[packages/systemd] up to 259.10 (last line with the SysV generator)
arekm
arekm at pld-linux.org
Sat Oct 24 18:27:23 CEST 2026
commit aefbfb14904af0f02a302056edc04bde5044f969
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Sat Oct 24 18:26:16 2026 +0200
up to 259.10 (last line with the SysV generator)
Requires cgroup v2: remove systemd.unified_cgroup_hierarchy=0 and systemd.legacy_systemd_cgroup_controller from the kernel command line and reboot on 254 before upgrading.
config-pld.patch | 14 +-
net-rename-revert.patch | 17 +
optional-tmp-on-tmpfs.patch | 2 +-
pld-boot_efi_mount.patch | 67 +---
pld-pam-systemd-user.patch | 7 +-
pld-sysv-network.patch | 6 +-
rpm-macros.patch | 4 +-
systemd-CVE-2026-15059.patch | 24 --
systemd-CVE-2026-16742.patch | 143 ---------
systemd-CVE-2026-29111.patch | 239 --------------
systemd-CVE-2026-40225.patch | 157 ---------
systemd-CVE-2026-40226.patch | 60 ----
systemd-CVE-2026-4105.patch | 21 --
systemd-GHSA-3jgj-3phh-hx5j.patch | 274 ----------------
systemd-GHSA-5rm9-cc37-35gq.patch | 93 ------
systemd-GHSA-m8q3-73v4-wvg7.patch | 44 ---
systemd-completion.patch | 24 --
systemd-configfs.patch | 2 +-
systemd-errno-list-kernel7.patch | 23 --
systemd-glibc.patch | 10 -
systemd-initctl.c | 157 +++++++++
systemd-initctl.service | 8 +
systemd-initctl.socket | 9 +
systemd-pld-layout.patch | 239 ++++++++++++++
systemd-remount-fs-unmounted.patch | 26 ++
systemd-runlevel-targets.patch | 88 +++++
systemd-runlevel.sh | 11 +
systemd-split-usr-compat.patch | 259 +++++++++++++++
systemd-split-usr-fix.patch | 23 --
systemd-telinit.sh | 15 +
systemd-x32.patch | 4 +-
systemd.spec | 637 +++++++++++++++++++++++++++++--------
target-pld.patch | 40 +--
udev-ploop-rules.patch | 2 +-
34 files changed, 1381 insertions(+), 1368 deletions(-)
---
diff --git a/systemd.spec b/systemd.spec
index 56c5b82..f22db59 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -22,7 +22,7 @@
%bcond_with tests # "make check" (requires systemd already installed)
%bcond_with xen # Xen kexec support
-%define min_kernel 3.15
+%define min_kernel 5.4
%ifnarch %{ix86} %{x8664} aarch64
# x32 disabled - maybe it's possible to build x64 EFI, but it requires some hacking (add -m64 to EFI gcc command line?)
@@ -32,14 +32,14 @@ Summary: A System and Service Manager
Summary(pl.UTF-8): systemd - zarządca systemu i usług dla Linuksa
Name: systemd
# Verify ChangeLog and NEWS when updating (since there are incompatible/breaking changes very often)
-Version: 254.27
-Release: 4
+Version: 259.10
+Release: 1
Epoch: 1
License: GPL v2+ (udev), LGPL v2.1+ (the rest)
Group: Base
#Source0Download: https://github.com/systemd/systemd/releases
-Source0: https://github.com/systemd/systemd-stable/archive/v%{version}/%{name}-%{version}.tar.gz
-# Source0-md5: bd8bbfe343b829b3ae2978b9603facde
+Source0: https://github.com/systemd/systemd/archive/v%{version}/%{name}-%{version}.tar.gz
+# Source0-md5: a7ad87e7deebffa72b1efb4fb4bb2910
Source1: %{name}-sysv-convert
Source2: %{name}_booted.c
Source3: network.service
@@ -52,6 +52,13 @@ Source17: rc-inetd.service
Source18: default.preset
Source19: prefdm.service
Source20: sigpwr-container-shutdown.service
+# /run/initctl for SysVinit's shutdown/halt/reboot/telinit, systemd >= 258 has none
+Source21: %{name}-initctl.c
+Source22: %{name}-initctl.service
+Source23: %{name}-initctl.socket
+# systemd >= 258 has no telinit/runlevel
+Source24: %{name}-telinit.sh
+Source25: %{name}-runlevel.sh
# rules
Source101: udev-alsa.rules
@@ -72,9 +79,9 @@ Patch1: config-pld.patch
Patch2: pld-sysv-network.patch
Patch3: tmpfiles-not-fatal.patch
Patch4: udev-ploop-rules.patch
-Patch5: %{name}-split-usr-fix.patch
+Patch5: %{name}-pld-layout.patch
Patch6: net-rename-revert.patch
-Patch7: %{name}-completion.patch
+Patch7: %{name}-split-usr-compat.patch
Patch8: proc-hidepid.patch
Patch9: %{name}-configfs.patch
Patch10: pld-boot_efi_mount.patch
@@ -83,17 +90,10 @@ Patch13: sysctl.patch
Patch14: pld-pam-%{name}-user.patch
Patch15: %{name}-x32.patch
Patch16: rpm-macros.patch
-Patch17: %{name}-glibc.patch
-Patch18: %{name}-CVE-2026-29111.patch
-Patch19: %{name}-CVE-2026-40225.patch
-Patch20: %{name}-GHSA-m8q3-73v4-wvg7.patch
-Patch21: %{name}-CVE-2026-40226.patch
-Patch22: %{name}-CVE-2026-16742.patch
-Patch23: %{name}-CVE-2026-15059.patch
-Patch24: %{name}-GHSA-5rm9-cc37-35gq.patch
-Patch25: %{name}-GHSA-3jgj-3phh-hx5j.patch
-Patch26: %{name}-CVE-2026-4105.patch
-Patch27: %{name}-errno-list-kernel7.patch
+# runlevel[0-6].target as aliases, existing default.target links and runlevelN.target.wants keep working
+# https://src.fedoraproject.org/rpms/systemd/blob/f44/f/0001-Revert-units-drop-runlevel-0-6-.target.patch
+Patch17: %{name}-runlevel-targets.patch
+Patch18: %{name}-remount-fs-unmounted.patch
URL: https://www.freedesktop.org/wiki/Software/systemd/
BuildRequires: acl-devel
%{?with_audit:BuildRequires: audit-libs-devel}
@@ -113,22 +113,18 @@ BuildRequires: docbook-dtd42-xml
BuildRequires: docbook-dtd45-xml
BuildRequires: docbook-style-xsl-nons
BuildRequires: elfutils-devel >= 0.177
-BuildRequires: gcc >= 6:4.9
+BuildRequires: gcc >= 6:8.4
BuildRequires: gettext-tools
BuildRequires: glib2-devel >= 1:2.22.0
BuildRequires: glibc-misc
-%{?with_efi:BuildRequires: gnu-efi}
BuildRequires: gnutls-devel >= 3.6.0
BuildRequires: gperf
-BuildRequires: intltool >= 0.40.0
-# pkgconfig(libiptc)
-BuildRequires: iptables-devel
%{?with_bpf:BuildRequires: kernel-tools >= 5.13.0}
BuildRequires: kmod-devel >= 15
BuildRequires: libapparmor-devel >= 1:2.13
+BuildRequires: libarchive-devel >= 3.0
BuildRequires: libblkid-devel >= 2.24
%{?with_bpf:BuildRequires: libbpf-devel >= 0.1.0}
-BuildRequires: libcap-devel
BuildRequires: libfdisk-devel >= 2.32
%{?with_fido2:BuildRequires: libfido2-devel}
BuildRequires: libgcrypt-devel >= 1.4.5
@@ -139,15 +135,13 @@ BuildRequires: libmount-devel >= 2.30
BuildRequires: libpwquality-devel >= 1.4.1
BuildRequires: libseccomp-devel >= 2.4.0
%{?with_selinux:BuildRequires: libselinux-devel >= 2.6}
-BuildRequires: libtool >= 2:2.2
BuildRequires: libxslt-progs
BuildRequires: lz4-devel >= 1:1.3.0
-BuildRequires: m4
-BuildRequires: meson >= 0.60.0
+BuildRequires: meson >= 0.62.0
BuildRequires: ninja
BuildRequires: openssl-devel
BuildRequires: p11-kit-devel >= 0.23.3
-%{?with_pam:BuildRequires: pam-devel >= 1.1.2}
+%{?with_pam:BuildRequires: pam-devel >= 1:1.1.2}
BuildRequires: pcre2-8-devel
# for sbat-distro* in src/boot/efi/meson.build
BuildRequires: pld-release
@@ -173,6 +167,7 @@ Requires(post,postun): %{name}-units%{?_isa} = %{epoch}:%{version}-%{release}
Requires(postun): /usr/sbin/groupdel
Requires(postun): /usr/sbin/userdel
Requires(post): /bin/setfacl
+Requires(post): /bin/stat
Requires(pre): /bin/id
Requires(pre): /usr/bin/getgid
Requires(pre): /usr/sbin/groupadd
@@ -424,6 +419,8 @@ License: LGPL v2.1+
Group: Base
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
Requires: curl-libs >= 7.32.0
+# dlopen()ed for tar import/export/pull and systemd-dissect --make-archive; built with archive_entry_hardlink_is_set (3.7.5)
+Requires: libarchive >= 3.7.5
%description container
Tools for container/VM management.
@@ -629,6 +626,7 @@ Summary(pl.UTF-8): Narzędzie do łączenia jądra oraz initrd w Unified Kernel
Group: Base
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
Requires: python3-modules >= 1:3.9
+Requires: python3-pefile
%description ukify
Tool for combining kernel and initrd into Unified Kernel Image (UKI).
@@ -640,10 +638,20 @@ Narzędzie do łączenia jądra oraz initrd w Unified Kernel Image (UKI).
Summary: Shared systemd libraries
Summary(pl.UTF-8): Biblioteki współdzielone systemd
Group: Libraries
+# libsystemd-shared dlopen()s these (systemd-analyze dlopen-metadata), rpm generates no dependencies
+Requires: acl
+%{?with_audit:Requires: audit-libs}
+Requires: kmod-libs >= 15
+Requires: libapparmor >= 1:2.13
+Requires: libblkid >= 2.24
Requires: libgcrypt >= 1.4.5
+Requires: libmount >= 2.30
Requires: libseccomp >= 2.4.0
%{?with_selinux:Requires: libselinux >= 2.6}
Requires: lz4-libs >= 1:1.3.0
+Requires: p11-kit >= 0.23.3
+%{?with_pam:Requires: pam-libs >= 1:1.1.2}
+Requires: xz-libs
Requires: zstd >= 1.4.0
Suggests: elfutils-libs >= 0.177
Obsoletes: nss_myhostname < 0.4
@@ -819,7 +827,7 @@ RPM macros that define paths and scriptlets related to systemd.
Makra RPM-a definiujące ścieżki i skryptlety związane z systemd.
%prep
-%setup -q -n systemd-stable-%{version}
+%setup -q
%patch -P0 -p1
%patch -P1 -p1
%patch -P2 -p1
@@ -839,17 +847,9 @@ Makra RPM-a definiujące ścieżki i skryptlety związane z systemd.
%patch -P16 -p1
%patch -P17 -p1
%patch -P18 -p1
-%patch -P19 -p1
-%patch -P20 -p1
-%patch -P21 -p1
-%patch -P22 -p1
-%patch -P23 -p1
-%patch -P24 -p1
-%patch -P25 -p1
-%patch -P26 -p1
-%patch -P27 -p1
cp -p %{SOURCE2} src/systemd_booted.c
+cp -p %{SOURCE21} src/systemd-initctl.c
grep -rlZ -0 '#!/usr/bin/env bash' . | xargs -0 sed -i -e 's,#!/usr/bin/env bash,#!/bin/bash,g'
@@ -858,7 +858,24 @@ grep -rlZ -0 '#!/usr/bin/env bash' . | xargs -0 sed -i -e 's,#!/usr/bin/env bash
src/kernel-install/60-ukify.install.in
%build
+# /bin, /sbin, /lib, /%{_lib} on the root fs as before (unmerged /usr); systemd-pld-layout.patch
+# keeps everything that does not need to be there below /usr.
+# sshd_config includes sshd_config.d first and sshd keeps the first value, so systemd's
+# AuthorizedKeysCommand drop-in would override ssh-ldap-wrapper: sshdconfdir=no.
+# tty-mode 0620 (upstream 0600) keeps write(1)/wall(1) working for other users.
+# mode=release: developer mode makes a failed assert_return() abort, PID 1 included.
+# net-naming-scheme v253 is what 254 used ("v254" is a later addition, SR-IOV representor names).
+# vmlinux-h=auto would generate vmlinux.h from the build host's running kernel BTF.
%meson \
+ --prefix=/ \
+ --bindir=/bin \
+ --libdir=/%{_lib} \
+ --includedir=%{_includedir} \
+ --datadir=%{_datadir} \
+ --mandir=%{_mandir} \
+ --infodir=%{_infodir} \
+ -Dpkgconfiglibdir=%{_pkgconfigdir} \
+ -Dpkgconfigdatadir=%{_npkgconfigdir} \
-Dadm-gid=3 \
-Daudio-gid=23 \
-Dcdrom-gid=27 \
@@ -880,68 +897,100 @@ grep -rlZ -0 '#!/usr/bin/env bash' . | xargs -0 sed -i -e 's,#!/usr/bin/env bash
-Dsystemd-timesync-uid=318 \
-Dnobody-user="nobody" \
-Dnobody-group="nogroup" \
- -Daudit=%{__true_false audit} \
- -Dbpf-framework=%{__true_false bpf} \
+ -Daudit=%{__enabled_disabled audit} \
+ -Dbpf-framework=%{__enabled_disabled bpf} \
-Ddefault-kill-user-processes=false \
+ -Ddefault-net-naming-scheme=v253 \
%{?debug:--buildtype=debug} \
-Defi=%{__true_false efi} \
- -Dlibfido2=%{__true_false fido2} \
+ -Dlibfido2=%{__enabled_disabled fido2} \
+ -Dagetty-path=/sbin/agetty \
-Dkexec-path=/sbin/kexec \
-Dkmod-path=/sbin/kmod \
- -Dlibcryptsetup=%{__true_false cryptsetup} \
+ -Dlibcryptsetup=%{__enabled_disabled cryptsetup} \
-Dlibcryptsetup-plugins-dir=/usr/%{_lib}/cryptsetup \
- -Dlibidn2=true \
+ -Dlibidn2=enabled \
-Dloadkeys-path=/usr/bin/loadkeys \
- -Dlz4=true \
- -Dman=true \
- -Dmicrohttpd=%{__true_false microhttpd} \
+ -Dlz4=enabled \
+ -Dman=enabled \
+ -Dmicrohttpd=%{__enabled_disabled microhttpd} \
+ -Dmode=release \
-Dmount-path=/bin/mount \
-Dntp-servers='0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org' \
- -Dpam=%{__true_false pam} \
- -Dqrencode=%{__true_false qrencode} \
+ -Dpam=%{__enabled_disabled pam} \
+ -Dqrencode=%{__enabled_disabled qrencode} \
-Dquotacheck=true \
-Dquotacheck-path=/sbin/quotacheck \
-Dquotaon-path=/sbin/quotaon \
-Drc-local=/etc/rc.d/rc.local \
- -Drootlibdir=/%{_lib} \
- -Drootprefix="" \
-Dsbat-distro="%vendor" \
-Dsbat-distro-pkgname="%name" \
-Dsbat-distro-summary="%distribution" \
-Dsbat-distro-url="https://git.pld-linux.org/?p=packages/systemd.git" \
-Dsbat-distro-version="%version-%release" \
- -Dselinux=%{__true_false selinux} \
+ -Dselinux=%{__enabled_disabled selinux} \
-Dsetfont-path=/bin/setfont \
-Dsplit-bin=true \
- -Dsplit-usr=true \
+ -Dsshdprivsepdir=/usr/share/empty \
+ -Dstatus-unit-format-default=name \
+ -Dsshdconfdir=no \
-Dsulogin-path=/sbin/sulogin \
+ -Dswapoff-path=/sbin/swapoff \
+ -Dswapon-path=/sbin/swapon \
-Dsysvinit-path=/etc/rc.d/init.d \
-Dsysvrcnd-path=/etc/rc.d \
- -Dtpm2=%{__true_false tpm2} \
+ -Dtpm2=%{__enabled_disabled tpm2} \
+ -Dtty-mode=0620 \
+ -Dukify=%{__enabled_disabled efi} \
-Dumount-path=/bin/umount \
- -Dxenctrl=%{__true_false xen}
+ -Dvmlinux-h=disabled \
+ -Dxenctrl=%{__enabled_disabled xen}
%meson_build
%{__cc} %{rpmcppflags} %{rpmcflags} -o build/systemd_booted %{rpmldflags} src/systemd_booted.c -Lbuild -lsystemd
+%{__cc} %{rpmcppflags} %{rpmcflags} -o build/systemd-initctl %{rpmldflags} src/systemd-initctl.c -Lbuild -lsystemd
%{?with_tests:%meson_test}
%install
rm -rf $RPM_BUILD_ROOT
install -d $RPM_BUILD_ROOT/var/lib/{%{name}/{catalog,coredump},machines} \
- $RPM_BUILD_ROOT%{_rootsbindir} \
+ $RPM_BUILD_ROOT{%{_bindir},%{_rootsbindir}} \
$RPM_BUILD_ROOT%{_sysconfdir}/{modprobe.d,repart.d,systemd/{system,user}-preset,sysupdate.d} \
$RPM_BUILD_ROOT%{systemduserunitdir}/{basic,sockets}.target.wants \
- $RPM_BUILD_ROOT%{systemdunitdir}/{final,sound,system-update}.target.wants \
+ $RPM_BUILD_ROOT%{systemdunitdir}/{final,graphical,rescue,sound,system-update}.target.wants \
$RPM_BUILD_ROOT%{systemdunitdir}/systemd-udevd.service.d \
$RPM_BUILD_ROOT%{_prefix}/lib/{repart.d,systemd/system-environment-generators,sysupdate.d}
%meson_install
+# meson has one bindir (/bin); these were in /usr/bin before, keep those paths as symlinks
+for f in bootctl busctl coredumpctl homectl hostnamectl kernel-install localectl oomctl \
+ resolvectl run0 systemd-ac-power systemd-analyze systemd-cat systemd-cgls systemd-cgtop \
+ %{?with_cryptsetup:systemd-cryptenroll} systemd-delta systemd-detect-virt systemd-dissect \
+ systemd-id128 systemd-mount systemd-nspawn systemd-path systemd-resolve systemd-run \
+ systemd-socket-activate systemd-stdio-bridge systemd-umount timedatectl %{?with_efi:ukify} \
+ userdbctl; do
+ ln -s ../../bin/$f $RPM_BUILD_ROOT%{_bindir}/$f
+done
+ln -sf ../bin/systemd-dissect $RPM_BUILD_ROOT/sbin/mount.ddi
+ln -sf ../bin/resolvectl $RPM_BUILD_ROOT/sbin/resolvconf
+# BINDIR/systemd-home-fallback-shell is compiled into homed
+ln -sf homectl $RPM_BUILD_ROOT/bin/systemd-home-fallback-shell
+%if %{with efi}
+ln -sf ../../bin/ukify $RPM_BUILD_ROOT/lib/systemd/ukify
+%endif
+
touch $RPM_BUILD_ROOT/var/lib/%{name}/random-seed
install -p -m755 build/systemd_booted $RPM_BUILD_ROOT/bin/systemd_booted
+install -p -m755 build/systemd-initctl $RPM_BUILD_ROOT/lib/systemd/systemd-initctl
+cp -p %{SOURCE22} $RPM_BUILD_ROOT%{systemdunitdir}/systemd-initctl.service
+cp -p %{SOURCE23} $RPM_BUILD_ROOT%{systemdunitdir}/systemd-initctl.socket
+ln -s ../systemd-initctl.socket $RPM_BUILD_ROOT%{systemdunitdir}/sockets.target.wants
+install -p %{SOURCE24} $RPM_BUILD_ROOT/sbin/telinit
+install -p %{SOURCE25} $RPM_BUILD_ROOT/sbin/runlevel
# target-pld.patch supplements
%{__rm} $RPM_BUILD_ROOT%{systemdunitdir}/sysinit.target.wants/sys-kernel-config.mount
@@ -1064,6 +1113,14 @@ install -d $RPM_BUILD_ROOT/var/log
:> $RPM_BUILD_ROOT/var/log/wtmp
%{__rm} -r $RPM_BUILD_ROOT%{_docdir}/%{name}
+# config dir READMEs as in the old layout; /etc/rc.d/init.d belongs to rc-scripts
+%{__rm} $RPM_BUILD_ROOT%{_sysconfdir}/rc.d/init.d/README \
+ $RPM_BUILD_ROOT/lib/modprobe.d/README \
+ $RPM_BUILD_ROOT/lib/udev/{hwdb.d,rules.d}/README \
+ $RPM_BUILD_ROOT%{_prefix}/lib/{sysctl.d,sysusers.d,tmpfiles.d}/README
+
+# header-only catalogs without a single translated message, find-lang skips them
+%{__rm} -r $RPM_BUILD_ROOT%{_localedir}/{kn,kw}
%find_lang %{name}
@@ -1086,7 +1143,17 @@ rm -rf $RPM_BUILD_ROOT
%post
/bin/systemd-machine-id-setup || :
/lib/systemd/systemd-random-seed save || :
-/bin/systemctl --system daemon-reexec || :
+# 259 PID 1 freezes on a cgroup v1/hybrid hierarchy, so no reexec there
+if [ -d /run/systemd/system ]; then
+ case "$(/bin/stat -fc %%T /sys/fs/cgroup/ 2>/dev/null)" in
+ cgroup2fs|sysfs|"")
+ /bin/systemctl --system daemon-reexec || :
+ ;;
+ *)
+ echo >&2 "systemd: cgroup v1 (legacy/hybrid) hierarchy, PID 1 was not reexecuted and new user sessions will fail until reboot. Remove systemd.unified_cgroup_hierarchy=0 and systemd.legacy_systemd_cgroup_controller from the kernel command line and reboot."
