Bug#926703: unblock: systemd/241-3
Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock
Hi release team,
I'd like to request an unblock for the systemd package. A full debdiff
is attached but for easier review I've also created an annotated
changelog to the individual changes.
It fixes a security issue (CVE-2019-3842) which should enter testing as
soon as possible.
The package itself builds a udeb, so requires an unblock by kibi (in
CC). Two of the patches touch udev (see the fix for #925190 and #924199),
everything else should not be relevant for the udebs.
systemd (241-3) unstable; urgency=high
[ Michael Biebl ]
* Drop systemd-shim alternative from libpam-systemd.
A fixed systemd-shim package which works with newer versions of systemd
is unlikely to happen given that the systemd-shim package has been
removed from the archive. Drop the alternative dependency from
libpam-systemd accordingly.
https://salsa.debian.org/systemd-team/systemd/commit/8d292a0afd3abaa3e393ee731cb346a61dfa2bf2
This change is basically not changing anything, as the alternative
dependency "systemd-shim (>= 10-4~)" was never available in the archive.
It's mostly clean-up and making the life of apt a bit easier by not
having to consider non-available alternatives. It's also confusing to
users to still see systemd-shim listed as alternative when it has been
removed from the archive.
* Properly remove duplicate directories from systemd package.
When removing duplicate directories from the systemd package, sort the
list of directories in reverse order so we properly delete nested
directories.
https://salsa.debian.org/systemd-team/systemd/commit/cdd220dd3ef632c76406d02366733713235dcfa2
Mostly cleanup. The systemd package mistakenly shipped an empty
/usr/lib/systemd/tests/testdata/ and /etc/udev/ directory. Those
directories are supposed to be shipped by the systemd-tests and udev
binary package.
* udev: Run programs in the specified order (Closes: #925190)
https://salsa.debian.org/systemd-team/systemd/commit/95a57c2179fcd7beb52c9d73d08473469034d059
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925190
This fixes an important regression in udev and should definitly be fixed
in buster.
* bash-completion: Use default completion for redirect operators
(Closes: #924541)
https://salsa.debian.org/systemd-team/systemd/commit/d4eebefd0b41ff58a7bf6d9c7f1898c011e7576f
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924541
Minor issue, mostly polish. No regression potential as it's an isolated
fix to the bash completion file.
* networkd: Clarify that IPv6 RA uses our own stack, no the kernel's
(Closes: #815582)
https://salsa.debian.org/systemd-team/systemd/commit/0ceb922acc4e7ff4c6d8ed1d853c232da12af906
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815582
Simple doc update, no regression potential.
* Revert "Drop systemd-timesyncd.service.d/disable-with-time-daemon.conf"
Apparently Conflicts= are not a reliable mechanism to ensure alternative
NTP implementations take precedence over systemd-timesyncd.
(Closes: #902026)
https://salsa.debian.org/systemd-team/systemd/commit/e1b3868e8b297a40e3dbfef1dfab80f3e5e0e8ef
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902026
This basically reverts back to what we had in stretch. We tried a
different approach during the buster development cycle, but it didn't
work out.
* network: Fix routing policy rule issue.
When multiple links request a routing policy, make sure they are all
applied correctly. (Closes: #924406)
https://salsa.debian.org/systemd-team/systemd/commit/2d871ae4727dcad604cba6d92156882dadf69ab6
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924406
Explicitly requested fix. Isolated fix to systemd-networkd, so
regression potential is small.
* pam-systemd: Use secure_getenv() rather than getenv()
Fixes a vulnerability in the systemd PAM module which insecurely uses
the environment and lacks seat verification permitting spoofing an
active session to PolicyKit. (CVE-2019-3842)
https://salsa.debian.org/systemd-team/systemd/commit/996e854fef1554829b757e7c1a515805b7f08d7a
https://www.debian.org/security/2019/dsa-4428
Fixes a security issue which was fixed in stable and should also enter
buster.
[ Martin Pitt ]
* Enable udev autopkgtest in containers.
This test doesn't actually need udev.service (which is disabled in
containers) and works fine in LXC.
* Enable boot-and-service autopkgtest in containers
- Skip tests which can't work in containers.
- Add missing rsyslog test dependency.
- e2scrub_reap.service fails in containers, ignore (filed as #926138)
- Relax pgrep pattern for gdm, as there's no wayland session in
containers.
https://salsa.debian.org/systemd-team/systemd/commit/c923cd4a7edf9f103f079c864ef47575e5d8a868
https://salsa.debian.org/systemd-team/systemd/commit/fbdd60c51ae260ba13e2b97bcbda0859fbf6efc2
https://salsa.debian.org/systemd-team/systemd/commit/b96b67cac42a33256c396f82ee70bfb4e8c5446c
Improvements to the autopkgtest suite. Doesn't change the contents of
binary packages.
-- Michael Biebl <biebl@debian.org> Mon, 08 Apr 2019 12:59:32 +0200
systemd (241-2) unstable; urgency=medium
[ Martin Pitt ]
* debian/tests/boot-smoke: Create journal and udevdb artifacts on all
failures
* autopkgtests: Replace obsolete $ADT_* variables
* networkd-test: Ignore failures of test_route_only_dns* in containers.
This test exposes a race condition when running in LXC, see issue #11848
for details. Until that is understood and fixed, skip the test as it's
not a recent regression. (Closes: #924539)
* Bump Standards-Version to 4.3.0.
No changes necessary.
* debian/tests/boot-smoke: Only check current boot for connection timeouts.
Otherwise we'll catch some
Failed to resolve group 'render': Connection timed out
messages that happen in earlier boots during VM setup, before the
"render" group is created.
Fixes https://github.com/systemd/systemd/issues/11875
* timedated: Fix emitted value when ntp client is enabled/disabled.
Fixes a regression introduced in 241.
https://salsa.debian.org/systemd-team/systemd/commit/bc11e5ff531e74b22bb1b87b221c94b75beb83e7
* debian/tests/timedated: Check enabling/disabling NTP.
Assert that `timedatectl set-ntp` correctly controls the service, sets
the `org.freedesktop.timedate1 NTP` property, and sends the right
`PropertiesChanged` signal.
This reproduces <https://github.com/systemd/systemd/issues/11944> and
also the earlier <https://github.com/systemd/systemd/issues/9672>.
https://salsa.debian.org/systemd-team/systemd/commit/6a9a7ec2bf3fe1503906dc9e8c40d05befea840e
https://salsa.debian.org/systemd-team/systemd/commit/ca4674f9008caa75610b6f6ce15d7495a28d6c21
https://salsa.debian.org/systemd-team/systemd/commit/d848b9d4d7f03bf06edd5e527534821aba7f8c59
https://salsa.debian.org/systemd-team/systemd/commit/d48f273d6aa442081b608a027b840acb73a59e4f
https://salsa.debian.org/systemd-team/systemd/commit/e54dc6dd7759748db05b3fd2004c75e480aa24d8
https://salsa.debian.org/systemd-team/systemd/commit/0cd41d36929123d2c6c5986c970b786202106c3f
https://salsa.debian.org/systemd-team/systemd/commit/57465d928dbcc7d2bb6a4305ef2b938b0b5d9dba
Again, improvements by Martin to the autopkgtest test-suite. Results are at
https://ci.debian.net/packages/s/systemd/
[ Michael Biebl ]
* Disable fallback DNS servers in resolved (Closes: #923081)
https://salsa.debian.org/systemd-team/systemd/commit/e6c7860a1f6bbc8075f16d55b95e7e9896a7ac84
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=923081
This has been a long standing issue which has been raised repeatedly.
It's a change in behaviour in systemd-resolved to not consult any
fallback DNS servers if none are configured or provided by DHCP.
It's arguably a little late to make such a behavioural change for
buster, but it's isolated to systemd-resolved, which is not enabled by
default in Debian.
Ubuntu has been shipping with this configuration since they shipped with
resolved enabled as default
* cgtop: Fix processing of controllers other than CPU (Closes: #921280)
https://salsa.debian.org/systemd-team/systemd/commit/e2edaaf8dff8ad59f3425ffffc1f7a787d57f08c
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=921280
Fixes a minor issue in systemd-cgtop. Isolated fix, very low regression
potential
* udev: Restore debug level when logging a failure in the external prog
called by IMPORT{program} (Closes: #924199)
https://salsa.debian.org/systemd-team/systemd/commit/349a7e9464983a4af86df9072f9df16e3ab81516
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924199
Fixes an issue in udev which imo should definitely enter buster,
otherwise it could lead to noise in the system logs which might confuse
users and admins.
* core: Remove "." path components from required mount paths.
Fixes mount related failures when a user's home directory contains "/./"
(Closes: #923881)
https://salsa.debian.org/systemd-team/systemd/commit/811854674ad7c3d5da54f8983b4f4b81657341d4
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=923881
Having "/./" in a users home directory is admittedly a bit of a special
case. But as the resulting failure is rather nasty, it seems worthwile
fixing it for buster.
* udev.init: Use new s-s-d --notify-await to start udev daemon.
Fixes a race condition during startup under SysV init.
Add versioned dependency on dpkg (>= 1.19.3) to ensure that a version
of start-stop-daemon which supports --notify-await is installed.
(Closes: #908796)
https://salsa.debian.org/systemd-team/systemd/commit/8d810fda9a640a932d6e7b32afd958fe75e36f5b
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908796
Important fix for sysvinit users. Introduces a versioned dependency on
dpkg for sysvinit users. This is a bit unfortunate. That said, I think
this fix should enter buster.
* Make /dev/dri/renderD* accessible to group "render"
Follow upstream and make render nodes available to a dedicated system
group "render" instead of "video". Keep the uaccess tag for local,
active users.
https://salsa.debian.org/systemd-team/systemd/commit/8ca0c4921b41429ef45b3a86dc6355f9b1fdbcfc
Having a dedicated "render" system group and making those devices
available to that group is useful for number crunching software, which
might run in the background and not within an active login session.
Since we still apply the uaccess tag, access to those devices is still
given to local, active users. So the should not be any regression in
that regard.
There is an old unblock request (#925409) for 241-2 where kibi already
acked the changes for d-i.
