audit 4.2 rejects overlong values (max 15 bytes) for the kernel comm.
systemd attempts to send the full 19 bytes of "systemd-update-utmp",
and the systemd-update-utmp service fails to start. this was changed to
truncate instead of reject in audit 4.2.1, but until we can take the
mass rebuild on staging, we fetch the systemd patch which shortens
"systemd-update-utmp" to "update-utmp". this is in the nixos module as
`apply` instead of part of the systemd package as that would be a larger
rebuild and would delay other fixes making their way to master.
This adds io.systemd.AskPassword Varlink API by default.
Change-Id: I45b9a53d489ec3ea5561006c9c91ccb7016b3ee1
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
This enables the ability to use systemd-repart over Varlink at
/run/systemd/io.systemd.Repart.
Change-Id: Ia74fdf8c2cbc4ec52994ba8ceb5796acc731abd3
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
time-sync.target has Wants/After=time-set.target, every OnCalendar=
timer gains an implicit After=time-set.target, and
systemd.special(7) documents it as the hook for "system clock has
been set from a local source". Without the unit file the target is
not-found, so WantedBy=time-set.target on third-party units is
silently ignored and the timer ordering is a no-op.
Allows running systemctl soft-reboot, to only reboot userspace not full reboot with the kernel included.
Signed-off-by: Hadi Chokr <hadichokr@icloud.com>
Previously, this was patched directly into the systemd derivation. Now,
this is done via the module system. To make building systemd and
maintaining it simpler.
This service is essentially a random sleep() call that old software that
is unable to properly handle modern hardware initialisation being
asynchronous can use to *mostly* get by.
Over the years is has caused so many issues in NixOS, like introducing
long delays in the boot process[1], complete deadlocks[2] and even failures
when reloading services or activating a new configuration[3].
systemd has been discouraging its use since 2011 (15 years ago!), then
it officially deprecated it in 2018 and since 2020 it started to show on
every boot a huge wall of text calling out all the offending services
that still use it.
Around 2021 we managed to fix around 15 NixOS modules[4] that were
relying on systemd-udev-settle and practically ZFS[5] was the only
remaining one. However, since then, people have actually started to
bring it back with new services[6][7][8]. This is not acceptable.
So, to prevent any more (lazy) uses of systemd-udev-settle, we stop
providing the systemd-udev-settle.service unit entirely. For existing
modules that unfortunately still need it, we replace it with the command
`udevadm settle --timeout=180`, which is all that the service does.
Hopefully this will also increase the awareness that it's bad and
something to be fixed.
Note: I tested this change using
- `nixosTests.zfs`,
- `nixosTests.ifstate`,
- `nixosTests.misc`,
- `nixosTests.openvswitch`,
- `nixosTests.predictable-interface-names`
- `nixosTests.nvidia-container-toolkit`
and making sure that none of the 165 packages that provide upstream
units (via the `systemd.packages` option) had a dependency on
systemd-udev-settle.service.
[1]: https://github.com/NixOS/nixpkgs/pull/25311
[2]: https://github.com/NixOS/nixpkgs/issues/107341
[3]: https://github.com/NixOS/nixpkgs/pull/113804
[4]: https://github.com/NixOS/nixpkgs/issues/73095
[5]: https://github.com/openzfs/zfs/issues/10891
[6]: https://github.com/NixOS/nixpkgs/pull/257525#discussion_r1442702970
[7]: https://github.com/NixOS/nixpkgs/pull/460075
[8]: https://github.com/NixOS/nixpkgs/pull/284507
Upstream systemd changed how modprobe is discovered. It is now searched
for on path. Thus, add the kmod package to the ExecSearchPath of the
modprobe@.service.
The default systemd sysctl snippet contains various security‐relevant
settings, it is however only installed if systemd.coredump.enable is
enabled, despite these settings not being strictly related to
systemd-coredump.
Replace the stringly-typed systemd.sleep.extraConfig option (types.lines)
with systemd.sleep.settings.Sleep, a freeformType submodule using
types.attrsOf unitOption. This follows the same pattern already used by
systemd.settings.Manager, services.logind.settings.Login, and other
systemd modules that have been migrated to RFC42.
The sleep.conf file is now rendered via settingsToSections instead of raw
string interpolation.
A mkRemovedOptionModule is added for the old option path to give users a
clear migration message.
This is done to prepare the removal of
0006-hostnamed-localed-timedated-disable-methods-that-cha.patch from
systemd.
Pointing the daemon to /etc/static will make imperative changes to these
files (e.g. via hostnamectl) fail because systemd cannot edit them.
The env generator allows us to declaratively set environment variables
via the module system for all systemd generators.
This will allow us to drop systemd/0013-inherit-systemd-environment-when-calling-generators.patch
This commit introduces "switch inhibitors" which are derivations that
prevent a switch of a system to a new configuration if those derivations
don't have the same hash in both configurations.
This means that we can for instance add the systemd and dbus derivations
such that users will be instructed to reboot their system when those
derivations have changed instead of switching.
This feature should be used sparingly, but it can make NixOS more robust
by avoiding users switching to a configuration that can make their
system unstable (like major updates of systemd, or new versions of dbus
since the dbus and dbus-broker daemons cannot be restarted).
The user can still force the switch by setting an env var.
