source: general/sysutils/systemd.xml@ ae0944a3

10.1 11.0 11.1 11.2 11.3 12.0 12.1 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since ae0944a3 was ae0944a3, checked in by Douglas R. Reno <renodr@…>, 3 years ago

Update to xorg-server-1.20.10 (Security Update)
Update to systemd-247
Update to nano-5.4
Update to libtirpc-1.3.1
Update to GnuTLS-3.7.0
Adapt xf86-input-wacom to udev changes

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@23955 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 15.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!-- <!ENTITY systemd-download-http "http://anduin.linuxfromscratch.org/LFS/systemd-&systemd-version;-&systemd-stable;.tar.xz"> For whenever we move to a stable snapshot for backports -->
8 <!ENTITY systemd-download-http "https://github.com/systemd/systemd/archive/v&systemd-version;/systemd-&systemd-version;.tar.gz">
9 <!ENTITY systemd-download-ftp " ">
10 <!ENTITY systemd-md5sum "b0d6e603b814908acc69db29bbfb023c">
11 <!ENTITY systemd-size "9.4 MB">
12 <!ENTITY systemd-buildsize "273 MB (with tests)">
13 <!ENTITY systemd-time "2.1 SBU (with tests)">
14
15]>
16
17<sect1 id="systemd" xreflabel="Systemd-&systemd-version;" revision="systemd">
18 <?dbhtml filename="systemd.html"?>
19
20 <sect1info>
21 <othername>$LastChangedBy$</othername>
22 <date>$Date$</date>
23 </sect1info>
24
25 <title>Systemd-&systemd-version;</title>
26 <!-- Whenever we switch back to stable backports, make sure to add the systemd-stable reference back. -->
27
28 <indexterm zone="systemd">
29 <primary sortas="a-systemd">systemd</primary>
30 </indexterm>
31
32 <sect2 role="package">
33 <title>Introduction to systemd</title>
34
35 <para>
36 While <application>systemd</application> was installed when
37 building LFS, there are many features provided by the package that
38 were not included in the initial installation because
39 <application>Linux-PAM</application> was not yet installed.
40 The <application>systemd</application> package needs to be
41 rebuilt to provide a working <command>systemd-logind</command> service,
42 which provides many additional features for dependent packages.
43 </para>
44
45 &lfs10_checked;
46
47 <bridgehead renderas="sect3">Package Information</bridgehead>
48 <itemizedlist spacing="compact">
49 <listitem>
50 <para>
51 Download (HTTP): <ulink url="&systemd-download-http;"/>
52 </para>
53 </listitem>
54 <listitem>
55 <para>
56 Download (FTP): <ulink url="&systemd-download-ftp;"/>
57 </para>
58 </listitem>
59 <listitem>
60 <para>
61 Download MD5 sum: &systemd-md5sum;
62 </para>
63 </listitem>
64 <listitem>
65 <para>
66 Download size: &systemd-size;
67 </para>
68 </listitem>
69 <listitem>
70 <para>
71 Estimated disk space required: &systemd-buildsize;
72 </para>
73 </listitem>
74 <listitem>
75 <para>
76 Estimated build time: &systemd-time;
77 </para>
78 </listitem>
79 </itemizedlist>
80
81 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
82 <itemizedlist spacing="compact">
83 <listitem>
84 <para>
85 Required patch:
86 <ulink url="&patch-root;/systemd-&systemd-version;-upstream_fixes-1.patch"/>
87 </para>
88 </listitem>
89 </itemizedlist>
90
91 <bridgehead renderas="sect3">systemd Dependencies</bridgehead>
92
93 <bridgehead renderas="sect4">Required</bridgehead>
94 <para role="required">
95 <xref linkend="linux-pam"/>
96 </para>
97
98 <bridgehead renderas="sect4">Recommended Runtime Dependencies</bridgehead>
99 <para role="recommended">
100 <xref role="runtime" linkend="polkit"/>
101 </para>
102
103 <bridgehead renderas="sect4">Optional</bridgehead>
104 <para role="optional">
105 <xref linkend="btrfs-progs"/> <!-- homed may support it, see the C.E.-->
106 <xref linkend="curl"/>,