I decided to file a new unblock request and close the one for 241-3.
If you prefer that old unblock requests are updated, please let me know
and I'll keep that in mind for the future.
Thanks for your time,
Michael
unblock systemd/241-3
-- System Information:
Debian Release: buster/sid
APT prefers unstable
APT policy: (500, 'unstable'), (200, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.19.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
diff --git a/debian/changelog b/debian/changelog
index 4a6d717..231cbb6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,9 +1,98 @@
+systemd (241-3) unstable; urgency=high
+
+ [ Michael Biebl ]
+ * Drop systemd-shim alternative from libpam-systemd.
+ A fixed systemd-shim package which works with newer versions of systemd
+ is unlikely to happen given that the systemd-shim package has been
+ removed from the archive. Drop the alternative dependency from
+ libpam-systemd accordingly.
+ * Properly remove duplicate directories from systemd package.
+ When removing duplicate directories from the systemd package, sort the
+ list of directories in reverse order so we properly delete nested
+ directories.
+ * udev: Run programs in the specified order (Closes: #925190)
+ * bash-completion: Use default completion for redirect operators
+ (Closes: #924541)
+ * networkd: Clarify that IPv6 RA uses our own stack, no the kernel's
+ (Closes: #815582)
+ * Revert "Drop systemd-timesyncd.service.d/disable-with-time-daemon.conf"
+ Apparently Conflicts= are not a reliable mechanism to ensure alternative
+ NTP implementations take precedence over systemd-timesyncd.
+ (Closes: #902026)
+ * network: Fix routing policy rule issue.
+ When multiple links request a routing policy, make sure they are all
+ applied correctly. (Closes: #924406)
+ * pam-systemd: Use secure_getenv() rather than getenv()
+ Fixes a vulnerability in the systemd PAM module which insecurely uses
+ the environment and lacks seat verification permitting spoofing an
+ active session to PolicyKit. (CVE-2019-3842)
+
+ [ Martin Pitt ]
+ * Enable udev autopkgtest in containers.
+ This test doesn't actually need udev.service (which is disabled in
+ containers) and works fine in LXC.
+ * Enable boot-and-service autopkgtest in containers
+ - Skip tests which can't work in containers.
+ - Add missing rsyslog test dependency.
+ - e2scrub_reap.service fails in containers, ignore (filed as #926138)
+ - Relax pgrep pattern for gdm, as there's no wayland session in
+ containers.
+
+ -- Michael Biebl <biebl@debian.org> Mon, 08 Apr 2019 12:59:32 +0200
+
+systemd (241-2) unstable; urgency=medium
+
+ [ Martin Pitt ]
+ * debian/tests/boot-smoke: Create journal and udevdb artifacts on all
+ failures
+ * autopkgtests: Replace obsolete $ADT_* variables
+ * networkd-test: Ignore failures of test_route_only_dns* in containers.
+ This test exposes a race condition when running in LXC, see issue #11848
+ for details. Until that is understood and fixed, skip the test as it's
+ not a recent regression. (Closes: #924539)
+ * Bump Standards-Version to 4.3.0.
+ No changes necessary.
+ * debian/tests/boot-smoke: Only check current boot for connection timeouts.
+ Otherwise we'll catch some
+ Failed to resolve group 'render': Connection timed out
+ messages that happen in earlier boots during VM setup, before the
+ "render" group is created.
+ Fixes https://github.com/systemd/systemd/issues/11875
+ * timedated: Fix emitted value when ntp client is enabled/disabled.
+ Fixes a regression introduced in 241.
+ * debian/tests/timedated: Check enabling/disabling NTP.
+ Assert that `timedatectl set-ntp` correctly controls the service, sets
+ the `org.freedesktop.timedate1 NTP` property, and sends the right
+ `PropertiesChanged` signal.
+ This reproduces <https://github.com/systemd/systemd/issues/11944> and
+ also the earlier <https://github.com/systemd/systemd/issues/9672>.
+
+ [ Michael Biebl ]
+ * Disable fallback DNS servers in resolved (Closes: #923081)
+ * cgtop: Fix processing of controllers other than CPU (Closes: #921280)
+ * udev: Restore debug level when logging a failure in the external prog
+ called by IMPORT{program} (Closes: #924199)
+ * core: Remove "." path components from required mount paths.
+ Fixes mount related failures when a user's home directory contains "/./"
+ (Closes: #923881)
+ * udev.init: Use new s-s-d --notify-await to start udev daemon.
+ Fixes a race condition during startup under SysV init.
+ Add versioned dependency on dpkg (>= 1.19.3) to ensure that a version
+ of start-stop-daemon which supports --notify-await is installed.
+ (Closes: #908796)
+ * Make /dev/dri/renderD* accessible to group "render"
+ Follow upstream and make render nodes available to a dedicated system
+ group "render" instead of "video". Keep the uaccess tag for local,
+ active users.
+
+ -- Michael Biebl <biebl@debian.org> Fri, 15 Mar 2019 18:33:54 +0100
+
systemd (241-1) unstable; urgency=medium
[ Adam Borowski ]
* Make libpam-systemd Provide: logind, default-logind.
This allows alternate logind implementations such as elogind, without
- having to recompile every dependant package -- as long as the client API
+ having to recompile every dependent package -- as long as the client API
remains compatible.
These new virtual packages got policy-approved in #917431. (Closes: #915407)
diff --git a/debian/control b/debian/control
index abfe9ff..febab41 100644
--- a/debian/control
+++ b/debian/control
@@ -7,7 +7,7 @@ Uploaders: Michael Biebl <biebl@debian.org>,
Sjoerd Simons <sjoerd@debian.org>,
Martin Pitt <mpitt@debian.org>,
Felipe Sateler <fsateler@debian.org>
-Standards-Version: 4.2.1
+Standards-Version: 4.3.0
Rules-Requires-Root: no
Vcs-Git: https://salsa.debian.org/systemd-team/systemd.git
Vcs-Browser: https://salsa.debian.org/systemd-team/systemd
@@ -209,7 +209,7 @@ Depends: ${shlibs:Depends},
systemd (= ${binary:Version}),
libpam-runtime (>= 1.0.1-6),
dbus,
- systemd-shim (>= 10-4~) | systemd-sysv
+ systemd-sysv
Provides: logind (= ${binary:Version}), default-logind (= ${binary:Version})
Description: system and service manager - PAM module
This package contains the PAM module which registers user sessions in
@@ -330,6 +330,7 @@ Pre-Depends: ${misc:Pre-Depends}
Depends: ${shlibs:Depends},
${misc:Depends},
adduser,
+ dpkg (>= 1.19.3) | systemd-sysv,
libudev1 (= ${binary:Version}),
lsb-base (>= 3.0-6),
util-linux (>= 2.27.1),
diff --git a/debian/extra/units/systemd-timesyncd.service.d/disable-with-time-daemon.conf b/debian/extra/units/systemd-timesyncd.service.d/disable-with-time-daemon.conf
new file mode 100644
index 0000000..8e4f853
--- /dev/null
+++ b/debian/extra/units/systemd-timesyncd.service.d/disable-with-time-daemon.conf
@@ -0,0 +1,6 @@
+[Unit]
+# don't run timesyncd if we have another NTP daemon installed
+ConditionFileIsExecutable=!/usr/sbin/ntpd
+ConditionFileIsExecutable=!/usr/sbin/openntpd
+ConditionFileIsExecutable=!/usr/sbin/chronyd
+ConditionFileIsExecutable=!/usr/sbin/VBoxService
diff --git a/debian/patches/Re-add-uaccess-tag-for-dev-dri-renderD.patch b/debian/patches/Re-add-uaccess-tag-for-dev-dri-renderD.patch
new file mode 100644
index 0000000..58d2b5d
--- /dev/null
+++ b/debian/patches/Re-add-uaccess-tag-for-dev-dri-renderD.patch
@@ -0,0 +1,49 @@
+From: Michael Biebl <biebl@debian.org>
+Date: Wed, 13 Mar 2019 23:22:26 +0100
+Subject: Re-add uaccess tag for /dev/dri/renderD*
+
+Setting an access mode != 0666 is explicitly supported via -Dgroup-render-mode
+In such a case, re-add the uaccess tag.