+ ;;
+ esac
+fi
/bin/journalctl --update-catalog || :
/bin/systemd-sysusers || :
@@ -1338,9 +1405,9 @@ fi
/etc/xdg/systemd
%attr(755,root,root) /bin/journalctl
%attr(755,root,root) /bin/loginctl
-%attr(755,root,root) /bin/systemd
+/bin/systemd
%attr(755,root,root) /bin/systemd-ask-password
-%attr(755,root,root) /bin/systemd-confext
+/bin/systemd-confext
%attr(755,root,root) /bin/systemd-creds
%attr(755,root,root) /bin/systemd-escape
%attr(755,root,root) /bin/systemd-firstboot
@@ -1348,29 +1415,56 @@ fi
%attr(755,root,root) /bin/systemd-machine-id-setup
%attr(755,root,root) /bin/systemd-notify
%attr(755,root,root) /bin/systemd-sysext
+%attr(755,root,root) /bin/systemd-mute-console
+%attr(755,root,root) /bin/systemd-pty-forward
+%attr(755,root,root) /bin/systemd-vpick
+%attr(755,root,root) /bin/varlinkctl
+/bin/run0
+%{_bindir}/run0
%attr(755,root,root) /bin/systemd-sysusers
%attr(755,root,root) /bin/systemd-tty-ask-password-agent
-%{?with_efi:%attr(755,root,root) %{_bindir}/bootctl}
-%attr(755,root,root) %{_bindir}/busctl
-%attr(755,root,root) %{_bindir}/coredumpctl
-%attr(755,root,root) %{_bindir}/hostnamectl
-%attr(755,root,root) %{_bindir}/kernel-install
-%attr(755,root,root) %{_bindir}/localectl
-%attr(755,root,root) %{_bindir}/systemd-ac-power
-%attr(755,root,root) %{_bindir}/systemd-cat
-%{?with_cryptsetup:%attr(755,root,root) %{_bindir}/systemd-cryptenroll}
-%attr(755,root,root) %{_bindir}/systemd-delta
-%attr(755,root,root) %{_bindir}/systemd-id128
-%attr(755,root,root) %{_bindir}/systemd-mount
-%attr(755,root,root) %{_bindir}/systemd-nspawn
-%attr(755,root,root) %{_bindir}/systemd-path
-%attr(755,root,root) %{_bindir}/systemd-resolve
-%attr(755,root,root) %{_bindir}/systemd-run
-%attr(755,root,root) %{_bindir}/systemd-socket-activate
-%attr(755,root,root) %{_bindir}/systemd-stdio-bridge
-%attr(755,root,root) %{_bindir}/systemd-umount
-%attr(755,root,root) %{_bindir}/timedatectl
-%attr(755,root,root) %{_bindir}/userdbctl
+%attr(755,root,root) /bin/bootctl
+%{_bindir}/bootctl
+%attr(755,root,root) /bin/busctl
+%{_bindir}/busctl
+%attr(755,root,root) /bin/coredumpctl
+%{_bindir}/coredumpctl
+%attr(755,root,root) /bin/hostnamectl
+%{_bindir}/hostnamectl
+%attr(755,root,root) /bin/kernel-install
+%{_bindir}/kernel-install
+%attr(755,root,root) /bin/localectl
+%{_bindir}/localectl
+%attr(755,root,root) /bin/systemd-ac-power
+%{_bindir}/systemd-ac-power
+%attr(755,root,root) /bin/systemd-cat
+%{_bindir}/systemd-cat
+%{?with_cryptsetup:%attr(755,root,root) /bin/systemd-cryptenroll}
+%{?with_cryptsetup:%{_bindir}/systemd-cryptenroll}
+%attr(755,root,root) /bin/systemd-delta
+%{_bindir}/systemd-delta
+%attr(755,root,root) /bin/systemd-id128
+%{_bindir}/systemd-id128
+%attr(755,root,root) /bin/systemd-mount
+%{_bindir}/systemd-mount
+%attr(755,root,root) /bin/systemd-nspawn
+%{_bindir}/systemd-nspawn
+%attr(755,root,root) /bin/systemd-path
+%{_bindir}/systemd-path
+/bin/systemd-resolve
+%{_bindir}/systemd-resolve
+%attr(755,root,root) /bin/systemd-run
+%{_bindir}/systemd-run
+%attr(755,root,root) /bin/systemd-socket-activate
+%{_bindir}/systemd-socket-activate
+%attr(755,root,root) /bin/systemd-stdio-bridge
+%{_bindir}/systemd-stdio-bridge
+/bin/systemd-umount
+%{_bindir}/systemd-umount
+%attr(755,root,root) /bin/timedatectl
+%{_bindir}/timedatectl
+%attr(755,root,root) /bin/userdbctl
+%{_bindir}/userdbctl
/lib/modprobe.d/systemd.conf
/lib/systemd/resolv.conf
%attr(755,root,root) /lib/systemd/pld-clean-tmp
@@ -1379,10 +1473,45 @@ fi
%attr(755,root,root) /lib/systemd/systemd-binfmt
%{?with_efi:%attr(755,root,root) /lib/systemd/systemd-bless-boot}
%attr(755,root,root) /lib/systemd/systemd-boot-check-no-failures
-%attr(755,root,root) /lib/systemd/systemd-cgroups-agent
%attr(755,root,root) /lib/systemd/systemd-coredump
+%attr(755,root,root) /lib/systemd/systemd-executor
+%attr(755,root,root) /lib/systemd/systemd-factory-reset
+%attr(755,root,root) /lib/systemd/systemd-bsod
+%attr(755,root,root) /lib/systemd/systemd-keyutil
+%attr(755,root,root) /lib/systemd/systemd-mountfsd
+%attr(755,root,root) /lib/systemd/systemd-mountwork
+%attr(755,root,root) /lib/systemd/systemd-nsresourced
+%attr(755,root,root) /lib/systemd/systemd-nsresourcework
+%attr(755,root,root) /lib/systemd/systemd-pcrlock
+%attr(755,root,root) /lib/systemd/systemd-sbsign
+%attr(755,root,root) /lib/systemd/systemd-ssh-issue
+%attr(755,root,root) /lib/systemd/systemd-ssh-proxy
+%attr(755,root,root) /lib/systemd/systemd-storagetm
+%attr(755,root,root) /lib/systemd/systemd-tpm2-clear
+%attr(755,root,root) /lib/systemd/systemd-tpm2-setup
+%attr(755,root,root) /lib/systemd/systemd-validatefs
+%attr(755,root,root) /lib/systemd/system-generators/systemd-factory-reset-generator
+%attr(755,root,root) /lib/systemd/system-generators/systemd-ssh-generator
+%attr(755,root,root) /lib/systemd/system-generators/systemd-tpm2-generator
+%dir /lib/systemd/profile.d
+/lib/systemd/profile.d/70-systemd-shell-extra.sh
+/lib/systemd/profile.d/80-systemd-osc-context.sh
+%dir /lib/systemd/ssh_config.d
+/lib/systemd/ssh_config.d/20-systemd-ssh-proxy.conf
+%dir /lib/nvpcr
+/lib/nvpcr/cryptsetup.nvpcr
+/lib/nvpcr/hardware.nvpcr
+%config(noreplace) %verify(not md5 mtime size) /etc/profile.d/70-systemd-shell-extra.sh
+%config(noreplace) %verify(not md5 mtime size) /etc/profile.d/80-systemd-osc-context.sh
+%config(noreplace) %verify(not md5 mtime size) /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
+%config(noreplace) %verify(not md5 mtime size) /usr/lib/pam.d/systemd-run0
+%{_prefix}/lib/kernel/install.conf
+%{_prefix}/lib/kernel/uki.conf
+%{_prefix}/lib/pcrlock.d
+%{_datadir}/mime/packages/io.systemd.xml
%if %{with cryptsetup}
-%attr(755,root,root) /lib/systemd/systemd-cryptsetup
+%attr(755,root,root) /bin/systemd-cryptsetup
+/lib/systemd/systemd-cryptsetup
%attr(755,root,root) /lib/systemd/systemd-integritysetup
%{?with_fido2:%attr(755,root,root) /usr/%{_lib}/cryptsetup/libcryptsetup-token-systemd-fido2.so}
%attr(755,root,root) /usr/%{_lib}/cryptsetup/libcryptsetup-token-systemd-pkcs11.so
@@ -1402,7 +1531,7 @@ fi
%endif
%attr(755,root,root) /lib/systemd/systemd-modules-load
%if %{with efi} && %{with tpm2}
-%attr(755,root,root) /lib/systemd/systemd-pcrphase
+%attr(755,root,root) /lib/systemd/systemd-pcrextend
%endif
%attr(755,root,root) /lib/systemd/systemd-pstore
%attr(755,root,root) /lib/systemd/systemd-quotacheck
@@ -1415,11 +1544,11 @@ fi
%attr(755,root,root) /lib/systemd/systemd-socket-proxyd
%attr(755,root,root) /lib/systemd/systemd-sulogin-shell
%attr(755,root,root) /lib/systemd/systemd-sysctl
-%attr(755,root,root) /lib/systemd/systemd-sysroot-fstab-check
+/lib/systemd/systemd-sysroot-fstab-check
%attr(755,root,root) /lib/systemd/systemd-time-wait-sync
%attr(755,root,root) /lib/systemd/systemd-timedated
%attr(755,root,root) /lib/systemd/systemd-timesyncd
-%attr(755,root,root) /lib/systemd/systemd-udevd
+/lib/systemd/systemd-udevd
%attr(755,root,root) /lib/systemd/systemd-update-utmp
%attr(755,root,root) /lib/systemd/systemd-update-done
%attr(755,root,root) /lib/systemd/systemd-user-runtime-dir
@@ -1457,7 +1586,7 @@ fi
%if %{with efi}
%dir %{_prefix}/lib/systemd/boot
%dir %{_prefix}/lib/systemd/boot/efi
-%ifarch %{ix86}
+%ifarch %{ix86} %{x8664}
%{_prefix}/lib/systemd/boot/efi/addonia32.efi.stub
%{_prefix}/lib/systemd/boot/efi/linuxia32.efi.stub
%{_prefix}/lib/systemd/boot/efi/systemd-bootia32.efi
@@ -1496,6 +1625,9 @@ fi
%{_prefix}/lib/sysusers.d/systemd-journal.conf
%{_prefix}/lib/sysusers.d/systemd-timesync.conf
%{_prefix}/lib/tmpfiles.d/credstore.conf
+%dir %attr(700,root,root) %{_sysconfdir}/credstore
+%dir %attr(700,root,root) %{_sysconfdir}/credstore.encrypted
+%dir %{_prefix}/lib/credstore
%{_prefix}/lib/tmpfiles.d/etc.conf
%{_prefix}/lib/tmpfiles.d/home.conf
%{_prefix}/lib/tmpfiles.d/journal-nocow.conf
@@ -1507,6 +1639,10 @@ fi
%{_prefix}/lib/tmpfiles.d/systemd-nspawn.conf
%{_prefix}/lib/tmpfiles.d/systemd-pstore.conf
%{_prefix}/lib/tmpfiles.d/systemd-tmp.conf
+%{_prefix}/lib/tmpfiles.d/20-systemd-osc-context.conf
+%{_prefix}/lib/tmpfiles.d/20-systemd-shell-extra.conf
+%{_prefix}/lib/tmpfiles.d/20-systemd-ssh-generator.conf
+%{_prefix}/lib/tmpfiles.d/20-systemd-stub.conf
%{_prefix}/lib/tmpfiles.d/tmp.conf
%{_prefix}/lib/tmpfiles.d/var.conf
%{_prefix}/lib/tmpfiles.d/x11.conf
@@ -1528,6 +1664,12 @@ fi
%{_datadir}/polkit-1/actions/org.freedesktop.systemd1.policy
%{_datadir}/polkit-1/actions/org.freedesktop.timedate1.policy
%{_datadir}/polkit-1/actions/org.freedesktop.timesync1.policy
+%{_datadir}/polkit-1/actions/io.systemd.ask-password.policy
+%{_datadir}/polkit-1/actions/io.systemd.credentials.policy
+%{_datadir}/polkit-1/actions/io.systemd.mount-file-system.policy
+%{_datadir}/polkit-1/actions/io.systemd.namespace-resource.policy
+%{_datadir}/polkit-1/rules.d/10-systemd-logind-root-ignore-inhibitors.rules.example
+%{_datadir}/polkit-1/rules.d/empower.rules
%{_datadir}/polkit-1/rules.d/systemd-networkd.rules
%dir %{_datadir}/systemd
%{_datadir}/systemd/kbd-model-map
@@ -1538,7 +1680,7 @@ fi
%{_datadir}/factory/etc/pam.d/other
%{_datadir}/factory/etc/pam.d/system-auth
%{_datadir}/factory/etc/vconsole.conf
-%{?with_efi:%{_mandir}/man1/bootctl.1*}
+%{_mandir}/man1/bootctl.1*
%{_mandir}/man1/busctl.1*
%{_mandir}/man1/coredumpctl.1*
%{_mandir}/man1/hostnamectl.1*
@@ -1573,6 +1715,62 @@ fi
%{_mandir}/man1/systemd-umount.1*
%{_mandir}/man1/timedatectl.1*
%{_mandir}/man1/userdbctl.1*
+%{_mandir}/man1/run0.1*
+%{_mandir}/man1/systemd-keyutil.1*
+%{_mandir}/man1/systemd-mute-console.1*
+%{_mandir}/man1/systemd-mute-console.socket.1*
+%{_mandir}/man1/systemd-mute-console at .service.1*
+%{_mandir}/man1/systemd-pty-forward.1*
+%{_mandir}/man1/systemd-sbsign.1*
+%{_mandir}/man1/systemd-ssh-issue.1*
+%{_mandir}/man1/systemd-ssh-proxy.1*
+%{_mandir}/man1/systemd-vpick.1*
+%{_mandir}/man1/varlinkctl.1*
+%{_mandir}/man5/capsule at .service.5*
+%{_mandir}/man5/confext.conf.5*
+%{_mandir}/man5/confext.conf.d.5*
+%{_mandir}/man5/org.freedesktop.timesync1.5*
+%{_mandir}/man5/sysext.conf.5*
+%{_mandir}/man5/sysext.conf.d.5*
+%{_mandir}/man7/systemd.v.7*
+%{_mandir}/man8/systemd-boot-clear-sysfail.service.8*
+%{_mandir}/man8/systemd-bsod.8*
+%{_mandir}/man8/systemd-bsod.service.8*
+%{_mandir}/man8/systemd-confext-initrd.service.8*
+%{_mandir}/man8/systemd-factory-reset.8*
+%{_mandir}/man8/systemd-factory-reset-complete.service.8*
+%{_mandir}/man8/systemd-factory-reset-generator.8*
+%{_mandir}/man8/systemd-factory-reset-request.service.8*
+%{_mandir}/man8/systemd-factory-reset.socket.8*
+%{_mandir}/man8/systemd-factory-reset at .service.8*
+%{_mandir}/man8/systemd-hibernate-clear.service.8*
+%{_mandir}/man8/systemd-loop at .service.8*
+%{_mandir}/man8/systemd-mountfsd.8*
+%{_mandir}/man8/systemd-mountfsd.service.8*
+%{_mandir}/man8/systemd-nsresourced.8*
+%{_mandir}/man8/systemd-nsresourced.service.8*
+%{_mandir}/man8/systemd-pcrlock.8*
+%{_mandir}/man8/systemd-pcrlock-file-system.service.8*
+%{_mandir}/man8/systemd-pcrlock-firmware-code.service.8*
+%{_mandir}/man8/systemd-pcrlock-firmware-config.service.8*
+%{_mandir}/man8/systemd-pcrlock-machine-id.service.8*
+%{_mandir}/man8/systemd-pcrlock-make-policy.service.8*
+%{_mandir}/man8/systemd-pcrlock-secureboot-authority.service.8*
+%{_mandir}/man8/systemd-pcrlock-secureboot-policy.service.8*
+%{_mandir}/man8/systemd-pcrnvdone.service.8*
+%{_mandir}/man8/systemd-pcrphase-factory-reset.service.8*
+%{_mandir}/man8/systemd-pcrphase-storage-target-mode.service.8*
+%{_mandir}/man8/systemd-pcrproduct.service.8*
+%{_mandir}/man8/systemd-ssh-generator.8*
+%{_mandir}/man8/systemd-storagetm.8*
+%{_mandir}/man8/systemd-storagetm.service.8*
+%{_mandir}/man8/systemd-sysext-initrd.service.8*
+%{_mandir}/man8/systemd-tpm2-clear.service.8*
+%{_mandir}/man8/systemd-tpm2-generator.8*
+%{_mandir}/man8/systemd-tpm2-setup.8*
+%{_mandir}/man8/systemd-tpm2-setup-early.service.8*
+%{_mandir}/man8/systemd-tpm2-setup.service.8*
+%{_mandir}/man8/systemd-validatefs at .service.8*
%{_mandir}/man5/binfmt.d.5*
%{_mandir}/man5/coredump.conf.5*
%{_mandir}/man5/coredump.conf.d.5*
@@ -1618,15 +1816,9 @@ fi
%{_mandir}/man7/file-hierarchy.7*
%{_mandir}/man7/kernel-command-line.7*
%if %{with efi}
-%ifarch %{ix86}
+%{_mandir}/man7/linuxaa64.efi.stub.7*
%{_mandir}/man7/linuxia32.efi.stub.7*
-%endif
-%ifarch %{x8664}
%{_mandir}/man7/linuxx64.efi.stub.7*
-%endif
-%ifarch aarch64
-%{_mandir}/man7/linuxaa64.efi.stub.7*
-%endif
%{_mandir}/man7/sd-boot.7*
%{_mandir}/man7/sd-stub.7*
%{_mandir}/man7/systemd-boot.7*
@@ -1675,7 +1867,6 @@ fi
%{_mandir}/man8/systemd-hibernate-resume.8*
%{_mandir}/man8/systemd-hibernate-resume.service.8*
%{_mandir}/man8/systemd-hostnamed.8*
-%{_mandir}/man8/systemd-initctl.8*
%{_mandir}/man8/systemd-journald-dev-log.socket.8*
%{_mandir}/man8/systemd-journald-varlink at .socket.8*
%{_mandir}/man8/systemd-journald.8*
@@ -1734,17 +1925,19 @@ fi
%if %{with pam}
%attr(755,root,root) /%{_lib}/security/pam_systemd.so
+%attr(755,root,root) /%{_lib}/security/pam_systemd_loadkey.so
+%{_mandir}/man8/pam_systemd_loadkey.8*
%{_mandir}/man8/pam_systemd.8*
%endif
%files init
%defattr(644,root,root,755)
-%attr(755,root,root) /sbin/halt
-%attr(755,root,root) /sbin/init
-%attr(755,root,root) /sbin/poweroff
-%attr(755,root,root) /sbin/reboot
+/sbin/halt
+/sbin/init
+/sbin/poweroff
+/sbin/reboot
%attr(755,root,root) /sbin/runlevel
-%attr(755,root,root) /sbin/shutdown
+/sbin/shutdown
%attr(755,root,root) /sbin/telinit
%{_mandir}/man1/init.1*
%if %{with cryptsetup}
@@ -1755,9 +1948,7 @@ fi
%{_mandir}/man8/halt.8*
%{_mandir}/man8/poweroff.8*
%{_mandir}/man8/reboot.8*
-%{_mandir}/man8/runlevel.8*
%{_mandir}/man8/shutdown.8*
-%{_mandir}/man8/telinit.8*
%files sysv-compat
%defattr(644,root,root,755)
@@ -1795,6 +1986,9 @@ fi
%dir /lib/systemd/pld-helpers.d
%dir /lib/systemd/system-generators
%dir /lib/systemd/system-preset
+%dir /lib/systemd/initrd-preset
+/lib/systemd/initrd-preset/90-systemd.preset
+/lib/systemd/initrd-preset/99-default.preset
/lib/systemd/system-preset/90-systemd.preset
%dir /lib/systemd/system-shutdown
%dir /lib/systemd/system-sleep
@@ -1802,7 +1996,8 @@ fi
%attr(755,root,root) /bin/systemctl
%attr(755,root,root) /bin/systemd-tmpfiles
%attr(755,root,root) /bin/systemd_booted
-%attr(755,root,root) %{_bindir}/systemd-detect-virt
+%attr(755,root,root) /bin/systemd-detect-virt
+%{_bindir}/systemd-detect-virt
%{_mandir}/man1/systemctl.1*
%{_mandir}/man1/systemd-detect-virt.1*
%{_mandir}/man5/tmpfiles.d.5*
@@ -1854,7 +2049,8 @@ fi
%{systemdunitdir}/network.service
%{systemdunitdir}/pld-clean-tmp.service
%{systemdunitdir}/prefdm.service
-%{systemdunitdir}/quotaon.service
+%{systemdunitdir}/quotaon-root.service
+%{systemdunitdir}/quotaon at .service
%{systemdunitdir}/random.service
%{systemdunitdir}/rescue.service
%{systemdunitdir}/serial-getty at .service
@@ -1884,6 +2080,99 @@ fi
%{systemdunitdir}/systemd-halt.service
%{systemdunitdir}/systemd-hibernate.service
%{systemdunitdir}/systemd-hostnamed.service
+%{systemdunitdir}/breakpoint-pre-basic.service
+%{systemdunitdir}/breakpoint-pre-mount.service
+%{systemdunitdir}/breakpoint-pre-switch-root.service
+%{systemdunitdir}/breakpoint-pre-udev.service
+%{systemdunitdir}/capsule.slice
+%{systemdunitdir}/capsule at .service
+%{systemdunitdir}/factory-reset-now.target
+%{systemdunitdir}/imports-pre.target
+%{systemdunitdir}/imports.target
+%{systemdunitdir}/remote-integritysetup.target
+%{systemdunitdir}/ssh-access.target
+%{systemdunitdir}/storage-target-mode.target
+%{systemdunitdir}/system-systemd\x2dmute\x2dconsole.slice
+%{systemdunitdir}/systemd-ask-password.socket
+%{systemdunitdir}/systemd-ask-password at .service
+%{systemdunitdir}/systemd-boot-clear-sysfail.service
+%{systemdunitdir}/systemd-bootctl.socket
+%{systemdunitdir}/systemd-bootctl at .service
+%{systemdunitdir}/systemd-bsod.service
+%{systemdunitdir}/systemd-confext-initrd.service
+%{systemdunitdir}/systemd-creds.socket
+%{systemdunitdir}/systemd-creds at .service
+%{systemdunitdir}/systemd-factory-reset-complete.service
+%{systemdunitdir}/systemd-factory-reset-reboot.service
+%{systemdunitdir}/systemd-factory-reset-request.service
+%{systemdunitdir}/systemd-factory-reset.socket
+%{systemdunitdir}/systemd-factory-reset at .service
+%{systemdunitdir}/systemd-hibernate-clear.service
+%{systemdunitdir}/systemd-hibernate-resume.service
+%{systemdunitdir}/systemd-hostnamed.socket
+%{systemdunitdir}/systemd-journald-sync at .service
+%{systemdunitdir}/systemd-logind-varlink.socket
+%{systemdunitdir}/systemd-loop at .service
+%{systemdunitdir}/systemd-mountfsd.service
+%{systemdunitdir}/systemd-mountfsd.socket
+%{systemdunitdir}/systemd-mute-console.socket
+%{systemdunitdir}/systemd-mute-console at .service
+%{systemdunitdir}/systemd-nsresourced.service
+%{systemdunitdir}/systemd-nsresourced.socket
+%{systemdunitdir}/systemd-pcrextend.socket
+%{systemdunitdir}/systemd-pcrextend at .service
+%{systemdunitdir}/systemd-pcrlock-file-system.service
+%{systemdunitdir}/systemd-pcrlock-firmware-code.service
+%{systemdunitdir}/systemd-pcrlock-firmware-config.service
+%{systemdunitdir}/systemd-pcrlock-machine-id.service
+%{systemdunitdir}/systemd-pcrlock-make-policy.service
+%{systemdunitdir}/systemd-pcrlock-secureboot-authority.service
+%{systemdunitdir}/systemd-pcrlock-secureboot-policy.service
+%{systemdunitdir}/systemd-pcrlock.socket
+%{systemdunitdir}/systemd-pcrlock at .service
+%{systemdunitdir}/systemd-pcrnvdone.service
+%{systemdunitdir}/systemd-pcrphase-factory-reset.service
+%{systemdunitdir}/systemd-pcrphase-storage-target-mode.service
+%{systemdunitdir}/systemd-pcrproduct.service
+%{systemdunitdir}/systemd-storagetm.service
+%{systemdunitdir}/systemd-sysext-initrd.service
+%{systemdunitdir}/systemd-sysext.socket
+%{systemdunitdir}/systemd-sysext at .service
+%{systemdunitdir}/systemd-tpm2-clear.service
+%{systemdunitdir}/systemd-tpm2-setup-early.service
+%{systemdunitdir}/systemd-tpm2-setup.service
+%{systemdunitdir}/systemd-userdb-load-credentials.service
+%{systemdunitdir}/systemd-validatefs at .service
+%{systemdunitdir}/tpm2.target
+%dir %{systemdunitdir}/factory-reset.target.wants
+%{systemdunitdir}/factory-reset.target.wants/systemd-factory-reset-request.service
+%{systemdunitdir}/factory-reset.target.wants/systemd-pcrphase-factory-reset.service
+%dir %{systemdunitdir}/storage-target-mode.target.wants
+%{systemdunitdir}/storage-target-mode.target.wants/systemd-pcrphase-storage-target-mode.service
+%{systemdunitdir}/initrd-root-device.target.wants/remote-integritysetup.target
+%{systemdunitdir}/initrd.target.wants/systemd-bsod.service
