source: general/sysutils/systemd.xml@ 64351cb

11.1 11.2 11.3 12.0 12.1 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 64351cb was 64351cb, checked in by Douglas R. Reno <renodr@…>, 2 years ago

Package update and a fix for systemd

Update to thunderbird-91.5.0
Fix CVE-2021-3997 in systemd.

  • Property mode set to 100644
File size: 16.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!-- <!ENTITY systemd-download-http "http://anduin.linuxfromscratch.org/LFS/systemd-&systemd-version;-&systemd-stable;.tar.xz"> For whenever we move to a stable snapshot for backports -->
8 <!ENTITY systemd-download-http "https://github.com/systemd/systemd/archive/v&systemd-version;/systemd-&systemd-version;.tar.gz">
9 <!ENTITY systemd-download-ftp " ">
10 <!ENTITY systemd-md5sum "8929beb037c587ada4ed201f19756fe2">
11 <!ENTITY systemd-size "11 MB">
12 <!ENTITY systemd-buildsize "307 MB (with tests)">
13 <!ENTITY systemd-time "2.5 SBU (with tests)">
14
15]>
16
17<sect1 id="systemd" xreflabel="Systemd-&systemd-version;" revision="systemd">
18 <?dbhtml filename="systemd.html"?>
19
20 <sect1info>
21 <date>$Date$</date>
22 </sect1info>
23
24 <title>Systemd-&systemd-version;</title>
25 <!-- Whenever we switch back to stable backports, make sure to add the systemd-stable reference back. -->
26
27 <indexterm zone="systemd">
28 <primary sortas="a-systemd">systemd</primary>
29 </indexterm>
30
31 <sect2 role="package">
32 <title>Introduction to systemd</title>
33
34 <para>
35 While <application>systemd</application> was installed when
36 building LFS, there are many features provided by the package that
37 were not included in the initial installation because
38 <application>Linux-PAM</application> was not yet installed.
39 The <application>systemd</application> package needs to be
40 rebuilt to provide a working <command>systemd-logind</command> service,
41 which provides many additional features for dependent packages.
42 </para>
43
44 &lfs110a_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&systemd-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&systemd-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &systemd-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &systemd-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &systemd-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &systemd-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80
81 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
82 <itemizedlist spacing="compact">
83 <listitem>
84 <para>
85 Required patch:
86 <ulink url="&patch-root;/systemd-&systemd-version;-upstream_fixes-1.patch"/>
87 </para>
88 </listitem>
89 </itemizedlist>
90
91
92 <bridgehead renderas="sect3">systemd Dependencies</bridgehead>
93
94 <bridgehead renderas="sect4">Required</bridgehead>
95 <para role="required">
96 <xref linkend="Jinja2"/> and
97 <xref linkend="linux-pam"/>
98 </para>
99
100 <bridgehead renderas="sect4">Recommended Runtime Dependencies</bridgehead>
101 <para role="recommended">
102 <xref role="runtime" linkend="polkit"/>
103 </para>
104
105 <bridgehead renderas="sect4">Optional</bridgehead>
106 <para role="optional">
107 <xref linkend="btrfs-progs"/>, <!-- homed may support it, see the C.E.-->
108 <xref linkend="curl"/>,
109 <xref linkend="cryptsetup"/>,
110 <xref linkend="git"/>,
111 <xref linkend="gnutls"/>,
112 <xref linkend="iptables"/>,
113 <xref linkend="libgcrypt"/>,
114 <xref linkend="libidn2"/>,
115 <xref linkend="libpwquality"/>,
116 <xref linkend="libseccomp"/>,
117 <xref linkend="libxkbcommon"/>,
118 <xref linkend="make-ca"/>,
119 <xref linkend="p11-kit"/>,