+
+This is basically the same change that was done for /dev/kvm in
+commit fa53e24130af3a389573acb9585eadbf7192955f and
+ace5e3111c0b8d8bfd84b32f2c689b0a4d92c061
+and partially reverts the changes from
+4e15a7343cb389e97f3eb4f49699161862d8b8b2
+
+(cherry picked from commit 055a083a47de968744c4988fe305592477118c86)
+---
+ meson.build | 4 +++-
+ src/login/70-uaccess.rules.m4 | 4 ++++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 56c98b9..d340736 100644
+--- a/meson.build
++++ b/meson.build
+@@ -818,7 +818,9 @@ conf.set10('ENABLE_WHEEL_GROUP', get_option('wheel-group'))
+ dev_kvm_mode = get_option('dev-kvm-mode')
+ substs.set('DEV_KVM_MODE', dev_kvm_mode)
+ conf.set10('DEV_KVM_UACCESS', dev_kvm_mode != '0666')
+-substs.set('GROUP_RENDER_MODE', get_option('group-render-mode'))
++group_render_mode = get_option('group-render-mode')
++substs.set('GROUP_RENDER_MODE', group_render_mode)
++conf.set10('GROUP_RENDER_UACCESS', group_render_mode != '0666')
+
+ kill_user_processes = get_option('default-kill-user-processes')
+ conf.set10('KILL_USER_PROCESSES', kill_user_processes)
+diff --git a/src/login/70-uaccess.rules.m4 b/src/login/70-uaccess.rules.m4
+index d55e5bf..4bb144a 100644
+--- a/src/login/70-uaccess.rules.m4
++++ b/src/login/70-uaccess.rules.m4
+@@ -46,6 +46,10 @@ SUBSYSTEM=="firewire", ATTR{units}=="*0x00a02d:0x014001*", TAG+="uaccess"
+
+ # DRI video devices
+ SUBSYSTEM=="drm", KERNEL=="card*", TAG+="uaccess"
++m4_ifdef(`GROUP_RENDER_UACCESS',``
++# DRI render nodes
++SUBSYSTEM=="drm", KERNEL=="renderD*", TAG+="uaccess"''
++)m4_dnl
+ m4_ifdef(`DEV_KVM_UACCESS',``
+ # KVM
+ SUBSYSTEM=="misc", KERNEL=="kvm", TAG+="uaccess"''
diff --git a/debian/patches/bash-completion-use-default-completion-for-redirect-opera.patch b/debian/patches/bash-completion-use-default-completion-for-redirect-opera.patch
new file mode 100644
index 0000000..053ed73
--- /dev/null
+++ b/debian/patches/bash-completion-use-default-completion-for-redirect-opera.patch
@@ -0,0 +1,27 @@
+From: Frantisek Sumsal <frantisek@sumsal.cz>
+Date: Sat, 23 Mar 2019 21:49:17 +0100
+Subject: bash-completion: use default completion for redirect operators
+
+(cherry picked from commit 1413763ea540a897852494259cb949fe01e1e7e7)
+---
+ shell-completion/bash/journalctl | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/shell-completion/bash/journalctl b/shell-completion/bash/journalctl
+index bcd4533..5a6a3da 100644
+--- a/shell-completion/bash/journalctl
++++ b/shell-completion/bash/journalctl
+@@ -52,6 +52,13 @@ _journalctl() {
+ --vacuum-size --vacuum-time --vacuum-files --output-fields'
+ )
+
++ # Use the default completion for shell redirect operators
++ if __contains_word "$prev" '>' '>>' '&>'; then
++ compopt -o filenames
++ COMPREPLY=( $(compgen -f -- "$cur") )
++ return 0;
++ fi
++
+ if __contains_word "$prev" ${OPTS[ARG]} ${OPTS[ARGUNKNOWN]}; then
+ case $prev in
+ --boot|-b)
diff --git a/debian/patches/cgtop-Fix-processing-of-controllers-other-than-CPU.patch b/debian/patches/cgtop-Fix-processing-of-controllers-other-than-CPU.patch
new file mode 100644
index 0000000..f18ecb2
--- /dev/null
+++ b/debian/patches/cgtop-Fix-processing-of-controllers-other-than-CPU.patch
@@ -0,0 +1,169 @@
+From: Szabolcs Fruhwald <sfruhwald@google.com>
+Date: Wed, 20 Feb 2019 12:38:50 -0800
+Subject: cgtop: Fix processing of controllers other than CPU
+
+After debugging the issue with gdb, I found that the following change
+
+ 94ddb08 "cgtop: Still try to get CPU statistics if controller-free"
+
+has introduced a bug, which prevents process(..) method processing
+memory and io controllers when cpu_accounting_is_cheap() is true.
+The obvious fix is to move this branch to be the last one, keeping
+the intended behavior of the above change, without having a negative
+effect on the other controllers.
+
+Fixes #11773 [systemd-cgtop no longer shows memory (and io) usage]
+
+(cherry picked from commit 5fe74e893c7939a360dc4eb75dbf3f540526c968)
+---
+ src/cgtop/cgtop.c | 130 +++++++++++++++++++++++++++---------------------------
+ 1 file changed, 65 insertions(+), 65 deletions(-)
+
+diff --git a/src/cgtop/cgtop.c b/src/cgtop/cgtop.c
+index b3bda30..ab3b979 100644
+--- a/src/cgtop/cgtop.c
++++ b/src/cgtop/cgtop.c
+@@ -223,71 +223,6 @@ static int process(
+ if (g->n_tasks > 0)
+ g->n_tasks_valid = true;
+
+- } else if (STR_IN_SET(controller, "cpu", "cpuacct") || cpu_accounting_is_cheap()) {
+- _cleanup_free_ char *p = NULL, *v = NULL;
+- uint64_t new_usage;
+- nsec_t timestamp;
+-
+- if (is_root_cgroup(path)) {
+- r = procfs_cpu_get_usage(&new_usage);
+- if (r < 0)
+- return r;
+- } else if (all_unified) {
+- _cleanup_free_ char *val = NULL;
+-
+- if (!streq(controller, "cpu"))
+- return 0;
+-
+- r = cg_get_keyed_attribute("cpu", path, "cpu.stat", STRV_MAKE("usage_usec"), &val);
+- if (IN_SET(r, -ENOENT, -ENXIO))
+- return 0;
+- if (r < 0)
+- return r;
+-
+- r = safe_atou64(val, &new_usage);
+- if (r < 0)
+- return r;
+-
+- new_usage *= NSEC_PER_USEC;
+- } else {
+- if (!streq(controller, "cpuacct"))
+- return 0;
+-
+- r = cg_get_path(controller, path, "cpuacct.usage", &p);
+- if (r < 0)
+- return r;
+-
+- r = read_one_line_file(p, &v);
+- if (r == -ENOENT)
+- return 0;
+- if (r < 0)
+- return r;
+-
+- r = safe_atou64(v, &new_usage);
+- if (r < 0)
+- return r;
+- }
+-
+- timestamp = now_nsec(CLOCK_MONOTONIC);
+-
+- if (g->cpu_iteration == iteration - 1 &&
+- (nsec_t) new_usage > g->cpu_usage) {
+-
+- nsec_t x, y;
+-
+- x = timestamp - g->cpu_timestamp;
+- if (x < 1)
+- x = 1;
+-
+- y = (nsec_t) new_usage - g->cpu_usage;
+- g->cpu_fraction = (double) y / (double) x;
+- g->cpu_valid = true;
+- }
+-
+- g->cpu_usage = (nsec_t) new_usage;
+- g->cpu_timestamp = timestamp;
+- g->cpu_iteration = iteration;
+-
+ } else if (streq(controller, "memory")) {
+
+ if (is_root_cgroup(path)) {
+@@ -411,6 +346,71 @@ static int process(
+ g->io_output = wr;
+ g->io_timestamp = timestamp;
+ g->io_iteration = iteration;
++ } else if (STR_IN_SET(controller, "cpu", "cpuacct") || cpu_accounting_is_cheap()) {
++ _cleanup_free_ char *p = NULL, *v = NULL;
++ uint64_t new_usage;
++ nsec_t timestamp;
++
++ if (is_root_cgroup(path)) {
++ r = procfs_cpu_get_usage(&new_usage);
++ if (r < 0)
++ return r;
++ } else if (all_unified) {
++ _cleanup_free_ char *val = NULL;
++
++ if (!streq(controller, "cpu"))
++ return 0;
++
++ r = cg_get_keyed_attribute("cpu", path, "cpu.stat", STRV_MAKE("usage_usec"), &val);
++ if (IN_SET(r, -ENOENT, -ENXIO))
++ return 0;
++ if (r < 0)
++ return r;
++
++ r = safe_atou64(val, &new_usage);
++ if (r < 0)
++ return r;
++
++ new_usage *= NSEC_PER_USEC;
++ } else {
++ if (!streq(controller, "cpuacct"))
++ return 0;
++
++ r = cg_get_path(controller, path, "cpuacct.usage", &p);
++ if (r < 0)
++ return r;
++
++ r = read_one_line_file(p, &v);
++ if (r == -ENOENT)
++ return 0;
++ if (r < 0)
++ return r;
++
++ r = safe_atou64(v, &new_usage);
++ if (r < 0)
++ return r;
++ }
++
++ timestamp = now_nsec(CLOCK_MONOTONIC);
++
++ if (g->cpu_iteration == iteration - 1 &&
++ (nsec_t) new_usage > g->cpu_usage) {
++
++ nsec_t x, y;
++
++ x = timestamp - g->cpu_timestamp;
++ if (x < 1)
++ x = 1;
++
++ y = (nsec_t) new_usage - g->cpu_usage;
++ g->cpu_fraction = (double) y / (double) x;
++ g->cpu_valid = true;
++ }
++
++ g->cpu_usage = (nsec_t) new_usage;
++ g->cpu_timestamp = timestamp;
++ g->cpu_iteration = iteration;
++
+ }
+
+ if (ret)
diff --git a/debian/patches/debian/Revert-core-one-step-back-again-for-nspawn-we-actual.patch b/debian/patches/debian/Revert-core-one-step-back-again-for-nspawn-we-actual.patch
index c8c61f4..7c1261e 100644
--- a/debian/patches/debian/Revert-core-one-step-back-again-for-nspawn-we-actual.patch
+++ b/debian/patches/debian/Revert-core-one-step-back-again-for-nspawn-we-actual.patch
@@ -14,7 +14,7 @@ Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1141137
1 file changed, 1 insertion(+), 10 deletions(-)
diff --git a/src/core/unit.c b/src/core/unit.c
-index 24b14fb..694df72 100644
+index 2a7359a..d55aba8 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -4553,16 +4553,7 @@ int unit_kill_context(
diff --git a/debian/patches/debian/Revert-udev-network-device-renaming-immediately-give.patch b/debian/patches/debian/Revert-udev-network-device-renaming-immediately-give.patch
index e8bf17b..acd6fbd 100644
--- a/debian/patches/debian/Revert-udev-network-device-renaming-immediately-give.patch
+++ b/debian/patches/debian/Revert-udev-network-device-renaming-immediately-give.patch
@@ -13,7 +13,7 @@ hack to make the renaming less likely to fail.
1 file changed, 46 insertions(+), 5 deletions(-)
diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
-index 07b7365..f67b295 100644
+index faec4fc..0b295b8 100644
--- a/src/udev/udev-event.c
+++ b/src/udev/udev-event.c
@@ -680,6 +680,7 @@ static int rename_netif(UdevEvent *event) {
diff --git a/debian/patches/debian/Revert-udev-rules-Permission-changes-for-dev-dri-renderD.patch b/debian/patches/debian/Revert-udev-rules-Permission-changes-for-dev-dri-renderD.patch
deleted file mode 100644
index 0329e4a..0000000
--- a/debian/patches/debian/Revert-udev-rules-Permission-changes-for-dev-dri-renderD.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From: Michael Biebl <biebl@debian.org>
-Date: Sun, 17 Dec 2017 00:31:20 +0100
-Subject: Revert "udev-rules: Permission changes for /dev/dri/renderD*"
-
-This would introduce a new system group "render". As the name is rather
-generic, this needs further discussion first, so revert this change for
-now.