+%{systemdunitdir}/initrd.target.wants/systemd-confext-initrd.service
+%{systemdunitdir}/initrd.target.wants/systemd-sysext-initrd.service
+%{systemdunitdir}/sockets.target.wants/systemd-ask-password.socket
+%{systemdunitdir}/sockets.target.wants/systemd-bootctl.socket
+%{systemdunitdir}/sockets.target.wants/systemd-creds.socket
+%{systemdunitdir}/sockets.target.wants/systemd-factory-reset.socket
+%{systemdunitdir}/sockets.target.wants/systemd-hostnamed.socket
+%{systemdunitdir}/sockets.target.wants/systemd-logind-varlink.socket
+%{systemdunitdir}/sockets.target.wants/systemd-mute-console.socket
+%{systemdunitdir}/sockets.target.wants/systemd-pcrextend.socket
+%{systemdunitdir}/sockets.target.wants/systemd-pcrlock.socket
+%{systemdunitdir}/sockets.target.wants/systemd-sysext.socket
+%{systemdunitdir}/sysinit.target.wants/imports.target
+%{systemdunitdir}/sysinit.target.wants/systemd-hibernate-clear.service
+%{systemdunitdir}/sysinit.target.wants/systemd-pcrnvdone.service
+%{systemdunitdir}/sysinit.target.wants/systemd-pcrproduct.service
+%{systemdunitdir}/sysinit.target.wants/systemd-tpm2-setup-early.service
+%{systemdunitdir}/sysinit.target.wants/systemd-tpm2-setup.service
+%{systemduserunitdir}/capsule at .target
+%{systemduserunitdir}/systemd-ask-password.socket
+%{systemduserunitdir}/systemd-ask-password at .service
+%{systemduserunitdir}/sockets.target.wants/systemd-ask-password.socket
%{systemdunitdir}/systemd-hwdb-update.service
%{systemdunitdir}/systemd-hybrid-sleep.service
%{systemdunitdir}/systemd-initctl.service
@@ -1906,7 +2195,8 @@ fi
%{systemdunitdir}/systemd-pcrphase.service
%endif
%{systemdunitdir}/systemd-poweroff.service
-%{systemdunitdir}/systemd-quotacheck.service
+%{systemdunitdir}/systemd-quotacheck-root.service
+%{systemdunitdir}/systemd-quotacheck at .service
%{systemdunitdir}/systemd-random-seed.service
%{systemdunitdir}/systemd-reboot.service
%{systemdunitdir}/systemd-remount-fs.service
@@ -1929,7 +2219,6 @@ fi
%{systemdunitdir}/systemd-udevd.service
%dir %{systemdunitdir}/systemd-udevd.service.d
%{systemdunitdir}/systemd-update-done.service
-%{systemdunitdir}/systemd-update-utmp-runlevel.service
%{systemdunitdir}/systemd-update-utmp.service
%{systemdunitdir}/systemd-user-sessions.service
%{systemdunitdir}/systemd-userdbd.service
@@ -1958,6 +2247,8 @@ fi
%{systemdunitdir}/systemd-journald at .socket
%{systemdunitdir}/systemd-udevd-control.socket
%{systemdunitdir}/systemd-udevd-kernel.socket
+%{systemdunitdir}/systemd-udev-load-credentials.service
+%{systemdunitdir}/systemd-udevd-varlink.socket
%{systemdunitdir}/basic.target
%{systemdunitdir}/blockdev at .target
%{systemdunitdir}/bluetooth.target
@@ -2064,7 +2355,6 @@ fi
%{systemdunitdir}/initrd-root-device.target.wants/remote-veritysetup.target
%endif
%{systemdunitdir}/graphical.target.wants/display-manager.service
-%{systemdunitdir}/graphical.target.wants/systemd-update-utmp-runlevel.service
%{systemdunitdir}/initrd.target.wants/systemd-battery-check.service
%if %{with efi} && %{with tpm2}
%{systemdunitdir}/initrd.target.wants/systemd-pcrphase-initrd.service
@@ -2076,9 +2366,7 @@ fi
%{systemdunitdir}/multi-user.target.wants/rc-local.service
%{systemdunitdir}/multi-user.target.wants/systemd-ask-password-wall.path
%{systemdunitdir}/multi-user.target.wants/systemd-logind.service
-%{systemdunitdir}/multi-user.target.wants/systemd-update-utmp-runlevel.service
%{systemdunitdir}/multi-user.target.wants/systemd-user-sessions.service
-%{systemdunitdir}/rescue.target.wants/systemd-update-utmp-runlevel.service
%{systemdunitdir}/sigpwr.target.wants/sigpwr-container-shutdown.service
%{systemdunitdir}/sockets.target.wants/systemd-coredump.socket
%{systemdunitdir}/sockets.target.wants/systemd-initctl.socket
@@ -2086,6 +2374,7 @@ fi
%{systemdunitdir}/sockets.target.wants/systemd-journald.socket
%{systemdunitdir}/sockets.target.wants/systemd-udevd-control.socket
%{systemdunitdir}/sockets.target.wants/systemd-udevd-kernel.socket
+%{systemdunitdir}/sockets.target.wants/systemd-udevd-varlink.socket
%if %{with cryptsetup}
%{systemdunitdir}/sysinit.target.wants/cryptsetup.target
%{systemdunitdir}/sysinit.target.wants/integritysetup.target
@@ -2180,8 +2469,6 @@ fi
%{_mandir}/man8/systemd-hibernate.service.8*
%{_mandir}/man8/systemd-hostnamed.service.8*
%{_mandir}/man8/systemd-hybrid-sleep.service.8*
-%{_mandir}/man8/systemd-initctl.service.8*
-%{_mandir}/man8/systemd-initctl.socket.8*
%{_mandir}/man8/systemd-journald.service.8*
%{_mandir}/man8/systemd-journald.socket.8*
%{_mandir}/man8/systemd-journald-audit.socket.8*
@@ -2195,11 +2482,12 @@ fi
%{_mandir}/man8/systemd-pcrmachine.service.8*
%{_mandir}/man8/systemd-pcrphase-initrd.service.8*
%{_mandir}/man8/systemd-pcrphase-sysinit.service.8*
-%{_mandir}/man8/systemd-pcrphase.8*
+%{_mandir}/man8/systemd-pcrextend.8*
%{_mandir}/man8/systemd-pcrphase.service.8*
%endif
%{_mandir}/man8/systemd-poweroff.service.8*
-%{_mandir}/man8/systemd-quotacheck.service.8*
+%{_mandir}/man8/systemd-quotacheck-root.service.8*
+%{_mandir}/man8/systemd-quotacheck at .service.8*
%{_mandir}/man8/systemd-random-seed.service.8*
%{_mandir}/man8/systemd-reboot.service.8*
%{_mandir}/man8/systemd-remount-fs.service.8*
@@ -2220,7 +2508,7 @@ fi
%{_mandir}/man8/systemd-udevd.service.8*
%{_mandir}/man8/systemd-udevd-control.socket.8*
%{_mandir}/man8/systemd-udevd-kernel.socket.8*
-%{_mandir}/man8/systemd-update-utmp-runlevel.service.8*
+%{_mandir}/man8/systemd-udevd-varlink.socket.8*
%{_mandir}/man8/systemd-update-utmp.service.8*
%{_mandir}/man8/systemd-user-sessions.service.8*
%{_mandir}/man8/systemd-userdbd.service.8*
@@ -2228,23 +2516,32 @@ fi
%files tools
%defattr(644,root,root,755)
-%attr(755,root,root) %{_bindir}/systemd-cgls
-%attr(755,root,root) %{_bindir}/systemd-cgtop
+%attr(755,root,root) /bin/systemd-cgls
+%{_bindir}/systemd-cgls
+%attr(755,root,root) /bin/systemd-cgtop
+%{_bindir}/systemd-cgtop
%{_mandir}/man1/systemd-cgls.1*
%{_mandir}/man1/systemd-cgtop.1*
%files container
%defattr(644,root,root,755)
%attr(755,root,root) /bin/machinectl
-/lib/systemd/import-pubring.gpg
+/lib/systemd/import-pubring.pgp
%attr(755,root,root) /lib/systemd/systemd-export
%attr(755,root,root) /lib/systemd/systemd-import
%attr(755,root,root) /lib/systemd/systemd-import-fs
%attr(755,root,root) /lib/systemd/systemd-machined
%attr(755,root,root) /lib/systemd/systemd-pull
%attr(755,root,root) /lib/systemd/systemd-importd
-%attr(755,root,root) %{_bindir}/systemd-dissect
-%attr(755,root,root) /sbin/mount.ddi
+%attr(755,root,root) /bin/importctl
+%attr(755,root,root) /lib/systemd/system-generators/systemd-import-generator
+%{_datadir}/dbus-1/services/org.freedesktop.import1.service
+%{_datadir}/dbus-1/services/org.freedesktop.machine1.service
+%{_mandir}/man1/importctl.1*
+%{_mandir}/man8/systemd-import-generator.8*
+%attr(755,root,root) /bin/systemd-dissect
+%{_bindir}/systemd-dissect
+/sbin/mount.ddi
%{_datadir}/dbus-1/system-services/org.freedesktop.import1.service
%{_datadir}/dbus-1/system-services/org.freedesktop.machine1.service
%{_datadir}/dbus-1/interfaces/org.freedesktop.import1.*.xml
@@ -2258,6 +2555,7 @@ fi
%{_mandir}/man5/org.freedesktop.import1.5*
%{_mandir}/man5/org.freedesktop.machine1.5*
%{_mandir}/man7/systemd.image-policy.7*
+%{_mandir}/man7/systemd.image-filter.7*
%{_mandir}/man8/systemd-importd.8*
%{_mandir}/man8/systemd-importd.service.8*
%{_mandir}/man8/systemd-machined.8*
@@ -2271,6 +2569,21 @@ fi
%{systemdunitdir}/var-lib-machines.mount
%{systemdunitdir}/systemd-importd.service
%{systemdunitdir}/systemd-machined.service
+%{systemdunitdir}/systemd-importd.socket
+%{systemdunitdir}/systemd-machined.socket
+%{systemdunitdir}/sockets.target.wants/systemd-importd.socket
+%{systemdunitdir}/sockets.target.wants/systemd-machined.socket
+%{systemduserunitdir}/dbus-org.freedesktop.import1.service
+%{systemduserunitdir}/dbus-org.freedesktop.machine1.service
+%{systemduserunitdir}/machine.slice
+%{systemduserunitdir}/machines.target
+%{systemduserunitdir}/systemd-importd.service
+%{systemduserunitdir}/systemd-importd.socket
+%{systemduserunitdir}/systemd-machined.service
+%{systemduserunitdir}/systemd-machined.socket
+%{systemduserunitdir}/systemd-nspawn at .service
+%{systemduserunitdir}/sockets.target.wants/systemd-importd.socket
+%{systemduserunitdir}/sockets.target.wants/systemd-machined.socket
%if %{with microhttpd}
%files journal-remote
@@ -2303,18 +2616,22 @@ fi
%files homed
%defattr(644,root,root,755)
-%attr(755,root,root) %{_bindir}/homectl
+%attr(755,root,root) /bin/homectl
+%{_bindir}/homectl
+/bin/systemd-home-fallback-shell
%attr(755,root,root) /lib/systemd/systemd-homed
%attr(755,root,root) /lib/systemd/systemd-homework
%attr(755,root,root) /%{_lib}/security/pam_systemd_home.so
%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/systemd/homed.conf
%{systemdunitdir}/systemd-homed.service
%{systemdunitdir}/systemd-homed-activate.service
+%{systemdunitdir}/systemd-homed-firstboot.service
%{_datadir}/dbus-1/interfaces/org.freedesktop.home1.*.xml
%{_datadir}/dbus-1/system-services/org.freedesktop.home1.service
%{_datadir}/dbus-1/system.d/org.freedesktop.home1.conf
%{_datadir}/polkit-1/actions/org.freedesktop.home1.policy
%{_mandir}/man1/homectl.1*
+%{_mandir}/man1/systemd-homed-firstboot.service.1*
%{_mandir}/man5/homed.conf.5*
%{_mandir}/man5/homed.conf.d.5*
%{_mandir}/man5/org.freedesktop.home1.5*
@@ -2336,12 +2653,29 @@ fi
/lib/systemd/network/80-container-vz.network
/lib/systemd/network/80-vm-vt.network
/lib/systemd/network/80-wifi-adhoc.network
+/lib/systemd/network/80-6rd-tunnel.link
+/lib/systemd/network/80-auto-link-local.network.example
+/lib/systemd/network/80-container-host0-tun.network
+/lib/systemd/network/80-container-vb.link
+/lib/systemd/network/80-container-ve.link
+/lib/systemd/network/80-container-vz.link
+/lib/systemd/network/80-namespace-ns-tun.link
+/lib/systemd/network/80-namespace-ns-tun.network
+/lib/systemd/network/80-namespace-ns.link
+/lib/systemd/network/80-namespace-ns.network
+/lib/systemd/network/80-vm-vt.link
+/lib/systemd/network/80-wifi-ap.network.example
+/lib/systemd/network/80-wifi-station.network.example
+/lib/systemd/network/89-ethernet.network.example
%{_prefix}/lib/sysusers.d/systemd-network.conf
%{systemdunitdir}/systemd-network-generator.service
%{systemdunitdir}/systemd-networkd-wait-online.service
%{systemdunitdir}/systemd-networkd-wait-online at .service
%{systemdunitdir}/systemd-networkd.service
%{systemdunitdir}/systemd-networkd.socket
+%{systemdunitdir}/systemd-networkd-persistent-storage.service
+%{systemdunitdir}/systemd-networkd-resolve-hook.socket
+%{systemdunitdir}/systemd-networkd-varlink.socket
%{_datadir}/dbus-1/system-services/org.freedesktop.network1.service
%{_datadir}/polkit-1/actions/org.freedesktop.network1.policy
%attr(755,root,root) /bin/networkctl
@@ -2363,7 +2697,8 @@ fi
%files oomd
%defattr(644,root,root,755)
-%attr(755,root,root) %{_bindir}/oomctl
+%attr(755,root,root) /bin/oomctl
+%{_bindir}/oomctl
%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/systemd/oomd.conf
%attr(755,root,root) /lib/systemd/systemd-oomd
%{_prefix}/lib/sysusers.d/systemd-oom.conf
@@ -2411,9 +2746,13 @@ fi
%dir %{_sysconfdir}/repart.d
%attr(755,root,root) /bin/systemd-repart
%{systemdunitdir}/systemd-repart.service
+%{systemdunitdir}/systemd-repart.socket
+%{systemdunitdir}/systemd-repart at .service
+%{systemdunitdir}/sockets.target.wants/systemd-repart.socket
%{systemdunitdir}/initrd-root-fs.target.wants/systemd-repart.service
%{systemdunitdir}/sysinit.target.wants/systemd-repart.service
%dir %{_prefix}/lib/repart.d
+/lib/systemd/repart
%{_mandir}/man5/repart.d.5*
%{_mandir}/man8/systemd-repart.8*
%{_mandir}/man8/systemd-repart.service.8*
@@ -2428,8 +2767,11 @@ fi
%{_datadir}/dbus-1/system-services/org.freedesktop.resolve1.service
%{_datadir}/polkit-1/actions/org.freedesktop.resolve1.policy
%{systemdunitdir}/systemd-resolved.service
-%attr(755,root,root) /sbin/resolvconf
-%attr(755,root,root) %{_bindir}/resolvectl
+%{systemdunitdir}/systemd-resolved-monitor.socket
+%{systemdunitdir}/systemd-resolved-varlink.socket
+/sbin/resolvconf
+%attr(755,root,root) /bin/resolvectl
+%{_bindir}/resolvectl
%attr(755,root,root) /lib/systemd/systemd-resolved
%{_mandir}/man1/resolvconf.1*
%{_mandir}/man1/resolvectl.1*
@@ -2449,6 +2791,7 @@ fi
%attr(755,root,root) /lib/systemd/systemd-sysupdate
%dir %{_prefix}/lib/sysupdate.d
%{_mandir}/man5/sysupdate.d.5*
+%{_mandir}/man5/sysupdate.features.5*
%{_mandir}/man8/systemd-sysupdate.8*
%{_mandir}/man8/systemd-sysupdate.service.8*
%{_mandir}/man8/systemd-sysupdate.timer.8*
@@ -2462,13 +2805,16 @@ fi
%files analyze
%defattr(644,root,root,755)
-%attr(755,root,root) %{_bindir}/systemd-analyze
+%attr(755,root,root) /bin/systemd-analyze
+%{_bindir}/systemd-analyze
%{_mandir}/man1/systemd-analyze.1*
%if %{with efi}
%files ukify
%defattr(644,root,root,755)
-%attr(755,root,root) /lib/systemd/ukify
+%attr(755,root,root) /bin/ukify
+%{_bindir}/ukify
+/lib/systemd/ukify
%{_prefix}/lib/kernel/install.d/60-ukify.install
%{_mandir}/man1/ukify.1*
%endif
@@ -2479,8 +2825,8 @@ fi
%attr(755,root,root) /%{_lib}/libnss_mymachines.so.2
%attr(755,root,root) /%{_lib}/libnss_resolve.so.2
%attr(755,root,root) /%{_lib}/libnss_systemd.so.2
-%attr(755,root,root) /%{_lib}/libsystemd.so.*.*.*
-%attr(755,root,root) %ghost /%{_lib}/libsystemd.so.0
+/%{_lib}/libsystemd.so.*.*.*
+%ghost /%{_lib}/libsystemd.so.0
%if "%{_lib}" != "lib"
%dir /%{_lib}/systemd
%endif
@@ -2493,7 +2839,7 @@ fi
%files devel
%defattr(644,root,root,755)
-%attr(755,root,root) /%{_lib}/libsystemd.so
+/%{_lib}/libsystemd.so
%{_includedir}/%{name}
%{_pkgconfigdir}/libsystemd.pc
%{_npkgconfigdir}/systemd.pc
@@ -2508,6 +2854,7 @@ fi
%{bash_compdir}/coredumpctl
%{bash_compdir}/homectl
%{bash_compdir}/hostnamectl
+%{bash_compdir}/importctl
%{bash_compdir}/journalctl
%{bash_compdir}/kernel-install
%{bash_compdir}/localectl
@@ -2517,11 +2864,14 @@ fi
%{bash_compdir}/oomctl
%{bash_compdir}/portablectl
%{bash_compdir}/resolvectl
+%{bash_compdir}/run0
%{bash_compdir}/systemctl
%{bash_compdir}/systemd-analyze
%{bash_compdir}/systemd-cat
%{bash_compdir}/systemd-cgls
%{bash_compdir}/systemd-cgtop
+%{bash_compdir}/systemd-confext
+%{bash_compdir}/systemd-creds
%{bash_compdir}/systemd-cryptenroll
%{bash_compdir}/systemd-delta
%{bash_compdir}/systemd-detect-virt
@@ -2532,7 +2882,10 @@ fi
%{bash_compdir}/systemd-resolve
%{bash_compdir}/systemd-run
%{bash_compdir}/systemd-sysext
+%{bash_compdir}/systemd-vpick
%{bash_compdir}/timedatectl
+%{bash_compdir}/userdbctl
+%{bash_compdir}/varlinkctl
%files -n zsh-completion-systemd
%defattr(644,root,root,755)
@@ -2548,6 +2901,8 @@ fi
%{zsh_compdir}/_networkctl
%{zsh_compdir}/_oomctl
%{zsh_compdir}/_resolvectl
+%{zsh_compdir}/_run0
+%{zsh_compdir}/_sd_bus_address
%{zsh_compdir}/_sd_hosts_or_user_at_host
%{zsh_compdir}/_sd_machines
%{zsh_compdir}/_sd_outputmodes
@@ -2556,12 +2911,15 @@ fi
%{zsh_compdir}/_systemd
%{zsh_compdir}/_systemd-analyze
%{zsh_compdir}/_systemd-delta
+%{zsh_compdir}/_systemd-id128
%{zsh_compdir}/_systemd-inhibit
%{zsh_compdir}/_systemd-nspawn
%{zsh_compdir}/_systemd-path
%{zsh_compdir}/_systemd-run
%{zsh_compdir}/_systemd-tmpfiles
%{zsh_compdir}/_timedatectl
+%{zsh_compdir}/_userdbctl
+%{zsh_compdir}/_varlinkctl
%files -n udev
%defattr(644,root,root,755)
@@ -2585,7 +2943,7 @@ fi
%attr(755,root,root) /lib/udev/scsi_id
%attr(755,root,root) /lib/udev/v4l_id
-%attr(755,root,root) /lib/udev/udevd
+/lib/udev/udevd
/lib/udev/hwdb.d/20-acpi-vendor.hwdb
/lib/udev/hwdb.d/20-bluetooth-vendor-product.hwdb
@@ -2612,6 +2970,7 @@ fi
/lib/udev/hwdb.d/70-cameras.hwdb
/lib/udev/hwdb.d/70-hardware-wallets.hwdb
/lib/udev/hwdb.d/70-joystick.hwdb
+/lib/udev/hwdb.d/70-maker-tools.hwdb
/lib/udev/hwdb.d/70-mouse.hwdb
/lib/udev/hwdb.d/70-pda.hwdb
/lib/udev/hwdb.d/70-pointingstick.hwdb
@@ -2619,10 +2978,11 @@ fi
/lib/udev/hwdb.d/70-sound-card.hwdb
/lib/udev/hwdb.d/70-touchpad.hwdb
/lib/udev/hwdb.d/80-ieee1394-unit-function.hwdb
+/lib/udev/hwdb.d/82-net-auto-link-local.hwdb
%attr(755,root,root) %{_rootsbindir}/start_udev
-%attr(755,root,root) %{_rootsbindir}/udevd
-%attr(755,root,root) %{_rootsbindir}/udevadm
+%{_rootsbindir}/udevd
+%{_rootsbindir}/udevadm
%attr(755,root,root) /bin/systemd-hwdb
%attr(755,root,root) /bin/udevadm
@@ -2656,11 +3016,14 @@ fi
/lib/udev/rules.d/60-drm.rules
/lib/udev/rules.d/60-evdev.rules
/lib/udev/rules.d/60-fido-id.rules
+/lib/udev/rules.d/60-gpiochip.rules
/lib/udev/rules.d/60-infiniband.rules
/lib/udev/rules.d/60-input-id.rules
/lib/udev/rules.d/60-persistent-alsa.rules
+/lib/udev/rules.d/60-persistent-hidraw.rules
/lib/udev/rules.d/60-persistent-input.rules
/lib/udev/rules.d/60-persistent-storage.rules
+/lib/udev/rules.d/60-persistent-storage-mtd.rules
/lib/udev/rules.d/60-persistent-storage-tape.rules
/lib/udev/rules.d/60-persistent-v4l.rules
/lib/udev/rules.d/60-sensor.rules
@@ -2681,11 +3044,15 @@ fi
/lib/udev/rules.d/80-drivers.rules
/lib/udev/rules.d/80-net-setup-link.rules
/lib/udev/rules.d/81-net-dhcp.rules
+/lib/udev/rules.d/81-net-bridge.rules
+/lib/udev/rules.d/82-net-auto-link-local.rules
+/lib/udev/rules.d/90-image-dissect.rules
/lib/udev/rules.d/90-iocost.rules
/lib/udev/rules.d/90-vconsole.rules
%{_mandir}/man5/iocost.conf.5*
%{_mandir}/man5/udev.conf.5*
+%{_mandir}/man5/udev.conf.d.5*
%{_mandir}/man7/udev.7*
%{_mandir}/man7/hwdb.7*
%{_mandir}/man8/systemd-hwdb.8*
@@ -2694,12 +3061,12 @@ fi
%files -n udev-libs
%defattr(644,root,root,755)
-%attr(755,root,root) /%{_lib}/libudev.so.*.*.*
-%attr(755,root,root) %ghost /%{_lib}/libudev.so.1
+/%{_lib}/libudev.so.*.*.*
+%ghost /%{_lib}/libudev.so.1
%files -n udev-devel
%defattr(644,root,root,755)
-%attr(755,root,root) /%{_lib}/libudev.so
+/%{_lib}/libudev.so
%{_includedir}/libudev.h
%{_pkgconfigdir}/libudev.pc
%{_npkgconfigdir}/udev.pc
@@ -2709,10 +3076,12 @@ fi
%files -n bash-completion-udev
%defattr(644,root,root,755)
%{bash_compdir}/udevadm
+%{bash_compdir}/systemd-hwdb
%files -n zsh-completion-udev
%defattr(644,root,root,755)
%{zsh_compdir}/_udevadm
+%{zsh_compdir}/_systemd-hwdb
%files -n rpm-macros-systemd
%defattr(644,root,root,755)
diff --git a/config-pld.patch b/config-pld.patch
index d1a8e75..3a8ce2e 100644
--- a/config-pld.patch
+++ b/config-pld.patch
@@ -1,20 +1,18 @@
--- systemd-stable-250/tmpfiles.d/legacy.conf.in.orig 2021-12-27 11:37:45.454887047 +0100
+++ systemd-stable-250/tmpfiles.d/legacy.conf.in 2021-12-27 11:39:02.180866644 +0100
@@ -10,7 +10,7 @@
- # These files are considered legacy and are unnecessary on legacy-free
- # systems.