120 <xref linkend="pcre2"/>,
121 <xref linkend="qemu"/>,
122 <xref linkend="qrencode"/>,
123 <xref linkend="rsync"/>,
124 <xref linkend="valgrind"/>,
125 <xref linkend="zsh"/> (for the zsh completions),
126 <ulink url="https://sourceforge.net/projects/gnu-efi/">gnu-efi</ulink>,
127 <ulink url="https://www.kernel.org/pub/linux/utils/kernel/kexec/">kexec-tools</ulink>,
128 <ulink url="https://github.com/libbpf/libbpf">libbpf</ulink>,
129 <ulink url="https://sourceware.org/elfutils/">libdw</ulink>,
130 <ulink url="https://developers.yubico.com/libfido2/">libfido2</ulink>,
131 <ulink url="https://www.gnu.org/software/libmicrohttpd/">libmicrohttpd</ulink>,
132 <ulink url="http://lz4.github.io/lz4/">lz4</ulink>,
133 <!--<ulink url="http://fukuchi.org/works/qrencode/">qrencode</ulink>,-->
134 <ulink url="https://sourceforge.net/projects/linuxquota/">quota-tools</ulink>,
135 <ulink url="https://pypi.python.org/pypi/Sphinx">Sphinx</ulink>, and
136 <ulink url="https://tpm2-tss.readthedocs.io/en/latest/">tpm2-tss</ulink>
137 </para>
138
139 <bridgehead renderas="sect4">Optional (to rebuild the manual pages)</bridgehead>
140 <para role="optional">
141 <xref linkend="DocBook"/>,
142 <xref linkend="docbook-xsl"/>,
143 <xref linkend="libxslt"/>, and
144 <xref linkend="lxml"/> (to build the index of systemd manual pages)
145 </para>
146
147 <para condition="html" role="usernotes">User Notes:
148 <ulink url="&blfs-wiki;/systemd"/>
149 </para>
150 </sect2>
151
152 <sect2 role="installation">
153 <title>Installation of systemd</title>
154
155
156 <para>
157 Apply a patch to fix a security vulnerability and fix issues with the
158 default hostname on some systems:
159 </para>
160
161<screen><userinput remap="pre">patch -Np1 -i ../systemd-&systemd-version;-upstream_fixes-1.patch</userinput></screen>
162
163 <para>
164 Remove two unneeded groups,
165 <systemitem class="groupname">render</systemitem> and
166 <systemitem class="groupname">sgx</systemitem>, from the default udev
167 rules:
168 </para>
169
170<screen><userinput remap="pre">sed -i -e 's/GROUP="render"/GROUP="video"/' \
171 -e 's/GROUP="sgx", //' rules.d/50-udev-default.rules.in</userinput></screen>
172
173 <para>
174 Rebuild <application>systemd</application> by running the
175 following commands:
176 </para>
177
178<screen><userinput>mkdir build &amp;&amp;
179cd build &amp;&amp;
180
181meson --prefix=/usr \
182 --buildtype=release \
183 -Dblkid=true \
184 -Ddefault-dnssec=no \
185 -Dfirstboot=false \
186 -Dinstall-tests=false \
187 -Dldconfig=false \
188 -Dman=auto \
189 -Dsysusers=false \
190 -Drpmmacrosdir=no \
191 -Db_lto=false \
192 -Dhomed=false \
193 -Duserdb=false \
194 -Dmode=release \
195 -Dpamconfdir=/etc/pam.d \
196 -Ddocdir=/usr/share/doc/systemd-&systemd-version; \
197 .. &amp;&amp;
198
199ninja</userinput></screen>
200<!-- Regarding homed and userdb, see the note below in Command Explanations-->
201
202 <note>
203 <para>
204 For the best test results, make sure you run the testsuite from
205 a system that is booted by the same
206 <application>systemd</application> version you are rebuilding.
207 </para>
208 </note>
209
210 <para>
211 To test the results, issue:
212 <command>PATH+=:/usr/sbin ninja test</command>.
213 <!-- One test named test-repart needs sfdisk, which is in /usr/sbin. -->
214 </para>
215
216<!--
217 <warning>
218 <para>
219 Installing the package will overwrite all files installed by
220 <application>systemd</application> in LFS. It is critical that
221 nothing uses either <application>systemd</application> or
222 <application>Udev</application> libraries during the installation.