-
-This reverts commit 4e15a7343cb389e97f3eb4f49699161862d8b8b2.
----
- meson.build | 2 --
- meson_options.txt | 2 --
- rules/50-udev-default.rules.in | 5 +----
- src/login/70-uaccess.rules.m4 | 2 +-
- 4 files changed, 2 insertions(+), 9 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index c539a00..1c00000 100644
---- a/meson.build
-+++ b/meson.build
-@@ -818,7 +818,6 @@ conf.set10('ENABLE_WHEEL_GROUP', get_option('wheel-group'))
- dev_kvm_mode = get_option('dev-kvm-mode')
- substs.set('DEV_KVM_MODE', dev_kvm_mode)
- conf.set10('DEV_KVM_UACCESS', dev_kvm_mode != '0666')
--substs.set('GROUP_RENDER_MODE', get_option('group-render-mode'))
-
- kill_user_processes = get_option('default-kill-user-processes')
- conf.set10('KILL_USER_PROCESSES', kill_user_processes)
-@@ -3107,7 +3106,6 @@ status = [
- 'minimum container UID base: @0@'.format(container_uid_base_min),
- 'maximum container UID base: @0@'.format(container_uid_base_max),
- '/dev/kvm access mode: @0@'.format(get_option('dev-kvm-mode')),
-- 'render group access mode: @0@'.format(get_option('group-render-mode')),
- 'certificate root directory: @0@'.format(get_option('certificate-root')),
- 'support URL: @0@'.format(support_url),
- 'nobody user name: @0@'.format(nobody_user),
-diff --git a/meson_options.txt b/meson_options.txt
-index 044bb79..2dcfa3b 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -192,8 +192,6 @@ option('nobody-group', type : 'string',
- value : 'nobody')
- option('dev-kvm-mode', type : 'string', value : '0666',
- description : '/dev/kvm access mode')
--option('group-render-mode', type : 'string', value : '0666',
-- description : 'Access mode for devices owned by render group (e.g. /dev/dri/renderD*, /dev/kfd).')
- option('default-kill-user-processes', type : 'boolean',
- description : 'the default value for KillUserProcesses= setting')
- option('gshadow', type : 'boolean',
-diff --git a/rules/50-udev-default.rules.in b/rules/50-udev-default.rules.in
-index 191f56f..63aa3db 100644
---- a/rules/50-udev-default.rules.in
-+++ b/rules/50-udev-default.rules.in
-@@ -31,14 +31,11 @@ SUBSYSTEM=="input", KERNEL=="js[0-9]*", MODE="0664"
-
- SUBSYSTEM=="video4linux", GROUP="video"
- SUBSYSTEM=="graphics", GROUP="video"
--SUBSYSTEM=="drm", KERNEL!="renderD*", GROUP="video"
-+SUBSYSTEM=="drm", GROUP="video"
- SUBSYSTEM=="dvb", GROUP="video"
- SUBSYSTEM=="media", GROUP="video"
- SUBSYSTEM=="cec", GROUP="video"
-
--SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="render", MODE="@GROUP_RENDER_MODE@"
--SUBSYSTEM=="kfd", GROUP="render", MODE="@GROUP_RENDER_MODE@"
--
- SUBSYSTEM=="sound", GROUP="audio", \
- OPTIONS+="static_node=snd/seq", OPTIONS+="static_node=snd/timer"
-
-diff --git a/src/login/70-uaccess.rules.m4 b/src/login/70-uaccess.rules.m4
-index d55e5bf..e46cacb 100644
---- a/src/login/70-uaccess.rules.m4
-+++ b/src/login/70-uaccess.rules.m4
-@@ -45,7 +45,7 @@ SUBSYSTEM=="firewire", ATTR{units}=="*0x00a02d:0x010001*", TAG+="uaccess"
- SUBSYSTEM=="firewire", ATTR{units}=="*0x00a02d:0x014001*", TAG+="uaccess"
-
- # DRI video devices
--SUBSYSTEM=="drm", KERNEL=="card*", TAG+="uaccess"
-+SUBSYSTEM=="drm", KERNEL=="card*|renderD*", TAG+="uaccess"
- m4_ifdef(`DEV_KVM_UACCESS',``
- # KVM
- SUBSYSTEM=="misc", KERNEL=="kvm", TAG+="uaccess"''
diff --git a/debian/patches/debian/Use-Debian-specific-config-files.patch b/debian/patches/debian/Use-Debian-specific-config-files.patch
index cd9a0f8..ba4d9ba 100644
--- a/debian/patches/debian/Use-Debian-specific-config-files.patch
+++ b/debian/patches/debian/Use-Debian-specific-config-files.patch
@@ -392,7 +392,7 @@ index 6b6b32a..cb63d45 100644
return r;
}
diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index eeb17b6..e1bce1f 100644
+index 324d4a4..4d54ac3 100644
--- a/src/timedate/timedated.c
+++ b/src/timedate/timedated.c
@@ -215,6 +215,7 @@ static int context_read_data(Context *c) {
diff --git a/debian/patches/debian/fsckd-daemon-for-inter-fsckd-communication.patch b/debian/patches/debian/fsckd-daemon-for-inter-fsckd-communication.patch
index a727c0e..84aabfb 100644
--- a/debian/patches/debian/fsckd-daemon-for-inter-fsckd-communication.patch
+++ b/debian/patches/debian/fsckd-daemon-for-inter-fsckd-communication.patch
@@ -239,10 +239,10 @@ index 0000000..b7ad58d
+
+</refentry>
diff --git a/meson.build b/meson.build
-index 56c98b9..c539a00 100644
+index d340736..d4887d5 100644
--- a/meson.build
+++ b/meson.build
-@@ -2393,6 +2393,14 @@ executable('systemd-makefs',
+@@ -2395,6 +2395,14 @@ executable('systemd-makefs',
install : true,
install_dir : rootlibexecdir)
@@ -268,7 +268,7 @@ index 029261c..d709ddb 100644
+src/fsckd/fsckd.c
diff --git a/src/fsckd/fsckd.c b/src/fsckd/fsckd.c
new file mode 100644
-index 0000000..d48e53a
+index 0000000..fffea29
--- /dev/null
+++ b/src/fsckd/fsckd.c
@@ -0,0 +1,690 @@
diff --git a/debian/patches/network-do-not-remove-rule-when-it-is-requested-by-existi.patch b/debian/patches/network-do-not-remove-rule-when-it-is-requested-by-existi.patch
new file mode 100644
index 0000000..19cabfe
--- /dev/null
+++ b/debian/patches/network-do-not-remove-rule-when-it-is-requested-by-existi.patch
@@ -0,0 +1,56 @@
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Fri, 22 Feb 2019 13:32:47 +0900
+Subject: network: do not remove rule when it is requested by existing links
+
+Otherwise, the first link once removes all saved rules in the foreign
+rule database, and the second or later links create again...
+
+(cherry picked from commit 031fb59a984e5b51f3c72aa8125ecc50b08011fe)
+---
+ src/network/networkd-routing-policy-rule.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/src/network/networkd-routing-policy-rule.c b/src/network/networkd-routing-policy-rule.c
+index 21a40fa..65a9af2 100644
+--- a/src/network/networkd-routing-policy-rule.c
++++ b/src/network/networkd-routing-policy-rule.c
+@@ -1250,6 +1250,26 @@ int routing_policy_load_rules(const char *state_file, Set **rules) {
+ return 0;
+ }
+
++static bool manager_links_have_routing_policy_rule(Manager *m, RoutingPolicyRule *rule) {
++ RoutingPolicyRule *link_rule;
++ Iterator i;
++ Link *link;
++
++ assert(m);
++ assert(rule);
++
++ HASHMAP_FOREACH(link, m->links, i) {
++ if (!link->network)
++ continue;
++
++ LIST_FOREACH(rules, link_rule, link->network->rules)
++ if (routing_policy_rule_compare_func(link_rule, rule) == 0)
++ return true;
++ }
++
++ return false;
++}
++
+ void routing_policy_rule_purge(Manager *m, Link *link) {
+ RoutingPolicyRule *rule, *existing;
+ Iterator i;
+@@ -1263,6 +1283,12 @@ void routing_policy_rule_purge(Manager *m, Link *link) {
+ if (!existing)
+ continue; /* Saved rule does not exist anymore. */
+
++ if (manager_links_have_routing_policy_rule(m, existing))
++ continue; /* Existing links have the saved rule. */
++
++ /* Existing links do not have the saved rule. Let's drop the rule now, and re-configure it
++ * later when it is requested. */
++
+ r = routing_policy_rule_remove(existing, link, NULL);
+ if (r < 0) {
+ log_warning_errno(r, "Could not remove routing policy rules: %m");
diff --git a/debian/patches/network-remove-routing-policy-rule-from-foreign-rule-data.patch b/debian/patches/network-remove-routing-policy-rule-from-foreign-rule-data.patch
new file mode 100644
index 0000000..b19e588
--- /dev/null
+++ b/debian/patches/network-remove-routing-policy-rule-from-foreign-rule-data.patch
@@ -0,0 +1,52 @@
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Fri, 22 Feb 2019 13:27:44 +0900
+Subject: network: remove routing policy rule from foreign rule database when
+ it is removed
+
+Previously, When the first link configures rules, it removes all saved
+rules, which were configured by networkd previously, in the foreign rule
+database, but the rules themselves are still in the database.
+Thus, when the second or later link configures rules, it errnously
+treats the rules already exist.
+This is the root of issue #11280.
+
+This removes rules from the foreign database when they are removed.
+
+Fixes #11280.
