source: general/sysutils/systemd.xml@ fde1abe

lazarus trunk
Last change on this file since fde1abe was fde1abe, checked in by Pierre Labastie <pierre.labastie@…>, 4 months ago

Don't reference MarkupSafe and Jinja2 in systemd book

  • Property mode set to 100644
File size: 17.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!-- <!ENTITY systemd-download-http "http://anduin.linuxfromscratch.org/LFS/systemd-&systemd-version;-&systemd-stable;.tar.xz"> For whenever we move to a stable snapshot for backports -->
8 <!ENTITY systemd-download-http "https://github.com/systemd/systemd/archive/v&systemd-version;/systemd-&systemd-version;.tar.gz">
9 <!ENTITY systemd-download-ftp " ">
10 <!ENTITY systemd-md5sum "8929beb037c587ada4ed201f19756fe2">
11 <!ENTITY systemd-size "11 MB">
12 <!ENTITY systemd-buildsize "307 MB (with tests)">
13 <!ENTITY systemd-time "2.5 SBU (with tests)">
14
15]>
16
17<sect1 id="systemd" xreflabel="Systemd-&systemd-version;" revision="systemd">
18 <?dbhtml filename="systemd.html"?>
19
20 <sect1info>
21 <date>$Date$</date>
22 </sect1info>
23
24 <title>Systemd-&systemd-version;</title>
25 <!-- Whenever we switch back to stable backports, make sure to add the systemd-stable reference back. -->
26
27 <indexterm zone="systemd">
28 <primary sortas="a-systemd">systemd</primary>
29 </indexterm>
30
31 <sect2 role="package">
32 <title>Introduction to systemd</title>
33
34 <para>
35 While <application>systemd</application> was installed when
36 building LFS, there are many features provided by the package that
37 were not included in the initial installation because
38 <application>Linux-PAM</application> was not yet installed.
39 The <application>systemd</application> package needs to be
40 rebuilt to provide a working <command>systemd-logind</command> service,
41 which provides many additional features for dependent packages.
42 </para>
43
44 &lfs111_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&systemd-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&systemd-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &systemd-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &systemd-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &systemd-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &systemd-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80
81 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
82 <itemizedlist spacing="compact">
83 <listitem>
84 <para>
85 Required patch:
86 <ulink url="&patch-root;/systemd-&systemd-version;-upstream_fixes-1.patch"/>
87 </para>
88 </listitem>
89 <listitem>
90 <para>
91 Required patch:
92 <ulink url="&patch-root;/systemd-&systemd-version;-kernel_5.17_fixes-1.patch"/>
93 </para>
94 </listitem>
95 </itemizedlist>
96
97
98 <bridgehead renderas="sect3">systemd Dependencies</bridgehead>
99
100 <bridgehead renderas="sect4">Required</bridgehead>
101 <para role="required">
102 <xref linkend="linux-pam"/>
103 </para>
104
105 <bridgehead renderas="sect4">Recommended Runtime Dependency</bridgehead>
106 <para role="recommended">
107 <xref role="runtime" linkend="polkit"/>
108 </para>
109
110 <bridgehead renderas="sect4">Optional</bridgehead>
111 <para role="optional">
112 <xref linkend="btrfs-progs"/>, <!-- homed may support it, see the C.E.-->
113 <xref linkend="curl"/>,
114 <xref linkend="cryptsetup"/>,
115 <xref linkend="git"/>,
116 <xref linkend="gnutls"/>,
117 <xref linkend="iptables"/>,
118 <xref linkend="libgcrypt"/>,
119 <xref linkend="libidn2"/>,
120 <xref linkend="libpwquality"/>,
121 <xref linkend="libseccomp"/>,
122 <xref linkend="libxkbcommon"/>,
123 <xref linkend="make-ca"/>,
124 <xref linkend="p11-kit"/>,
125 <xref linkend="pcre2"/>,
126 <xref linkend="qemu"/>,
127 <xref linkend="qrencode"/>,
128 <xref linkend="rsync"/>,
129 <xref linkend="valgrind"/>,
130 <xref linkend="zsh"/> (for the zsh completions),
131 <ulink url="https://sourceforge.net/projects/gnu-efi/">gnu-efi</ulink>,
132 <ulink url="https://www.kernel.org/pub/linux/utils/kernel/kexec/">kexec-tools</ulink>,
133 <ulink url="https://github.com/libbpf/libbpf">libbpf</ulink>,
134 <ulink url="https://sourceware.org/elfutils/">libdw</ulink>,
135 <ulink url="https://developers.yubico.com/libfido2/">libfido2</ulink>,
136 <ulink url="https://www.gnu.org/software/libmicrohttpd/">libmicrohttpd</ulink>,
137 <ulink url="http://lz4.github.io/lz4/">lz4</ulink>,
138 <!--<ulink url="http://fukuchi.org/works/qrencode/">qrencode</ulink>,-->
139 <ulink url="https://sourceforge.net/projects/linuxquota/">quota-tools</ulink>,
140 <ulink url="https://pypi.python.org/pypi/Sphinx">Sphinx</ulink>, and
141 <ulink url="https://tpm2-tss.readthedocs.io/en/latest/">tpm2-tss</ulink>
142 </para>
143
144 <bridgehead renderas="sect4">Optional (to rebuild the manual pages)</bridgehead>
145 <para role="optional">
146 <xref linkend="DocBook"/>,
147 <xref linkend="docbook-xsl"/>,
148 <xref linkend="libxslt"/>, and
149 <xref linkend="lxml"/> (to build the index of systemd manual pages)
150 </para>
151
152 <para condition="html" role="usernotes">User Notes:
153 <ulink url="&blfs-wiki;/systemd"/>
154 </para>
155 </sect2>
156
157 <sect2 role="installation">
158 <title>Installation of systemd</title>
159
160 <para>
