source: general/sysutils/systemd.xml@ 791f986

12.0 12.1 kea ken/TL2024 ken/tuningfonts lazarus lxqt plabs/newcss python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk xry111/llvm18 xry111/xf86-video-removal
Last change on this file since 791f986 was c1ad464d, checked in by Xi Ruoyao <xry111@…>, 14 months ago

systemd: Add -Ddev-kvm-mode=0660

Sync with LFS.

  • Property mode set to 100644
File size: 14.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!-- <!ENTITY systemd-download-http "https://anduin.linuxfromscratch.org/LFS/systemd-&systemd-version;-&systemd-stable;.tar.xz"> For whenever we move to a stable snapshot for backports -->
8 <!ENTITY systemd-download-http "https://github.com/systemd/systemd/archive/v&systemd-version;/systemd-&systemd-version;.tar.gz">
9 <!ENTITY systemd-download-ftp " ">
10 <!ENTITY systemd-md5sum "7cf12ee8a91a04306fc6cf290eed42e8">
11 <!ENTITY systemd-size "12 MB">
12 <!ENTITY systemd-buildsize "297 MB (with tests)">
13 <!ENTITY systemd-time "3.7 SBU (with tests using 4 cores)">
14
15]>
16
17<sect1 id="systemd" xreflabel="Systemd-&systemd-version;" revision="systemd">
18 <?dbhtml filename="systemd.html"?>
19
20
21 <title>Systemd-&systemd-version;</title>
22 <!-- Whenever we switch back to stable backports, make sure to add the systemd-stable reference back. -->
23
24 <indexterm zone="systemd">
25 <primary sortas="a-systemd">systemd</primary>
26 </indexterm>
27
28 <sect2 role="package">
29 <title>Introduction to systemd</title>
30
31 <para>
32 While <application>systemd</application> was installed when
33 building LFS, there are many features provided by the package that
34 were not included in the initial installation because
35 <application>Linux-PAM</application> was not yet installed.
36 The <application>systemd</application> package needs to be
37 rebuilt to provide a working <command>systemd-logind</command> service,
38 which provides many additional features for dependent packages.
39 </para>
40
41 &lfs113_checked;
42
43 <bridgehead renderas="sect3">Package Information</bridgehead>
44 <itemizedlist spacing="compact">
45 <listitem>
46 <para>
47 Download (HTTP): <ulink url="&systemd-download-http;"/>
48 </para>
49 </listitem>
50 <listitem>
51 <para>
52 Download (FTP): <ulink url="&systemd-download-ftp;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download MD5 sum: &systemd-md5sum;
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download size: &systemd-size;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Estimated disk space required: &systemd-buildsize;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated build time: &systemd-time;
73 </para>
74 </listitem>
75 </itemizedlist>
76
77<!-- Keep here in case a patch will be needed.-->
78<!--
79 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
80 <itemizedlist spacing="compact">
81 <listitem>
82 <para>
83 Required patch:
84 <ulink url="&patch-root;/systemd-&systemd-version;-security_fix-1.patch"/>
85 </para>
86 </listitem>
87 </itemizedlist>
88-->
89 <bridgehead renderas="sect3">systemd Dependencies</bridgehead>
90
91 <bridgehead renderas="sect4">Recommended</bridgehead>
92
93 <note>
94 <para>
95 <xref linkend='linux-pam'/> is not strictly required to build
96 <application>systemd</application>, but the main reason to rebuild
97 <application>systemd</application> in BLFS (it's already built in
98 LFS anyway) is for the <command>systemd-logind</command> daemon and
99 the
100 <filename class='libraryfile'>pam_systemd.so</filename> PAM module.
101 <xref linkend='linux-pam'/> is required for them. All packages in
102 BLFS book with a dependency on <application>systemd</application>
103 expects it has been rebuilt with <xref linkend='linux-pam'/>.