+
+(cherry picked from commit 92cd00b9749141907a1110044cc7d1f01caff545)
+---
+ src/network/networkd-routing-policy-rule.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/src/network/networkd-routing-policy-rule.c b/src/network/networkd-routing-policy-rule.c
+index 2dc7862..21a40fa 100644
+--- a/src/network/networkd-routing-policy-rule.c
++++ b/src/network/networkd-routing-policy-rule.c
+@@ -1260,15 +1260,18 @@ void routing_policy_rule_purge(Manager *m, Link *link) {
+
+ SET_FOREACH(rule, m->rules_saved, i) {
+ existing = set_get(m->rules_foreign, rule);
+- if (existing) {
++ if (!existing)
++ continue; /* Saved rule does not exist anymore. */
+
+- r = routing_policy_rule_remove(rule, link, NULL);
+- if (r < 0) {
+- log_warning_errno(r, "Could not remove routing policy rules: %m");
+- continue;
+- }
+-
+- link->routing_policy_rule_remove_messages++;
++ r = routing_policy_rule_remove(existing, link, NULL);
++ if (r < 0) {
++ log_warning_errno(r, "Could not remove routing policy rules: %m");
++ continue;
+ }
++
++ link->routing_policy_rule_remove_messages++;
++
++ assert_se(set_remove(m->rules_foreign, existing) == existing);
++ routing_policy_rule_free(existing);
+ }
+ }
diff --git a/debian/patches/networkd-clarify-that-IPv6-RA-uses-our-own-stack-no-the-k.patch b/debian/patches/networkd-clarify-that-IPv6-RA-uses-our-own-stack-no-the-k.patch
new file mode 100644
index 0000000..8b7b4d8
--- /dev/null
+++ b/debian/patches/networkd-clarify-that-IPv6-RA-uses-our-own-stack-no-the-k.patch
@@ -0,0 +1,26 @@
+From: Lennart Poettering <lennart@poettering.net>
+Date: Wed, 13 Mar 2019 17:00:56 +0100
+Subject: networkd: clarify that IPv6 RA uses our own stack, no the kernel's
+
+Fixes: #8906
+(cherry picked from commit c4a05aa1a8338013108d099de805f3262a871c0f)
+---
+ man/systemd.network.xml | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/man/systemd.network.xml b/man/systemd.network.xml
+index ee464ff..12be72a 100644
+--- a/man/systemd.network.xml
++++ b/man/systemd.network.xml
+@@ -632,6 +632,11 @@
+ url="https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt";>ip-sysctl.txt</ulink> in the kernel
+ documentation regarding <literal>accept_ra</literal>, but note that systemd's setting of
+ <constant>1</constant> (i.e. true) corresponds to kernel's setting of <constant>2</constant>.</para>
++
++ <para>Note that if this option is enabled a userspace implementation of the IPv6 RA protocol is
++ used, and the kernel's own implementation remains disabled, since `networkd` needs to know all
++ details supplied in the advertisements, and these are not available from the kernel if the kernel's
++ own implemenation is used.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
diff --git a/debian/patches/networkd-test-ignore-failures-of-test_route_only_dns-in-c.patch b/debian/patches/networkd-test-ignore-failures-of-test_route_only_dns-in-c.patch
new file mode 100644
index 0000000..72e5042
--- /dev/null
+++ b/debian/patches/networkd-test-ignore-failures-of-test_route_only_dns-in-c.patch
@@ -0,0 +1,61 @@
+From: Martin Pitt <martin@piware.de>
+Date: Wed, 27 Feb 2019 23:15:31 +0100
+Subject: networkd-test: ignore failures of test_route_only_dns* in containers
+
+This test exposes a race condition when running in LXC, see issue #11848
+for details. Until that is understood and fixed, skip the test as it's
+not a recent regression.
+
+(cherry picked from commit 09b8826ea371e027c76a573a226bfd8f8c5652a2)
+---
+ test/networkd-test.py | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/test/networkd-test.py b/test/networkd-test.py
+index 9487910..6efeef9 100755
+--- a/test/networkd-test.py
++++ b/test/networkd-test.py
+@@ -29,6 +29,7 @@ import time
+ import unittest
+
+ HAVE_DNSMASQ = shutil.which('dnsmasq') is not None
++IS_CONTAINER = subprocess.call(['systemd-detect-virt', '--quiet', '--container']) == 0
+
+ NETWORK_UNITDIR = '/run/systemd/network'
+
+@@ -476,8 +477,15 @@ Address=192.168.42.100
+ DNS=192.168.42.1
+ Domains= ~company''')
+
+- self.do_test(coldplug=True, ipv6=False,
+- extra_opts='IPv6AcceptRouterAdvertisements=False')
++ try:
++ self.do_test(coldplug=True, ipv6=False,
++ extra_opts='IPv6AcceptRouterAdvertisements=False')
++ except subprocess.CalledProcessError as e:
++ # networkd often fails to start in LXC: https://github.com/systemd/systemd/issues/11848
++ if IS_CONTAINER and e.cmd == ['systemctl', 'start', 'systemd-networkd']:
++ raise unittest.SkipTest('https://github.com/systemd/systemd/issues/11848')
++ else:
++ raise
+
+ with open(RESOLV_CONF) as f:
+ contents = f.read()
+@@ -500,8 +508,15 @@ Address=192.168.42.100
+ DNS=192.168.42.1
+ Domains= ~company ~.''')
+
+- self.do_test(coldplug=True, ipv6=False,
+- extra_opts='IPv6AcceptRouterAdvertisements=False')
++ try:
++ self.do_test(coldplug=True, ipv6=False,
++ extra_opts='IPv6AcceptRouterAdvertisements=False')
++ except subprocess.CalledProcessError as e:
++ # networkd often fails to start in LXC: https://github.com/systemd/systemd/issues/11848
++ if IS_CONTAINER and e.cmd == ['systemctl', 'start', 'systemd-networkd']:
++ raise unittest.SkipTest('https://github.com/systemd/systemd/issues/11848')
++ else:
++ raise
+
+ with open(RESOLV_CONF) as f:
+ contents = f.read()
diff --git a/debian/patches/pam-systemd-use-secure_getenv-rather-than-getenv.patch b/debian/patches/pam-systemd-use-secure_getenv-rather-than-getenv.patch
new file mode 100644
index 0000000..b966fe3
--- /dev/null
+++ b/debian/patches/pam-systemd-use-secure_getenv-rather-than-getenv.patch
@@ -0,0 +1,40 @@
+From: Lennart Poettering <lennart@poettering.net>
+Date: Mon, 4 Feb 2019 10:23:43 +0100
+Subject: pam-systemd: use secure_getenv() rather than getenv()
+
+And explain why in a comment.
+
+(cherry picked from commit 83d4ab55336ff8a0643c6aa627b31e351a24040a)
+---
+ src/login/pam_systemd.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/src/login/pam_systemd.c b/src/login/pam_systemd.c
+index 997b74e..ea245c8 100644
+--- a/src/login/pam_systemd.c
++++ b/src/login/pam_systemd.c
+@@ -316,14 +316,21 @@ static const char* getenv_harder(pam_handle_t *handle, const char *key, const ch
+ assert(handle);
+ assert(key);
+
+- /* Looks for an environment variable, preferrably in the environment block associated with the specified PAM
+- * handle, falling back to the process' block instead. */
++ /* Looks for an environment variable, preferrably in the environment block associated with the
++ * specified PAM handle, falling back to the process' block instead. Why check both? Because we want
++ * to permit configuration of session properties from unit files that invoke PAM services, so that
++ * PAM services don't have to be reworked to set systemd-specific properties, but these properties
++ * can still be set from the unit file Environment= block. */
+
+ v = pam_getenv(handle, key);
+ if (!isempty(v))
+ return v;
+
+- v = getenv(key);
++ /* We use secure_getenv() here, since we might get loaded into su/sudo, which are SUID. Ideally
++ * they'd clean up the environment before invoking foreign code (such as PAM modules), but alas they
++ * currently don't (to be precise, they clean up the environment they pass to their children, but
++ * not their own environ[]). */
++ v = secure_getenv(key);
+ if (!isempty(v))
+ return v;
+
diff --git a/debian/patches/remove-.-path-components-from-required-mount-paths.patch b/debian/patches/remove-.-path-components-from-required-mount-paths.patch
new file mode 100644
index 0000000..3cb5b6a
--- /dev/null
+++ b/debian/patches/remove-.-path-components-from-required-mount-paths.patch
@@ -0,0 +1,30 @@
+From: Stephane Chazelas <stephane.chazelas@gmail.com>
+Date: Wed, 6 Mar 2019 22:16:55 +0000
+Subject: remove "." path components from required mount paths
+
+unit_require_mounts_for may be passed path arguments that contain "."
+components like for user's home directories where "." is sometimes used
+to specify some form of anchor point.
+
+This change stops considering such path as an error and removes the "."
+components instead.