+ # by newer interfaces. Their use is discouraged on legacy-free systems. This
+ # configuration is provided to maintain backward compatibility.
-d /run/lock 0755 root root -
+d /run/lock 1771 root root -
L /var/lock - - - - ../run/lock
{% if CREATE_LOG_DIRS %}
- L /var/log/README - - - - ../..{{DOC_DIR}}/README.logs
-@@ -19,7 +19,7 @@
+ L$ /var/log/README - - - - ../..{{DOC_DIR}}/README.logs
+@@ -19,5 +19,5 @@
+ {% if HAVE_SYSV_COMPAT %}
# /run/lock/subsys is used for serializing SysV service execution, and
# hence without use on SysV-less systems.
-
-d /run/lock/subsys 0755 root root -
+d /run/lock/subsys 0700 root root -
-
- # /forcefsck, /fastboot and /forcequotacheck are deprecated in favor of the
- # kernel command line options 'fsck.mode=force', 'fsck.mode=skip' and
+ {% endif %}
diff --git a/net-rename-revert.patch b/net-rename-revert.patch
index 8de05a6..8e6307f 100644
--- a/net-rename-revert.patch
+++ b/net-rename-revert.patch
@@ -8,6 +8,23 @@ generated names. Re-apply this old hack to make the renaming less likely to fail
--- systemd-stable-246.1/src/udev/udev-event.c.orig 2020-08-07 17:09:53.000000000 +0200
+++ systemd-stable-246.1/src/udev/udev-event.c 2020-08-15 11:04:10.263428290 +0200
+@@ -2,6 +2,8 @@
+
+ #include "sd-netlink.h"
+
++#include <linux/if.h>
++
+ #include "alloc-util.h"
+ #include "device-internal.h"
+ #include "device-private.h"
+@@ -15,6 +15,7 @@
+ #include "socket-util.h"
+ #include "string-util.h"
+ #include "strv.h"
++#include "strxcpyx.h"
+ #include "time-util.h"
+ #include "udev-event.h"
+ #include "udev-node.h"
@@ -820,6 +820,8 @@
const char *s;
sd_device *dev;
diff --git a/optional-tmp-on-tmpfs.patch b/optional-tmp-on-tmpfs.patch
index a699cfc..204ffa6 100644
--- a/optional-tmp-on-tmpfs.patch
+++ b/optional-tmp-on-tmpfs.patch
@@ -3,7 +3,7 @@
@@ -20,3 +20,6 @@ What=tmpfs
Where=/tmp
Type=tmpfs
- Options=mode=1777,strictatime,nosuid,nodev,size=50%%,nr_inodes=1m
+ Options=mode=1777,strictatime,nosuid,nodev,size=50%%,nr_inodes=1m,x-systemd.graceful-option=usrquota
+
+[Install]
+WantedBy=local-fs.target
diff --git a/pld-boot_efi_mount.patch b/pld-boot_efi_mount.patch
index 7ed2147..f766050 100644
--- a/pld-boot_efi_mount.patch
+++ b/pld-boot_efi_mount.patch
@@ -1,68 +1,21 @@
--- systemd-stable-254.1/src/gpt-auto-generator/gpt-auto-generator.c.orig 2023-08-09 22:33:59.978475054 +0200
+++ systemd-stable-254.1/src/gpt-auto-generator/gpt-auto-generator.c 2023-08-09 22:41:09.618936068 +0200
-@@ -487,6 +487,18 @@
- return cache;
- }
-
-+static int slash_boot_efi_in_fstab(void) {
-+ static int cache = -1;
-+
-+ if (cache >= 0)
-+ return cache;
-+
-+ cache = fstab_is_mount_point("/boot/efi");
-+ if (cache < 0)
-+ return log_error_errno(cache, "Failed to parse fstab: %m");
-+ return cache;
-+}
-+
- static int add_partition_xbootldr(DissectedPartition *p) {
- _cleanup_free_ char *options = NULL;
- int r;
-@@ -562,6 +574,21 @@
- return (cache = false);
- }
-
-+static bool slash_boot_efi_exists(void) {
-+ static int cache = -1;
-+
-+ if (cache >= 0)
-+ return cache;
-+
-+ if (access("/boot/efi", F_OK) >= 0)
-+ return (cache = true);
-+ if (errno != ENOENT)
-+ log_error_errno(errno, "Failed to determine whether /boot/efi exists, assuming no: %m");
-+ else
-+ log_debug_errno(errno, "/boot/efi: %m");
-+ return (cache = false);
-+}
-+
- static int add_partition_esp(DissectedPartition *p, bool has_xbootldr) {
- const char *esp_path = NULL, *id = NULL;
- _cleanup_free_ char *options = NULL;
-@@ -582,19 +609,19 @@
+@@ -582,15 +609,15 @@
if (r > 0)
return 0;
-- /* If /boot/ is present, unused, and empty, we'll take that.
-+ /* If /boot/efi is present, unused, and empty, we'll take that.
+- /* If XBOOTLDR partition is not present and /boot/ is unused and empty, we'll take that.
++ /* If XBOOTLDR partition is not present and /boot/efi/ is unused and empty, we'll take that.
* Otherwise, if /efi/ is unused and empty (or missing), we'll take that.
* Otherwise, we do nothing. */
-- if (!has_xbootldr && slash_boot_exists()) {
-- r = slash_boot_in_fstab();
-+ if (!has_xbootldr && slash_boot_efi_exists()) {
-+ r = slash_boot_efi_in_fstab();
+ if (!has_xbootldr) {
+- r = path_is_busy("/boot");
++ r = path_is_busy("/boot/efi");
if (r < 0)
return r;
if (r == 0) {
-- r = path_is_busy("/boot");
-+ r = path_is_busy("/boot/efi");
- if (r < 0)
- return r;
- if (r == 0) {
-- esp_path = "/boot";
-+ esp_path = "/boot/efi";
- id = "boot";
- }
+- esp_path = "/boot";
++ esp_path = "/boot/efi";
+ id = "boot";
}
+ }
diff --git a/pld-pam-systemd-user.patch b/pld-pam-systemd-user.patch
index 3a69a54..501079f 100644
--- a/pld-pam-systemd-user.patch
+++ b/pld-pam-systemd-user.patch
@@ -1,14 +1,13 @@
--- systemd-stable-249/src/login/systemd-user.in.orig 2021-07-07 19:41:29.000000000 +0200
+++ systemd-stable-249/src/login/systemd-user.in 2021-07-07 22:39:21.502935327 +0200
-@@ -2,21 +2,11 @@
+@@ -2,20 +2,11 @@
#
# Used by systemd --user instances.
-{% if ENABLE_HOMED %}
---account sufficient pam_systemd_home.so
+--account [success=done authtok_expired=bad new_authtok_reqd=bad maxtries=bad acct_expired=bad default=ignore] pam_systemd_home.so
-{% endif %}
--account sufficient pam_unix.so no_pass_expiry
--account required pam_permit.so
+-account required pam_unix.so no_pass_expiry
-
+account include system-auth
{% if HAVE_SELINUX %}
diff --git a/pld-sysv-network.patch b/pld-sysv-network.patch
index e2eb088..3e950e5 100644
--- a/pld-sysv-network.patch
+++ b/pld-sysv-network.patch
@@ -15,11 +15,11 @@ diff -dur -x '*.orig' systemd-218.orig/src/sysv-generator/sysv-generator.c syste
--- systemd-218.orig/src/sysv-generator/sysv-generator.c 2014-12-05 01:26:51.000000000 +0100
+++ systemd-218/src/sysv-generator/sysv-generator.c 2015-04-03 15:02:21.000000000 +0200
@@ -325,6 +325,15 @@
+
line++;
- t = strstrip(l);
+ // PLD specific ugly hack to detect SysV services requiring network
-+ if (startswith_no_case(t, ". /etc/sysconfig/network")) {
++ if (startswith_no_case(l, ". /etc/sysconfig/network")) {
+ r = strv_extend(&s->wants, "network.target");
+ if (r < 0)
+ log_error("[%s:%u] Failed to add dependency on network.target, ignoring: %s", s->path, line, strerror(-r));
@@ -27,6 +27,6 @@ diff -dur -x '*.orig' systemd-218.orig/src/sysv-generator/sysv-generator.c syste
+ if (r < 0)
+ log_error("[%s:%u] Failed to add dependency on network.target, ignoring: %s", s->path, line, strerror(-r));
+ }
- if (*t != '#') {
+ if (l[0] != '#') {
/* Try to figure out whether this init script supports
* the reload operation. This heuristic looks for
diff --git a/rpm-macros.patch b/rpm-macros.patch
index 43dd90d..44f8757 100644
--- a/rpm-macros.patch
+++ b/rpm-macros.patch
@@ -53,11 +53,11 @@
+# %preun
+# %systemd_user_preun %{name}.service
- %_systemd_util_dir {{ROOTLIBEXECDIR}}
+ %_systemd_util_dir {{LIBEXECDIR}}
%_unitdir {{SYSTEM_DATA_UNIT_DIR}}
@@ -173,3 +221,34 @@
%{expand:%%{?__systemd_someargs_%#:%%__systemd_someargs_%# binfmt_apply}} \
- [ -x {{ROOTLIBEXECDIR}}/systemd-binfmt ] && {{ROOTLIBEXECDIR}}/systemd-binfmt %{?*} || : \
+ [ -x {{LIBEXECDIR}}/systemd-binfmt ] && {{LIBEXECDIR}}/systemd-binfmt %{?*} || : \
%{nil}
+
+# PLD macros
diff --git a/systemd-CVE-2026-15059.patch b/systemd-CVE-2026-15059.patch
deleted file mode 100644
index a767fdd..0000000
--- a/systemd-CVE-2026-15059.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-CVE-2026-15059: oomd ReportManagedOOMCGroups accepts ../ in cgroup paths;
-unprivileged users can make oomd SIGKILL arbitrary processes.
-https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6
-Upstream v258.9: a8feb2f235; from Ubuntu noble 255.4-1ubuntu8.17.
-
- src/oom/oomd-manager.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/src/oom/oomd-manager.c b/src/oom/oomd-manager.c
-index 49896ea..20757a8 100644
---- a/src/oom/oomd-manager.c
-+++ b/src/oom/oomd-manager.c
-@@ -79,6 +79,11 @@ static int process_managed_oom_message(Manager *m, uid_t uid, JsonVariant *param
- if (r < 0)
- continue;
-
-+ if (!path_is_normalized(empty_to_root(message.path))) {
-+ log_debug("Received non-normalized cgroup path '%s', ignoring.", message.path);
-+ continue;
-+ }
-+
- if (uid != 0) {
- uid_t cg_uid;
-
diff --git a/systemd-CVE-2026-16742.patch b/systemd-CVE-2026-16742.patch
deleted file mode 100644
index d3f3567..0000000
--- a/systemd-CVE-2026-16742.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-CVE-2026-16742: homed stores worker-supplied user records without signature
-verification; a homed user can add itself to privileged groups.
-https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv
-Upstream v258.10: 8735bb63b7 04cba0a78d; from Ubuntu noble 255.4-1ubuntu8.17.
-
- src/home/homed-home.c | 19 ++++++++++
- test/units/testsuite-46.sh | 71 ++++++++++++++++++++++++++++++++++++++
- 2 files changed, 90 insertions(+)
-
-diff --git a/src/home/homed-home.c b/src/home/homed-home.c
-index b0fee2a..58f4b7b 100644
---- a/src/home/homed-home.c
-+++ b/src/home/homed-home.c
-@@ -921,10 +921,18 @@ static void home_change_finish(Home *h, int ret, UserRecord *hr) {
- }
-
- if (hr) {
-+ bool signed_locally = false;
-+
-+ r = home_verify_user_record(h, hr, &signed_locally, &error);
-+ if (r < 0)
-+ goto finish;
-+
- r = home_set_record(h, hr);
- if (r < 0)
- log_warning_errno(r, "Failed to update home record, ignoring: %m");
- else {
-+ h->signed_locally = signed_locally;
-+
- r = user_record_good_authentication(h->record);
- if (r < 0)
- log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
-@@ -1027,10 +1035,21 @@ static void home_authenticating_finish(Home *h, int ret, UserRecord *hr) {
- }
-
- if (hr) {
-+ bool signed_locally = false, signed_locally_needs_update = false;
-+
-+ r = home_verify_user_record(h, hr, &signed_locally, /* ret_error= */ NULL);
-+ if (r < 0)
-+ hr = h->record;
-+ else
-+ signed_locally_needs_update = true;
-+
- r = home_set_record(h, hr);
- if (r < 0)
- log_warning_errno(r, "Failed to update home record, ignoring: %m");
- else {
-+ if (signed_locally_needs_update)
-+ h->signed_locally = signed_locally;
-+
- r = user_record_good_authentication(h->record);
- if (r < 0)
- log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
-diff --git a/test/units/testsuite-46.sh b/test/units/testsuite-46.sh
-index 8c0b9ea..0e9f027 100755
---- a/test/units/testsuite-46.sh
-+++ b/test/units/testsuite-46.sh
-@@ -33,6 +33,75 @@ wait_for_state() {
- done
- }
-
-+testcase_identity_groups() {
-+ NEWPASSWORD=foobar homectl create idgrouptest --storage=directory --shell=/bin/bash --enforce-password-policy=no --rebalance-weight=off
-+ PASSWORD=foobar homectl activate idgrouptest
-+
-+ machinectl shell idgrouptest@ /usr/bin/bash -euxo pipefail -c "jq '.memberOf = ((.memberOf // []) + [\"systemd-journal\"] | unique) | .lastChangeUSec = ((.lastChangeUSec // 0) + 3600000000)' /home/idgrouptest/.identity > /home/idgrouptest/.identity.new && mv -f /home/idgrouptest/.identity.new /home/idgrouptest/.identity"
-+ jq -e '.memberOf | index("systemd-journal") != null' /home/idgrouptest/.identity
-+
-+ PASSWORD=foobar homectl authenticate idgrouptest
-+
-+ local groups
-+ groups="$(machinectl shell idgrouptest@ /usr/bin/groups)"
-+ (! grep systemd-journal <<<"$groups" >/dev/null)
-+
-+ homectl deactivate idgrouptest ||:
-+ wait_for_state idgrouptest inactive
-+ homectl remove idgrouptest
-+
-+ # Install a PK rule that allows 'idgrouptest2' user to update homed even
-+ # though they are not on an fg console, just for testing
-+ mkdir -p /etc/polkit-1/rules.d
-+ cat >/etc/polkit-1/rules.d/updatehome.rules <<'EOF'
-+polkit.addRule(function(action, subject) {
-+ if (action.id == "org.freedesktop.home1.update-home-by-owner" &&
-+ subject.user == "idgrouptest2") {
-+ return polkit.Result.YES;
-+ }
-+});
-+EOF
-+ trap 'rm -f /etc/polkit-1/rules.d/updatehome.rules' RETURN ERR EXIT
-+ systemctl try-reload-or-restart polkit.service
-+
-+ NEWPASSWORD=foobar homectl create idgrouptest2 --storage=directory --shell=/bin/bash --enforce-password-policy=no --rebalance-weight=off
-+ PASSWORD=foobar homectl activate idgrouptest2
-+
-+ cat >/tmp/idgrouptest-add-group.sh <<'EOF'
-+#!/bin/bash
-+set -exuo pipefail
-+
-+loginctl show-session "${XDG_SESSION_ID:?}" -p Active --value | grep '^yes$' >/dev/null
-+RECORD="$(busctl -j call org.freedesktop.home1 /org/freedesktop/home1 org.freedesktop.home1.Manager GetUserRecordByName s "$USER" | jq -r '.data[0]')"
-+TS="$(printf '%s' "$RECORD" | jq '.lastChangeUSec')"
-+NEW_TS=$((TS + 172800000000))
-+jq --arg g systemd-journal --argjson ts "$NEW_TS" \
-+ '.memberOf = ((.memberOf // []) + [$g]) | .lastChangeUSec = $ts' \
-+ ~/.identity > ~/.identity.new
-+mv -f ~/.identity.new ~/.identity
-+# Ensure the identity update is persisted before UpdateHomeEx reads it.
-+sync
-+
-+UPDATE_TS=$((TS + 1))
-+UPDATE_RECORD="$(printf '%s' "$RECORD" | jq -c --argjson ts "$UPDATE_TS" --arg p foobar 'del(.binding, .status, .signature) | .lastChangeUSec = $ts | .secret = {password: [$p]}')"
-+(! busctl call org.freedesktop.home1 /org/freedesktop/home1 org.freedesktop.home1.Manager UpdateHomeEx "sa{sh}t" "$UPDATE_RECORD" 0 0 )
-+EOF
-+ chmod +x /tmp/idgrouptest-add-group.sh
-+ machinectl shell idgrouptest2@ /tmp/idgrouptest-add-group.sh
-+ rm -f /tmp/idgrouptest-add-group.sh
-+
-+ PASSWORD=foobar homectl authenticate idgrouptest2
-+
-+ local groups
-+ groups="$(machinectl shell idgrouptest2@ /usr/bin/groups)"
-+ (! grep systemd-journal <<<"$groups" >/dev/null)
-+
-+ homectl deactivate idgrouptest2 ||:
-+ wait_for_state idgrouptest2 inactive
-+ homectl remove idgrouptest2
-+}
-+
-+
- systemd-analyze log-level debug
- systemctl service-log-level systemd-homed debug
-
-@@ -170,6 +239,8 @@ if ! systemd-detect-virt -cq ; then
- homectl remove test-user2
- fi
-
-+testcase_identity_groups
-+
- # userdbctl tests
- export PAGER=
-
diff --git a/systemd-CVE-2026-29111.patch b/systemd-CVE-2026-29111.patch
deleted file mode 100644
index 313b2f6..0000000
--- a/systemd-CVE-2026-29111.patch
+++ /dev/null
@@ -1,239 +0,0 @@
-CVE-2026-29111: unprivileged GetUnitByControlGroup()/AttachProcesses call with
-oversized or unnormalized cgroup path asserts PID 1 (stack via strdupa/strjoina).
-https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764
-Upstream v257.11: 20021e7686 7ac3220213 2116700657 54588d2ded; from Ubuntu noble
-255.4-1ubuntu8.17; core/cgroup.c part ported to 254 (no PidRef).
