source: general/sysutils/systemd.xml@ ac336b2

11.0 11.1 lazarus qt5new trunk upgradedb xry111/intltool xry111/test-20220226
Last change on this file since ac336b2 was ac336b2, checked in by Xi Ruoyao <xry111@…>, 12 months ago

systemd: remove unneeded option

  • Property mode set to 100644
File size: 16.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!-- <!ENTITY systemd-download-http "http://anduin.linuxfromscratch.org/LFS/systemd-&systemd-version;-&systemd-stable;.tar.xz"> For whenever we move to a stable snapshot for backports -->
8 <!ENTITY systemd-download-http "https://github.com/systemd/systemd/archive/v&systemd-version;/systemd-&systemd-version;.tar.gz">
9 <!ENTITY systemd-download-ftp " ">
10 <!ENTITY systemd-md5sum "8e8adf909c255914dfc10709bd372e69">
11 <!ENTITY systemd-size "10 MB">
12 <!ENTITY systemd-buildsize "287 MB (with tests)">
13 <!ENTITY systemd-time "2.5 SBU (with tests)">
14
15]>
16
17<sect1 id="systemd" xreflabel="Systemd-&systemd-version;" revision="systemd">
18 <?dbhtml filename="systemd.html"?>
19
20 <sect1info>
21 <date>$Date$</date>
22 </sect1info>
23
24 <title>Systemd-&systemd-version;</title>
25 <!-- Whenever we switch back to stable backports, make sure to add the systemd-stable reference back. -->
26
27 <indexterm zone="systemd">
28 <primary sortas="a-systemd">systemd</primary>
29 </indexterm>
30
31 <sect2 role="package">
32 <title>Introduction to systemd</title>
33
34 <para>
35 While <application>systemd</application> was installed when
36 building LFS, there are many features provided by the package that
37 were not included in the initial installation because
38 <application>Linux-PAM</application> was not yet installed.
39 The <application>systemd</application> package needs to be
40 rebuilt to provide a working <command>systemd-logind</command> service,
41 which provides many additional features for dependent packages.
42 </para>
43
44 &lfs101_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&systemd-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&systemd-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &systemd-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &systemd-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &systemd-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &systemd-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
81 <itemizedlist spacing="compact">
82 <listitem>
83 <para>
84 Required patch:
85 <ulink url="&patch-root;/systemd-&systemd-version;-upstream_fixes-1.patch"/>
86 </para>
87 </listitem>
88 </itemizedlist>
89
90 <bridgehead renderas="sect3">systemd Dependencies</bridgehead>
91
92 <bridgehead renderas="sect4">Required</bridgehead>
93 <para role="required">
94 <xref linkend="Jinja2"/> and
95 <xref linkend="linux-pam"/>
96 </para>
97
98 <bridgehead renderas="sect4">Recommended Runtime Dependencies</bridgehead>
99 <para role="recommended">
100 <xref role="runtime" linkend="polkit"/>
101 </para>
102
103 <bridgehead renderas="sect4">Optional</bridgehead>
104 <para role="optional">
105 <xref linkend="btrfs-progs"/>, <!-- homed may support it, see the C.E.-->
106 <xref linkend="curl"/>,
107 <xref linkend="cryptsetup"/>,
108 <xref linkend="git"/>,
109 <xref linkend="gnutls"/>,
110 <xref linkend="iptables"/>,
111 <xref linkend="libgcrypt"/>,
112 <xref linkend="libidn2"/>,
113 <xref linkend="libpwquality"/>,
114 <xref linkend="libseccomp"/>,
115 <xref linkend="libxkbcommon"/>,
116 <xref linkend="make-ca"/>,
117 <xref linkend="p11-kit"/>,