+
+Closes: #11910
+(cherry picked from commit 106bf8e445a797f9d9c88b827ed42193f2f6b838)
+---
+ src/core/unit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/core/unit.c b/src/core/unit.c
+index 24b14fb..2a7359a 100644
+--- a/src/core/unit.c
++++ b/src/core/unit.c
+@@ -4607,7 +4607,7 @@ int unit_require_mounts_for(Unit *u, const char *path, UnitDependencyMask mask)
+ if (!p)
+ return -ENOMEM;
+
+- path = path_simplify(p, false);
++ path = path_simplify(p, true);
+
+ if (!path_is_normalized(path))
+ return -EPERM;
diff --git a/debian/patches/series b/debian/patches/series
index 643b155..c4bdca5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,6 +4,18 @@ sd-device-also-store-properties-read-from-udev-database-t.patch
networkd-test-disable-DNSSEC-in-domain-restricted-DNS-tes.patch
networkd-test-use-a-complete-domain-name-in-test_route_on.patch
networkd-test-fix-test_dropin.patch
+networkd-test-ignore-failures-of-test_route_only_dns-in-c.patch
+timedate-fix-emitted-value-when-ntp-client-is-enabled-dis.patch
+cgtop-Fix-processing-of-controllers-other-than-CPU.patch
+udev-restore-debug-level-when-logging-a-failure-in-the-ex.patch
+remove-.-path-components-from-required-mount-paths.patch
+Re-add-uaccess-tag-for-dev-dri-renderD.patch
+udev-run-programs-in-the-specified-order.patch
+bash-completion-use-default-completion-for-redirect-opera.patch
+networkd-clarify-that-IPv6-RA-uses-our-own-stack-no-the-k.patch
+network-remove-routing-policy-rule-from-foreign-rule-data.patch
+network-do-not-remove-rule-when-it-is-requested-by-existi.patch
+pam-systemd-use-secure_getenv-rather-than-getenv.patch
debian/Use-Debian-specific-config-files.patch
debian/Bring-tmpfiles.d-tmp.conf-in-line-with-Debian-defaul.patch
debian/Make-run-lock-tmpfs-an-API-fs.patch
@@ -19,5 +31,4 @@ debian/Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch
debian/Revert-core-enable-TasksMax-for-all-services-by-default-a.patch
debian/Let-graphical-session-pre.target-be-manually-started.patch
debian/Add-env-variable-for-machine-ID-path.patch
-debian/Revert-udev-rules-Permission-changes-for-dev-dri-renderD.patch
debian/Drop-seccomp-system-call-filter-for-udev.patch
diff --git a/debian/patches/timedate-fix-emitted-value-when-ntp-client-is-enabled-dis.patch b/debian/patches/timedate-fix-emitted-value-when-ntp-client-is-enabled-dis.patch
new file mode 100644
index 0000000..4ae8684
--- /dev/null
+++ b/debian/patches/timedate-fix-emitted-value-when-ntp-client-is-enabled-dis.patch
@@ -0,0 +1,31 @@
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 11 Mar 2019 04:44:21 +0900
+Subject: timedate: fix emitted value when ntp client is enabled/disabled
+ (#11951)
+
+This fixes a regression originall caused by cf3872bd2 and
+triggered by b4356b5720a.
+
+Fixes #11944
+
+(cherry picked from commit 49942d6b1eac12f3157c628ee6249c3bbb3602aa)
+---
+ src/timedate/timedated.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
+index eeb17b6..324d4a4 100644
+--- a/src/timedate/timedated.c
++++ b/src/timedate/timedated.c
+@@ -377,9 +377,9 @@ static int match_job_removed(sd_bus_message *m, void *userdata, sd_bus_error *er
+ n += !!u->path;
+
+ if (n == 0) {
+- (void) sd_bus_emit_properties_changed(sd_bus_message_get_bus(m), "/org/freedesktop/timedate1", "org.freedesktop.timedate1", "NTP", NULL);
+-
+ c->slot_job_removed = sd_bus_slot_unref(c->slot_job_removed);
++
++ (void) sd_bus_emit_properties_changed(sd_bus_message_get_bus(m), "/org/freedesktop/timedate1", "org.freedesktop.timedate1", "NTP", NULL);
+ }
+
+ return 0;
diff --git a/debian/patches/udev-restore-debug-level-when-logging-a-failure-in-the-ex.patch b/debian/patches/udev-restore-debug-level-when-logging-a-failure-in-the-ex.patch
new file mode 100644
index 0000000..63cc83a
--- /dev/null
+++ b/debian/patches/udev-restore-debug-level-when-logging-a-failure-in-the-ex.patch
@@ -0,0 +1,29 @@
+From: Franck Bui <fbui@suse.com>
+Date: Tue, 5 Mar 2019 11:03:07 +0100
+Subject: udev: restore debug level when logging a failure in the external
+ prog called by IMPORT{program}
+
+It was already the case before commit a75211421fc9366068e6d9446e8e567246c72feb,
+which upgraded the log to warning.
+
+This seems an unintended side effect as the commit message doesn't mention it
+and the old behavior looks more appropriate.
+
+(cherry picked from commit 3c37dadf627677eef62fcfc0c0f07cc67c748a9e)
+---
+ src/udev/udev-rules.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
+index bc9c6c2..7fa4fd4 100644
+--- a/src/udev/udev-rules.c
++++ b/src/udev/udev-rules.c
+@@ -647,7 +647,7 @@ static int import_program_into_properties(UdevEvent *event,
+ char *line;
+ int r;
+
+- r = udev_event_spawn(event, timeout_usec, false, program, result, sizeof result);
++ r = udev_event_spawn(event, timeout_usec, true, program, result, sizeof result);
+ if (r < 0)
+ return r;
+ if (r > 0)
diff --git a/debian/patches/udev-run-programs-in-the-specified-order.patch b/debian/patches/udev-run-programs-in-the-specified-order.patch
new file mode 100644
index 0000000..95c8f15
--- /dev/null
+++ b/debian/patches/udev-run-programs-in-the-specified-order.patch
@@ -0,0 +1,161 @@
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 5 Mar 2019 04:01:34 +0900
+Subject: udev: run programs in the specified order
+
+This fixes bugs introduced by 29448498c724da7ade1b5efb20d7472c1b128d2c
+and d838e14515c82b05a07f2bf393cce057b45b2b53.
+
+Previously, RUN and SECLABEL keys are stored in udev_list with its unique
+flag is false. If the flag is false, then udev_list is just a linked
+list and new entries are always added in the last.
+So, we should use OrderedHashmap instead of Hashmap.
+
+Fixes #11368.
+
+(cherry picked from commit 39a15c8a8dad26deda140867f03e44a535b7bd8d)
+---
+ src/udev/udev-event.c | 6 +++---
+ src/udev/udev-node.c | 6 +++---
+ src/udev/udev-node.h | 2 +-
+ src/udev/udev-rules.c | 12 ++++++------
+ src/udev/udev.h | 4 ++--
+ src/udev/udevadm-test.c | 2 +-
+ 6 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
+index 07b7365..faec4fc 100644
+--- a/src/udev/udev-event.c
++++ b/src/udev/udev-event.c
+@@ -71,8 +71,8 @@ UdevEvent *udev_event_free(UdevEvent *event) {
+ sd_device_unref(event->dev);
+ sd_device_unref(event->dev_db_clone);
+ sd_netlink_unref(event->rtnl);
+- hashmap_free_free_key(event->run_list);
+- hashmap_free_free_free(event->seclabel_list);
++ ordered_hashmap_free_free_key(event->run_list);
++ ordered_hashmap_free_free_free(event->seclabel_list);
+ free(event->program_result);
+ free(event->name);
+
+@@ -873,7 +873,7 @@ void udev_event_execute_run(UdevEvent *event, usec_t timeout_usec) {
+ void *val;
+ Iterator i;
+
+- HASHMAP_FOREACH_KEY(val, cmd, event->run_list, i) {
++ ORDERED_HASHMAP_FOREACH_KEY(val, cmd, event->run_list, i) {
+ enum udev_builtin_cmd builtin_cmd = PTR_TO_INT(val);
+ char command[UTIL_PATH_SIZE];
+
+diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c
+index 1c00dd1..cfbbd7b 100644
+--- a/src/udev/udev-node.c
++++ b/src/udev/udev-node.c
+@@ -272,7 +272,7 @@ int udev_node_update_old_links(sd_device *dev, sd_device *dev_old) {
+
+ static int node_permissions_apply(sd_device *dev, bool apply,
+ mode_t mode, uid_t uid, gid_t gid,
+- Hashmap *seclabel_list) {
++ OrderedHashmap *seclabel_list) {
+ const char *devnode, *subsystem, *id_filename = NULL;
+ struct stat stats;
+ dev_t devnum;
+@@ -318,7 +318,7 @@ static int node_permissions_apply(sd_device *dev, bool apply,
+ log_device_debug(dev, "Preserve permissions of %s, %#o, uid=%u, gid=%u", devnode, mode, uid, gid);
+
+ /* apply SECLABEL{$module}=$label */
+- HASHMAP_FOREACH_KEY(label, name, seclabel_list, i) {
++ ORDERED_HASHMAP_FOREACH_KEY(label, name, seclabel_list, i) {
+ int q;
+
+ if (streq(name, "selinux")) {
+@@ -386,7 +386,7 @@ static int xsprintf_dev_num_path_from_sd_device(sd_device *dev, char **ret) {
+
+ int udev_node_add(sd_device *dev, bool apply,
+ mode_t mode, uid_t uid, gid_t gid,
+- Hashmap *seclabel_list) {
++ OrderedHashmap *seclabel_list) {
+ const char *devnode, *devlink;
+ _cleanup_free_ char *filename = NULL;
+ int r;
+diff --git a/src/udev/udev-node.h b/src/udev/udev-node.h
+index 223c8f0..5ae816d 100644
+--- a/src/udev/udev-node.h
++++ b/src/udev/udev-node.h
+@@ -10,6 +10,6 @@
+
+ int udev_node_add(sd_device *dev, bool apply,
+ mode_t mode, uid_t uid, gid_t gid,
+- Hashmap *seclabel_list);
++ OrderedHashmap *seclabel_list);
+ int udev_node_remove(sd_device *dev);
+ int udev_node_update_old_links(sd_device *dev, sd_device *dev_old);
+diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
+index 7fa4fd4..93709cc 100644
+--- a/src/udev/udev-rules.c
++++ b/src/udev/udev-rules.c
+@@ -2291,13 +2291,13 @@ int udev_rules_apply_to_event(
+ return log_oom();
+
+ if (IN_SET(cur->key.op, OP_ASSIGN, OP_ASSIGN_FINAL))
+- hashmap_clear_free_free(event->seclabel_list);