107 <xref linkend="cryptsetup"/>,
108 <xref linkend="git"/>,
109 <xref linkend="gnutls"/>,
110 <xref linkend="iptables"/>,
111 <xref linkend="libgcrypt"/>,
112 <xref linkend="libidn2"/>,
113 <xref linkend="libpwquality"/>,
114 <xref linkend="libseccomp"/>,
115 <xref linkend="libxkbcommon"/>,
116 <xref linkend="make-ca"/>,
117 <xref linkend="pcre2"/>,
118 <xref linkend="qemu"/>,
119 <xref linkend="valgrind"/>,
120 <xref linkend="zsh"/> (for the zsh completions),
121 <ulink url="http://sourceforge.net/projects/gnu-efi/">gnu-efi</ulink>,
122 <ulink url="https://www.kernel.org/pub/linux/utils/kernel/kexec/">kexec-tools</ulink>,
123 <ulink url="https://developers.yubico.com/libfido2/">libfido2</ulink>,
124 <ulink url="https://www.gnu.org/software/libmicrohttpd/">libmicrohttpd</ulink>,
125 <ulink url="http://lz4.github.io/lz4/">lz4</ulink>,
126 <ulink url="http://fukuchi.org/works/qrencode/">qrencode</ulink>,
127 <ulink url="http://sourceforge.net/projects/linuxquota/">quota-tools</ulink> and
128 <ulink url="https://pypi.python.org/pypi/Sphinx">Sphinx</ulink>
129 </para>
130
131 <bridgehead renderas="sect4">Optional (to rebuild the manual pages)</bridgehead>
132 <para role="optional">
133 <xref linkend="DocBook"/>,
134 <xref linkend="docbook-xsl"/>,
135 <xref linkend="libxslt"/>, and
136 <xref linkend="lxml"/> (to build the index of systemd manual pages)
137 </para>
138
139 <para condition="html" role="usernotes">User Notes:
140 <ulink url="&blfs-wiki;/systemd"/>
141 </para>
142 </sect2>
143
144 <sect2 role="installation">
145 <title>Installation of systemd</title>
146
147 <para>
148 Apply a patch to fix regressions in systemd-networkd and segmentation
149 faults in systemctl:
150 </para>
151
152<screen><userinput remap="pre">patch -Np1 -i ../systemd-&systemd-version;-upstream_fixes-1.patch</userinput></screen>
153
154 <para>
155 Remove an unneeded group,
156 <systemitem class="groupname">render</systemitem>, from the default udev
157 rules:
158 </para>
159
160<screen><userinput remap="pre">sed -i 's/GROUP="render", //' rules.d/50-udev-default.rules.in</userinput></screen>
161
162 <para>
163 Rebuild <application>systemd</application> by running the
164 following commands:
165 </para>
166
167<screen><userinput>mkdir build &amp;&amp;
168cd build &amp;&amp;
169
170meson --prefix=/usr \
171 -Dblkid=true \
172 -Dbuildtype=release \
173 -Ddefault-dnssec=no \
174 -Dfirstboot=false \
175 -Dinstall-tests=false \
176 -Dldconfig=false \
177 -Dman=auto \
178 -Drootprefix= \
179 -Drootlibdir=/lib \
180 -Dsplit-usr=true \
181 -Dsysusers=false \
182 -Drpmmacrosdir=no \
183 -Db_lto=false \
184 -Dhomed=false \
185 -Duserdb=false \
186 -Dmode=release \
187 -Dpamconfdir=/etc/pam.d \
188 -Ddocdir=/usr/share/doc/systemd-&systemd-version; \
189 .. &amp;&amp;
190
191ninja</userinput></screen>
192<!-- Regarding homed and userdb, see the note below in Command Explanations-->
193
194 <note>
195 <para>
196 For the best test results, make sure you run the testsuite from
197 a system that is booted by the same
198 <application>systemd</application> version you are rebuilding.
199 </para>
200 </note>
201
202 <para>
203 To test the results, issue: <command>ninja test</command>. <!--One test,
204 <filename>udev-test</filename> (test 273) fails due to changes in
205 the Linux 5.3+ kernel. It does not affect the package's
206 functionality. NO LONGER APPLICABLE AS OF 244 -->
207 </para>
208
209<!--
210 <warning>
211 <para>
212 Installing the package will overwrite all files installed by
213 <application>systemd</application> in LFS. It is critical that
214 nothing uses either <application>systemd</application> or
215 <application>Udev</application> libraries during the installation.