223 The best way to ensure that these libraries are not being used is to
224 run the installation in rescue mode. To switch to rescue mode,
225 run the following command as the
226 <systemitem class="username">root</systemitem> user (from a TTY):
227 </para>
228
229<screen role="root"><userinput>systemctl isolate rescue.target</userinput></screen>
230 </warning>
231 Nobody has reported problems with this in years. Let's comment it. -->
232
233 <para>
234 Now, as the <systemitem class="username">root</systemitem> user:
235 </para>
236
237<screen role="root"><userinput>ninja install</userinput></screen>
238
239<!-- Included in the patch
240 <para>
241 Fix a problem in a systemd unit that can cause extra delays when
242 changing TTYs:
243 </para>
244
245<screen role="root"><userinput>sed -i 's/idle/simple/' /usr/lib/systemd/system/getty@.service</userinput></screen>
246-->
247 <!-- No longer needed as of systemd-244.
248 <para>
249 Remove a configuration file that causes some problems with PID files:
250 </para>
251
252<screen role="root"><userinput>rm -fv /etc/sysctl.d/50-pid-max.conf</userinput></screen>
253 -->
254 </sect2>
255
256 <sect2 role="commands">
257 <title>Command Explanations</title>
258
259<!-- Not needed with the patch
260 <para>
261 <parameter>-Dc_args=-Wno-format-overflow</parameter>: Prevents an error
262 when building with <application>GCC 10</application>. The default is
263 <option>-Werror=format-overflow</option>,
264 which generates false positives. This switch may be used with previous
265 versions of GCC too.
266 </para>
267-->
268
269 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
270 href="../../xincludes/meson-buildtype-release.xml"/>
271
272 <para>
273 <parameter>-Dpamconfdir=/etc/pam.d</parameter>: Forces the PAM files to
274 be installed in /etc/pam.d rather than /usr/lib/pam.d.
275 </para>
276
277 <para>
278 <parameter>-Duserdb=false</parameter>: Removes a daemon that does not
279 offer any use under a BLFS configuration. If you wish to enable the
280 <application>userdbd</application> daemon, replace "false" with "true"
281 in the above meson command.
282 </para>
283
284 <para>
285 <parameter>-Dhomed=false</parameter>: Removes a daemon that does not offer
286 any use under a traditional BLFS configuration, especially using accounts
287 created with useradd. To enable systemd-homed, first ensure that you have
288 <xref linkend="cryptsetup"/> and <xref linkend="libpwquality"/>, and then
289 change "false" to "true" in the above meson command.
290 </para>
291
292 <!-- EDITORS NOTE: Explanation on removing userdbd and homed:
293 In BLFS, we do not fully support disk encryption. We offer instructions for
294 building 'cryptsetup' as a dependency, but we do not offer instructions for
295 actually configuring it. In addition, we generally do not include
296 functionality that could potentially conflict with other packages, or that
297 is not of any use to us (in an enterprise configuration using Thin Clients
298 or laptops with LUKS encryption, it could make sense though, but that isn't
299 the configuration that we natively support).
300
301 A few of the complications of systemd-homed include:
302 - SSH Logins
303 - Disk Space Assignments
304 - UID Assignments (chown() on login)
305 (See https://cfp.all-systems-go.io/media/homed-asg2019.pdf)
306
307 In an article I read when systemd-homed was originally unveiled, I remember
308 reading about systemd-homed causing problems with OpenSSH Private Key Auth
309 because the user would have to login at the console in order to unlock
310 their home directory, thus allowing the private key to be unlocked and
311 processed by OpenSSH. Since BLFS does not fully support encrypted disks,
312 and because systemd-homed is incompatible with our usage of useradd /
313 traditional UNIX users and groups, I advise that we take the following
314 approach to avoid any confusion:
315
316 - Leave the added Short Descriptions for homectl and userdbctl
317 - Add the above command explanations and restore the previous behavior
318
319 Should we decide to enable homed by default anytime in the future,
320 let's move cryptsetup to recommended or required.
321
322 I would be open to discussing this after the next systemd version when
323 systemd-homed has matured a bit more. -renodr -->
324
325 </sect2>
326
327 <sect2 role="configuration">
328 <title>Configuring systemd</title>
329
330 <para>
331 The <filename>/etc/pam.d/system-session</filename> file needs to
332 be modified and a new file needs to be created in order for
333 <command>systemd-logind</command> to work correctly. Run the following
334 commands as the <systemitem class="username">root</systemitem> user:
335 </para>
336
337<screen role="root"><userinput>grep 'pam_systemd' /etc/pam.d/system-session ||
338cat &gt;&gt; /etc/pam.d/system-session &lt;&lt; "EOF"
339<literal># Begin Systemd addition
340
341session required pam_loginuid.so
342session optional pam_systemd.so
343
344# End Systemd addition</literal>
345EOF
346
347cat &gt; /etc/pam.d/systemd-user &lt;&lt; "EOF"
348<literal># Begin /etc/pam.d/systemd-user
349
350account required pam_access.so
351account include system-account
352
353session required pam_env.so
354session required pam_limits.so
355session required pam_unix.so
356session required pam_loginuid.so
357session optional pam_keyinit.so force revoke
358session optional pam_systemd.so
359
360auth required pam_deny.so
361password required pam_deny.so
362
363# End /etc/pam.d/systemd-user</literal>
364EOF</userinput></screen>
365
366<!--
367 <para>
368 At this point, you should reload the systemd daemon, and reenter
369 multi-user mode with the following commands (as the
370 <systemitem class="username">root</systemitem> user). If a desktop
371 manager is installed and you wish to reenter the graphical mode,
372 replace <userinput>multi-user.target</userinput> with
373 <userinput>graphical.target</userinput>:
374 </para>
375
376<screen role="root"><userinput>systemctl daemon-reexec
377systemctl start multi-user.target</userinput></screen>-->
378
379 <warning>
380 <para>
381 If upgrading from a previous version of systemd and an
382 initrd is used for system boot, you should generate a new initrd before
383 rebooting the system.
384 </para>
385 </warning>
386
387 </sect2>
388
389 <sect2 role="content">
390 <title>Contents</title>
391
392 <para>
393 A list of the installed files, along with their short
394 descriptions can be found at
395 <ulink url="&lfs-root;/chapter08/systemd.html#contents-systemd"/>.
396 </para>
397
398 <para>
399 Listed below are the newly installed programs
400 along with short descriptions.
401 </para>
402
403 <segmentedlist>
404 <segtitle>Installed Programs</segtitle>
405
406 <seglistitem>
407 <seg>
408 <!-- maybe userdbd/userdbctl can go in LFS, try at next time -->
409 homectl (if <xref linkend="cryptsetup"/> is installed)
410 and userdbctl (optionally)
411 </seg>
412 </seglistitem>
413 </segmentedlist>
414
415 <variablelist>
416 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
417 <?dbfo list-presentation="list"?>
418 <?dbhtml list-presentation="table"?>
419
420 <varlistentry id="homectl">
421 <term><command>homectl</command></term>
422 <listitem>
423 <para>
424 is a tool to create, remove, change, or inspect a home directory
425 managed by <command>systemd-homed</command>; note that it's
426 useless for the classic UNIX users and home directories which
427 we are using in LFS/BLFS book
428 </para>
429 <indexterm zone="systemd homectl">
430 <primary sortas="b-homectl">homectl</primary>
431 </indexterm>
432 </listitem>
433 </varlistentry>
434
435 <varlistentry id="userdbctl">
436 <term><command>userdbctl</command></term>
437 <listitem>
438 <para>
439 inspects users, groups, and group memberships
440 </para>
441 <indexterm zone="systemd userdbctl">
442 <primary sortas="b-userdbctl">userdbctl</primary>
443 </indexterm>
444 </listitem>
445 </varlistentry>
446
447 <varlistentry id="pam_systemd">
448 <term><filename class="libraryfile">pam_systemd.so</filename></term>
449 <listitem>
450 <para>
451 is a PAM module used to register user sessions with the
452 <application>systemd</application> login manager,
453 <command>systemd-logind</command>
454 </para>
455 <indexterm zone="systemd pam_systemd">
456 <primary sortas="c-pam_systemd">pam_systemd.so</primary>
457 </indexterm>
458 </listitem>
459 </varlistentry>
460
461 </variablelist>
462
463 </sect2>
464
465</sect1>
Note: See TracBrowser for help on using the repository browser.