++ ordered_hashmap_clear_free_free(event->seclabel_list);
+
+- r = hashmap_ensure_allocated(&event->seclabel_list, NULL);
++ r = ordered_hashmap_ensure_allocated(&event->seclabel_list, NULL);
+ if (r < 0)
+ return log_oom();
+
+- r = hashmap_put(event->seclabel_list, name, label);
++ r = ordered_hashmap_put(event->seclabel_list, name, label);
+ if (r < 0)
+ return log_oom();
+ log_device_debug(dev, "SECLABEL{%s}='%s' %s:%u",
+@@ -2474,9 +2474,9 @@ int udev_rules_apply_to_event(
+ _cleanup_free_ char *cmd = NULL;
+
+ if (IN_SET(cur->key.op, OP_ASSIGN, OP_ASSIGN_FINAL))
+- hashmap_clear_free_key(event->run_list);
++ ordered_hashmap_clear_free_key(event->run_list);
+
+- r = hashmap_ensure_allocated(&event->run_list, NULL);
++ r = ordered_hashmap_ensure_allocated(&event->run_list, NULL);
+ if (r < 0)
+ return log_oom();
+
+@@ -2484,7 +2484,7 @@ int udev_rules_apply_to_event(
+ if (!cmd)
+ return log_oom();
+
+- r = hashmap_put(event->run_list, cmd, INT_TO_PTR(cur->key.builtin_cmd));
++ r = ordered_hashmap_put(event->run_list, cmd, INT_TO_PTR(cur->key.builtin_cmd));
+ if (r < 0)
+ return log_oom();
+
+diff --git a/src/udev/udev.h b/src/udev/udev.h
+index 3bc69ff..2fb49dc 100644
+--- a/src/udev/udev.h
++++ b/src/udev/udev.h
+@@ -25,8 +25,8 @@ typedef struct UdevEvent {
+ mode_t mode;
+ uid_t uid;
+ gid_t gid;
+- Hashmap *seclabel_list;
+- Hashmap *run_list;
++ OrderedHashmap *seclabel_list;
++ OrderedHashmap *run_list;
+ usec_t exec_delay_usec;
+ usec_t birth_usec;
+ sd_netlink *rtnl;
+diff --git a/src/udev/udevadm-test.c b/src/udev/udevadm-test.c
+index 54c525e..9c17844 100644
+--- a/src/udev/udevadm-test.c
++++ b/src/udev/udevadm-test.c
+@@ -135,7 +135,7 @@ int test_main(int argc, char *argv[], void *userdata) {
+ FOREACH_DEVICE_PROPERTY(dev, key, value)
+ printf("%s=%s\n", key, value);
+
+- HASHMAP_FOREACH_KEY(val, cmd, event->run_list, i) {
++ ORDERED_HASHMAP_FOREACH_KEY(val, cmd, event->run_list, i) {
+ char program[UTIL_PATH_SIZE];
+
+ udev_event_apply_format(event, cmd, program, sizeof(program), false);
diff --git a/debian/rules b/debian/rules
index 09c133a..a1b568b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -10,7 +10,7 @@ include /usr/share/dpkg/default.mk
ifeq ($(DEB_VENDOR),Ubuntu)
DEFAULT_NTP_SERVERS = ntp.ubuntu.com
SUPPORT_URL = http://www.ubuntu.com/support
- CONFFLAGS_DISTRO = -Ddns-servers=''
+ CONFFLAGS_DISTRO =
else
DEFAULT_NTP_SERVERS = 0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org
SUPPORT_URL = https://www.debian.org/support
@@ -66,13 +66,15 @@ CONFFLAGS = \
-Dportabled=false \
-Dwheel-group=false \
-Dntp-servers="$(DEFAULT_NTP_SERVERS)" \
+ -Ddns-servers='' \
-Dlink-udev-shared=false \
-Dsystem-uid-max=999 \
-Dsystem-gid-max=999 \
-Dnobody-user=nobody \
-Dnobody-group=nogroup \
-Dbump-proc-sys-fs-nr-open=false \
- -Ddev-kvm-mode=0660
+ -Ddev-kvm-mode=0660 \
+ -Dgroup-render-mode=0660
# resolved's DNSSEC support is still not mature enough, don't enable it by
# default on stable Debian or any Ubuntu releases
@@ -254,7 +256,7 @@ endif
set -e; for pkg in $(shell dh_listpackages -Nudev-udeb -Nlibudev1-udeb -Nsystemd); do \
echo "... from $$pkg..."; \
(cd debian/$$pkg; find -type f -o -type l) | (cd debian/systemd; xargs rm -f --verbose); \
- (cd debian/$$pkg; find -mindepth 1 -type d) | (cd debian/systemd; xargs rmdir --ignore-fail-on-non-empty --verbose || true); \
+ (cd debian/$$pkg; find -mindepth 1 -type d | sort -r) | (cd debian/systemd; xargs rmdir --ignore-fail-on-non-empty --verbose || true); \
done
# Ubuntu specific files
diff --git a/debian/tests/assert.sh b/debian/tests/assert.sh
index eccc338..1d47bf4 100644
--- a/debian/tests/assert.sh
+++ b/debian/tests/assert.sh
@@ -23,3 +23,12 @@ assert_in() {
fi
}
+assert_rc() {
+ local exp=$1
+ shift
+ set +e
+ $@
+ RC=$?
+ set -e
+ assert_eq $RC $exp
+}
diff --git a/debian/tests/boot-and-services b/debian/tests/boot-and-services
index 7508966..fe2cdfb 100755
--- a/debian/tests/boot-and-services
+++ b/debian/tests/boot-and-services
@@ -13,6 +13,8 @@ import time
import re
from glob import glob
+is_container = subprocess.call(['systemd-detect-virt', '--container']) == 0
+
def wait_unit_stop(unit, timeout=10):
'''Wait until given unit is not running any more
@@ -53,6 +55,9 @@ class ServicesTest(unittest.TestCase):
failed = [f for f in failed if 'console-setup' not in f]
# cpi.service fails on s390x
failed = [f for f in failed if 'cpi.service' not in f]
+ # https://bugs.debian.org/926138
+ if is_container:
+ failed = [f for f in failed if 'e2scrub_reap.service' not in f]
if failed:
for f in failed:
f = f.split()[0]
@@ -63,7 +68,7 @@ class ServicesTest(unittest.TestCase):
@unittest.skipUnless(shutil.which('gdm3') is not None, 'gdm3 not found')
def test_gdm3(self):
- subprocess.check_call(['pgrep', '-af', 'gdm-.*-session'])
+ subprocess.check_call(['pgrep', '-af', '/gdm[-3]'])
self.active_unit('gdm')
def test_dbus(self):
@@ -102,13 +107,15 @@ class ServicesTest(unittest.TestCase):
self.active_unit('rsyslog')
with open('/var/log/syslog') as f:
log = f.read()
- # has kernel messages
- self.assertRegex(log, 'kernel:.*[cC]ommand line:')
+ if not is_container:
+ # has kernel messages
+ self.assertRegex(log, 'kernel:.*[cC]ommand line:')
# has init messages
self.assertRegex(log, 'systemd.*Reached target Graphical Interface')
# has other services
self.assertRegex(log, 'NetworkManager.*:')
+ @unittest.skipIf(is_container, 'udev does not work in containers')
def test_udev(self):
out = subprocess.check_output(['udevadm', 'info', '--export-db'])
self.assertIn(b'\nP: /devices/', out)
@@ -146,12 +153,14 @@ class ServicesTest(unittest.TestCase):
['systemctl', 'status', 'systemd-tmpfiles-clean.timer'],
stdout=subprocess.PIPE), 0)
subprocess.check_call(['systemctl', 'start', 'systemd-tmpfiles-clean'])
- # all files in /tmp/ should get cleaned up on boot
- self.assertFalse(os.path.exists('/tmp/oldfile.test'))
+ if not is_container:
+ # all files in /tmp/ should get cleaned up on boot
+ self.assertFalse(os.path.exists('/tmp/oldfile.test'))
self.assertFalse(os.path.exists('/tmp/newfile.test'))
# files in /var/tmp/ older than 30d should get cleaned up
# XXX FIXME: /var/tmp/ cleanup was disabled in #675422
- # self.assertFalse(os.path.exists('/var/tmp/oldfile.test'))
+ # if not is_container:
+ # self.assertFalse(os.path.exists('/var/tmp/oldfile.test'))
self.assertTrue(os.path.exists('/var/tmp/newfile.test'))
# next run should leave the recent ones
@@ -175,8 +184,9 @@ class JournalTest(unittest.TestCase):
def test_no_options(self):
out = subprocess.check_output(['journalctl'])
- # has kernel messages
- self.assertRegex(out, b'kernel:.*[cC]ommand line:')
+ if not is_container:
+ # has kernel messages
+ self.assertRegex(out, b'kernel:.*[cC]ommand line:')
# has init messages
self.assertRegex(out, b'systemd.*Reached target Graphical Interface')
# has other services
@@ -190,6 +200,7 @@ class JournalTest(unittest.TestCase):
self.assertNotIn(b'systemd:', out)
+@unittest.skipIf(is_container, 'nspawn does not work in most containers')
class NspawnTest(unittest.TestCase):
'''Check nspawn'''
@@ -412,6 +423,7 @@ SystemCallFilter=access
self.assertNotIn(f.read().strip().encode('ASCII'), out)
+@unittest.skipIf(is_container, 'systemd-coredump does not work in containers')
class CoredumpTest(unittest.TestCase):
'''Check systemd-coredump'''
@@ -504,21 +516,25 @@ class CLITest(unittest.TestCase):
def pre_boot_setup():
'''Test setup before rebooting testbed'''
+ subprocess.check_call(['systemctl', 'set-default', 'graphical.target'],
+ stderr=subprocess.STDOUT)
+
# create a few temporary files to ensure that they get cleaned up on boot
os.close(os.open('/tmp/newfile.test',
os.O_CREAT | os.O_EXCL | os.O_WRONLY))
os.close(os.open('/var/tmp/newfile.test',
os.O_CREAT | os.O_EXCL | os.O_WRONLY))
# we can't use utime() here, as systemd looks for ctime
- cur_time = time.clock_gettime(time.CLOCK_REALTIME)
- time.clock_settime(time.CLOCK_REALTIME, cur_time - 2 * 30 * 86400)
- try:
- os.close(os.open('/tmp/oldfile.test',
- os.O_CREAT | os.O_EXCL | os.O_WRONLY))
- os.close(os.open('/var/tmp/oldfile.test',
- os.O_CREAT | os.O_EXCL | os.O_WRONLY))
- finally:
- time.clock_settime(time.CLOCK_REALTIME, cur_time)
+ if not is_container:
+ cur_time = time.clock_gettime(time.CLOCK_REALTIME)
+ time.clock_settime(time.CLOCK_REALTIME, cur_time - 2 * 30 * 86400)
+ try:
+ os.close(os.open('/tmp/oldfile.test',
+ os.O_CREAT | os.O_EXCL | os.O_WRONLY))
+ os.close(os.open('/var/tmp/oldfile.test',
+ os.O_CREAT | os.O_EXCL | os.O_WRONLY))
+ finally:
+ time.clock_settime(time.CLOCK_REALTIME, cur_time)
# allow X to start even on headless machines
os.makedirs('/etc/X11/xorg.conf.d/', exist_ok=True)
@@ -530,7 +546,7 @@ EndSection''')
if __name__ == '__main__':
- if not os.getenv('ADT_REBOOT_MARK'):
+ if not os.getenv('AUTOPKGTEST_REBOOT_MARK'):
pre_boot_setup()
print('Rebooting...')
