diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 576f3c6db4c4..d5a65d16fa33 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -135,6 +135,17 @@ - `services.pyload` has been removed because the package it relies on does not exist anymore in nixpkgs due to vulnerabilities and being unmaintained. +- Removed the ability from systemd to start units installed via `nix-env -i`. + This feature is hardly used and most units do not work without NixOS specific + changes anyways. Removing this allows us to drop a custom systemd patch + improving systemd maintainability and update speed. + +- Removed the ability from systemd to depend on open-yet-unformatted dm-crypt + devices as systemd device units. For example you cannot call systemd-makefs + on such devices. This was never implemented upstream but patched into + Nixpkgs's systemd. Removing this allows us to drop a custom systemd patch + improving systemd maintainability and update speed. + - `linux_hardened` kernel has been removed due to a lack of maintenance. - `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media). diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 750a462ad868..f00888b94c44 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -604,6 +604,10 @@ in environment.systemPackages = [ cfg.package ]; + environment.variables = { + SYSTEMD_XKB_DIRECTORY = "/etc/X11/xkb"; + }; + environment.etc = let # generate contents for /etc/systemd/${dir} from attrset of links and packages diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix index 98cc88a0326f..d04b3a374570 100644 --- a/nixos/tests/systemd.nix +++ b/nixos/tests/systemd.nix @@ -125,17 +125,6 @@ # wait for user services machine.wait_for_unit("default.target", "alice") - with subtest("systemctl edit suggests --runtime"): - # --runtime is suggested when using `systemctl edit` - ret, out = machine.execute("systemctl edit testservice1.service 2>&1") - assert ret == 1 - assert out.rstrip("\n") == "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead." - # editing w/o `--runtime` is possible for user-services, however - # it's not possible because we're not in a tty when grepping - # (i.e. hacky way to ensure that the error from above doesn't appear here). - _, out = machine.execute("systemctl --user edit testservice2.service 2>&1") - assert out.rstrip("\n") == "Cannot edit units interactively if not on a tty." - # Regression test for https://github.com/NixOS/nixpkgs/issues/105049 with subtest("systemd reads timezone database in /etc/zoneinfo"): timer = machine.succeed("TZ=UTC systemctl show --property=TimersCalendar oncalendar-test.timer") @@ -179,7 +168,6 @@ # Regression test for https://github.com/NixOS/nixpkgs/pull/91232 with subtest("setting transient hostnames works"): machine.succeed("hostnamectl set-hostname --transient machine-transient") - machine.fail("hostnamectl set-hostname machine-all") with subtest("systemd-shutdown works"): machine.shutdown() diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch deleted file mode 100644 index 02845eb126f6..000000000000 --- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Eelco Dolstra -Date: Tue, 8 Jan 2013 15:46:30 +0100 -Subject: [PATCH] Start device units for uninitialised encrypted devices - -This is necessary because the NixOS service that initialises the -filesystem depends on the appearance of the device unit. Also, this -makes more sense to me: the device is ready; it's the filesystem -that's not, but taking care of that is the responsibility of the mount -unit. (However, this ignores the fsck unit, so it's not perfect...) ---- - rules.d/99-systemd.rules.in | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in -index bebc4d7d09..60278a0da7 100644 ---- a/rules.d/99-systemd.rules.in -+++ b/rules.d/99-systemd.rules.in -@@ -30,10 +30,6 @@ SUBSYSTEM=="block", ACTION=="add", KERNEL=="dm-*", ENV{DM_NAME}!="?*", ENV{SYSTE - # Import previous SYSTEMD_READY state. - SUBSYSTEM=="block", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}=="", IMPORT{db}="SYSTEMD_READY" - --# Ignore encrypted devices with no identified superblock on it, since --# we are probably still calling mke2fs or mkswap on it. --SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0" -- - # Ignore raid devices that are not yet assembled and started - SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0" - SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0" diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch deleted file mode 100644 index fc80edc766cf..000000000000 --- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Eelco Dolstra -Date: Wed, 16 Apr 2014 10:59:28 +0200 -Subject: [PATCH] Fix NixOS containers - -In NixOS containers, the init script is bind-mounted into the -container, so checking early whether it exists will fail. ---- - src/nspawn/nspawn.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c -index 84e94e845a..a0052c1c88 100644 ---- a/src/nspawn/nspawn.c -+++ b/src/nspawn/nspawn.c -@@ -6368,6 +6368,7 @@ static int run(int argc, char *argv[]) { - goto finish; - } - } else { -+#if 0 - _cleanup_free_ char *p = NULL; - - if (arg_pivot_root_new) -@@ -6387,6 +6388,7 @@ static int run(int argc, char *argv[]) { - log_error_errno(r, "Unable to determine if %s looks like it has an OS tree (i.e. whether /usr/ exists): %m", arg_directory); - goto finish; - } -+#endif - } - - if (userns_fd >= 0) { diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch deleted file mode 100644 index 6ba6bcffd76c..000000000000 --- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch +++ /dev/null @@ -1,129 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Raito Bezarius -Date: Mon, 19 Jun 2023 02:13:42 +0200 -Subject: [PATCH] Add some NixOS-specific unit directories - -Look in `/nix/var/nix/profiles/default/lib/systemd/{system,user}` for -units provided by packages installed into the default profile via -`nix-env -iA nixos.$package`. - -Also, remove /usr and /lib as these don't exist on NixOS. - -Original-Author: Eelco Dolstra ---- - src/core/systemd.pc.in | 8 ++++---- - src/libsystemd/sd-path/path-lookup.c | 20 +++----------------- - 2 files changed, 7 insertions(+), 21 deletions(-) - -diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in -index 862d57dcb6..8ba0ca4486 100644 ---- a/src/core/systemd.pc.in -+++ b/src/core/systemd.pc.in -@@ -46,10 +46,10 @@ systemdsystemconfdir=${systemd_system_conf_dir} - systemd_user_conf_dir=${sysconfdir}/systemd/user - systemduserconfdir=${systemd_user_conf_dir} - --systemd_system_unit_path=${systemd_system_conf_dir}:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:${systemd_system_unit_dir}:/usr/lib/systemd/system:/lib/systemd/system -+systemd_system_unit_path=${systemd_system_conf_dir}:/etc/systemd/system:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/system:${systemd_system_unit_dir} - systemdsystemunitpath=${systemd_system_unit_path} - --systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemd_user_unit_dir}:/usr/lib/systemd/user:/usr/share/systemd/user -+systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemd_user_unit_dir} - systemduserunitpath=${systemd_user_unit_path} - - systemd_system_generator_dir=${prefix}/lib/systemd/system-generators -@@ -58,10 +58,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir} - systemd_user_generator_dir=${prefix}/lib/systemd/user-generators - systemdusergeneratordir=${systemd_user_generator_dir} - --systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:/usr/local/lib/systemd/system-generators:${systemd_system_generator_dir} -+systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:${systemd_system_generator_dir} - systemdsystemgeneratorpath=${systemd_system_generator_path} - --systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:/usr/local/lib/systemd/user-generators:${systemd_user_generator_dir} -+systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:${systemd_user_generator_dir} - systemdusergeneratorpath=${systemd_user_generator_path} - - systemd_sleep_dir=${prefix}/lib/systemd/system-sleep -diff --git a/src/libsystemd/sd-path/path-lookup.c b/src/libsystemd/sd-path/path-lookup.c -index 32c14fb14a..7f0bf62844 100644 ---- a/src/libsystemd/sd-path/path-lookup.c -+++ b/src/libsystemd/sd-path/path-lookup.c -@@ -102,11 +102,7 @@ int runtime_directory(RuntimeScope scope, const char *fallback_suffix, char **re - } - - static const char* const user_data_unit_paths[] = { -- "/usr/local/lib/systemd/user", -- "/usr/local/share/systemd/user", - USER_DATA_UNIT_DIR, -- "/usr/lib/systemd/user", -- "/usr/share/systemd/user", - NULL - }; - -@@ -519,16 +515,13 @@ int lookup_paths_init( - persistent_config, - SYSTEM_CONFIG_UNIT_DIR, - "/etc/systemd/system", -+ "/nix/var/nix/profiles/default/lib/systemd/system", - ASSERT_PTR(persistent_attached), - ASSERT_PTR(runtime_config), - "/run/systemd/system", - ASSERT_PTR(runtime_attached), - STRV_IFNOTNULL(generator), -- "/usr/local/lib/systemd/system", - SYSTEM_DATA_UNIT_DIR, -- "/usr/lib/systemd/system", -- /* To be used ONLY for images which might be legacy split-usr */ -- FLAGS_SET(flags, LOOKUP_PATHS_SPLIT_USR) ? "/lib/systemd/system" : STRV_IGNORE, - STRV_IFNOTNULL(generator_late)); - break; - -@@ -546,13 +539,10 @@ int lookup_paths_init( - add = strv_new(persistent_config, - USER_CONFIG_UNIT_DIR, - "/etc/systemd/user", -+ "/nix/var/nix/profiles/default/lib/systemd/user", - ASSERT_PTR(runtime_config), - "/run/systemd/user", -- "/usr/local/share/systemd/user", -- "/usr/share/systemd/user", -- "/usr/local/lib/systemd/user", -- USER_DATA_UNIT_DIR, -- "/usr/lib/systemd/user"); -+ USER_DATA_UNIT_DIR); - break; - - case RUNTIME_SCOPE_USER: -@@ -692,7 +682,6 @@ void lookup_paths_log(LookupPaths *lp) { - static const char* const system_generator_paths[] = { - "/run/systemd/system-generators", - "/etc/systemd/system-generators", -- "/usr/local/lib/systemd/system-generators", - SYSTEM_GENERATOR_DIR, - NULL, - }; -@@ -700,7 +689,6 @@ static const char* const system_generator_paths[] = { - static const char* const user_generator_paths[] = { - "/run/systemd/user-generators", - "/etc/systemd/user-generators", -- "/usr/local/lib/systemd/user-generators", - USER_GENERATOR_DIR, - NULL, - }; -@@ -708,7 +696,6 @@ static const char* const user_generator_paths[] = { - static const char* const system_env_generator_paths[] = { - "/run/systemd/system-environment-generators", - "/etc/systemd/system-environment-generators", -- "/usr/local/lib/systemd/system-environment-generators", - SYSTEM_ENV_GENERATOR_DIR, - NULL, - }; -@@ -716,7 +703,6 @@ static const char* const system_env_generator_paths[] = { - static const char* const user_env_generator_paths[] = { - "/run/systemd/user-environment-generators", - "/etc/systemd/user-environment-generators", -- "/usr/local/lib/systemd/user-environment-generators", - USER_ENV_GENERATOR_DIR, - NULL, - }; diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch deleted file mode 100644 index 112f3f509f54..000000000000 --- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Eelco Dolstra -Date: Mon, 11 May 2015 15:39:38 +0200 -Subject: [PATCH] Get rid of a useless message in user sessions - -Namely lots of variants of - - Unit nix-var-nix-db.mount is bound to inactive unit dev-disk-by\x2dlabel-nixos.device. Stopping, too. - -in containers. ---- - src/core/manager.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/core/manager.c b/src/core/manager.c -index 79fa19d976..2115d74595 100644 ---- a/src/core/manager.c -+++ b/src/core/manager.c -@@ -1579,7 +1579,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) { - if (!unit_is_bound_by_inactive(u, &culprit)) - continue; - -- log_unit_debug(u, "Unit is stopped because bound to inactive unit %s.", culprit->id); -+ if (u->type != UNIT_MOUNT || detect_container() <= 0) -+ log_unit_debug(u, "Unit is stopped because bound to inactive unit %s.", culprit->id); - - /* If stopping a unit fails continuously we might enter a stop loop here, hence stop acting on the - * service being unnecessary after a while. */ diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch deleted file mode 100644 index 2abe659a42bf..000000000000 --- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch +++ /dev/null @@ -1,105 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Gabriel Ebner -Date: Sun, 6 Dec 2015 14:26:36 +0100 -Subject: [PATCH] hostnamed, localed, timedated: disable methods that change - system settings. - ---- - src/hostname/hostnamed.c | 6 ++++++ - src/locale/localed.c | 9 +++++++++ - src/timedate/timedated.c | 10 ++++++++++ - 3 files changed, 25 insertions(+) - -diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c -index 04c72e8137..1f9f296d56 100644 ---- a/src/hostname/hostnamed.c -+++ b/src/hostname/hostnamed.c -@@ -1421,6 +1421,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_ - if (r < 0) - return r; - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - name = empty_to_null(name); - - context_read_etc_hostname(c); -@@ -1487,6 +1490,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess - if (r < 0) - return r; - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - name = empty_to_null(name); - - context_read_machine_info(c); -diff --git a/src/locale/localed.c b/src/locale/localed.c -index 041ba29cd8..02fbe3e278 100644 ---- a/src/locale/localed.c -+++ b/src/locale/localed.c -@@ -221,6 +221,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er - - use_localegen = locale_gen_check_available(); - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - /* If single locale without variable name is provided, then we assume it is LANG=. */ - if (strv_length(l) == 1 && !strchr(l[0], '=')) { - if (!locale_is_valid(l[0])) -@@ -338,6 +341,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro - if (r < 0) - return bus_log_parse_error(r); - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - vc_context_empty_to_null(&in); - - r = vc_context_verify_and_warn(&in, LOG_ERR, error); -@@ -455,6 +461,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err - if (r < 0) - return bus_log_parse_error(r); - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - x11_context_empty_to_null(&in); - - r = x11_context_verify_and_warn(&in, LOG_ERR, error); -diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c -index 43cf3fddb9..1455830cba 100644 ---- a/src/timedate/timedated.c -+++ b/src/timedate/timedated.c -@@ -680,6 +680,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error * - if (r < 0) - return r; - -+ if (getenv("NIXOS_STATIC_TIMEZONE")) -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing timezone via systemd is not supported when it is set in NixOS configuration."); -+ - if (!timezone_is_valid(z, LOG_DEBUG)) - return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z); - -@@ -758,6 +762,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error - if (r < 0) - return r; - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - if (lrtc == c->local_rtc && !fix_system) - return sd_bus_reply_method_return(m, NULL); - -@@ -956,6 +963,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error - if (r < 0) - return r; - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - r = context_update_ntp_status(c, bus, m); - if (r < 0) - return r; diff --git a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch deleted file mode 100644 index d2eb05c290be..000000000000 --- a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Imuli -Date: Wed, 19 Oct 2016 08:46:47 -0400 -Subject: [PATCH] localectl: use /etc/X11/xkb for list-x11-* - -NixOS has an option to link the xkb data files to /etc/X11, but not to -/usr/share/X11. ---- - src/locale/localectl.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/locale/localectl.c b/src/locale/localectl.c -index 63703007ad..50def81940 100644 ---- a/src/locale/localectl.c -+++ b/src/locale/localectl.c -@@ -295,7 +295,7 @@ static const char* xkb_directory(void) { - static const char *cached = NULL; - - if (!cached) -- cached = secure_getenv("SYSTEMD_XKB_DIRECTORY") ?: "/usr/share/X11/xkb"; -+ cached = secure_getenv("SYSTEMD_XKB_DIRECTORY") ?: "/etc/X11/xkb"; - return cached; - } - diff --git a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch deleted file mode 100644 index 5de6a93cd7f9..000000000000 --- a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch +++ /dev/null @@ -1,23 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Nikolay Amiantov -Date: Thu, 25 Jul 2019 20:45:55 +0300 -Subject: [PATCH] systemd-shutdown: execute scripts in - /etc/systemd/system-shutdown - -This is needed for NixOS to use such scripts as systemd directory is immutable. ---- - src/shutdown/shutdown.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c -index fc6df238be..cb8b45a41b 100644 ---- a/src/shutdown/shutdown.c -+++ b/src/shutdown/shutdown.c -@@ -330,6 +330,7 @@ static void notify_supervisor(void) { - int main(int argc, char *argv[]) { - static const char* const dirs[] = { - SYSTEM_SHUTDOWN_PATH, -+ "/etc/systemd/system-shutdown", - NULL - }; - _cleanup_free_ char *cgroup = NULL; diff --git a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch deleted file mode 100644 index 5da56ce4be17..000000000000 --- a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch +++ /dev/null @@ -1,22 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Nikolay Amiantov -Date: Thu, 25 Jul 2019 20:46:58 +0300 -Subject: [PATCH] systemd-sleep: execute scripts in /etc/systemd/system-sleep - -This is needed for NixOS to use such scripts as systemd directory is immutable. ---- - src/sleep/sleep.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c -index 43aaede5b0..a8e5a75e39 100644 ---- a/src/sleep/sleep.c -+++ b/src/sleep/sleep.c -@@ -248,6 +248,7 @@ static int execute( - }; - static const char* const dirs[] = { - SYSTEM_SLEEP_PATH, -+ "/etc/systemd/system-sleep", - NULL - }; - diff --git a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch deleted file mode 100644 index 4645b2f6d269..000000000000 --- a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Yuriy Taraday -Date: Fri, 17 Jun 2022 12:45:10 +0000 -Subject: [PATCH] inherit systemd environment when calling generators. - -Systemd generators need access to the environment configured in -stage-2-init.sh since it schedules fsck and mkfs executions based on -being able to find an appropriate binary for the target filesystem. - -With this commit I am altering the systemd behaviour since upstream -tries to gather environments with that they call -"environment-generators" and then seems to pass that on to all the other -executables that are being called from managers. ---- - src/core/manager.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/src/core/manager.c b/src/core/manager.c -index 2115d74595..86f697313b 100644 ---- a/src/core/manager.c -+++ b/src/core/manager.c -@@ -3999,9 +3999,17 @@ static int build_generator_environment(Manager *m, char ***ret) { - * adjust generated units to that. Let's pass down some bits of information that are easy for us to - * determine (but a bit harder for generator scripts to determine), as environment variables. */ - -+ // On NixOS we must propagate PATH to generators so they are -+ // able to find binaries such as `fsck.${fstype}` and -+ // `mkfs.${fstype}`. That is why we ignore transient_environment that -+ // overrides the PATH variable. This propagates systemd's -+ // environment (e.g. PATH) that was setup -+ // before calling systemd from stage-2-init.sh. -+#if 0 - nl = strv_copy(m->transient_environment); - if (!nl) - return -ENOMEM; -+#endif - - r = strv_env_assign(&nl, "SYSTEMD_SCOPE", runtime_scope_to_string(m->runtime_scope)); - if (r < 0) diff --git a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch deleted file mode 100644 index 2cf174823605..000000000000 --- a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Nick Cao -Date: Sun, 15 Jan 2023 20:15:55 +0800 -Subject: [PATCH] tpm2_context_init: fix driver name checking - -https://github.com/systemd/systemd/commit/542dbc623e introduced -additional checks for tpm2 driver names, namely ensuring the driver -name, when concated with "libtss2-tcti-" and ".so.0", generates a valid -filename (with no '/' inside). - -For example, if the driver is name "device", the line - fn = strjoina("libtss2-tcti-", driver, ".so.0") -would yield "libtss2-tcti-device.so.0", passing the check. And the -filename is then passed to dlopen for loading the driver. - -Our current approach for systemd to correctly locate these dynamically -loaded libraries is to patch the filenames to include their absolute -path. Thus the line mentioned above is patched into - fn = strjoina("/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-", driver, ".so.0") -yielding "/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-device.so.0", -tripping the check. - -This patch relaxes the check to also accept absolute paths, by replacing -filename_is_valid with path_is_valid. ---- - src/shared/tpm2-util.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c -index 9e05c847ed..c0dd773eee 100644 ---- a/src/shared/tpm2-util.c -+++ b/src/shared/tpm2-util.c -@@ -918,7 +918,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) { - return log_oom_debug(); - - /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */ -- if (!filename_is_valid(fn)) -+ if (!path_is_valid(fn)) - return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver); - - const char *dle = NULL; diff --git a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch deleted file mode 100644 index e106791f3115..000000000000 --- a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maximilian Bosch -Date: Fri, 1 Sep 2023 09:57:02 +0200 -Subject: [PATCH] systemctl-edit: suggest `systemdctl edit --runtime` on system - scope - -This is a NixOS-specific change. When trying to modify a unit with -`systemctl edit` on NixOS, it'll fail with "Read-only file system": - - $ systemctl edit libvirtd - Failed to open "/etc/systemd/system/libvirtd.service.d/.#override.conffa9825a0c9a249eb": Read-only file system - -This is because `/etc/systemd/system` is a symlink into the store. In -fact, I'd consider this a feature rather than a bug since this ensures I -don't introduce state imperatively. - -However, people wrongly assume that it's not possible to edit units -ad-hoc and re-deploy their system for quick&dirty debugging where this -would be absolutely fine (and doable with `--runtime` which adds a -transient and non-persistent unit override in `/run`). - -To make sure that people learn about it quicker, this patch -throws an error which suggests using `--runtime` when running -`systemctl edit` on the system scope. - -For the user scope this isn't needed because user-level unit overrides -are written into `$XDG_CONFIG_HOME/systemd/user`. ---- - src/systemctl/systemctl-edit.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c -index a28180922a..22c9c8fdbd 100644 ---- a/src/systemctl/systemctl-edit.c -+++ b/src/systemctl/systemctl-edit.c -@@ -336,6 +336,9 @@ int verb_edit(int argc, char *argv[], void *userdata) { - sd_bus *bus = NULL; - int r; - -+ if (!arg_runtime && arg_runtime_scope == RUNTIME_SCOPE_SYSTEM) -+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead."); -+ - if (!on_tty() && !arg_stdin) - return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot edit units interactively if not on a tty."); - diff --git a/pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch b/pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch deleted file mode 100644 index ffc324be19df..000000000000 --- a/pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Marie Ramlow -Date: Sun, 24 Nov 2024 20:04:35 +0100 -Subject: [PATCH] meson: Don't link ssh dropins - ---- - meson.build | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/meson.build b/meson.build -index 3672005d75..406be24b45 100644 ---- a/meson.build -+++ b/meson.build -@@ -210,13 +210,13 @@ sshconfdir = get_option('sshconfdir') - if sshconfdir == '' - sshconfdir = sysconfdir / 'ssh/ssh_config.d' - endif --conf.set10('LINK_SSH_PROXY_DROPIN', sshconfdir != 'no' and not sshconfdir.startswith('/usr/')) -+conf.set10('LINK_SSH_PROXY_DROPIN', 0) - - sshdconfdir = get_option('sshdconfdir') - if sshdconfdir == '' - sshdconfdir = sysconfdir / 'ssh/sshd_config.d' - endif --conf.set10('LINK_SSHD_USERDB_DROPIN', sshdconfdir != 'no' and not sshdconfdir.startswith('/usr/')) -+conf.set10('LINK_SSHD_USERDB_DROPIN', 0) - - sshdprivsepdir = get_option('sshdprivsepdir') - conf.set10('CREATE_SSHDPRIVSEPDIR', sshdprivsepdir != 'no' and not sshdprivsepdir.startswith('/usr/')) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 0b221cac145a..4fa721d41b3f 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -215,6 +215,19 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-FUKj3lvjz8TIsyu8NyJYtiNele+1BhdJPdw7r7nW6as="; }; + # PATCH POLICY + # + # There are only two reasons we accept patches on systemd: + # 1. systemd functionality is fundamentally incompatible with how NixOS works + # and workarounds are not possible. + # 2. Hotfixes that we want to apply before they have reached a systemd branch + # we can use. If we come up with the fixes in Nixpkgs, they need to be + # reported upstream and the upstream issue needs to be linked in the + # commit message of the patch. + # + # Importantly, patches to improve usability, enable new features on NixOS or + # add entirely new features to systemd are not allowed. + # On major changes, or when otherwise required, you *must* : # 1. reformat the patches, # 2. `git am path/to/00*.patch` them into a systemd worktree, @@ -224,27 +237,11 @@ stdenv.mkDerivation (finalAttrs: { # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all # patches patches = [ - ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch - ./0003-Fix-NixOS-containers.patch - ./0004-Add-some-NixOS-specific-unit-directories.patch - ./0005-Get-rid-of-a-useless-message-in-user-sessions.patch - ./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch - ./0008-localectl-use-etc-X11-xkb-for-list-x11.patch ./0009-add-rootprefix-to-lookup-dir-paths.patch - ./0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch - ./0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch ./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch - ./0013-inherit-systemd-environment-when-calling-generators.patch ./0014-core-don-t-taint-on-unmerged-usr.patch - ./0015-tpm2_context_init-fix-driver-name-checking.patch - ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch - - # systemd tries to link the systemd-ssh-proxy ssh config snippet with tmpfiles - # if the install prefix is not /usr, but that does not work for us - # because we include the config snippet manually - ./0017-meson-Don-t-link-ssh-dropins.patch ] ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [ ./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch @@ -700,12 +697,22 @@ stdenv.mkDerivation (finalAttrs: { # warning messages postConfigure = '' substituteInPlace config.h \ - --replace-fail "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH" + --replace-fail "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH" \ + --replace-fail "SYSTEM_SHUTDOWN_PATH" "_SYSTEM_SHUTDOWN_PATH" \ + --replace-fail "SYSTEM_SLEEP_PATH" "_SYSTEM_SLEEP_PATH" ''; env.NIX_CFLAGS_COMPILE = toString [ "-USYSTEMD_BINARY_PATH" "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\"" + + # This path is not exposed via meson + "-USYSTEM_SHUTDOWN_PATH" + "-DSYSTEM_SHUTDOWN_PATH=\"/etc/systemd/system-shutdown\"" + + # This path is not exposed via meson + "-USYSTEM_SLEEP_PATH" + "-DSYSTEM_SLEEP_PATH=\"/etc/systemd/system-sleep\"" ]; doCheck = false;