104 </para>
105 </note>
106
107 <para role="recommended">
108 <xref linkend="linux-pam"/> and
109 <xref role="runtime" linkend="polkit"/> (runtime)
110 </para>
111
112 <bridgehead renderas="sect4">Optional</bridgehead>
113 <para role="optional">
114 <xref linkend="btrfs-progs"/>, <!-- homed may support it, see the C.E.-->
115 <xref linkend="curl"/>,
116 <xref linkend="cryptsetup"/>,
117 <xref linkend="git"/>,
118 <xref linkend="gnutls"/>,
119 <xref linkend="iptables"/>,
120 <xref linkend="libgcrypt"/>,
121 <xref linkend="libidn2"/>,
122 <xref linkend="libpwquality"/>,
123 <xref linkend="libseccomp"/>,
124 <xref linkend="libxkbcommon"/>,
125 <xref linkend="make-ca"/>,
126 <xref linkend="p11-kit"/>,
127 <xref linkend="pcre2"/>,
128 <xref linkend="qemu"/>,
129 <xref linkend="qrencode"/>,
130 <xref linkend="rsync"/>,
131 <xref linkend="sphinx"/>,
132 <xref linkend="valgrind"/>,
133 <xref linkend="zsh"/> (for the zsh completions),
134 <ulink url="https://sourceforge.net/projects/gnu-efi/">gnu-efi</ulink>,
135 <ulink url="https://www.kernel.org/pub/linux/utils/kernel/kexec/">kexec-tools</ulink>,
136 <ulink url="https://github.com/libbpf/libbpf">libbpf</ulink>,
137 <ulink url="https://sourceware.org/elfutils/">libdw</ulink>,
138 <ulink url="https://developers.yubico.com/libfido2/">libfido2</ulink>,
139 <ulink url="https://www.gnu.org/software/libmicrohttpd/">libmicrohttpd</ulink>,
140 <ulink url="https://lz4.github.io/lz4/">lz4</ulink>,
141 <!--<ulink url="http://fukuchi.org/works/qrencode/">qrencode</ulink>,-->
142 <ulink url="https://sourceforge.net/projects/linuxquota/">quota-tools</ulink>, and
143 <ulink url="https://tpm2-tss.readthedocs.io/en/latest/">tpm2-tss</ulink>
144 </para>
145
146 <bridgehead renderas="sect4">Optional (to rebuild the manual pages)</bridgehead>
147 <para role="optional">
148 <xref linkend="DocBook"/>,
149 <xref linkend="docbook-xsl"/>,
150 <xref linkend="libxslt"/>, and
151 <xref linkend="lxml"/> (to build the index of systemd manual pages)
152 </para>
153
154 <para condition="html" role="usernotes">User Notes:
155 <ulink url="&blfs-wiki;/systemd"/>
156 </para>
157 </sect2>
158
159 <sect2 role="installation">
160 <title>Installation of systemd</title>
161<!--
162 <para>
163 First, fix a security issue in systemd-coredump:
164 </para>
165
166<screen><userinput>patch -Np1 -i ../systemd-&systemd-version;-security_fix-1.patch</userinput></screen>
167-->
168 <para>
169 Remove two unneeded groups,
170 <systemitem class="groupname">render</systemitem> and
171 <systemitem class="groupname">sgx</systemitem>, from the default udev
172 rules:
173 </para>
174
175<screen><userinput remap="pre">sed -i -e 's/GROUP="render"/GROUP="video"/' \
176 -e 's/GROUP="sgx", //' rules.d/50-udev-default.rules.in</userinput></screen>
177
178 <para>
179 Rebuild <application>systemd</application> by running the
180 following commands:
181 </para>
182
183<screen><userinput>mkdir build &amp;&amp;
184cd build &amp;&amp;
185
186meson setup .. \
187 --prefix=/usr \
188 --buildtype=release \
189 -Ddefault-dnssec=no \
190 -Dfirstboot=false \
191 -Dinstall-tests=false \
192 -Dldconfig=false \
193 -Dman=auto \
194 -Dsysusers=false \
195 -Drpmmacrosdir=no \
196 -Dhomed=false \
197 -Duserdb=false \
198 -Dmode=release \
199 -Dpam=true \
200 -Dpamconfdir=/etc/pam.d \
201 -Ddev-kvm-mode=0660 \
202 -Ddocdir=/usr/share/doc/systemd-&systemd-version; &amp;&amp;
203
204ninja</userinput></screen>
205<!-- Regarding homed and userdb, see the note below in Command Explanations-->
206
207 <note>
208 <para>
209 For the best test results, make sure you run the test suite from
210 a system that is booted by the same
211 <application>systemd</application> version you are rebuilding.
