Don't set meson flags for nsresourced/mountfsd to avoid rebuilds of
pkgs.systemd. Will be reverted on staging.
This gives 1840 rebuilds compare to upstream/master.
Boot a VM with the default (kernel-BTF-backed) systemd and verify that the
BPF LSM is active, both sockets come up, nsresourced delegates a user
namespace, and mountfsd mounts a DDI via systemd-dissect. This is the runtime
counterpart to compiling the userns-restrict/restrict-fsaccess BPF programs
against the kernel's vmlinux.h.
These subsystems rely on the userns-restrict and restrict-fsaccess BPF
programs, which need a vmlinux.h, so default them to on only when a
kernel BTF is provided.
When set, systemd is configured with -Dvmlinux-h=provided pointing at
the given vmlinux.h, which enables the BPF programs that need kernel
internal types (userns-restrict for nsresourced, sysctl-monitor, and
restrict-fsaccess for mountfsd).
Defaults to null, i.e. today's behaviour of skipping these features.
All ~80 specialisations are full NixOS evaluations alive at once, so
switchTest alone peaked at ~17 GiB RSS. Split by subtest group; the
largest part now needs under 8 GiB. switchTest keeps its name for the
services part.
The container tests need a specific Nix config that is not trivial to
enable and most importantly not enabled by default. Thus this test
doesn't belong in the standard test suite that we use as a merge gate.
This enables the ability to use systemd-repart over Varlink at
/run/systemd/io.systemd.Repart.
Change-Id: Ia74fdf8c2cbc4ec52994ba8ceb5796acc731abd3
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Reorganize the passthru.tests to be able to comment out/disable
individual tests that were previously hidden in an attrset.
Also comment out tests that are currently broken on master. Once this is
merged, the tests in passthru.nixosTests serve as a hard quality gate
for merging changes to systemd as per the newly addded README that lives
next to the systemd derivation. These tests were only commented out
because I believe they are still valuable and should be fixed. However,
actually fixing them is out of scope for this change.
This removed the `installer-systemd-stage-1` tests because they were to
costly to evaluate and build for normal maintainers. We also don't have
all the other installer tests here. All tests use systemd, but we need
to balance the executability in a sensible timescale with test coverage.
This fix was necessary because systemd now requires the pefile module to
be present in the buildtime python installation.
However, this python is never used in the runtime of ukify. Thus this
change is only necessary to trick systemd's meson to do the right thing.
It doesn't seem like there is a right thing to do in meson for this so
it is unlikely that systemd would accept a patch for this.
These were only replaying paths in man pages or tests. Since we do not
run the tests (because they don't work yet on NixOS), this is just
maintenance churn without being useful.
Patching manpages is IMO also not useful because manpages that diverge
from their canonical form are more confusing than helpful.