118 <xref linkend="pcre2"/>,
119 <xref linkend="qemu"/>,
120 <xref linkend="qrencode"/>,
121 <xref linkend="rsync"/>,
122 <xref linkend="valgrind"/>,
123 <xref linkend="zsh"/> (for the zsh completions),
124 <ulink url="https://sourceforge.net/projects/gnu-efi/">gnu-efi</ulink>,
125 <ulink url="https://www.kernel.org/pub/linux/utils/kernel/kexec/">kexec-tools</ulink>,
126 <ulink url="https://sourceware.org/elfutils/">libdw</ulink>,
127 <ulink url="https://developers.yubico.com/libfido2/">libfido2</ulink>,
128 <ulink url="https://www.gnu.org/software/libmicrohttpd/">libmicrohttpd</ulink>,
129 <ulink url="http://lz4.github.io/lz4/">lz4</ulink>,
130 <!--<ulink url="http://fukuchi.org/works/qrencode/">qrencode</ulink>,-->
131 <ulink url="https://sourceforge.net/projects/linuxquota/">quota-tools</ulink>,
132 <ulink url="https://pypi.python.org/pypi/Sphinx">Sphinx</ulink>, and
133 <ulink url="https://tpm2-tss.readthedocs.io/en/latest/">tpm2-tss</ulink>
134 </para>
135
136 <bridgehead renderas="sect4">Optional (to rebuild the manual pages)</bridgehead>
137 <para role="optional">
138 <xref linkend="DocBook"/>,
139 <xref linkend="docbook-xsl"/>,
140 <xref linkend="libxslt"/>, and
141 <xref linkend="lxml"/> (to build the index of systemd manual pages)
142 </para>
143
144 <para condition="html" role="usernotes">User Notes:
145 <ulink url="&blfs-wiki;/systemd"/>
146 </para>
147 </sect2>
148
149 <sect2 role="installation">
150 <title>Installation of systemd</title>
151
152 <para>
153 Apply a patch to fix a security vulnerability:
154 </para>
155
156<screen><userinput remap="pre">patch -Np1 -i ../systemd-&systemd-version;-upstream_fixes-1.patch</userinput></screen>
157
158 <para>
159 Remove two unneeded groups,
160 <systemitem class="groupname">render</systemitem> and
161 <systemitem class="groupname">sgx</systemitem>, from the default udev
162 rules:
163 </para>
164
165<screen><userinput remap="pre">sed -i -e 's/GROUP="render"/GROUP="video"/' \
166 -e 's/GROUP="sgx", //' rules.d/50-udev-default.rules.in</userinput></screen>
167
168 <para>
169 Rebuild <application>systemd</application> by running the
170 following commands:
171 </para>
172
173<screen><userinput>mkdir build &amp;&amp;
174cd build &amp;&amp;
175
176meson --prefix=/usr \
177 --buildtype=release \
178 -Dblkid=true \
179 -Ddefault-dnssec=no \
180 -Dfirstboot=false \
181 -Dinstall-tests=false \
182 -Dldconfig=false \
183 -Dman=auto \
184 -Dsysusers=false \
185 -Drpmmacrosdir=no \
186 -Db_lto=false \
187 -Dhomed=false \
188 -Duserdb=false \
189 -Dmode=release \
190 -Dpamconfdir=/etc/pam.d \
191 -Ddocdir=/usr/share/doc/systemd-&systemd-version; \
192 .. &amp;&amp;
193
194ninja</userinput></screen>
195<!-- Regarding homed and userdb, see the note below in Command Explanations-->
196
197 <note>
198 <para>
199 For the best test results, make sure you run the testsuite from
200 a system that is booted by the same
201 <application>systemd</application> version you are rebuilding.
202 </para>
203 </note>
204
205 <para>
206 To test the results, issue:
207 <command>PATH+=:/usr/sbin ninja test</command>.
208 <!-- One test named test-repart needs sfdisk, which is in /usr/sbin. -->
209 </para>
210
211<!--
212 <warning>
213 <para>
214 Installing the package will overwrite all files installed by
215 <application>systemd</application> in LFS. It is critical that
216 nothing uses either <application>systemd</application> or
217 <application>Udev</application> libraries during the installation.