212 </para>
213 </note>
214
215 <para>
216 To test the results, issue:
217 <command>PATH+=:/usr/sbin ninja test</command>.
218 <!-- One test named test-repart needs sfdisk, which is in /usr/sbin. -->
219 </para>
220
221 <para>
222 Now, as the <systemitem class="username">root</systemitem> user:
223 </para>
224
225<screen role="root"><userinput>ninja install</userinput></screen>
226
227 </sect2>
228
229 <sect2 role="commands">
230 <title>Command Explanations</title>
231
232 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
233 href="../../xincludes/meson-buildtype-release.xml"/>
234
235 <para>
236 <parameter>-Dpamconfdir=/etc/pam.d</parameter>: Forces the PAM files to
237 be installed in /etc/pam.d rather than /usr/lib/pam.d.
238 </para>
239
240 <para>
241 <parameter>-Duserdb=false</parameter>: Removes a daemon that does not
242 offer any use under a BLFS configuration. If you wish to enable the
243 <application>userdbd</application> daemon, replace "false" with "true"
244 in the above meson command.
245 </para>
246
247 <para>
248 <parameter>-Dhomed=false</parameter>: Removes a daemon that does not offer
249 any use under a traditional BLFS configuration, especially using accounts
250 created with useradd. To enable systemd-homed, first ensure that you have
251 <xref linkend="cryptsetup"/> and <xref linkend="libpwquality"/> installed,
252 and then change "false" to "true" in the above meson command.
253 </para>
254
255 <!-- EDITORS NOTE: Explanation on removing userdbd and homed:
256 In BLFS, we do not fully support disk encryption. We offer instructions for
257 building 'cryptsetup' as a dependency, but we do not offer instructions for
258 actually configuring it. In addition, we generally do not include
259 functionality that could potentially conflict with other packages, or that
260 is not of any use to us (in an enterprise configuration using Thin Clients
261 or laptops with LUKS encryption, it could make sense though, but that isn't
262 the configuration that we natively support).
263
264 A few of the complications of systemd-homed include:
265 - SSH Logins
266 - Disk Space Assignments
267 - UID Assignments (chown() on login)
268 (See https://cfp.all-systems-go.io/media/homed-asg2019.pdf)
269
270 In an article I read when systemd-homed was originally unveiled, I remember
271 reading about systemd-homed causing problems with OpenSSH Private Key Auth
272 because the user would have to login at the console in order to unlock
273 their home directory, thus allowing the private key to be unlocked and
274 processed by OpenSSH. Since BLFS does not fully support encrypted disks,
275 and because systemd-homed is incompatible with our usage of useradd /
276 traditional UNIX users and groups, I advise that we take the following
277 approach to avoid any confusion:
278
279 - Leave the added Short Descriptions for homectl and userdbctl
280 - Add the above command explanations and restore the previous behavior
281
282 Should we decide to enable homed by default anytime in the future,
283 let's move cryptsetup to recommended or required.
284
285 I would be open to discussing this after the next systemd version when
286 systemd-homed has matured a bit more. -renodr -->
287
288 </sect2>
289
290 <sect2 role="configuration">
291 <title>Configuring systemd</title>
292
293 <para>
294 The <filename>/etc/pam.d/system-session</filename> file needs to
295 be modified and a new file needs to be created in order for
296 <command>systemd-logind</command> to work correctly. Run the following
297 commands as the <systemitem class="username">root</systemitem> user:
298 </para>
299
300<screen role="root"><userinput>grep 'pam_systemd' /etc/pam.d/system-session ||
301cat &gt;&gt; /etc/pam.d/system-session &lt;&lt; "EOF"
302<literal># Begin Systemd addition
303
304session required pam_loginuid.so
305session optional pam_systemd.so
306
307# End Systemd addition</literal>
308EOF
309
310cat &gt; /etc/pam.d/systemd-user &lt;&lt; "EOF"
311<literal># Begin /etc/pam.d/systemd-user
312
313account required pam_access.so
314account include system-account
315
316session required pam_env.so
317session required pam_limits.so
318session required pam_unix.so
319session required pam_loginuid.so
320session optional pam_keyinit.so force revoke
321session optional pam_systemd.so
322
323auth required pam_deny.so
324password required pam_deny.so
325
326# End /etc/pam.d/systemd-user</literal>
327EOF</userinput></screen>
328
329 <warning>
330 <para>
331 If upgrading from a previous version of systemd and an
332 initrd is used for system boot, you should generate a new initrd before
333 rebooting the system.
334 </para>
335 </warning>
336
337 </sect2>
338
339 <sect2 role="content">
340 <title>Contents</title>
341
342 <para>
343 A list of the installed files, along with their short
344 descriptions can be found at
345 <ulink url="&lfs-root;/chapter08/systemd.html#contents-systemd"/>.
346 </para>
347
348 <para>
349 Listed below are the newly installed programs
350 along with short descriptions.
351 </para>
352
353 <segmentedlist>
354 <segtitle>Installed Programs</segtitle>
355
356 <seglistitem>
357 <seg>
358 <!-- maybe userdbd/userdbctl can go in LFS, try at next time -->
359 homectl (optional),
360 systemd-cryptenroll (if <xref linkend="cryptsetup"/> is installed),
361 and userdbctl (optional)
362 </seg>
363 </seglistitem>
364 </segmentedlist>
365
366 <variablelist>
367 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
368 <?dbfo list-presentation="list"?>
369 <?dbhtml list-presentation="table"?>
370
371 <varlistentry id="homectl">
372 <term><command>homectl</command></term>
373 <listitem>
374 <para>
375 is a tool to create, remove, change, or inspect a home directory
376 managed by <command>systemd-homed</command>; note that it's
377 useless for the classic UNIX users and home directories which
378 we are using in LFS/BLFS book
379 </para>
380 <indexterm zone="systemd homectl">
381 <primary sortas="b-homectl">homectl</primary>
382 </indexterm>
383 </listitem>
384 </varlistentry>
385
386 <varlistentry id="systemd-cryptenroll">
387 <term><command>systemd-cryptenroll</command></term>
388 <listitem>
389 <para>
390 Is used to enroll or remove a system from full disk encryption,
391 as well as set and query private keys and recovery keys
392 </para>
393 <indexterm zone="systemd systemd-cryptenroll">
394 <primary sortas="b-systemd-cryptenroll">systemd-cryptenroll</primary>
395 </indexterm>
396 </listitem>
397 </varlistentry>
398
399 <varlistentry id="userdbctl">
400 <term><command>userdbctl</command></term>
401 <listitem>
402 <para>
403 inspects users, groups, and group memberships
404 </para>
405 <indexterm zone="systemd userdbctl">
406 <primary sortas="b-userdbctl">userdbctl</primary>
407 </indexterm>
408 </listitem>
409 </varlistentry>
410
411 <varlistentry id="pam_systemd">
412 <term><filename class="libraryfile">pam_systemd.so</filename></term>
413 <listitem>
414 <para>
415 is a PAM module used to register user sessions with the
416 <application>systemd</application> login manager,
417 <command>systemd-logind</command>
418 </para>
419 <indexterm zone="systemd pam_systemd">
420 <primary sortas="c-pam_systemd">pam_systemd.so</primary>
421 </indexterm>
422 </listitem>
423 </varlistentry>
424
425 </variablelist>
426
427 </sect2>
428
429</sect1>
Note: See TracBrowser for help on using the repository browser.