Fixes several correctness bugs primarily around modular services' recent
reload/notification options (#535695) and adds compliance coverage to guard them.
Fixes:
- `lib/services/service.nix`:
- the reload-conflict assertion had inverted polarity, so it fired on the
default configuration
- the `mkIf` guard on `process.reloadCommand` had a misplaced paren, applying
`!= null` to the `mkIf` result rather than to the condition
- `process.reloadSignal` derives `process.reloadCommand`, so the assertion
could not check `reloadCommand != null` -- that fired on every signal-only
service. The command is now derived at `mkDefault` priority and the
assertion is gated on `options.process.reloadCommand.highestPrio`, firing
only when the user also set `reloadCommand` explicitly.
- change `notificationProtocol` to a sub-module type
- `nixos/modules/system/service/systemd/service.nix`:
- `systemd.mainExecReload`'s default ran `escapeSystemdExecArgs` (a list
escaper) on the `nullOr str` `process.reloadCommand`; this threw
`expected a list but found a string` and would have mangled `$MAINPID`. It
now uses `process.reloadCommand` verbatim.
- the `Type` default read a non-existent
`config.serviceManager.notificationProtocol` instead of
`config.notificationProtocol`.
Tests:
Extend the modular-service compliance suite to guard the above:
- Portable (manager-agnostic) eval assertions: `reloadSignal` derives
`reloadCommand`, the conflict assertion does not fire on signal-only services
but does when both are set explicitly, and `notificationProtocol.systemd`/`.s6`
default to `false`.
- systemd-specific eval assertions: `serviceConfig.Type` (simple/notify) and
`serviceConfig.ExecReload` are asserted on the resolved host units. This
directly guards the `mainExecReload` fix, which threw before it.
- Runtime reload compliance test: a nested reloadable sub-service is started and
reloaded, asserting the service observed the reload (recorded a SIGHUP marker).
`callReload` receives the service's name path (the list of names from the
top-level service down to the target sub-service); each integration joins it
per its own unit-naming convention (NixOS dash-joins to the systemd unit name,
e.g. `reload-inner.service`). Keeping it a path list rather than a read-only
submodule option keeps the suite manager-agnostic.
- `doc/build-helpers/testers.chapter.md`: document `callReload`.
Follow-up to #535695.
Signed-off-by: cinereal <cinereal@riseup.net>
Assisted-by: Claude:claude-opus-4-8
libfido2 links against pcsclite's libpcsclite.so.1, which since
pcsclite 2.3.1 is a shim that dlopens libpcsclite_real.so.1. nixpkgs
patches that dlopen to an absolute store path. make-initrd-ng only
follows DT_NEEDED, so the real library never ends up in the initrd.
systemd-cryptsetup then logs at boot:
loading ".../pcsclite-2.4.1-lib/lib/libpcsclite_real.so.1" failed:
cannot open shared object file: No such file or directory
and FIDO2 tokens behind PC/SC (NFC readers) cannot be used to unlock
LUKS in stage 1. Add the real library to the initrd store paths.
systemd v261 added systemd-pcrlogin@.service, which logind starts on
first login of a user to measure the user record into the 'login'
NvPCR. NixOS does not install the unit, so every first login logs:
systemd-logind: Failed to start user measurement service
'systemd-pcrlogin@1000.service', ignoring: Unit not found.
Install the unit on systems with systemd.tpm2.enable. The unit has ConditionSecurity=measured-os and does nothing elsewhere.
The documentation describes this as a set of files copied to /boot, with
the attribute name denoting the destination file name in /boot.
This uses essentially the same description as refind, systemd-boot and
grub. However limine put it into limine_install_dir (/boot/limine by
default) by accident, which broke downstream users.
For example, nixos-apple-silicon uses boot.loader.limine.additionalFiles
(and similar directives for other bootloaders) to update its m1n1
bootloader (which chainloads into u-boot, which chainloads into the
bootloader selected in NixOS), and due to this bug, put new versions of
it in the wrong location, effectively never updating m1n1.
Fix this, by updating the location. The next commit adds a regression VM
test for it.
systemd v261 lists the new systemd-boot-fallback binary in `bootctl
status`, so our regex picked up the older fallback version and ran
`bootctl update` on an already current ESP, which then exits non-zero.
Switch from parsing the `bootctl --status` output to having bootctl
compare versions itself by calling io.systemd.BootControl.Install over
Varlink. bootctl is spawned as a stdio Varlink server so that we always
use the bootctl from the target closure. An already current binary comes
back as an io.systemd.System error carrying ESTALE, which we treat as
success.
Because all options are below the [Resolve] section, and we nest them as
such below `settings.Resolve` we need to apply the transformations one
level down for it to match the relevant keys.
This is for instance useful on Asahi where an additional initrd archive
containing firmware blobs and per-device calibration files is placed
on the ESP and updated by the Asahi Linux Installer.
These need to be loaded alongside the NixOS initrd.
Implemented for systemd-boot and Limine. Grub is left out since its
install script does not use bootspec yet.
Co-authored-by: Florian Klink <flokli@flokli.de>
The upstream unit has ConditionPathIsReadWrite=/etc, which is always
false on the read-only overlay, so the previous commit alone requires
users that want persistence to override the conditions themselves before
the generated ID can be written back.
Use ConditionFirstBoot instead, with the empty placeholder
first-boot is "no" and commit stays skipped, but when a writable
file containing "uninitialized" is bind-mounted over /etc/machine-id,
first-boot is "yes" once and commit writes the ID through the bind.
The symlink to /var/lib/nixos/machine-id never persists the ID,
systemd-machine-id-commit.service requires a writable /etc, and
machine_id_commit() does not follow symlinks for its mountpoint check.
So the backing file stays "uninitialized", every boot is
ConditionFirstBoot=yes, and the machine-id is random per boot.
Ship an empty regular file instead, systemd then overlays /run/machine-id
for the session, ConditionFirstBoot is correctly "no", commit is
cleanly condition-skipped, and the file is a usable bind target for
users that want persistence.
Fixes#523878
Allows running additional shell commands after the limine install script
generates menu entries, mirroring the systemd-boot option of the same
name.
Co-authored-by: Florian Klink <flokli@flokli.de>
We aren't linking systemd to gnutls anymore so these options
were all silently ignored. Which is pretty bad!
Assisted-by: Claude <noreply@anthropic.com>
This adds io.systemd.PCRExtend if the system has TPM2
enabled.
Additionally, this requires the system to fullfill
ConditionSecurity=measured-uki.
Change-Id: I3f1046cdc7463f3b6d3205030f7f12ac95e5cd9e
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
This adds io.systemd.AskPassword Varlink API by default.
Change-Id: I45b9a53d489ec3ea5561006c9c91ccb7016b3ee1
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
This enables the ability to use systemd-repart over Varlink at
/run/systemd/io.systemd.Repart.
Change-Id: Ia74fdf8c2cbc4ec52994ba8ceb5796acc731abd3
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
I have effectively renounced on maintaining all these packages and I do
not plan to return them except if I'm forced to.
I am also fine with most of these packages being dropped for next
releases if no maintainer shows up.
Change-Id: I8d167c8029b6991181bd7a094af21c3313af2b51
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Robert Hensing