218 The best way to ensure that these libraries are not being used is to
219 run the installation in rescue mode. To switch to rescue mode,
220 run the following command as the
221 <systemitem class="username">root</systemitem> user (from a TTY):
222 </para>
223
224<screen role="root"><userinput>systemctl isolate rescue.target</userinput></screen>
225 </warning>
226 Nobody has reported problems with this in years. Let's comment it. -->
227
228 <para>
229 Now, as the <systemitem class="username">root</systemitem> user:
230 </para>
231
232<screen role="root"><userinput>ninja install</userinput></screen>
233 <!-- No longer needed as of systemd-244.
234 <para>
235 Remove a configuration file that causes some problems with PID files:
236 </para>
237
238<screen role="root"><userinput>rm -fv /etc/sysctl.d/50-pid-max.conf</userinput></screen>
239 -->
240 </sect2>
241
242 <sect2 role="commands">
243 <title>Command Explanations</title>
244
245<!-- Not needed with the patch
246 <para>
247 <parameter>-Dc_args=-Wno-format-overflow</parameter>: Prevents an error
248 when building with <application>GCC 10</application>. The default is
249 <option>-Werror=format-overflow</option>,
250 which generates false positives. This switch may be used with previous
251 versions of GCC too.
252 </para>
253-->
254
255 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
256 href="../../xincludes/meson-buildtype-release.xml"/>
257
258 <para>
259 <parameter>-Dpamconfdir=/etc/pam.d</parameter>: Forces the PAM files to
260 be installed in /etc/pam.d rather than /usr/lib/pam.d.
261 </para>
262
263 <para>
264 <parameter>-Duserdb=false</parameter>: Removes a daemon that does not
265 offer any use under a BLFS configuration. If you wish to enable the
266 <application>userdbd</application> daemon, replace "false" with "true"
267 in the above meson command.
268 </para>
269
270 <para>
271 <parameter>-Dhomed=false</parameter>: Removes a daemon that does not offer
272 any use under a traditional BLFS configuration, especially using accounts
273 created with useradd. To enable systemd-homed, first ensure that you have
274 <xref linkend="cryptsetup"/> and <xref linkend="libpwquality"/>, and then
275 change "false" to "true" in the above meson command.
276 </para>
277
278 <!-- EDITORS NOTE: Explanation on removing userdbd and homed:
279 In BLFS, we do not fully support disk encryption. We offer instructions for
280 building 'cryptsetup' as a dependency, but we do not offer instructions for
281 actually configuring it. In addition, we generally do not include
282 functionality that could potentially conflict with other packages, or that
283 is not of any use to us (in an enterprise configuration using Thin Clients
284 or laptops with LUKS encryption, it could make sense though, but that isn't
285 the configuration that we natively support).
286
287 A few of the complications of systemd-homed include:
288 - SSH Logins
289 - Disk Space Assignments
290 - UID Assignments (chown() on login)
291 (See https://cfp.all-systems-go.io/media/homed-asg2019.pdf)
292
293 In an article I read when systemd-homed was originally unveiled, I remember
294 reading about systemd-homed causing problems with OpenSSH Private Key Auth
295 because the user would have to login at the console in order to unlock
296 their home directory, thus allowing the private key to be unlocked and
297 processed by OpenSSH. Since BLFS does not fully support encrypted disks,
298 and because systemd-homed is incompatible with our usage of useradd /
299 traditional UNIX users and groups, I advise that we take the following
300 approach to avoid any confusion:
301
302 - Leave the added Short Descriptions for homectl and userdbctl
303 - Add the above command explanations and restore the previous behavior
304
305 Should we decide to enable homed by default anytime in the future,
306 let's move cryptsetup to recommended or required.