subprocess.check_call(['/tmp/autopkgtest-reboot', 'boot1'])
diff --git a/debian/tests/boot-smoke b/debian/tests/boot-smoke
index ca1fd37..ed52bf6 100755
--- a/debian/tests/boot-smoke
+++ b/debian/tests/boot-smoke
@@ -7,7 +7,14 @@ set -e
. `dirname $0`/assert.sh
-if [ -z "$ADT_REBOOT_MARK" ]; then
+fail() {
+ journalctl --sync
+ journalctl -a > "$AUTOPKGTEST_ARTIFACTS/boot-smoke-journal.txt"
+ udevadm info --export-db > "$AUTOPKGTEST_ARTIFACTS/boot-smoke-udevdb.txt"
+ exit 1
+}
+
+if [ -z "$AUTOPKGTEST_REBOOT_MARK" ]; then
# enable persistent journal
mkdir -p /var/log/journal
# allow X to start even on headless machines
@@ -20,7 +27,7 @@ EndSection
EOF
- ADT_REBOOT_MARK=0
+ AUTOPKGTEST_REBOOT_MARK=0
if [ -d /tmp/systemd-replace/ ]; then
for f in /tmp/systemd-replace/*; do
echo "Installing $f..."
@@ -30,13 +37,14 @@ EOF
fi
else
echo "checking for failed unmounts for user systemd"
- JOURNAL=$(journalctl)
- if echo "$JOURNAL" | grep -E "systemd\[([2-9]|[1-9][0-9]+)\].*Failed unmounting"; then
- exit 1
+ # grep complete journal to catch shutdown messages
+ if journalctl | grep -E "systemd\[([2-9]|[1-9][0-9]+)\].*Failed unmounting"; then
+ fail
fi
+ # grep only this boot's journal, earlier ones complain about missing "render" group
echo "checking for connection timeouts"
- if echo "$JOURNAL" | grep "Connection timed out"; then
- exit 1
+ if journalctl -b | grep "Connection timed out"; then
+ fail
fi
echo "checking that polkitd runs"
@@ -51,16 +59,13 @@ else
done
if [ -n "$running" ]; then
echo "running jobs after remaining timeout $TIMEOUT: $running"
- journalctl --sync
- journalctl -ab > $ADT_ARTIFACTS/journal.txt
- udevadm info --export-db > $ADT_ARTIFACTS/udevdb.txt
- exit 1
+ fail
fi
fi
-if [ "$ADT_REBOOT_MARK" -ge 5 ]; then
+if [ "$AUTOPKGTEST_REBOOT_MARK" -ge 5 ]; then
exit 0
fi
-echo "reboot #$ADT_REBOOT_MARK"
-/tmp/autopkgtest-reboot $(($ADT_REBOOT_MARK + 1))
+echo "reboot #$AUTOPKGTEST_REBOOT_MARK"
+/tmp/autopkgtest-reboot $(($AUTOPKGTEST_REBOOT_MARK + 1))
diff --git a/debian/tests/control b/debian/tests/control
index b8f2df5..0ae1c8b 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -82,10 +82,11 @@ Depends: systemd-sysv,
cron,
network-manager,
busybox-static,
+ rsyslog,
apparmor,
pkg-config,
python3
-Restrictions: needs-root, isolation-machine, breaks-testbed
+Restrictions: needs-root, isolation-container, breaks-testbed
Tests: udev
Depends: systemd-tests,
@@ -93,7 +94,7 @@ Depends: systemd-tests,
tree,
perl,
xz-utils,
-Restrictions: needs-root, allow-stderr, isolation-machine
+Restrictions: needs-root, allow-stderr, isolation-container
Tests: root-unittests
Depends: systemd-tests,
diff --git a/debian/tests/systemd-fsckd b/debian/tests/systemd-fsckd
index b71a8dc..09d68f5 100755
--- a/debian/tests/systemd-fsckd
+++ b/debian/tests/systemd-fsckd
@@ -250,17 +250,17 @@ def getAllTests(unitTestClass):
if test[0].startswith('test_')])
-# ADT_REBOOT_MARK contains the test name to pursue after reboot
+# AUTOPKGTEST_REBOOT_MARK contains the test name to pursue after reboot
# (to check results and states after reboot, mostly).
# we append the previous global return code (0 or 1) to it.
-# Example: ADT_REBOOT_MARK=test_foo:0
+# Example: AUTOPKGTEST_REBOOT_MARK=test_foo:0
if __name__ == '__main__':
if os.path.exists('/run/initramfs/fsck-root'):
print('SKIP: root file system is being checked by initramfs already')
sys.exit(0)
all_tests = getAllTests(FsckdTest)
- reboot_marker = os.getenv('ADT_REBOOT_MARK')
+ reboot_marker = os.getenv('AUTOPKGTEST_REBOOT_MARK')
current_test_after_reboot = ""
if not reboot_marker:
@@ -279,7 +279,7 @@ if __name__ == '__main__':
try:
remaining_tests = all_tests[all_tests.index(current_test):]
except ValueError:
- print("Invalid value for ADT_REBOOT_MARK, {} is not a valid test name".format(reboot_marker))
+ print("Invalid value for AUTOPKGTEST_REBOOT_MARK, {} is not a valid test name".format(reboot_marker))
sys.exit(2)
# run all remaining tests
diff --git a/debian/tests/timedated b/debian/tests/timedated
index 52df8cf..fe90e13 100755
--- a/debian/tests/timedated
+++ b/debian/tests/timedated
@@ -134,3 +134,55 @@ timedatectl set-local-rtc 1
assert_eq "`cat /etc/adjtime`" "0.0 0 0
0
LOCAL"
+
+# timesyncd has ConditionVirtualization=!container by default; drop/mock that for testing
+if systemd-detect-virt --container --quiet; then
+ systemctl disable --quiet --now systemd-timesyncd
+ mkdir -p /run/systemd/system/systemd-timesyncd.service.d
+ printf '[Unit]\nConditionVirtualization=\n[Service]\nType=simple\nAmbientCapabilities=\nExecStart=\nExecStart=/bin/sleep infinity' > /run/systemd/system/systemd-timesyncd.service.d/container.conf
+ systemctl daemon-reload
+fi
+
+mon=$(mktemp -t dbusmon.XXXXXX)
+trap "rm -f $mon" EXIT INT QUIT PIPE
+
+assert_ntp() {
+ V=$(busctl get-property org.freedesktop.timedate1 /org/freedesktop/timedate1 org.freedesktop.timedate1 NTP)
+ assert_eq "$V" "b $1"
+}
+
+start_mon() {
+ dbus-monitor --system "type='signal', member='PropertiesChanged', path='/org/freedesktop/timedate1'" > $mon &
+ MONPID=$!
+}
+
+wait_mon() {
+ for retry in $(seq 10); do
+ grep -q "$1" $mon && break
+ sleep 1
+ done
+ assert_in "$2" "$(cat $mon)"
+ kill $MONPID
+ wait
+}
+
+echo 'disable NTP'
+timedatectl set-ntp false
+while systemctl is-active --quiet systemd-timesyncd; do sleep 1; done
+assert_ntp false
+assert_rc 3 systemctl is-active --quiet systemd-timesyncd
+
+echo 'enable NTP'
+start_mon
+timedatectl set-ntp true
+wait_mon "NTP" "boolean true"
+assert_ntp true
+while [ "$(systemctl is-active systemd-timesyncd)" = "activating" ]; do sleep 1; done
+assert_rc 0 systemctl is-active --quiet systemd-timesyncd
+
+echo 're-disable NTP'
+start_mon
+timedatectl set-ntp false
+wait_mon "NTP" "boolean false"
+assert_ntp false
+assert_rc 3 systemctl is-active --quiet systemd-timesyncd
diff --git a/debian/udev.init b/debian/udev.init
index 6a3c9b3..a10a586 100644
--- a/debian/udev.init
+++ b/debian/udev.init
@@ -166,7 +166,8 @@ case "$1" in
log_daemon_msg "Starting $DESC" "$NAME"
if start-stop-daemon --start --name $NAME --user root --quiet \
- --pidfile $PIDFILE --exec $DAEMON --background --make-pidfile; then
+ --pidfile $PIDFILE --exec $DAEMON --background --make-pidfile \
+ --notify-await; then
# prevents udevd to be killed by sendsigs (see #791944)
mkdir -p $OMITDIR
ln -sf $PIDFILE $OMITDIR/$NAME
@@ -226,7 +227,8 @@ case "$1" in
log_daemon_msg "Starting $DESC" "$NAME"
if start-stop-daemon --start --name $NAME --user root --quiet \
- --pidfile $PIDFILE --exec $DAEMON --background --make-pidfile; then
+ --pidfile $PIDFILE --exec $DAEMON --background --make-pidfile \
+ --notify-await; then
# prevents udevd to be killed by sendsigs (see #791944)
mkdir -p $OMITDIR
ln -sf $PIDFILE $OMITDIR/$NAME
diff --git a/debian/udev.postinst b/debian/udev.postinst
index d18a8de..7a78ede 100644
--- a/debian/udev.postinst
+++ b/debian/udev.postinst
@@ -107,6 +107,9 @@ case "$1" in
# Make /dev/kvm accessible to kvm group
addgroup --quiet --system kvm
+ # Make /dev/dri/renderD* accessible to render group
+ addgroup --quiet --system render
+
if [ -z "$2" ]; then # first install
if ! chrooted && ! in_debootstrap; then
enable_udev
Reply to: