemctl-edit: suggest `systemdctl edit --runtime` on system
scope
This is a NixOS-specific change. When trying to modify a unit with
`systemctl edit` on NixOS, it'll fail with "Read-only file system":
$ systemctl edit libvirtd
Failed to open "/etc/systemd/system/libvirtd.service.d/.#override.conffa9825a0c9a249eb": Read-only file system
This is because `/etc/systemd/system` is a symlink into the store. In
fact, I'd consider this a feature rather than a bug since this ensures I
don't introduce state imperatively.
However, people wrongly assume that it's not possible to edit units
ad-hoc and re-deploy their system for quick&dirty debugging where this
would be absolutely fine (and doable with `--runtime` which adds a
transient and non-persistent unit override in `/run`).
To make sure that people learn about it quicker, this patch
throws an error which suggests using `--runtime` when running
`systemctl edit` on the system scope.
For the user scope this isn't needed because user-level unit overrides
are written into `$XDG_CONFIG_HOME/systemd/user`.
---
src/systemctl/systemctl-edit.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
index a28180922a..22c9c8fdbd 100644
--- a/src/systemctl/systemctl-edit.c
+++ b/src/systemctl/systemctl-edit.c
@@ -336,6 +336,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
sd_bus *bus = NULL;
int r;
+ if (!arg_runtime && arg_runtime_scope == RUNTIME_SCOPE_SYSTEM)
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead.");
+
if (!on_tty() && !arg_stdin)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot edit units interactively if not on a tty.");
pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch
-29
View File
@@ -1,29 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Marie Ramlow <me@nycode.dev>
Date: Sun, 24 Nov 2024 20:04:35 +0100
Subject: [PATCH] meson: Don't link ssh dropins
---
meson.build | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meson.build b/meson.build
index 3672005d75..406be24b45 100644
--- a/meson.build
+++ b/meson.build
@@ -210,13 +210,13 @@ sshconfdir = get_option('sshconfdir')
if sshconfdir == ''
sshconfdir = sysconfdir / 'ssh/ssh_config.d'
endif
-conf.set10('LINK_SSH_PROXY_DROPIN', sshconfdir != 'no' and not sshconfdir.startswith('/usr/'))
+conf.set10('LINK_SSH_PROXY_DROPIN', 0)
sshdconfdir = get_option('sshdconfdir')
if sshdconfdir == ''
sshdconfdir = sysconfdir / 'ssh/sshd_config.d'
endif
-conf.set10('LINK_SSHD_USERDB_DROPIN', sshdconfdir != 'no' and not sshdconfdir.startswith('/usr/'))
+conf.set10('LINK_SSHD_USERDB_DROPIN', 0)
sshdprivsepdir = get_option('sshdprivsepdir')
conf.set10('CREATE_SSHDPRIVSEPDIR', sshdprivsepdir != 'no' and not sshdprivsepdir.startswith('/usr/'))
pkgs/os-specific/linux/systemd/default.nix
+24 -17
View File
@@ -215,6 +215,19 @@ stdenv.mkDerivation (finalAttrs: {
hash = "sha256-FUKj3lvjz8TIsyu8NyJYtiNele+1BhdJPdw7r7nW6as=";
};
# PATCH POLICY
#
# There are only two reasons we accept patches on systemd:
# 1. systemd functionality is fundamentally incompatible with how NixOS works
# and workarounds are not possible.
# 2. Hotfixes that we want to apply before they have reached a systemd branch
# we can use. If we come up with the fixes in Nixpkgs, they need to be
# reported upstream and the upstream issue needs to be linked in the
# commit message of the patch.
#
# Importantly, patches to improve usability, enable new features on NixOS or
# add entirely new features to systemd are not allowed.
# On major changes, or when otherwise required, you *must* :
# 1. reformat the patches,
# 2. `git am path/to/00*.patch` them into a systemd worktree,
@@ -224,27 +237,11 @@ stdenv.mkDerivation (finalAttrs: {
# Use `find . -name "*.patch" | sort` to get an up-to-date listing of all
# patches
patches = [
./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
./0003-Fix-NixOS-containers.patch
./0004-Add-some-NixOS-specific-unit-directories.patch
./0005-Get-rid-of-a-useless-message-in-user-sessions.patch
./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
./0008-localectl-use-etc-X11-xkb-for-list-x11.patch
./0009-add-rootprefix-to-lookup-dir-paths.patch
./0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
./0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
./0013-inherit-systemd-environment-when-calling-generators.patch
./0014-core-don-t-taint-on-unmerged-usr.patch
./0015-tpm2_context_init-fix-driver-name-checking.patch
./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
# systemd tries to link the systemd-ssh-proxy ssh config snippet with tmpfiles
# if the install prefix is not /usr, but that does not work for us
# because we include the config snippet manually
./0017-meson-Don-t-link-ssh-dropins.patch
]
++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -700,12 +697,22 @@ stdenv.mkDerivation (finalAttrs: {
# warning messages
postConfigure = ''
substituteInPlace config.h \
--replace-fail "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH"
--replace-fail "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH" \
--replace-fail "SYSTEM_SHUTDOWN_PATH" "_SYSTEM_SHUTDOWN_PATH" \
--replace-fail "SYSTEM_SLEEP_PATH" "_SYSTEM_SLEEP_PATH"
'';
env.NIX_CFLAGS_COMPILE = toString [
"-USYSTEMD_BINARY_PATH"
"-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
# This path is not exposed via meson
"-USYSTEM_SHUTDOWN_PATH"
"-DSYSTEM_SHUTDOWN_PATH=\"/etc/systemd/system-shutdown\""
# This path is not exposed via meson
"-USYSTEM_SLEEP_PATH"
"-DSYSTEM_SLEEP_PATH=\"/etc/systemd/system-sleep\""
];
doCheck = false;