307
308 I would be open to discussing this after the next systemd version when
309 systemd-homed has matured a bit more. -renodr -->
310
311 </sect2>
312
313 <sect2 role="configuration">
314 <title>Configuring systemd</title>
315
316 <para>
317 The <filename>/etc/pam.d/system-session</filename> file needs to
318 be modified and a new file needs to be created in order for
319 <command>systemd-logind</command> to work correctly. Run the following
320 commands as the <systemitem class="username">root</systemitem> user:
321 </para>
322
323<screen role="root"><userinput>cat &gt;&gt; /etc/pam.d/system-session &lt;&lt; "EOF"
324<literal># Begin Systemd addition
325
326session required pam_loginuid.so
327session optional pam_systemd.so
328
329# End Systemd addition</literal>
330EOF
331
332cat &gt; /etc/pam.d/systemd-user &lt;&lt; "EOF"
333<literal># Begin /etc/pam.d/systemd-user
334
335account required pam_access.so
336account include system-account
337
338session required pam_env.so
339session required pam_limits.so
340session required pam_unix.so
341session required pam_loginuid.so
342session optional pam_keyinit.so force revoke
343session optional pam_systemd.so
344
345auth required pam_deny.so
346password required pam_deny.so
347
348# End /etc/pam.d/systemd-user</literal>
349EOF</userinput></screen>
350
351<!--
352 <para>
353 At this point, you should reload the systemd daemon, and reenter
354 multi-user mode with the following commands (as the
355 <systemitem class="username">root</systemitem> user). If a desktop
356 manager is installed and you wish to reenter the graphical mode,
357 replace <userinput>multi-user.target</userinput> with
358 <userinput>graphical.target</userinput>:
359 </para>
360
361<screen role="root"><userinput>systemctl daemon-reexec
362systemctl start multi-user.target</userinput></screen>-->
363
364 <warning>
365 <para>
366 If upgrading from a previous version of systemd and an
367 initrd is used for system boot, you should generate a new initrd before
368 rebooting the system.
369 </para>
370 </warning>
371
372 </sect2>
373
374 <sect2 role="content">
375 <title>Contents</title>
376
377 <para>
378 A list of the installed files, along with their short
379 descriptions can be found at
380 <ulink url="&lfs-root;/chapter08/systemd.html#contents-systemd"/>.
381 </para>
382
383 <para>
384 Listed below are the newly installed libraries and directories
385 along with short descriptions.
386 </para>
387
388 <segmentedlist>
389 <segtitle>Installed Programs</segtitle>
390 <segtitle>Installed Libraries</segtitle>
391 <segtitle>Installed Directories</segtitle>
392
393 <seglistitem>
394 <seg>
395 <!-- maybe userdbd/userdbctl can go in LFS, try at next time -->
396 homectl (if <xref linkend="cryptsetup"/> is installed)
397 and userdbctl (optionally)
398 </seg>
399 <seg>
400 pam_systemd.so
401 (in <filename class="directory">/lib/security</filename>)
402 </seg>
403 <seg>
404 None
405 </seg>
406 </seglistitem>
407 </segmentedlist>
408
409 <variablelist>
410 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
411 <?dbfo list-presentation="list"?>
412 <?dbhtml list-presentation="table"?>
413
414 <varlistentry id="homectl">
415 <term><command>homectl</command></term>
416 <listitem>
417 <para>
418 is a tool to create, remove, change, or inspect a home directory
419 managed by <command>systemd-homed</command>; note that it's
420 useless for the classic UNIX users and home directories which
421 we are using in LFS/BLFS book
422 </para>
423 <indexterm zone="systemd homectl">
424 <primary sortas="b-homectl">homectl</primary>
425 </indexterm>
426 </listitem>
427 </varlistentry>
428
429 <varlistentry id="userdbctl">
430 <term><command>userdbctl</command></term>
431 <listitem>
432 <para>
433 inspects users, groups, and group memberships
434 </para>
435 <indexterm zone="systemd userdbctl">
436 <primary sortas="b-userdbctl">userdbctl</primary>
437 </indexterm>
438 </listitem>
439 </varlistentry>
440
441 <varlistentry id="pam_systemd">
442 <term><filename class="libraryfile">pam_systemd.so</filename></term>
443 <listitem>
444 <para>
445 is a PAM module used to register user sessions with the
446 <application>systemd</application> login manager,
447 <command>systemd-logind</command>
448 </para>
449 <indexterm zone="systemd pam_systemd">
450 <primary sortas="c-pam_systemd">pam_systemd.so</primary>
451 </indexterm>
452 </listitem>
453 </varlistentry>
454
455 </variablelist>
456
457 </sect2>
458
459</sect1>
Note: See TracBrowser for help on using the repository browser.