-
- src/basic/fs-util.c | 2 +-
- src/basic/mkdir.c | 2 +-
- src/basic/path-util.c | 39 ++++++++++++++++++++++++++++-----------
- src/basic/path-util.h | 10 ++++++++--
- src/core/cgroup.c | 21 ++++++++++-----------
- src/core/dbus-manager.c | 6 ++++++
- src/test/test-path-util.c | 16 ++++++++++++++++
- 7 files changed, 70 insertions(+), 26 deletions(-)
-
-diff --git a/src/basic/fs-util.c b/src/basic/fs-util.c
-index 479b036..e28d6a3 100644
---- a/src/basic/fs-util.c
-+++ b/src/basic/fs-util.c
-@@ -64,7 +64,7 @@ int rmdir_parents(const char *path, const char *stop) {
- assert(*slash == '/');
- *slash = '\0';
-
-- if (path_startswith_full(stop, p, /* accept_dot_dot= */ false))
-+ if (path_startswith_full(stop, p, PATH_STARTSWITH_REFUSE_DOT_DOT))
- return 0;
-
- if (rmdir(p) < 0 && errno != ENOENT)
-diff --git a/src/basic/mkdir.c b/src/basic/mkdir.c
-index 41af148..5ea7ceb 100644
---- a/src/basic/mkdir.c
-+++ b/src/basic/mkdir.c
-@@ -154,7 +154,7 @@ int mkdir_parents_internal(const char *prefix, const char *path, mode_t mode, ui
- assert(_mkdirat != mkdirat);
-
- if (prefix) {
-- p = path_startswith_full(path, prefix, /* accept_dot_dot= */ false);
-+ p = path_startswith_full(path, prefix, PATH_STARTSWITH_REFUSE_DOT_DOT);
- if (!p)
- return -ENOTDIR;
- } else
-diff --git a/src/basic/path-util.c b/src/basic/path-util.c
-index 216410e..b04125b 100644
---- a/src/basic/path-util.c
-+++ b/src/basic/path-util.c
-@@ -397,8 +397,8 @@ char* path_simplify_full(char *path, PathSimplifyFlags flags) {
- return path;
- }
-
--char* path_startswith_full(const char *path, const char *prefix, bool accept_dot_dot) {
-- assert(path);
-+char* path_startswith_full(const char *original_path, const char *prefix, PathStartWithFlags flags) {
-+ assert(original_path);
- assert(prefix);
-
- /* Returns a pointer to the start of the first component after the parts matched by
-@@ -411,28 +411,45 @@ char* path_startswith_full(const char *path, const char *prefix, bool accept_dot
- * Returns NULL otherwise.
- */
-
-+ const char *path = original_path;
-+
- if ((path[0] == '/') != (prefix[0] == '/'))
- return NULL;
-
- for (;;) {
- const char *p, *q;
-- int r, k;
-+ int m, n;
-
-- r = path_find_first_component(&path, accept_dot_dot, &p);
-- if (r < 0)
-+ m = path_find_first_component(&path, !FLAGS_SET(flags, PATH_STARTSWITH_REFUSE_DOT_DOT), &p);
-+ if (m < 0)
- return NULL;
-
-- k = path_find_first_component(&prefix, accept_dot_dot, &q);
-- if (k < 0)
-+ n = path_find_first_component(&prefix, !FLAGS_SET(flags, PATH_STARTSWITH_REFUSE_DOT_DOT), &q);
-+ if (n < 0)
- return NULL;
-
-- if (k == 0)
-- return (char*) (p ?: path);
-+ if (n == 0) {
-+ if (!p)
-+ p = path;
-+
-+ if (FLAGS_SET(flags, PATH_STARTSWITH_RETURN_LEADING_SLASH)) {
-+
-+ if (p <= original_path)
-+ return NULL;
-+
-+ p--;
-+
-+ if (*p != '/')
-+ return NULL;
-+ }
-+
-+ return (char*) p;
-+ }
-
-- if (r != k)
-+ if (m != n)
- return NULL;
-
-- if (!strneq(p, q, r))
-+ if (!strneq(p, q, m))
- return NULL;
- }
- }
-diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 6e7b493..924cf84 100644
---- a/src/basic/path-util.h
-+++ b/src/basic/path-util.h
-@@ -63,9 +63,15 @@ int safe_getcwd(char **ret);
- int path_make_absolute_cwd(const char *p, char **ret);
- int path_make_relative(const char *from, const char *to, char **ret);
- int path_make_relative_parent(const char *from_child, const char *to, char **ret);
--char* path_startswith_full(const char *path, const char *prefix, bool accept_dot_dot) _pure_;
-+
-+typedef enum PathStartWithFlags {
-+ PATH_STARTSWITH_REFUSE_DOT_DOT = 1U << 0,
-+ PATH_STARTSWITH_RETURN_LEADING_SLASH = 1U << 1,
-+} PathStartWithFlags;
-+
-+char* path_startswith_full(const char *path, const char *prefix, PathStartWithFlags flags) _pure_;
- static inline char* path_startswith(const char *path, const char *prefix) {
-- return path_startswith_full(path, prefix, true);
-+ return path_startswith_full(path, prefix, 0);
- }
-
- int path_compare(const char *a, const char *b) _pure_;
-diff --git a/src/core/cgroup.c b/src/core/cgroup.c
-index 8fe9305..8291b0a 100644
---- a/src/core/cgroup.c
-+++ b/src/core/cgroup.c
-@@ -2404,12 +2404,13 @@ static int unit_update_cgroup(
- return 0;
- }
-
--static int unit_attach_pid_to_cgroup_via_bus(Unit *u, pid_t pid, const char *suffix_path) {
-+static int unit_attach_pid_to_cgroup_via_bus(Unit *u, const char *cgroup_path, pid_t pid) {
- _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
-- char *pp;
- int r;
-
- assert(u);
-+ assert(cgroup_path);
-+ assert(pid_is_valid(pid));
-
- if (MANAGER_IS_SYSTEM(u->manager))
- return -EINVAL;
-@@ -2417,17 +2418,13 @@ static int unit_attach_pid_to_cgroup_via_bus(Unit *u, pid_t pid, const char *suf
- if (!u->manager->system_bus)
- return -EIO;
-
-- if (!u->cgroup_path)
-- return -EINVAL;
--
- /* Determine this unit's cgroup path relative to our cgroup root */
-- pp = path_startswith(u->cgroup_path, u->manager->cgroup_root);
-+ const char *pp = path_startswith_full(cgroup_path,
-+ u->manager->cgroup_root,
-+ PATH_STARTSWITH_RETURN_LEADING_SLASH|PATH_STARTSWITH_REFUSE_DOT_DOT);
- if (!pp)
- return -EINVAL;
-
-- pp = strjoina("/", pp, suffix_path);
-- path_simplify(pp);
--
- r = bus_call_method(u->manager->system_bus,
- bus_systemd_mgr,
- "AttachProcessesToUnit",
-@@ -2466,8 +2463,10 @@ int unit_attach_pids_to_cgroup(Unit *u, Set *pids, const char *suffix_path) {
- return r;
-
- if (isempty(suffix_path))
-- p = u->cgroup_path;
-+ p = empty_to_root(u->cgroup_path);
- else {
-+ assert(path_is_absolute(suffix_path));
-+
- joined = path_join(u->cgroup_path, suffix_path);
- if (!joined)
- return -ENOMEM;
-@@ -2498,7 +2497,7 @@ int unit_attach_pids_to_cgroup(Unit *u, Set *pids, const char *suffix_path) {
- * Since it's more privileged it might be able to move the process across the
- * leaves of a subtree whose top node is not owned by us. */
-
-- z = unit_attach_pid_to_cgroup_via_bus(u, pid, suffix_path);
-+ z = unit_attach_pid_to_cgroup_via_bus(u, p, pid);
- if (z < 0)
- log_unit_info_errno(u, z, "Couldn't move process "PID_FMT" to requested cgroup '%s' (directly or via the system bus): %m", pid, empty_to_root(p));
- else {
-diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
-index 91fe54b..1e2d45a 100644
---- a/src/core/dbus-manager.c
-+++ b/src/core/dbus-manager.c
-@@ -666,6 +666,12 @@ static int method_get_unit_by_control_group(sd_bus_message *message, void *userd
- if (r < 0)
- return r;
-
-+ if (!path_is_absolute(cgroup))
-+ return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Control group path is not absolute: %s", cgroup);
-+
-+ if (!path_is_normalized(cgroup))
-+ return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Control group path is not normalized: %s", cgroup);
-+
- u = manager_get_unit_by_cgroup(m, cgroup);
- if (!u)
- return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT,
-diff --git a/src/test/test-path-util.c b/src/test/test-path-util.c
-index 46a0c57..19cf9db 100644
---- a/src/test/test-path-util.c
-+++ b/src/test/test-path-util.c
-@@ -714,6 +714,22 @@ TEST(path_startswith) {
- test_path_startswith_one("/foo/bar/barfoo/", "/fo", NULL, NULL);
- }
-
-+static void test_path_startswith_return_leading_slash_one(const char *path, const char *prefix, const char *expected) {
-+ const char *p;
-+
-+ log_debug("/* %s(%s, %s) */", __func__, path, prefix);
-+
-+ p = path_startswith_full(path, prefix, PATH_STARTSWITH_RETURN_LEADING_SLASH);
-+ assert_se(streq_ptr(p, expected));
-+}
-+
-+TEST(path_startswith_return_leading_slash) {
-+ test_path_startswith_return_leading_slash_one("/foo/bar", "/", "/foo/bar");
-+ test_path_startswith_return_leading_slash_one("/foo/bar", "/foo", "/bar");
-+ test_path_startswith_return_leading_slash_one("/foo/bar", "/foo/bar", NULL);
-+ test_path_startswith_return_leading_slash_one("/foo/bar/", "/foo/bar", "/");
-+}
-+
- static void test_prefix_root_one(const char *r, const char *p, const char *expected) {
- _cleanup_free_ char *s = NULL;
- const char *t;
diff --git a/systemd-CVE-2026-40225.patch b/systemd-CVE-2026-40225.patch
deleted file mode 100644
index 17159af..0000000
--- a/systemd-CVE-2026-40225.patch
+++ /dev/null
@@ -1,157 +0,0 @@
-CVE-2026-40225: scsi_id/v4l_id/net_id/dmi_memory_id print unsanitized device
-strings into udev properties; a crafted device can inject e.g. SYSTEMD_WANTS=.
-https://github.com/systemd/systemd/security/advisories/GHSA-vpfq-8p5f-jcqx
-Upstream v257.13: 03bb697b8d 5887e72ff8; from Ubuntu noble 255.4-1ubuntu8.17;
-net_id part ported to 254 (port name is checked where each name is built).
-
- src/udev/dmi_memory_id/dmi_memory_id.c | 3 ++-
- src/udev/scsi_id/scsi_id.c | 3 ++-
- src/udev/udev-builtin-net_id.c | 26 ++++++++++++++++++++------
- src/udev/v4l_id/v4l_id.c | 5 ++++-
- 4 files changed, 28 insertions(+), 9 deletions(-)
-
-diff --git a/src/udev/dmi_memory_id/dmi_memory_id.c b/src/udev/dmi_memory_id/dmi_memory_id.c
-index 52ea250..4f2c21b 100644
---- a/src/udev/dmi_memory_id/dmi_memory_id.c
-+++ b/src/udev/dmi_memory_id/dmi_memory_id.c
-@@ -51,6 +51,7 @@
- #include "string-util.h"
- #include "udev-util.h"
- #include "unaligned.h"
-+#include "utf8.h"
-
- #define SUPPORTED_SMBIOS_VER 0x030300
-
-@@ -185,7 +186,7 @@ static void dmi_memory_device_string(
-
- str = strdupa_safe(dmi_string(h, s));
- str = strstrip(str);
-- if (!isempty(str))
-+ if (!isempty(str) && utf8_is_valid(str) && !string_has_cc(str, /* ok= */ NULL))
- printf("MEMORY_DEVICE_%u_%s=%s\n", slot_num, attr_suffix, str);
- }
-
-diff --git a/src/udev/scsi_id/scsi_id.c b/src/udev/scsi_id/scsi_id.c
-index 6308c52..b2df8d9 100644
---- a/src/udev/scsi_id/scsi_id.c
-+++ b/src/udev/scsi_id/scsi_id.c
-@@ -27,6 +27,7 @@
- #include "strv.h"
- #include "strxcpyx.h"
- #include "udev-util.h"
-+#include "utf8.h"
-
- static const struct option options[] = {
- { "device", required_argument, NULL, 'd' },
-@@ -443,7 +444,7 @@ static int scsi_id(char *maj_min_dev) {
- }
- if (dev_scsi.tgpt_group[0] != '\0')
- printf("ID_TARGET_PORT=%s\n", dev_scsi.tgpt_group);
-- if (dev_scsi.unit_serial_number[0] != '\0')
-+ if (dev_scsi.unit_serial_number[0] != '\0' && utf8_is_valid(dev_scsi.unit_serial_number) && !string_has_cc(dev_scsi.unit_serial_number, /* ok= */ NULL))
- printf("ID_SCSI_SERIAL=%s\n", dev_scsi.unit_serial_number);
- goto out;
- }
-diff --git a/src/udev/udev-builtin-net_id.c b/src/udev/udev-builtin-net_id.c
-index 01bfb78..f54e06d 100644
---- a/src/udev/udev-builtin-net_id.c
-+++ b/src/udev/udev-builtin-net_id.c
-@@ -39,6 +39,7 @@
- #include "strv.h"
- #include "strxcpyx.h"
- #include "udev-builtin.h"
-+#include "utf8.h"
-
- #define ONBOARD_14BIT_INDEX_MAX ((1U << 14) - 1)
- #define ONBOARD_16BIT_INDEX_MAX ((1U << 16) - 1)
-@@ -163,6 +164,14 @@ static bool is_valid_onboard_index(unsigned long idx) {
- return idx <= (naming_scheme_has(NAMING_16BIT_INDEX) ? ONBOARD_16BIT_INDEX_MAX : ONBOARD_14BIT_INDEX_MAX);
- }
-
-+static bool phys_port_name_is_valid(sd_device *dev, const char *phys_port_name) {
-+ if (utf8_is_valid(phys_port_name) && !string_has_cc(phys_port_name, /* ok= */ NULL))
-+ return true;
-+
-+ log_device_debug(dev, "Invalid phys_port_name, not generating names using it.");
-+ return false;
-+}
-+
- /* retrieve on-board index number and label from firmware */
- static int dev_pci_onboard(sd_device *dev, const LinkInfo *info, NetNames *names) {
- unsigned long idx, dev_port = 0;
-@@ -213,7 +222,7 @@ static int dev_pci_onboard(sd_device *dev, const LinkInfo *info, NetNames *names
- l = strpcpyf(&s, l, "r%d", info->vf_representor_id);
- else if (!isempty(info->phys_port_name))
- /* kernel provided front panel port name for multiple port PCI device */
-- l = strpcpyf(&s, l, "n%s", info->phys_port_name);
-+ l = phys_port_name_is_valid(dev, info->phys_port_name) ? strpcpyf(&s, l, "n%s", info->phys_port_name) : 0;
- else if (dev_port > 0)
- l = strpcpyf(&s, l, "d%lu", dev_port);
- if (l == 0)
-@@ -222,10 +231,13 @@ static int dev_pci_onboard(sd_device *dev, const LinkInfo *info, NetNames *names
- idx, strempty(info->phys_port_name), dev_port,
- special_glyph(SPECIAL_GLYPH_ARROW_RIGHT), empty_to_na(names->pci_onboard));
-
-- if (sd_device_get_sysattr_value(names->pcidev, "label", &names->pci_onboard_label) >= 0)
-- log_device_debug(dev, "Onboard label from PCI device: %s", names->pci_onboard_label);
-- else
-+ if (sd_device_get_sysattr_value(names->pcidev, "label", &names->pci_onboard_label) < 0)
- names->pci_onboard_label = NULL;
-+ else if (!utf8_is_valid(names->pci_onboard_label) || string_has_cc(names->pci_onboard_label, /* ok= */ NULL)) {
-+ log_device_debug(dev, "Invalid onboard label from PCI device, ignoring.");
-+ names->pci_onboard_label = NULL;
-+ } else
-+ log_device_debug(dev, "Onboard label from PCI device: %s", names->pci_onboard_label);
-
- return 0;
- }
-@@ -399,7 +411,7 @@ static int dev_pci_slot(sd_device *dev, const LinkInfo *info, NetNames *names) {
- l = strpcpyf(&s, l, "r%d", info->vf_representor_id);
- else if (!isempty(info->phys_port_name))
- /* kernel provided front panel port name for multi-port PCI device */
-- l = strpcpyf(&s, l, "n%s", info->phys_port_name);
-+ l = phys_port_name_is_valid(dev, info->phys_port_name) ? strpcpyf(&s, l, "n%s", info->phys_port_name) : 0;
- else if (dev_port > 0)
- l = strpcpyf(&s, l, "d%lu", dev_port);
- if (l == 0)
-@@ -495,7 +507,7 @@ static int dev_pci_slot(sd_device *dev, const LinkInfo *info, NetNames *names) {
- /* For VF representor append 'r<VF_NUM>' and not phys_port_name */
- l = strpcpyf(&s, l, "r%d", info->vf_representor_id);
- else if (!isempty(info->phys_port_name))
-- l = strpcpyf(&s, l, "n%s", info->phys_port_name);
-+ l = phys_port_name_is_valid(dev, info->phys_port_name) ? strpcpyf(&s, l, "n%s", info->phys_port_name) : 0;
- else if (dev_port > 0)
- l = strpcpyf(&s, l, "d%lu", dev_port);
- if (l == 0)
-@@ -970,6 +982,8 @@ static int names_netdevsim(sd_device *dev, const LinkInfo *info, NetNames *names
-
- if (isempty(info->phys_port_name))
- return -EINVAL;
-+ if (!phys_port_name_is_valid(dev, info->phys_port_name))
-+ return -EINVAL;
-
- r = sd_device_get_parent_with_subsystem_devtype(dev, "netdevsim", NULL, &netdevsimdev);
- if (r < 0)
-diff --git a/src/udev/v4l_id/v4l_id.c b/src/udev/v4l_id/v4l_id.c
-index 30527e9..2ec96d8 100644
---- a/src/udev/v4l_id/v4l_id.c
-+++ b/src/udev/v4l_id/v4l_id.c
-@@ -29,6 +29,8 @@
- #include "build.h"
- #include "fd-util.h"
- #include "main-func.h"
-+#include "string-util.h"
-+#include "utf8.h"
-
- static const char *arg_device = NULL;
-
-@@ -82,7 +84,8 @@ static int run(int argc, char *argv[]) {
- int capabilities;
-
- printf("ID_V4L_VERSION=2\n");
-- printf("ID_V4L_PRODUCT=%s\n", v2cap.card);
-+ if (utf8_is_valid((char *)v2cap.card) && !string_has_cc((char *)v2cap.card, /* ok= */ NULL))
-+ printf("ID_V4L_PRODUCT=%s\n", v2cap.card);
- printf("ID_V4L_CAPABILITIES=:");
-
- if (v2cap.capabilities & V4L2_CAP_DEVICE_CAPS)
diff --git a/systemd-CVE-2026-40226.patch b/systemd-CVE-2026-40226.patch
deleted file mode 100644
index 5725ef9..0000000
--- a/systemd-CVE-2026-40226.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-CVE-2026-40226: malformed PivotRoot=/BindUser=/Ephemeral= in .nspawn files spawn
-the container on the host rootfs.
-https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx
-Upstream v257.12: 773fd3b6e7 bfa0a84282; from Ubuntu noble 255.4-1ubuntu8.17.
-
- src/nspawn/nspawn-mount.c | 4 +++-
- src/nspawn/nspawn.c | 18 ++++++++++++++----
- 2 files changed, 17 insertions(+), 5 deletions(-)
-
-diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c
-index 0a85b5d..b73b9d6 100644
---- a/src/nspawn/nspawn-mount.c
-+++ b/src/nspawn/nspawn-mount.c
-@@ -1255,7 +1255,9 @@ int pivot_root_parse(char **pivot_root_new, char **pivot_root_old, const char *s
-
- if (!path_is_absolute(root_new))
- return -EINVAL;
-- if (root_old && !path_is_absolute(root_old))
-+ if (!path_is_normalized(root_new))
-+ return -EINVAL;
-+ if (root_old && (!path_is_absolute(root_old) || !path_is_normalized(root_old)))
- return -EINVAL;
-
- free_and_replace(*pivot_root_new, root_new);
-diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 7f6417b..073f1f7 100644
---- a/src/nspawn/nspawn.c
-+++ b/src/nspawn/nspawn.c
-@@ -4341,8 +4341,13 @@ static int merge_settings(Settings *settings, const char *path) {
- }
-
- if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 &&
-- settings->ephemeral >= 0)
-- arg_ephemeral = settings->ephemeral;
-+ settings->ephemeral >= 0) {
-+
-+ if (!arg_settings_trusted)
-+ log_warning("Ignoring ephemeral setting, file %s is not trusted.", path);
-+ else
-+ arg_ephemeral = settings->ephemeral;
-+ }
-
- if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
- settings->root) {
-@@ -4510,8 +4515,13 @@ static int merge_settings(Settings *settings, const char *path) {
- }
-
- if ((arg_settings_mask & SETTING_BIND_USER) == 0 &&
-- !strv_isempty(settings->bind_user))
-- strv_free_and_replace(arg_bind_user, settings->bind_user);
-+ !strv_isempty(settings->bind_user)) {
-+
-+ if (!arg_settings_trusted)
-+ log_warning("Ignoring bind user setting, file %s is not trusted.", path);
-+ else
-+ strv_free_and_replace(arg_bind_user, settings->bind_user);
-+ }
-
- if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0 &&
- settings->notify_ready >= 0)
diff --git a/systemd-CVE-2026-4105.patch b/systemd-CVE-2026-4105.patch
deleted file mode 100644
index 13b2330..0000000
--- a/systemd-CVE-2026-4105.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-CVE-2026-4105: machined RegisterMachine accepts class=host, leaving a usable
-privileged machine object (needs a polkit policy granting register-machine).
-https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862
-Upstream 6941d92dc2; from Debian bookworm 252.39-1~deb12u2.
-
- src/machine/machined-dbus.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c
-index 2050bb2..58de076 100644
---- a/src/machine/machined-dbus.c
-+++ b/src/machine/machined-dbus.c
-@@ -270,7 +270,7 @@ static int method_create_or_register_machine(Manager *manager, sd_bus_message *m
- c = _MACHINE_CLASS_INVALID;
- else {
- c = machine_class_from_string(class);
-- if (c < 0)
-+ if (c < 0 || !IN_SET(c, MACHINE_CONTAINER, MACHINE_VM))
- return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid machine class parameter");
- }
-
diff --git a/systemd-GHSA-3jgj-3phh-hx5j.patch b/systemd-GHSA-3jgj-3phh-hx5j.patch
deleted file mode 100644
index 9d7ad35..0000000
--- a/systemd-GHSA-3jgj-3phh-hx5j.patch
+++ /dev/null
@@ -1,274 +0,0 @@
-GHSA-3jgj-3phh-hx5j: unbounded lists in D-Bus/varlink calls to PID 1, resolved
-and userdb let unprivileged users exhaust memory/CPU.
-https://github.com/systemd/systemd/security/advisories/GHSA-3jgj-3phh-hx5j
-From Ubuntu noble 255.4-1ubuntu8.17 (7 of 9 upstream commits; 7671b43cb8 and
-1c534452e9 patch functions 254 does not have); manager.h context ported.
-
- src/basic/env-util.h | 2 ++
- src/core/dbus-manager.c | 40 ++++++++++++++++++++++++++---
- src/core/manager.h | 6 ++++-
- src/libsystemd/sd-bus/bus-message.c | 4 ++-
- src/machine/machine-dbus.c | 4 +++
- src/resolve/resolved-link-bus.c | 7 ++++-
- src/resolve/resolved-link.h | 1 +
- src/shared/json.c | 3 ++-
- src/shared/user-record.c | 3 ++-
- 9 files changed, 62 insertions(+), 8 deletions(-)
-
-diff --git a/src/basic/env-util.h b/src/basic/env-util.h
-index c1ea486..a3c1de5 100644
---- a/src/basic/env-util.h
-+++ b/src/basic/env-util.h
-@@ -15,6 +15,8 @@ static inline size_t sc_arg_max(void) {
- return (size_t) l;
- }
-
-+#define ENVIRONMENT_ASSIGNMENTS_MAX 16384U
-+
- bool env_name_is_valid(const char *e);
- bool env_value_is_valid(const char *e);
- bool env_assignment_is_valid(const char *e);
-diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
-index 1e2d45a..8f5bfa1 100644
---- a/src/core/dbus-manager.c
-+++ b/src/core/dbus-manager.c
-@@ -967,6 +967,10 @@ static int method_list_units_by_names(sd_bus_message *message, void *userdata, s
- if (r < 0)
- return r;
-
-+ if (strv_length(units) > MAX(hashmap_size(m->units), (unsigned) MANAGER_MAX_NAMES / 2))
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED,
-+ "Too many unit names requested.");
-+
- r = sd_bus_message_new_method_return(message, &reply);
- if (r < 0)
- return r;
-@@ -1251,9 +1255,13 @@ static int list_units_filtered(sd_bus_message *message, void *userdata, sd_bus_e
-
- /* Anyone can call this method */
-
-- r = mac_selinux_access_check(message, "status", error);
-- if (r < 0)
-- return r;
-+ if (strv_length(states) > MANAGER_MAX_STATES_PER_CALL)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED,
-+ "Too many states in a single query.");
-+
-+ if (strv_length(patterns) > MANAGER_MAX_PATTERNS_PER_CALL)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED,
-+ "Too many patterns in a single query.");
-
- r = sd_bus_message_new_method_return(message, &reply);
- if (r < 0)
-@@ -1267,6 +1275,10 @@ static int list_units_filtered(sd_bus_message *message, void *userdata, sd_bus_e
- if (k != u->id)
- continue;
-
-+ _cleanup_(sd_bus_error_free) sd_bus_error unused_error = SD_BUS_ERROR_NULL;
-+ r = mac_selinux_unit_access_check(u, message, "status", &unused_error);
-+ if (r < 0)
-+ continue; /* silently skip units the caller is not allowed to see */
- if (!strv_isempty(states) &&
- !strv_contains(states, unit_load_state_to_string(u->load_state)) &&
- !strv_contains(states, unit_active_state_to_string(unit_active_state(u))) &&
-@@ -1441,6 +1453,10 @@ static int dump_impl(
-
- assert(message);
-
-+ if (strv_length(patterns) > MANAGER_MAX_PATTERNS_PER_CALL)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED,
-+ "Too many patterns in a single query.");
-+
- /* 'status' access is the bare minimum always needed for this, as the policy might straight out
- * forbid a client from querying any information from systemd, regardless of any rate limiting. */
- r = mac_selinux_access_check(message, "status", error);
-@@ -1954,6 +1970,10 @@ static int method_set_environment(sd_bus_message *message, void *userdata, sd_bu
- r = sd_bus_message_read_strv(message, &plus);
- if (r < 0)
- return r;
-+
-+ if (strv_length(plus) > ENVIRONMENT_ASSIGNMENTS_MAX)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED,
-+ "Too many environment assignments in a single query.");
- if (!strv_env_is_valid(plus))
- return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments");
-
-@@ -1985,6 +2005,9 @@ static int method_unset_environment(sd_bus_message *message, void *userdata, sd_
- if (r < 0)
- return r;
-
-+ if (strv_length(minus) > ENVIRONMENT_ASSIGNMENTS_MAX)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED,
-+ "Too many environment variable names in a single query.");
- if (!strv_env_name_or_assignment_is_valid(minus))
- return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS,
- "Invalid environment variable names or assignments");
-@@ -2021,6 +2044,9 @@ static int method_unset_and_set_environment(sd_bus_message *message, void *userd
- if (r < 0)
- return r;
-
-+ if (strv_length(plus) > ENVIRONMENT_ASSIGNMENTS_MAX || strv_length(minus) > ENVIRONMENT_ASSIGNMENTS_MAX)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED,
-+ "Too many environment variable names or assignments in a single query.");
- if (!strv_env_name_or_assignment_is_valid(minus))
- return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS,
- "Invalid environment variable names or assignments");
-@@ -2243,6 +2269,14 @@ static int list_unit_files_by_patterns(sd_bus_message *message, void *userdata,
-
- /* Anyone can call this method */
-
-+ if (strv_length(states) > MANAGER_MAX_STATES_PER_CALL)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED,
-+ "Too many states in a single query.");
-+
-+ if (strv_length(patterns) > MANAGER_MAX_PATTERNS_PER_CALL)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED,
-+ "Too many patterns in a single query.");
-+
- r = mac_selinux_access_check(message, "status", error);
- if (r < 0)
- return r;
-diff --git a/src/core/manager.h b/src/core/manager.h
-index a6c87dc..5b919b9 100644
---- a/src/core/manager.h
-+++ b/src/core/manager.h
-@@ -20,9 +20,13 @@
- struct libmnt_monitor;
- typedef struct Unit Unit;
-
--/* Enforce upper limit how many names we allow */
-+/* Enforce upper limit on how many names we allow */
- #define MANAGER_MAX_NAMES 131072 /* 128K */
-
-+/* Enforce upper limit on the number of patterns/states requested over IPC */
-+#define MANAGER_MAX_PATTERNS_PER_CALL 4096U
-+#define MANAGER_MAX_STATES_PER_CALL 256U
-+
- typedef struct Manager Manager;
-
- /* An externally visible state. We don't actually maintain this as state variable, but derive it from various fields
-diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
-index 7d75b67..f0747e3 100644
---- a/src/libsystemd/sd-bus/bus-message.c
-+++ b/src/libsystemd/sd-bus/bus-message.c
-@@ -4295,6 +4295,7 @@ int bus_message_get_blob(sd_bus_message *m, void **buffer, size_t *sz) {
- _public_ int sd_bus_message_read_strv_extend(sd_bus_message *m, char ***l) {
- char type;
- const char *contents, *s;
-+ size_t n;
- int r;
-
- assert(m);
-@@ -4311,9 +4312,10 @@ _public_ int sd_bus_message_read_strv_extend(sd_bus_message *m, char ***l) {
- if (r <= 0)
- return r;
-
-+ n = strv_length(*l);
- /* sd_bus_message_read_basic() does content validation for us. */
- while ((r = sd_bus_message_read_basic(m, *contents, &s)) > 0) {
-- r = strv_extend(l, s);
-+ r = strv_extend_with_size(l, &n, s);
- if (r < 0)
- return r;
- }
-diff --git a/src/machine/machine-dbus.c b/src/machine/machine-dbus.c
-index 5ecb570..7c3a14f 100644
---- a/src/machine/machine-dbus.c
-+++ b/src/machine/machine-dbus.c
-@@ -640,6 +640,10 @@ int bus_machine_method_open_shell(sd_bus_message *message, void *userdata, sd_bu
- r = sd_bus_message_read_strv(message, &env);
- if (r < 0)
- return r;
-+
-+ if (strv_length(env) > ENVIRONMENT_ASSIGNMENTS_MAX)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED,
-+ "Too many environment assignments in a single query.");
- if (!strv_env_is_valid(env))
- return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments");
-
-diff --git a/src/resolve/resolved-link-bus.c b/src/resolve/resolved-link-bus.c
-index 4f8f591..02f5e5a 100644
---- a/src/resolve/resolved-link-bus.c
-+++ b/src/resolve/resolved-link-bus.c
-@@ -333,7 +333,7 @@ int bus_link_method_set_domains(sd_bus_message *message, void *userdata, sd_bus_
- if (r < 0)
- return r;
-
-- for (;;) {
-+ for (unsigned n_names = 0;; n_names++) {
- _cleanup_free_ char *prefixed = NULL;
- const char *name;
- int route_only;
-@@ -351,6 +351,8 @@ int bus_link_method_set_domains(sd_bus_message *message, void *userdata, sd_bus_
- return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid search domain %s", name);
- if (!route_only && dns_name_is_root(name))
- return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Root domain is not suitable as search domain");
-+ if (n_names >= LINK_SEARCH_DOMAINS_MAX)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED, "Too many search domains per link");
-
- if (route_only) {
- prefixed = strjoin("~", name);
-@@ -682,6 +684,9 @@ int bus_link_method_set_dnssec_negative_trust_anchors(sd_bus_message *message, v
- if (r < 0)
- return r;
-
-+ if (strv_length(ntas) > LINK_NEGATIVE_TRUST_ANCHORS_MAX)
-+ return sd_bus_error_set(error, SD_BUS_ERROR_LIMITS_EXCEEDED, "Too many negative trust anchors per link");
-+
- STRV_FOREACH(i, ntas) {
- r = dns_name_is_valid(*i);
- if (r < 0)
-diff --git a/src/resolve/resolved-link.h b/src/resolve/resolved-link.h
-index e2cb2a2..d7cd153 100644
---- a/src/resolve/resolved-link.h
-+++ b/src/resolve/resolved-link.h
-@@ -20,6 +20,7 @@ typedef struct LinkAddress LinkAddress;
-
- #define LINK_SEARCH_DOMAINS_MAX 256
- #define LINK_DNS_SERVERS_MAX 256
-+#define LINK_NEGATIVE_TRUST_ANCHORS_MAX 2048
-
- struct LinkAddress {
- Link *link;
-diff --git a/src/shared/json.c b/src/shared/json.c
-index d64daaf..b8b4aa8 100644
---- a/src/shared/json.c
-+++ b/src/shared/json.c
-@@ -4610,6 +4610,7 @@ int json_dispatch_strv(const char *name, JsonVariant *variant, JsonDispatchFlags
- _cleanup_strv_free_ char **l = NULL;
- char ***s = ASSERT_PTR(userdata);
- JsonVariant *e;
-+ size_t n = 0;
- int r;
-
- assert(variant);
-@@ -4642,7 +4643,7 @@ int json_dispatch_strv(const char *name, JsonVariant *variant, JsonDispatchFlags
- if ((flags & JSON_SAFE) && !string_is_safe(json_variant_string(e)))
- return json_log(e, flags, SYNTHETIC_ERRNO(EINVAL), "JSON field '%s' contains unsafe characters, refusing.", strna(name));
-
-- r = strv_extend(&l, json_variant_string(e));
-+ r = strv_extend_with_size(&l, &n, json_variant_string(e));
- if (r < 0)
- return json_log(e, flags, r, "Failed to append array element: %m");
- }
-diff --git a/src/shared/user-record.c b/src/shared/user-record.c
-index b51d8ad..fad7d09 100644
---- a/src/shared/user-record.c
-+++ b/src/shared/user-record.c
-@@ -620,6 +620,7 @@ int json_dispatch_user_group_list(const char *name, JsonVariant *variant, JsonDi
- _cleanup_strv_free_ char **l = NULL;
- char ***list = userdata;
- JsonVariant *e;
-+ size_t s = 0;
- int r;
-
- if (!json_variant_is_array(variant))
-@@ -633,7 +634,7 @@ int json_dispatch_user_group_list(const char *name, JsonVariant *variant, JsonDi
- if (!valid_user_group_name(json_variant_string(e), FLAGS_SET(flags, JSON_RELAX) ? VALID_USER_RELAX : 0))
- return json_log(e, flags, SYNTHETIC_ERRNO(EINVAL), "JSON array element is not a valid user/group name: %s", json_variant_string(e));
-
-- r = strv_extend(&l, json_variant_string(e));
-+ r = strv_extend_with_size(&l, &s, json_variant_string(e));
- if (r < 0)
- return json_log(e, flags, r, "Failed to append array element: %m");
- }
diff --git a/systemd-GHSA-5rm9-cc37-35gq.patch b/systemd-GHSA-5rm9-cc37-35gq.patch
deleted file mode 100644
index b6f177a..0000000
--- a/systemd-GHSA-5rm9-cc37-35gq.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-GHSA-5rm9-cc37-35gq: JSON parser stack grows without a nesting limit; a 16 MB
-varlink message makes services allocate ~640 MB.
-https://github.com/systemd/systemd/security/advisories/GHSA-5rm9-cc37-35gq
-Upstream v258.8: de6adcc29c; from Ubuntu noble 255.4-1ubuntu8.17.
-
- src/shared/json.c | 12 ++++++++++++
- src/test/test-json.c | 43 +++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 55 insertions(+)
-
-diff --git a/src/shared/json.c b/src/shared/json.c
-index aad79ba..d64daaf 100644
---- a/src/shared/json.c
-+++ b/src/shared/json.c
-@@ -2979,6 +2979,12 @@ static int json_parse_internal(
- goto finish;
- }
-
-+ /* n_stack includes the top level entry, hence > instead of >= */
-+ if (n_stack > DEPTH_MAX) {
-+ r = -ELNRNG;
-+ goto finish;
-+ }
-+
- if (!GREEDY_REALLOC(stack, n_stack+1)) {
- r = -ENOMEM;
- goto finish;
-@@ -3030,6 +3036,12 @@ static int json_parse_internal(
- goto finish;
- }
-
-+ /* n_stack includes the top level entry, hence > instead of >= */
-+ if (n_stack > DEPTH_MAX) {
-+ r = -ELNRNG;
-+ goto finish;
-+ }
-+
- if (!GREEDY_REALLOC(stack, n_stack+1)) {
- r = -ENOMEM;
- goto finish;
-diff --git a/src/test/test-json.c b/src/test/test-json.c
-index 3657075..64bef46 100644
---- a/src/test/test-json.c
-+++ b/src/test/test-json.c
-@@ -436,6 +436,49 @@ TEST(depth) {
- fputs("\n", stdout);
- }
-
-+static char *prepare_nested_json(const char *open, unsigned depth) {
-+ char *s, *p;
-+ size_t olen;
-+
-+ assert_se(open);
-+
-+ olen = strlen(open);
-+ s = p = new(char, olen * depth + 1);
-+ if (!s)
-+ return NULL;
-+
-+ for (unsigned i = 0; i < depth; i++)
-+ p = mempcpy(p, open, olen);
-+ *p = '\0';
-+
-+ return s;
-+}
-+
-+TEST(parse_depth) {
-+ _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
-+ _cleanup_free_ char *s = NULL;
-+
-+ /* Refuse parsing > DEPTH_MAX (currently 2048) levels of nested arrays */
-+ s = prepare_nested_json("[", 2049);
-+ assert_se(json_parse(s, 0, &v, NULL, NULL) == -ELNRNG);
-+ s = mfree(s);
-+
-+ /* Same for nested objects */
-+ s = prepare_nested_json("{\"a\":", 2049);
-+ assert_se(json_parse(s, 0, &v, NULL, NULL) == -ELNRNG);
-+ s = mfree(s);
-+
-+ /* <= DEPTH_MAX levels of nested arrays should be refused by EINVAL
-+ * later in the parsing process */
-+ s = prepare_nested_json("[", 2048);
-+ assert_se(json_parse(s, 0, &v, NULL, NULL) == -EINVAL);
-+ s = mfree(s);
-+
-+ /* And the same for nested objects */
-+ s = prepare_nested_json("{\"a\":", 2048);
-+ assert_se(json_parse(s, 0, &v, NULL, NULL) == -EINVAL);
-+}
-+
- TEST(normalize) {
- _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *w = NULL;
- _cleanup_free_ char *t = NULL;
diff --git a/systemd-GHSA-m8q3-73v4-wvg7.patch b/systemd-GHSA-m8q3-73v4-wvg7.patch
deleted file mode 100644
index 2cd98ff..0000000
--- a/systemd-GHSA-m8q3-73v4-wvg7.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-GHSA-m8q3-73v4-wvg7: scsi_id prints unsanitized ID_WWN* fields (rest of CVE-2026-40225).
-https://github.com/systemd/systemd/security/advisories/GHSA-m8q3-73v4-wvg7
-Upstream v258.8: d2d3aab7ab; from Ubuntu noble 255.4-1ubuntu8.17.
-
- src/udev/scsi_id/scsi_id.c | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/src/udev/scsi_id/scsi_id.c b/src/udev/scsi_id/scsi_id.c
-index b2df8d9..1f0d75f 100644
---- a/src/udev/scsi_id/scsi_id.c
-+++ b/src/udev/scsi_id/scsi_id.c
-@@ -391,6 +391,10 @@ static int set_inq_values(struct scsi_id_device *dev_scsi, const char *path) {
- return 0;
- }
-
-+static bool scsi_string_is_valid(const char *s) {
-+ return !isempty(s) && utf8_is_valid(s) && !string_has_cc(s, /* ok= */ NULL);
-+}
-+
- /*
- * scsi_id: try to get an id, if one is found, printf it to stdout.
- * returns a value passed to exit() - 0 if printed an id, else 1.
-@@ -434,17 +438,17 @@ static int scsi_id(char *maj_min_dev) {
- udev_replace_chars(serial_str, NULL);
- printf("ID_SERIAL_SHORT=%s\n", serial_str);
- }
-- if (dev_scsi.wwn[0] != '\0') {
-+ if (scsi_string_is_valid(dev_scsi.wwn)) {
- printf("ID_WWN=0x%s\n", dev_scsi.wwn);
-- if (dev_scsi.wwn_vendor_extension[0] != '\0') {
-+ if (scsi_string_is_valid(dev_scsi.wwn_vendor_extension)) {
- printf("ID_WWN_VENDOR_EXTENSION=0x%s\n", dev_scsi.wwn_vendor_extension);
- printf("ID_WWN_WITH_EXTENSION=0x%s%s\n", dev_scsi.wwn, dev_scsi.wwn_vendor_extension);
- } else
- printf("ID_WWN_WITH_EXTENSION=0x%s\n", dev_scsi.wwn);
- }
-- if (dev_scsi.tgpt_group[0] != '\0')
-+ if (scsi_string_is_valid(dev_scsi.tgpt_group))
- printf("ID_TARGET_PORT=%s\n", dev_scsi.tgpt_group);
-- if (dev_scsi.unit_serial_number[0] != '\0' && utf8_is_valid(dev_scsi.unit_serial_number) && !string_has_cc(dev_scsi.unit_serial_number, /* ok= */ NULL))
-+ if (scsi_string_is_valid(dev_scsi.unit_serial_number))
- printf("ID_SCSI_SERIAL=%s\n", dev_scsi.unit_serial_number);
- goto out;
- }
diff --git a/systemd-completion.patch b/systemd-completion.patch
deleted file mode 100644
index f49847f..0000000
--- a/systemd-completion.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff -urN systemd-241.orig/shell-completion/bash/meson.build systemd-241/shell-completion/bash/meson.build
---- systemd-241.orig/shell-completion/bash/meson.build 2019-02-14 11:11:58.000000000 +0100
-+++ systemd-241/shell-completion/bash/meson.build 2019-03-07 01:08:55.312337719 +0100
-@@ -30,7 +30,7 @@
- ['systemd-path', ''],
- ['systemd-run', ''],
- ['udevadm', ''],
-- ['bootctl', 'ENABLE_BOOTLOADER'],
-+ ['bootctl', ''],
- ['coredumpctl', 'ENABLE_COREDUMP'],
- ['homectl', 'ENABLE_HOMED'],
- ['hostnamectl', 'ENABLE_HOSTNAMED'],
-diff -urN systemd-241.orig/shell-completion/zsh/meson.build systemd-241/shell-completion/zsh/meson.build
---- systemd-241.orig/shell-completion/zsh/meson.build 2019-02-14 11:11:58.000000000 +0100
-+++ systemd-241/shell-completion/zsh/meson.build 2019-03-07 01:09:00.655641470 +0100
-@@ -25,7 +25,7 @@
- ['_sd_outputmodes', ''],
- ['_sd_unit_files', ''],
- ['_sd_machines', ''],
-- ['_bootctl', 'ENABLE_BOOTLOADER'],
-+ ['_bootctl', ''],
- ['_coredumpctl', 'ENABLE_COREDUMP'],
- ['_hostnamectl', 'ENABLE_HOSTNAMED'],
- ['_localectl', 'ENABLE_LOCALED'],
diff --git a/systemd-configfs.patch b/systemd-configfs.patch
index fb50264..34c3b6e 100644
--- a/systemd-configfs.patch
+++ b/systemd-configfs.patch
@@ -13,7 +13,7 @@ diff -durN -x '*.orig' systemd-208.orig/units/sys-kernel-config.mount systemd-20
+++ systemd-208/units/sys-kernel-config.mount 2014-01-10 10:22:04.000000000 +0100
@@ -10,8 +10,9 @@ Description=Configuration File System
Documentation=https://docs.kernel.org/filesystems/configfs.html
- Documentation=https://www.freedesktop.org/wiki/Software/systemd/APIFileSystems
+ Documentation=https://systemd.io/API_FILE_SYSTEMS
DefaultDependencies=no
-ConditionPathExists=/sys/kernel/config
ConditionCapability=CAP_SYS_RAWIO
diff --git a/systemd-errno-list-kernel7.patch b/systemd-errno-list-kernel7.patch
deleted file mode 100644
index 3637e6c..0000000
--- a/systemd-errno-list-kernel7.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-linux-libc-headers 7.0+ define EFSBADCRC/EFSCORRUPTED as aliases of EBADMSG/EUCLEAN;
-the generated errno table then fails with -Werror=override-init.
-Upstream 3cfb16998808a6ec8012a6120d0a82f0e1a0c8bb, adapted to the 254 script.
-
---- a/src/basic/generate-errno-list.sh
-+++ b/src/basic/generate-errno-list.sh
-@@ -3,9 +3,13 @@
- set -eu
- set -o pipefail
-
--# In kernel's arch/parisc/include/uapi/asm/errno.h, ECANCELLED and EREFUSED are defined as aliases of
--# ECANCELED and ECONNREFUSED, respectively. Let's drop them.
-+# In kernel's arch/parisc/include/uapi/asm/errno.h, The following aliases are defined:
-+# ECANCELLED → ECANCELED
-+# EREFUSED → ECONNREFUSED
-+# EFSBADCRC → EBADMSG
-+# EFSCORRUPTED → EUCLEAN
-+# Let's drop them.
-
- ${1:?} -dM -include errno.h - </dev/null | \
-- grep -Ev '^#define[[:space:]]+(ECANCELLED|EREFUSED)' | \
-+ grep -Ev '^#define[[:space:]]+(ECANCELLED|EREFUSED|EFSBADCRC|EFSCORRUPTED)' | \
- awk '/^#define[ \t]+E[^ _]+[ \t]+/ { print $2; }'
diff --git a/systemd-glibc.patch b/systemd-glibc.patch
deleted file mode 100644
index 1398e78..0000000
--- a/systemd-glibc.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- systemd-stable-252.5/src/partition/growfs.c.orig 2023-01-26 09:12:21.000000000 +0100
-+++ systemd-stable-252.5/src/partition/growfs.c 2023-02-25 20:05:31.824939843 +0100
-@@ -13,6 +13,7 @@
- * See: https://github.com/systemd/systemd/issues/8507
- * [0] https://github.com/torvalds/linux/commit/a28135303a669917002f569aecebd5758263e4aa
- */
-+#define _LINUX_MOUNT_H
- #include <linux/btrfs.h>
-
- #include "sd-device.h"
diff --git a/systemd-initctl.c b/systemd-initctl.c
new file mode 100644
index 0000000..2cc9587
--- /dev/null
+++ b/systemd-initctl.c
@@ -0,0 +1,157 @@
+/*
+ * /run/initctl for SysVinit's shutdown, halt, reboot, poweroff and telinit running under
+ * systemd as PID 1 (systemd >= 258 dropped its systemd-initctl). Socket-activated through
+ * systemd-initctl.socket (ListenFIFO), maps runlevel requests to systemd targets.
+ */
+#include <errno.h>
+#include <poll.h>
+#include <signal.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "systemd/sd-bus.h"
+#include "systemd/sd-daemon.h"
+
+/* struct init_request from sysvinit's initreq.h, 384 bytes */
+#define INIT_MAGIC 0x03091969
+#define INIT_CMD_RUNLVL 1
+#define INIT_CMD_POWERFAIL 2
+#define INIT_CMD_POWERFAILNOW 3
+#define INIT_CMD_POWEROK 4
+struct init_request {
+ int magic;
+ int cmd;
+ int runlevel;
+ int sleeptime;
+ char data[368];
+};
+_Static_assert(sizeof(struct init_request) == 384, "init_request size");
+
+/* exit when idle, the socket starts us again on the next request */
+#define IDLE_TIMEOUT_MSEC (30 * 1000)
+
+static bool kexec_loaded(void) {
+ char c = '0';
+ FILE *f = fopen("/sys/kernel/kexec_loaded", "re");
+
+ if (f) {
+ if (fread(&c, 1, 1, f) != 1)
+ c = '0';
+ fclose(f);
+ }
+ return c == '1';
+}
+
+static int start_unit(const char *target, const char *mode) {
+ sd_bus_error error = SD_BUS_ERROR_NULL;
+ sd_bus *bus = NULL;
+ int r;
+
+ /* PID 1's private socket, works without dbus-daemon (early boot, rescue) */
+ r = sd_bus_new(&bus);
+ if (r >= 0)
+ r = sd_bus_set_address(bus, "unix:path=/run/systemd/private");
+ if (r >= 0)
+ r = sd_bus_start(bus);
+ if (r < 0) {
+ fprintf(stderr, SD_ERR "Failed to connect to systemd: %s\n", strerror(-r));
+ sd_bus_unref(bus);
+ return r;
+ }
+ r = sd_bus_call_method(bus, "org.freedesktop.systemd1", "/org/freedesktop/systemd1",
+ "org.freedesktop.systemd1.Manager", "StartUnit", &error, NULL,
+ "ss", target, mode);
+ if (r < 0)
+ fprintf(stderr, SD_ERR "Failed to start %s: %s\n", target,
+ error.message ? error.message : strerror(-r));
+ sd_bus_error_free(&error);
+ sd_bus_flush_close_unref(bus);
+ return r;
+}
+
+/* returns true when we should exit (PID 1 is being reexecuted) */
+static bool runlevel_request(int runlevel) {
+ switch (runlevel) {
+ case '0':
+ start_unit("poweroff.target", "replace-irreversibly");
+ break;
+ case '6':
+ start_unit(kexec_loaded() ? "kexec.target" : "reboot.target", "replace-irreversibly");
+ break;
+ case '1': case 's': case 'S':
+ start_unit("rescue.target", "isolate");
+ break;
+ case '2': case '3': case '4':
+ start_unit("multi-user.target", "isolate");
+ break;
+ case '5':
+ start_unit("graphical.target", "isolate");
+ break;
+ case 'q': case 'Q':
+ if (kill(1, SIGHUP) < 0)
+ fprintf(stderr, SD_ERR "kill(1, SIGHUP): %s\n", strerror(errno));
+ break;
+ case 'u': case 'U':
+ if (kill(1, SIGTERM) < 0)
+ fprintf(stderr, SD_ERR "kill(1, SIGTERM): %s\n", strerror(errno));
+ return true;
+ default:
+ fprintf(stderr, SD_WARNING "Unknown runlevel request '%c', ignoring.\n", runlevel);
+ }
+ return false;
+}
+
+int main(void) {
+ int n, fd = SD_LISTEN_FDS_START;
+
+ n = sd_listen_fds(1);
+ if (n != 1) {
+ fprintf(stderr, SD_ERR "Expected exactly one FIFO from socket activation, got %d.\n", n);
+ return 1;
+ }
+
+ for (;;) {
+ struct pollfd p = { .fd = fd, .events = POLLIN };
+ struct init_request req;
+ ssize_t l;
+
+ n = poll(&p, 1, IDLE_TIMEOUT_MSEC);
+ if (n < 0) {
+ if (errno == EINTR)
+ continue;
+ fprintf(stderr, SD_ERR "poll(): %s\n", strerror(errno));
+ return 1;
+ }
+ if (n == 0)
+ return 0;
+
+ l = read(fd, &req, sizeof(req));
+ if (l < 0) {
+ if (errno == EAGAIN || errno == EINTR)
+ continue;
+ fprintf(stderr, SD_ERR "read(): %s\n", strerror(errno));
+ return 1;
+ }
+ if (l != (ssize_t) sizeof(req) || req.magic != INIT_MAGIC) {
+ fprintf(stderr, SD_WARNING "Invalid initctl request, ignoring.\n");
+ continue;
+ }
+
+ switch (req.cmd) {
+ case INIT_CMD_RUNLVL:
+ if (runlevel_request(req.runlevel))
+ return 0;
+ break;
+ case INIT_CMD_POWERFAIL:
+ case INIT_CMD_POWERFAILNOW:
+ case INIT_CMD_POWEROK:
+ fprintf(stderr, SD_WARNING "UPS power requests through initctl are not supported by systemd, use systemctl.\n");
+ break;
+ default:
+ /* INIT_CMD_SETENV from shutdown(8) and friends: nothing to do */
+ break;
+ }
+ }
+}
diff --git a/systemd-initctl.service b/systemd-initctl.service
new file mode 100644
index 0000000..6ade71f
--- /dev/null
+++ b/systemd-initctl.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=initctl Compatibility Daemon
+DefaultDependencies=no
+
+[Service]
+ExecStart=/lib/systemd/systemd-initctl
+NoNewPrivileges=yes
+SystemCallArchitectures=native
diff --git a/systemd-initctl.socket b/systemd-initctl.socket
new file mode 100644
index 0000000..f288c06
--- /dev/null
+++ b/systemd-initctl.socket
@@ -0,0 +1,9 @@
+[Unit]
+Description=initctl Compatibility Named Pipe
+DefaultDependencies=no
+Before=sockets.target
+
+[Socket]
+ListenFIFO=/run/initctl
+Symlinks=/dev/initctl
+SocketMode=0600
diff --git a/systemd-pld-layout.patch b/systemd-pld-layout.patch
new file mode 100644
index 0000000..75e2e20
--- /dev/null
+++ b/systemd-pld-layout.patch
@@ -0,0 +1,239 @@
+PLD installs systemd into / with a separate /usr (prefix=/): keep in /usr what the 254
+split-usr layout kept there (tmpfiles.d, sysusers.d, sysctl.d, user units, catalog, ...) and
+export the same paths in systemd.pc, libsystemd.pc, libudev.pc and sd-path.
+
+ meson.build | 51 +++++++++++++++++++-------------
+ src/core/systemd.pc.in | 16 +++++-----
+ src/libsystemd/libsystemd.pc.in | 4 +--
+ src/libsystemd/sd-path/sd-path.c | 10 +++----
+ src/libudev/libudev.pc.in | 4 +--
+ 5 files changed, 47 insertions(+), 38 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index ce6898f..7d3c6fd 100644
+--- a/meson.build
++++ b/meson.build
+@@ -125,6 +125,14 @@ if not prefixdir.startswith('/')
+ endif
+
+ prefixdir_noslash = '/' + prefixdir.strip('/')
++# PLD keeps /usr unmerged: with prefix=/ the files that do not need to be on the
++# root fs (as in the old split-usr layout) still go below /usr
++if prefixdir == '/'
++ prefixdir_noslash = ''
++ usrprefixdir = '/usr'
++else
++ usrprefixdir = prefixdir
++endif
+ bindir = prefixdir / get_option('bindir')
+ sbindir = prefixdir / (split_bin ? 'sbin' : 'bin')
+ sbin_to_bin = split_bin ? '../bin/' : ''
+@@ -149,27 +157,27 @@ polkitpkladir = localstatedir / 'lib/polkit-1/localauthority/10-vendor.d'
+ xinitrcdir = get_option('xinitrcdir') != '' ? get_option('xinitrcdir') : sysconfdir / 'X11/xinit/xinitrc.d'
+ rpmmacrosdir = get_option('rpmmacrosdir')
+ if rpmmacrosdir != 'no'
+- rpmmacrosdir = prefixdir / rpmmacrosdir
++ rpmmacrosdir = usrprefixdir / rpmmacrosdir
+ endif
+ modprobedir = prefixdir / 'lib/modprobe.d'
+
+ # Our own paths
+ pkgdatadir = datadir / 'systemd'
+-environmentdir = prefixdir / 'lib/environment.d'
++environmentdir = usrprefixdir / 'lib/environment.d'
+ pkgsysconfdir = sysconfdir / 'systemd'
+-userunitdir = prefixdir / 'lib/systemd/user'
+-userpresetdir = prefixdir / 'lib/systemd/user-preset'
+-tmpfilesdir = prefixdir / 'lib/tmpfiles.d'
+-usertmpfilesdir = prefixdir / 'share/user-tmpfiles.d'
+-sysusersdir = prefixdir / 'lib/sysusers.d'
+-sysctldir = prefixdir / 'lib/sysctl.d'
+-binfmtdir = prefixdir / 'lib/binfmt.d'
+-modulesloaddir = prefixdir / 'lib/modules-load.d'
++userunitdir = usrprefixdir / 'lib/systemd/user'
++userpresetdir = usrprefixdir / 'lib/systemd/user-preset'
++tmpfilesdir = usrprefixdir / 'lib/tmpfiles.d'
++usertmpfilesdir = usrprefixdir / 'share/user-tmpfiles.d'
++sysusersdir = usrprefixdir / 'lib/sysusers.d'
++sysctldir = usrprefixdir / 'lib/sysctl.d'
++binfmtdir = usrprefixdir / 'lib/binfmt.d'
++modulesloaddir = usrprefixdir / 'lib/modules-load.d'
+ networkdir = prefixdir / 'lib/systemd/network'
+ systemgeneratordir = libexecdir / 'system-generators'
+-usergeneratordir = prefixdir / 'lib/systemd/user-generators'
+-systemenvgeneratordir = prefixdir / 'lib/systemd/system-environment-generators'
+-userenvgeneratordir = prefixdir / 'lib/systemd/user-environment-generators'
++usergeneratordir = usrprefixdir / 'lib/systemd/user-generators'
++systemenvgeneratordir = usrprefixdir / 'lib/systemd/system-environment-generators'
++userenvgeneratordir = usrprefixdir / 'lib/systemd/user-environment-generators'
+ systemshutdowndir = libexecdir / 'system-shutdown'
+ systemsleepdir = libexecdir / 'system-sleep'
+ systemunitdir = prefixdir / 'lib/systemd/system'
+@@ -178,12 +186,12 @@ initrdpresetdir = prefixdir / 'lib/systemd/initrd-preset'
+ udevlibexecdir = prefixdir / 'lib/udev'
+ udevrulesdir = udevlibexecdir / 'rules.d'
+ udevhwdbdir = udevlibexecdir / 'hwdb.d'
+-catalogdir = prefixdir / 'lib/systemd/catalog'
+-kerneldir = prefixdir / 'lib/kernel'
++catalogdir = usrprefixdir / 'lib/systemd/catalog'
++kerneldir = usrprefixdir / 'lib/kernel'
+ kernelinstalldir = kerneldir / 'install.d'
+ factorydir = datadir / 'factory'
+-bootlibdir = prefixdir / 'lib/systemd/boot/efi'
+-testsdir = prefixdir / 'lib/systemd/tests'
++bootlibdir = usrprefixdir / 'lib/systemd/boot/efi'
++testsdir = usrprefixdir / 'lib/systemd/tests'
+ unittestsdir = testsdir / 'unit-tests'
+ testdata_dir = testsdir / 'testdata'
+ systemdstatedir = localstatedir / 'lib/systemd'
+@@ -192,9 +200,9 @@ randomseeddir = localstatedir / 'lib/systemd'
+ profiledir = libexecdir / 'portable' / 'profile'
+ repartdefinitionsdir = libexecdir / 'repart/definitions'
+ ntpservicelistdir = prefixdir / 'lib/systemd/ntp-units.d'
+-credstoredir = prefixdir / 'lib/credstore'
+-pcrlockdir = prefixdir / 'lib/pcrlock.d'
+-mimepackagesdir = prefixdir / 'share/mime/packages'
++credstoredir = usrprefixdir / 'lib/credstore'
++pcrlockdir = usrprefixdir / 'lib/pcrlock.d'
++mimepackagesdir = usrprefixdir / 'share/mime/packages'
+
+ configfiledir = get_option('configfiledir')
+ if configfiledir == ''
+@@ -214,7 +222,7 @@ endif
+
+ pamconfdir = get_option('pamconfdir')
+ if pamconfdir == ''
+- pamconfdir = prefixdir / 'lib/pam.d'
++ pamconfdir = usrprefixdir / 'lib/pam.d'
+ endif
+
+ sshconfdir = get_option('sshconfdir')
+@@ -270,6 +278,7 @@ conf.set_quoted('PKGSYSCONFDIR', pkgsysconfdir)
+ conf.set_quoted('POLKIT_RULES_DIR', polkitrulesdir)
+ conf.set_quoted('PREFIX', prefixdir)
+ conf.set_quoted('PREFIX_NOSLASH', prefixdir_noslash)
++conf.set_quoted('USR_PREFIX', usrprefixdir)
+ conf.set_quoted('RANDOM_SEED', randomseeddir / 'random-seed')
+ conf.set_quoted('RANDOM_SEED_DIR', randomseeddir)
+ conf.set_quoted('SSHCONFDIR', sshconfdir)
+diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
+index 862d57d..e0efde0 100644
+--- a/src/core/systemd.pc.in
++++ b/src/core/systemd.pc.in
+@@ -16,22 +16,22 @@
+ # overrode this variable in their build system to support installing units elsewhere.
+ # To stop those builds from silently breaking we keep root_prefix around but have
+ # it as an alias for prefix
++prefix={{USR_PREFIX}}
+ root_prefix={{PREFIX_NOSLASH}}
+ rootprefix=${root_prefix}
+-prefix=${rootprefix}
+ sysconf_dir={{SYSCONF_DIR}}
+ sysconfdir=${sysconf_dir}
+
+-systemd_util_dir=${prefix}/lib/systemd
++systemd_util_dir=${rootprefix}/lib/systemd
+ systemdutildir=${systemd_util_dir}
+
+-systemd_system_unit_dir=${prefix}/lib/systemd/system
++systemd_system_unit_dir=${rootprefix}/lib/systemd/system
+ systemdsystemunitdir=${systemd_system_unit_dir}
+
+-systemd_system_preset_dir=${prefix}/lib/systemd/system-preset
++systemd_system_preset_dir=${rootprefix}/lib/systemd/system-preset
+ systemdsystempresetdir=${systemd_system_preset_dir}
+
+-systemd_initrd_preset_dir=${prefix}/lib/systemd/initrd-preset
++systemd_initrd_preset_dir=${rootprefix}/lib/systemd/initrd-preset
+ systemdinitrdpresetdir=${systemd_initrd_preset_dir}
+
+ systemd_user_unit_dir=${prefix}/lib/systemd/user
+@@ -52,7 +52,7 @@ systemdsystemunitpath=${systemd_system_unit_path}
+ systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemd_user_unit_dir}:/usr/lib/systemd/user:/usr/share/systemd/user
+ systemduserunitpath=${systemd_user_unit_path}
+
+-systemd_system_generator_dir=${prefix}/lib/systemd/system-generators
++systemd_system_generator_dir=${rootprefix}/lib/systemd/system-generators
+ systemdsystemgeneratordir=${systemd_system_generator_dir}
+
+ systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
+@@ -64,10 +64,10 @@ systemdsystemgeneratorpath=${systemd_system_generator_path}
+ systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:/usr/local/lib/systemd/user-generators:${systemd_user_generator_dir}
+ systemdusergeneratorpath=${systemd_user_generator_path}
+
+-systemd_sleep_dir=${prefix}/lib/systemd/system-sleep
++systemd_sleep_dir=${rootprefix}/lib/systemd/system-sleep
+ systemdsleepdir=${systemd_sleep_dir}
+
+-systemd_shutdown_dir=${prefix}/lib/systemd/system-shutdown
++systemd_shutdown_dir=${rootprefix}/lib/systemd/system-shutdown
+ systemdshutdowndir=${systemd_shutdown_dir}
+
+ tmpfiles_dir=${prefix}/lib/tmpfiles.d
+diff --git a/src/libsystemd/libsystemd.pc.in b/src/libsystemd/libsystemd.pc.in
+index 3a43ef6..9faccc8 100644
+--- a/src/libsystemd/libsystemd.pc.in
++++ b/src/libsystemd/libsystemd.pc.in
+@@ -7,8 +7,8 @@
+ # the Free Software Foundation; either version 2.1 of the License, or
+ # (at your option) any later version.
+
+-prefix={{PREFIX}}
+-exec_prefix={{PREFIX}}
++prefix={{USR_PREFIX}}
++exec_prefix={{USR_PREFIX}}
+ libdir={{LIBDIR}}
+ includedir={{INCLUDE_DIR}}
+
+diff --git a/src/libsystemd/sd-path/sd-path.c b/src/libsystemd/sd-path/sd-path.c
+index e009a71..ace5ff7 100644
+--- a/src/libsystemd/sd-path/sd-path.c
++++ b/src/libsystemd/sd-path/sd-path.c
+@@ -299,7 +299,7 @@ static int get_path(uint64_t type, char **buffer, const char **ret) {
+ return 0;
+
+ case SD_PATH_SYSTEMD_USER_PRESET:
+- *ret = PREFIX_NOSLASH "/lib/systemd/user-preset";
++ *ret = USR_PREFIX "/lib/systemd/user-preset";
+ return 0;
+
+ case SD_PATH_SYSTEMD_INITRD_PRESET:
+@@ -335,19 +335,19 @@ static int get_path(uint64_t type, char **buffer, const char **ret) {
+ return 0;
+
+ case SD_PATH_SYSUSERS:
+- *ret = PREFIX_NOSLASH "/lib/sysusers.d";
++ *ret = USR_PREFIX "/lib/sysusers.d";
+ return 0;
+
+ case SD_PATH_SYSCTL:
+- *ret = PREFIX_NOSLASH "/lib/sysctl.d";
++ *ret = USR_PREFIX "/lib/sysctl.d";
+ return 0;
+
+ case SD_PATH_BINFMT:
+- *ret = PREFIX_NOSLASH "/lib/binfmt.d";
++ *ret = USR_PREFIX "/lib/binfmt.d";
+ return 0;
+
+ case SD_PATH_MODULES_LOAD:
+- *ret = PREFIX_NOSLASH "/lib/modules-load.d";
++ *ret = USR_PREFIX "/lib/modules-load.d";
+ return 0;
+
+ case SD_PATH_CATALOG:
+diff --git a/src/libudev/libudev.pc.in b/src/libudev/libudev.pc.in
+index 6541bcb..015232b 100644
+--- a/src/libudev/libudev.pc.in
++++ b/src/libudev/libudev.pc.in
+@@ -7,8 +7,8 @@
+ # the Free Software Foundation; either version 2.1 of the License, or
+ # (at your option) any later version.
+
+-prefix={{PREFIX}}
+-exec_prefix={{PREFIX}}
++prefix={{USR_PREFIX}}
++exec_prefix={{USR_PREFIX}}
+ libdir={{LIBDIR}}
+ includedir={{INCLUDE_DIR}}
+
diff --git a/systemd-remount-fs-unmounted.patch b/systemd-remount-fs-unmounted.patch
new file mode 100644
index 0000000..06649cc
--- /dev/null
+++ b/systemd-remount-fs-unmounted.patch
@@ -0,0 +1,26 @@
+remount-fs: skip API file systems that are not mounted; an fstab entry for efivarfs
+failed the unit on every non-EFI boot ("mount point does not exist")
+
+--- a/src/remount-fs/remount-fs.c
++++ b/src/remount-fs/remount-fs.c
+@@ -14,6 +14,7 @@
+ #include "log.h"
+ #include "main-func.h"
+ #include "mount-setup.h"
++#include "mountpoint-util.h"
+ #include "path-util.h"
+ #include "process-util.h"
+ #include "signal-util.h"
+@@ -105,6 +106,12 @@
+ has_root = true;
+ else if (!path_equal(target, "/usr") && !mount_point_is_api(target))
+ continue;
++ else if (mount_point_is_api(target) && path_is_mount_point(target) <= 0) {
++ /* PID 1 mounts some API file systems only conditionally (efivarfs only on
++ * EFI boots), an fstab entry for one that is not mounted has nothing to remount */
++ log_debug("%s is not mounted, not remounting.", target);
++ continue;
++ }
+
+ r = do_remount(target, /* force_rw= */ false, &pids);
+ if (r < 0)
diff --git a/systemd-runlevel-targets.patch b/systemd-runlevel-targets.patch
new file mode 100644
index 0000000..faf8341
--- /dev/null
+++ b/systemd-runlevel-targets.patch
@@ -0,0 +1,88 @@
+From 61750e265ce3f7783a8dba831e91140f84ad89f2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek at in.waw.pl>
+Date: Wed, 5 Nov 2025 17:52:16 +0100
+Subject: [PATCH 1/3] Revert "units: drop runlevel[0-6].target"
+
+This partially reverts commit e58ba80a40fb6e96543d56774a5bc5aa9cdadbf3.
+The unit are still needed for compat.
+---
+ units/meson.build | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/units/meson.build b/units/meson.build
+index 2e04c4aa2b..46eaac4073 100644
+--- a/units/meson.build
++++ b/units/meson.build
+@@ -1,5 +1,7 @@
+ # SPDX-License-Identifier: LGPL-2.1-or-later
+
++with_runlevels = conf.get('HAVE_SYSV_COMPAT') == 1
++
+ units = [
+ { 'file' : 'basic.target' },
+ { 'file' : 'blockdev at .target' },
+@@ -49,7 +51,7 @@ units = [
+ },
+ {
+ 'file' : 'graphical.target',
+- 'symlinks' : ['default.target'],
++ 'symlinks' : ['default.target'] + (with_runlevels ? ['runlevel5.target'] : []),
+ },
+ { 'file' : 'halt.target' },
+ {
+@@ -142,7 +144,10 @@ units = [
+ 'conditions' : ['ENABLE_MACHINED'],
+ },
+ { 'file' : 'modprobe at .service' },
+- { 'file' : 'multi-user.target' },
++ {
++ 'file' : 'multi-user.target',
++ 'symlinks' : with_runlevels ? ['runlevel2.target', 'runlevel3.target', 'runlevel4.target'] : [],
++ },
+ {
+ 'file' : 'systemd-mute-console.socket',
+ 'symlinks' : ['sockets.target.wants/']
+@@ -155,7 +160,10 @@ units = [
+ { 'file' : 'nss-lookup.target' },
+ { 'file' : 'nss-user-lookup.target' },
+ { 'file' : 'paths.target' },
+- { 'file' : 'poweroff.target' },
++ {
++ 'file' : 'poweroff.target',
++ 'symlinks' : with_runlevels ? ['runlevel0.target'] : [],
++ },
+ { 'file' : 'printer.target' },
+ {
+ 'file' : 'proc-sys-fs-binfmt_misc.automount',
+@@ -180,7 +188,7 @@ units = [
+ },
+ {
+ 'file' : 'reboot.target',
+- 'symlinks' : ['ctrl-alt-del.target'],
++ 'symlinks' : ['ctrl-alt-del.target'] + (with_runlevels ? ['runlevel6.target'] : []),
+ },
+ {
+ 'file' : 'remote-cryptsetup.target',
+@@ -200,7 +208,10 @@ units = [
+ 'symlinks' : ['initrd-root-device.target.wants/'],
+ },
+ { 'file' : 'rescue.service.in' },
+- { 'file' : 'rescue.target' },
++ {
++ 'file' : 'rescue.target',
++ 'symlinks' : with_runlevels ? ['runlevel1.target'] : [],
++ },
+ { 'file' : 'rpcbind.target' },
+ { 'file' : 'serial-getty at .service.in' },
+ { 'file' : 'shutdown.target' },
+@@ -1001,4 +1012,10 @@ else
+ dbussessionservicedir / 'org.freedesktop.systemd1.service'))
+ endif
+
++if conf.get('HAVE_SYSV_COMPAT') == 1
++ foreach i : [1, 2, 3, 4, 5]
++ install_emptydir(systemunitdir / 'runlevel at 0@.target.wants'.format(i))
++ endforeach
++endif
++
+ subdir('user')
diff --git a/systemd-runlevel.sh b/systemd-runlevel.sh
new file mode 100644
index 0000000..1b6aad1
--- /dev/null
+++ b/systemd-runlevel.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+# runlevel(8) for systemd as PID 1: derived from the active targets, the previous runlevel is
+# not known ("N"); systemd >= 258 no longer records runlevels in utmp
+for t in poweroff:0 reboot:6 graphical:5 multi-user:3 rescue:1; do
+ if /bin/systemctl --quiet is-active "${t%:*}.target"; then
+ echo "N ${t#*:}"
+ exit 0
+ fi
+done
+echo unknown
+exit 1
diff --git a/systemd-split-usr-compat.patch b/systemd-split-usr-compat.patch
new file mode 100644
index 0000000..d7f493f
--- /dev/null
+++ b/systemd-split-usr-compat.patch
@@ -0,0 +1,259 @@
+Restore what upstream dropped with split-usr support (v255) for PLD's unmerged /usr:
+config lookup in /lib (udev rules, .link, presets), /sbin:/bin in $PATH, ProtectSystem= and
+ProtectKernelModules= covering /bin /sbin /lib /lib64 /lib/modules, /lib/kbd keymaps.
+
+ meson.build | 2 ++
+ src/basic/constants.h | 14 ++++++++++--
+ src/basic/path-util.c | 5 ++++-
+ src/core/namespace.c | 19 ++++++++++++++++
+ src/delta/delta.c | 38 ++++++++++++++++++++++++++++++++
+ src/libsystemd/sd-path/sd-path.c | 9 ++++++++
+ src/shared/install.c | 5 +++++
+ src/shared/kbd-util.c | 9 +++++++-
+ 8 files changed, 97 insertions(+), 4 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 7d3c6fd..5fddaeb 100644
+--- a/meson.build
++++ b/meson.build
+@@ -279,6 +279,8 @@ conf.set_quoted('POLKIT_RULES_DIR', polkitrulesdir)
+ conf.set_quoted('PREFIX', prefixdir)
+ conf.set_quoted('PREFIX_NOSLASH', prefixdir_noslash)
+ conf.set_quoted('USR_PREFIX', usrprefixdir)
++conf.set_quoted('USR_LIBDIR', usrprefixdir / fs.name(libdir))
++conf.set10('HAVE_SPLIT_USR', prefixdir == '/')
+ conf.set_quoted('RANDOM_SEED', randomseeddir / 'random-seed')
+ conf.set_quoted('RANDOM_SEED_DIR', randomseeddir)
+ conf.set_quoted('SSHCONFDIR', sshconfdir)
+diff --git a/src/basic/constants.h b/src/basic/constants.h
+index a26cff4..0429107 100644
+--- a/src/basic/constants.h
++++ b/src/basic/constants.h
+@@ -34,19 +34,29 @@
+ #define NOTIFY_FD_MAX 768
+ #define NOTIFY_BUFFER_MAX PIPE_BUF
+
++#if HAVE_SPLIT_USR
++# define _CONF_PATHS_SPLIT_USR_NULSTR(n) "/lib/" n "\0"
++# define _CONF_PATHS_SPLIT_USR(n) , "/lib/" n
++#else
++# define _CONF_PATHS_SPLIT_USR_NULSTR(n)
++# define _CONF_PATHS_SPLIT_USR(n)
++#endif
++
+ /* Return a nulstr for a standard cascade of configuration paths, suitable to pass to
+ * conf_files_list_nulstr() to implement drop-in directories for extending configuration files. */
+ #define CONF_PATHS_NULSTR(n) \
+ "/etc/" n "\0" \
+ "/run/" n "\0" \
+ "/usr/local/lib/" n "\0" \
+- "/usr/lib/" n "\0"
++ "/usr/lib/" n "\0" \
++ _CONF_PATHS_SPLIT_USR_NULSTR(n)
+
+ #define CONF_PATHS(n) \
+ "/etc/" n, \
+ "/run/" n, \
+ "/usr/local/lib/" n, \
+- "/usr/lib/" n
++ "/usr/lib/" n \
++ _CONF_PATHS_SPLIT_USR(n)
+
+ #define CONF_PATHS_STRV(n) \
+ STRV_MAKE(CONF_PATHS(n))
+diff --git a/src/basic/path-util.c b/src/basic/path-util.c
+index cf01964..d112e0d 100644
+--- a/src/basic/path-util.c
++++ b/src/basic/path-util.c
+@@ -1533,7 +1533,10 @@ static bool dir_is_split(const char *a, const char *b) {
+ #endif
+
+ const char* default_PATH(void) {
+-#if HAVE_SPLIT_BIN
++#if HAVE_SPLIT_USR
++ /* /bin and /sbin are separate directories, not symlinks into /usr */
++ return DEFAULT_PATH_COMPAT;
++#elif HAVE_SPLIT_BIN
+ static const char *default_path = NULL;
+
+ /* Return one of the three sets of paths:
+diff --git a/src/core/namespace.c b/src/core/namespace.c
+index 6fc2f09..71b3a00 100644
+--- a/src/core/namespace.c
++++ b/src/core/namespace.c
+@@ -180,6 +180,9 @@ static const MountEntry private_bpf_no_table[] = {
+
+ /* ProtectKernelModules= option */
+ static const MountEntry protect_kernel_modules_table[] = {
++#if HAVE_SPLIT_USR
++ { "/lib/modules", MOUNT_INACCESSIBLE, true },
++#endif
+ { "/usr/lib/modules", MOUNT_INACCESSIBLE, true },
+ };
+
+@@ -237,6 +240,14 @@ static const MountEntry protect_system_yes_table[] = {
+ { "/usr", MOUNT_READ_ONLY, false },
+ { "/boot", MOUNT_READ_ONLY, true },
+ { "/efi", MOUNT_READ_ONLY, true },
++#if HAVE_SPLIT_USR
++ { "/lib", MOUNT_READ_ONLY, true },
++ { "/lib64", MOUNT_READ_ONLY, true },
++ { "/bin", MOUNT_READ_ONLY, true },
++# if HAVE_SPLIT_BIN
++ { "/sbin", MOUNT_READ_ONLY, true },
++# endif
++#endif
+ };
+
+ /* ProtectSystem=full includes ProtectSystem=yes */
+@@ -245,6 +256,14 @@ static const MountEntry protect_system_full_table[] = {
+ { "/boot", MOUNT_READ_ONLY, true },
+ { "/efi", MOUNT_READ_ONLY, true },
+ { "/etc", MOUNT_READ_ONLY, false },
++#if HAVE_SPLIT_USR
++ { "/lib", MOUNT_READ_ONLY, true },
++ { "/lib64", MOUNT_READ_ONLY, true },
++ { "/bin", MOUNT_READ_ONLY, true },
++# if HAVE_SPLIT_BIN
++ { "/sbin", MOUNT_READ_ONLY, true },
++# endif
++#endif
+ };
+
+ /* ProtectSystem=strict. In this strict mode, we mount everything read-only, except for /proc, /dev, and
+diff --git a/src/delta/delta.c b/src/delta/delta.c
+index 7eb9d91..d5fbc94 100644
+--- a/src/delta/delta.c
++++ b/src/delta/delta.c
+@@ -32,6 +32,9 @@ static const char prefixes[] =
+ "/usr/local/share\0"
+ "/usr/lib\0"
+ "/usr/share\0"
++#if HAVE_SPLIT_USR
++ "/lib\0"
++#endif
+ ;
+
+ static const char suffixes[] =
+@@ -365,6 +368,38 @@ static int enumerate_dir(
+ return 0;
+ }
+
++static int should_skip_path(const char *prefix, const char *suffix) {
++#if HAVE_SPLIT_USR
++ _cleanup_free_ char *target = NULL, *dirname = NULL;
++
++ /* With /lib and /usr/lib both in prefixes, a directory that is a symlink to its counterpart
++ * would show every file as overriding itself. */
++ dirname = path_join(prefix, suffix);
++ if (!dirname)
++ return -ENOMEM;
++
++ if (chase(dirname, NULL, 0, &target, NULL) < 0)
++ return false;
++
++ NULSTR_FOREACH(p, prefixes) {
++ _cleanup_free_ char *tmp = NULL;
++
++ if (path_startswith(dirname, p))
++ continue;
++
++ tmp = path_join(p, suffix);
++ if (!tmp)
++ return -ENOMEM;
++
++ if (path_equal(target, tmp)) {
++ log_debug("%s redirects to %s, skipping.", dirname, target);
++ return true;
++ }
++ }
++#endif
++ return false;
++}
++
+ static int process_suffix(const char *suffix, const char *onlyprefix) {
+ int r, ret = 0;
+
+@@ -378,6 +413,9 @@ static int process_suffix(const char *suffix, const char *onlyprefix) {
+ NULSTR_FOREACH(p, prefixes) {
+ _cleanup_free_ char *t = NULL;
+
++ if (should_skip_path(p, suffix) > 0)
++ continue;
++
+ t = path_join(p, suffix);
+ if (!t)
+ return -ENOMEM;
+diff --git a/src/libsystemd/sd-path/sd-path.c b/src/libsystemd/sd-path/sd-path.c
+index ace5ff7..b1ec7ac 100644
+--- a/src/libsystemd/sd-path/sd-path.c
++++ b/src/libsystemd/sd-path/sd-path.c
+@@ -535,6 +535,9 @@ static int get_search(uint64_t type, char ***ret) {
+ true,
+ ARRAY_SBIN_BIN("/usr/local/"),
+ ARRAY_SBIN_BIN("/usr/"),
++#if HAVE_SPLIT_USR
++ ARRAY_SBIN_BIN("/"),
++#endif
+ NULL);
+
+ case SD_PATH_SEARCH_LIBRARY_PRIVATE:
+@@ -545,6 +548,9 @@ static int get_search(uint64_t type, char ***ret) {
+ false,
+ "/usr/local/lib",
+ "/usr/lib",
++#if HAVE_SPLIT_USR
++ "/lib",
++#endif
+ NULL);
+
+ case SD_PATH_SEARCH_LIBRARY_ARCH:
+@@ -554,6 +560,9 @@ static int get_search(uint64_t type, char ***ret) {
+ "LD_LIBRARY_PATH",
+ true,
+ LIBDIR,
++#if HAVE_SPLIT_USR
++ USR_LIBDIR,
++#endif
+ NULL);
+
+ case SD_PATH_SEARCH_SHARED:
+diff --git a/src/shared/install.c b/src/shared/install.c
+index 4bbbd99..79ef610 100644
+--- a/src/shared/install.c
++++ b/src/shared/install.c
+@@ -269,6 +269,11 @@ static int path_is_vendor_or_generator(const LookupPaths *lp, const char *path)
+ if (path_startswith(rpath, "/usr"))
+ return true;
+
++#if HAVE_SPLIT_USR
++ if (path_startswith(rpath, "/lib"))
++ return true;
++#endif
++
+ /* The lookup paths are root prefixed, so we have to pass in a root prefixed path. */
+ r = path_is_generator(lp, path);
+ if (r != 0)
+diff --git a/src/shared/kbd-util.c b/src/shared/kbd-util.c
+index 4f608ce..b27ad50 100644
+--- a/src/shared/kbd-util.c
++++ b/src/shared/kbd-util.c
+@@ -12,10 +12,17 @@
+ #include "strv.h"
+ #include "utf8.h"
+
++#if HAVE_SPLIT_USR
++# define _KBD_KEYMAP_DIRS_SPLIT_USR , "/lib/kbd/keymaps/"
++#else
++# define _KBD_KEYMAP_DIRS_SPLIT_USR
++#endif
++
+ #define KBD_KEYMAP_DIRS \
+ "/usr/share/keymaps/", \
+ "/usr/share/kbd/keymaps/", \
+- "/usr/lib/kbd/keymaps/"
++ "/usr/lib/kbd/keymaps/" \
++ _KBD_KEYMAP_DIRS_SPLIT_USR
+
+ int keymap_directories(char ***ret) {
+ assert(ret);
diff --git a/systemd-split-usr-fix.patch b/systemd-split-usr-fix.patch
deleted file mode 100644
index 9b239d2..0000000
--- a/systemd-split-usr-fix.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- systemd-stable-249.4/src/core/systemd.pc.in.orig 2021-08-24 13:04:08.000000000 +0200
-+++ systemd-stable-249.4/src/core/systemd.pc.in 2021-09-27 19:10:02.119608114 +0200
-@@ -65,16 +65,16 @@ systemdshutdowndir=${systemd_shutdown_di
-
- user_tmpfiles_dir=${prefix}/share/user-tmpfiles.d
-
--sysusers_dir=${rootprefix}/lib/sysusers.d
-+sysusers_dir=${prefix}/lib/sysusers.d
- sysusersdir=${sysusers_dir}
-
--sysctl_dir=${rootprefix}/lib/sysctl.d
-+sysctl_dir=${prefix}/lib/sysctl.d
- sysctldir=${sysctl_dir}
-
--binfmt_dir=${rootprefix}/lib/binfmt.d
-+binfmt_dir=${prefix}/lib/binfmt.d
- binfmtdir=${binfmt_dir}
-
--modules_load_dir=${rootprefix}/lib/modules-load.d
-+modules_load_dir=${prefix}/lib/modules-load.d
- modulesloaddir=${modules_load_dir}
-
- catalog_dir=${prefix}/lib/systemd/catalog
diff --git a/systemd-telinit.sh b/systemd-telinit.sh
new file mode 100644
index 0000000..1122ac0
--- /dev/null
+++ b/systemd-telinit.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+# telinit(8) for systemd as PID 1, runlevels mapped like systemd-initctl does
+case "$1" in
+0) exec /bin/systemctl poweroff ;;
+6) exec /bin/systemctl reboot ;;
+1|s|S) exec /bin/systemctl isolate rescue.target ;;
+2|3|4) exec /bin/systemctl isolate multi-user.target ;;
+5) exec /bin/systemctl isolate graphical.target ;;
+q|Q) exec /bin/systemctl daemon-reload ;;
+u|U) exec /bin/systemctl daemon-reexec ;;
+*)
+ echo "Usage: telinit {0|1|2|3|4|5|6|s|S|q|Q|u|U}" >&2
+ exit 1
+ ;;
+esac
diff --git a/systemd-x32.patch b/systemd-x32.patch
index 566f6c5..c64c057 100644
--- a/systemd-x32.patch
+++ b/systemd-x32.patch
@@ -2,7 +2,7 @@ diff -urN systemd-244.orig/src/test/test-seccomp.c systemd-244/src/test/test-sec
--- systemd-244.orig/src/test/test-seccomp.c 2019-11-29 17:32:36.000000000 +0100
+++ systemd-244/src/test/test-seccomp.c 2019-12-02 16:38:04.314771202 +0100
@@ -558,11 +558,11 @@
- uint32_t arch;
+ int r, shmid;
SECCOMP_FOREACH_LOCAL_ARCH(arch) {
- log_debug("arch %s: SCMP_SYS(mmap) = %d", seccomp_arch_to_string(arch), SCMP_SYS(mmap));
@@ -17,4 +17,4 @@ diff -urN systemd-244.orig/src/test/test-seccomp.c systemd-244/src/test/test-sec
+ log_debug("arch %s: SCMP_SYS(shmdt) = %lli", seccomp_arch_to_string(arch), (long long int) SCMP_SYS(shmdt));
}
- if (!is_seccomp_available()) {
+ CHECK_SECCOMP(/* skip_container= */ false);
diff --git a/target-pld.patch b/target-pld.patch
index 7ce2e0f..cb7de6d 100644
--- a/target-pld.patch
+++ b/target-pld.patch
@@ -6,19 +6,19 @@
int shorten_overlong(const char *s, char **ret);
+int read_etc_hostname_distro(const char *path, char **ret);
- int read_etc_hostname_stream(FILE *f, char **ret);
- int read_etc_hostname(const char *path, char **ret);
+ int read_etc_hostname_stream(FILE *f, bool substitute_wildcards, char **ret);
+ int read_etc_hostname(const char *path, bool substitute_wildcards, char **ret);
--- systemd-stable-248/src/shared/hostname-setup.c.orig 2021-03-30 22:59:02.000000000 +0200
+++ systemd-stable-248/src/shared/hostname-setup.c 2021-04-07 00:04:58.955649812 +0200
@@ -7,6 +7,7 @@
- #include <unistd.h>
+ #include "sd-daemon.h"
#include "alloc-util.h"
+#include "env-file.h"
+ #include "creds-util.h"
#include "fd-util.h"
#include "fileio.h"
- #include "fs-util.h"
@@ -130,13 +131,34 @@
}
}
@@ -39,7 +39,7 @@
+}
+
+
- int read_etc_hostname(const char *path, char **ret) {
+ int read_etc_hostname(const char *path, bool substitute_wildcards, char **ret) {
_cleanup_fclose_ FILE *f = NULL;
assert(ret);
@@ -47,7 +47,7 @@
- if (!path)
+ if (!path) {
+ int r;
- path = "/etc/hostname";
+ path = etc_hostname();
+ r = read_etc_hostname_distro(path, ret);
+ if (r == 0)
+ return r;
@@ -86,21 +86,21 @@
--- systemd-240/src/basic/time-util.c.orig 2019-01-13 09:27:36.718995151 +0100
+++ systemd-240/src/basic/time-util.c 2019-01-13 09:31:12.275659356 +0100
@@ -14,6 +14,7 @@
- #include <unistd.h>
#include "alloc-util.h"
+ #include "env-util.h"
+#include "env-file.h"
- #include "fd-util.h"
- #include "fileio.h"
- #include "fs-util.h"
+ #include "errno-util.h"
+ #include "extract-word.h"
+ #include "hexdecoct.h" /* IWYU pragma: keep */
@@ -1385,8 +1385,16 @@
- return r; /* returns EINVAL if not a symlink */
+ return r; /* Return EINVAL if not a symlink */
- e = PATH_STARTSWITH_SET(t, "/usr/share/zoneinfo/", "../usr/share/zoneinfo/");
+ const char *e = PATH_STARTSWITH_SET(t, "/usr/share/zoneinfo/", "../usr/share/zoneinfo/");
- if (!e)
- return -EINVAL;
+ if (!e) {
-+ r = parse_env_file(NULL, "/etc/sysconfig/timezone"
++ r = parse_env_file(NULL, "/etc/sysconfig/timezone",
+ "TIMEZONE", &e
+ );
+ if (r < 0) {
@@ -108,10 +108,10 @@
+ log_warning_errno(r, "Failed to read /etc/sysconfig/timezone: %m");
+ return -EINVAL;
+ }
-+ }
-
++ }
if (!timezone_is_valid(e, LOG_DEBUG))
return -EINVAL;
+
--- systemd-stable-254/src/vconsole/vconsole-setup.c.orig 2023-08-02 23:51:41.833676408 +0200
+++ systemd-stable-254/src/vconsole/vconsole-setup.c 2023-08-03 00:00:16.025707038 +0200
@@ -141,7 +141,19 @@
@@ -120,11 +120,11 @@
log_warning_errno(r, "Failed to read /etc/vconsole.conf, ignoring: %m");
- return r;
+
-+ int r1 = parse_env_file(NULL, "/etc/sysconfig/console"
-+ "CONSOLEFONT", &v.config[VC_FONT],
-+ "CONSOLEMAP", &v.config[VC_FONT_MAP],
-+ "CONSOLESCREENFONTMAP", &v.config[VC_FONT_UNIMAP],
-+ "KEYTABLE", &v.config[VC_KEYMAP]
++ int r1 = parse_env_file(NULL, "/etc/sysconfig/console",
++ "CONSOLEFONT", &v.font,
++ "CONSOLEMAP", &v.font_map,
++ "CONSOLESCREENFONTMAP", &v.font_unimap,
++ "KEYTABLE", &v.keymap
+ );
+ if (r1 < 0) {
+ if (r1 != -ENOENT)
diff --git a/udev-ploop-rules.patch b/udev-ploop-rules.patch
index c1b2ba4..7613604 100644
--- a/udev-ploop-rules.patch
+++ b/udev-ploop-rules.patch
@@ -3,7 +3,7 @@ diff -ru udev-182.orig/rules/60-persistent-storage.rules udev-182/rules/60-persi
+++ udev-182/rules.d/60-persistent-storage.rules.in 2012-05-24 11:23:01.000000000 +0200
@@ -16,6 +16,8 @@
SUBSYSTEM!="block|ubi", GOTO="persistent_storage_end"
- KERNEL!="loop*|mmcblk*[0-9]|msblk*[0-9]|mspblk*[0-9]|nvme*|sd*|sr*|vd*|xvd*|bcache*|cciss*|dasd*|ubd*|ubi*|scm*|pmem*|nbd*|zd*", GOTO="persistent_storage_end"
+ KERNEL!="loop*|mmcblk*[0-9]|msblk*[0-9]|mspblk*[0-9]|nvme*|sd*|sr*|vd*|xvd*|bcache*|cciss*|dasd*|ubd*|ubi*|scm*|pmem*|nbd*|zd*|rbd*|zram*|ublkb*", GOTO="persistent_storage_end"
+KERNEL=="ploop*", GOTO="persistent_storage_end"
+
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/systemd.git/commitdiff/aefbfb14904af0f02a302056edc04bde5044f969
More information about the pld-cvs-commit
mailing list