216 The best way to ensure that these libraries are not being used is to
217 run the installation in rescue mode. To switch to rescue mode,
218 run the following command as the
219 <systemitem class="username">root</systemitem> user (from a TTY):
220 </para>
221
222<screen role="root"><userinput>systemctl isolate rescue.target</userinput></screen>
223 </warning>
224 Nobody has reported problems with this in years. Let's comment it. -->
225
226 <para>
227 Now, as the <systemitem class="username">root</systemitem> user:
228 </para>
229
230<screen role="root"><userinput>ninja install</userinput></screen>
231 <!-- No longer needed as of systemd-244.
232 <para>
233 Remove a configuration file that causes some problems with PID files:
234 </para>
235
236<screen role="root"><userinput>rm -fv /etc/sysctl.d/50-pid-max.conf</userinput></screen>
237 -->
238 </sect2>
239
240 <sect2 role="commands">
241 <title>Command Explanations</title>
242
243<!-- Not needed with the patch
244 <para>
245 <parameter>-Dc_args=-Wno-format-overflow</parameter>: Prevents an error
246 when building with <application>GCC 10</application>. The default is
247 <option>-Werror=format-overflow</option>,
248 which generates false positives. This switch may be used with previous
249 versions of GCC too.
250 </para>
251-->
252
253 <para>
254 <parameter>-Dpamconfdir=/etc/pam.d</parameter>: Forces the PAM files to
255 be installed in /etc/pam.d rather than /usr/lib/pam.d.
256 </para>
257
258 <para>
259 <parameter>-Duserdb=false</parameter>: Removes a daemon that does not
260 offer any use under a BLFS configuration. If you wish to enable the
261 <application>userdbd</application> daemon, replace "false" with "true"
262 in the above meson command.
263 </para>
264
265 <para>
266 <parameter>-Dhomed=false</parameter>: Remove a daemon that does not offer
267 any use under a traditional BLFS configuration, especially using accounts
268 created with useradd. To enable systemd-homed, first ensure that you have
269 <xref linkend="cryptsetup"/> and <xref linkend="libpwquality"/>, and then
270 change "false" to "true" in the above meson command.
271 </para>
272
273 <!-- EDITORS NOTE: Explanation on removing userdbd and homed:
274 In BLFS, we do not fully support disk encryption. We offer instructions for
275 building 'cryptsetup' as a dependency, but we do not offer instructions for
276 actually configuring it. In addition, we generally do not include
277 functionality that could potentially conflict with other packages, or that
278 is not of any use to us (in an enterprise configuration using Thin Clients
279 or laptops with LUKS encryption, it could make sense though, but that isn't
280 the configuration that we natively support).
281
282 A few of the complications of systemd-homed include:
283 - SSH Logins
284 - Disk Space Assignments
285 - UID Assignments (chown() on login)
286 (See https://cfp.all-systems-go.io/media/homed-asg2019.pdf)
287
288 In an article I read when systemd-homed was originally unveiled, I remember
289 reading about systemd-homed causing problems with OpenSSH Private Key Auth
290 because the user would have to login at the console in order to unlock
291 their home directory, thus allowing the private key to be unlocked and
292 processed by OpenSSH. Since BLFS does not fully support encrypted disks,
293 and because systemd-homed is incompatible with our usage of useradd /
294 traditional UNIX users and groups, I advise that we take the following
295 approach to avoid any confusion:
296
297 - Leave the added Short Descriptions for homectl and userdbctl
298 - Add the above command explanations and restore the previous behavior
299
300 Should we decide to enable homed by default anytime in the future,
301 let's move cryptsetup to recommended or required.
302
303 I would be open to discussing this after the next systemd version when
304 systemd-homed has matured a bit more. -renodr -->
305
306 </sect2>
307
308 <sect2 role="configuration">
309 <title>Configuring systemd</title>
310
311 <para>
312 The <filename>/etc/pam.d/system-session</filename> file needs to
313 be modified and a new file needs to be created in order for
314 <command>systemd-logind</command> to work correctly. Run the following
315 commands as the <systemitem class="username">root</systemitem> user:
316 </para>
317
318<screen role="root"><userinput>cat &gt;&gt; /etc/pam.d/system-session &lt;&lt; "EOF"
319<literal># Begin Systemd addition
320
321session required pam_loginuid.so
322session optional pam_systemd.so
323
324# End Systemd addition</literal>
325EOF
326
327cat &gt; /etc/pam.d/systemd-user &lt;&lt; "EOF"
328<literal># Begin /etc/pam.d/systemd-user
329
330account required pam_access.so
331account include system-account
332
333session required pam_env.so
334session required pam_limits.so
335session required pam_unix.so
336session required pam_loginuid.so
337session optional pam_keyinit.so force revoke
338session optional pam_systemd.so
339
340auth required pam_deny.so
341password required pam_deny.so
342
343# End /etc/pam.d/systemd-user</literal>
344EOF</userinput></screen>
345
346<!--
347 <para>
348 At this point, you should reload the systemd daemon, and reenter
349 multi-user mode with the following commands (as the
350 <systemitem class="username">root</systemitem> user). If a desktop
351 manager is installed and you wish to reenter the graphical mode,
352 replace <userinput>multi-user.target</userinput> with
353 <userinput>graphical.target</userinput>:
354 </para>
355
356<screen role="root"><userinput>systemctl daemon-reexec
357systemctl start multi-user.target</userinput></screen>-->
358
359 <warning>
360 <para>
361 If upgrading from a previous version of systemd and an
362 initrd is used for system boot, you should generate a new initrd before
363 rebooting the system.
364 </para>
365 </warning>
366
367 </sect2>
368
369 <sect2 role="content">
370 <title>Contents</title>
371
372 <para>
373 A list of the installed files, along with their short
374 descriptions can be found at
375 <ulink url="&lfs-root;/chapter08/systemd.html#contents-systemd"/>.
376 </para>
377
378 <para>
379 Listed below are the newly installed libraries and directories
380 along with short descriptions.
381 </para>
382
383 <segmentedlist>
384 <segtitle>Installed Programs</segtitle>
385 <segtitle>Installed Libraries</segtitle>
386 <segtitle>Installed Directories</segtitle>
387
388 <seglistitem>
389 <seg>
390 <!-- maybe userdbd/userdbctl can go in LFS, try at next time -->
391 homectl (if <xref linkend="cryptsetup"/> is installed)
392 and userdbctl (optionally)
393 </seg>
394 <seg>
395 pam_systemd.so
396 (in <filename class="directory">/lib/security</filename>)
397 </seg>
398 <seg>
399 None
400 </seg>
401 </seglistitem>
402 </segmentedlist>
403
404 <variablelist>
405 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
406 <?dbfo list-presentation="list"?>
407 <?dbhtml list-presentation="table"?>
408
409 <varlistentry id="homectl">
410 <term><command>homectl</command></term>
411 <listitem>
412 <para>
413 is a tool to create, remove, change, or inspect a home directory
414 managed by <command>systemd-homed</command>; note that it's
415 useless for the classic UNIX users and home directories which
416 we are using in LFS/BLFS book
417 </para>
418 <indexterm zone="systemd homectl">
419 <primary sortas="b-homectl">homectl</primary>
420 </indexterm>
421 </listitem>
422 </varlistentry>
423
424 <varlistentry id="userdbctl">
425 <term><command>userdbctl</command></term>
426 <listitem>
427 <para>
428 inspects users, groups, and group memberships
429 </para>
430 <indexterm zone="systemd userdbctl">
431 <primary sortas="b-userdbctl">userdbctl</primary>
432 </indexterm>
433 </listitem>
434 </varlistentry>
435
436 <varlistentry id="pam_systemd">
437 <term><filename class="libraryfile">pam_systemd.so</filename></term>
438 <listitem>
439 <para>
440 is a PAM module used to register user sessions with the
441 <application>systemd</application> login manager,
442 <command>systemd-logind</command>.
443 </para>
444 <indexterm zone="systemd pam_systemd">
445 <primary sortas="c-pam_systemd">pam_systemd.so</primary>
446 </indexterm>
447 </listitem>
448 </varlistentry>
449
450 </variablelist>
451
452 </sect2>
453
454</sect1>
Note: See TracBrowser for help on using the repository browser.