161 First, apply a patch to fix a security vulnerability and fix issues with the
162 default hostname on some systems:
163 </para>
164
165<screen><userinput remap="pre">patch -Np1 -i ../systemd-&systemd-version;-upstream_fixes-1.patch</userinput></screen>
166
167 <para>
168 Now, apply a patch to fix a problem with the linux kernel headers in
169 versions 5.17 and above:
170 </para>
171
172<screen><userinput remap="pre">patch -Np1 -i ../systemd-&systemd-version;-kernel_5.17_fixes-1.patch</userinput></screen>
173
174 <para>
175 Remove two unneeded groups,
176 <systemitem class="groupname">render</systemitem> and
177 <systemitem class="groupname">sgx</systemitem>, from the default udev
178 rules:
179 </para>
180
181<screen><userinput remap="pre">sed -i -e 's/GROUP="render"/GROUP="video"/' \
182 -e 's/GROUP="sgx", //' rules.d/50-udev-default.rules.in</userinput></screen>
183
184 <para>
185 Rebuild <application>systemd</application> by running the
186 following commands:
187 </para>
188
189<screen><userinput>mkdir build &amp;&amp;
190cd build &amp;&amp;
191
192meson --prefix=/usr \
193 --buildtype=release \
194 -Dblkid=true \
195 -Ddefault-dnssec=no \
196 -Dfirstboot=false \
197 -Dinstall-tests=false \
198 -Dldconfig=false \
199 -Dman=auto \
200 -Dsysusers=false \
201 -Drpmmacrosdir=no \
202 -Db_lto=false \
203 -Dhomed=false \
204 -Duserdb=false \
205 -Dmode=release \
206 -Dpamconfdir=/etc/pam.d \
207 -Ddocdir=/usr/share/doc/systemd-&systemd-version; \
208 .. &amp;&amp;
209
210ninja</userinput></screen>
211<!-- Regarding homed and userdb, see the note below in Command Explanations-->
212
213 <note>
214 <para>
215 For the best test results, make sure you run the testsuite from
216 a system that is booted by the same
217 <application>systemd</application> version you are rebuilding.
218 </para>
219 </note>
220
221 <para>
222 To test the results, issue:
223 <command>PATH+=:/usr/sbin ninja test</command>.
224 <!-- One test named test-repart needs sfdisk, which is in /usr/sbin. -->
225 </para>
226
227<!--
228 <warning>
229 <para>
230 Installing the package will overwrite all files installed by
231 <application>systemd</application> in LFS. It is critical that
232 nothing uses either <application>systemd</application> or
233 <application>Udev</application> libraries during the installation.
234 The best way to ensure that these libraries are not being used is to
235 run the installation in rescue mode. To switch to rescue mode,
236 run the following command as the
237 <systemitem class="username">root</systemitem> user (from a TTY):
238 </para>
239
240<screen role="root"><userinput>systemctl isolate rescue.target</userinput></screen>
241 </warning>
242 Nobody has reported problems with this in years. Let's comment it. -->
243
244 <para>
245 Now, as the <systemitem class="username">root</systemitem> user:
246 </para>
247
248<screen role="root"><userinput>ninja install</userinput></screen>
249
250<!-- Included in the patch
251 <para>
252 Fix a problem in a systemd unit that can cause extra delays when
253 changing TTYs:
254 </para>
255
256<screen role="root"><userinput>sed -i 's/idle/simple/' /usr/lib/systemd/system/getty@.service</userinput></screen>
257-->
258 <!-- No longer needed as of systemd-244.
259 <para>
260 Remove a configuration file that causes some problems with PID files:
261 </para>
262
263<screen role="root"><userinput>rm -fv /etc/sysctl.d/50-pid-max.conf</userinput></screen>
264 -->
265 </sect2>
266
267 <sect2 role="commands">
268 <title>Command Explanations</title>
269
270<!-- Not needed with the patch
271 <para>
272 <parameter>-Dc_args=-Wno-format-overflow</parameter>: Prevents an error
273 when building with <application>GCC 10</application>. The default is
274 <option>-Werror=format-overflow</option>,
275 which generates false positives. This switch may be used with previous
276 versions of GCC too.
277 </para>
278-->
279
280 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
281 href="../../xincludes/meson-buildtype-release.xml"/>
282
283 <para>
284 <parameter>-Dpamconfdir=/etc/pam.d</parameter>: Forces the PAM files to
285 be installed in /etc/pam.d rather than /usr/lib/pam.d.
286 </para>
287
288 <para>
289 <parameter>-Duserdb=false</parameter>: Removes a daemon that does not
290 offer any use under a BLFS configuration. If you wish to enable the
291 <application>userdbd</application> daemon, replace "false" with "true"
292 in the above meson command.
293 </para>
294
295 <para>
296 <parameter>-Dhomed=false</parameter>: Removes a daemon that does not offer
297 any use under a traditional BLFS configuration, especially using accounts
298 created with useradd. To enable systemd-homed, first ensure that you have
299 <xref linkend="cryptsetup"/> and <xref linkend="libpwquality"/> installed,
300 and then change "false" to "true" in the above meson command.
301 </para>
302
303 <!-- EDITORS NOTE: Explanation on removing userdbd and homed:
304 In BLFS, we do not fully support disk encryption. We offer instructions for
305 building 'cryptsetup' as a dependency, but we do not offer instructions for
306 actually configuring it. In addition, we generally do not include
307 functionality that could potentially conflict with other packages, or that
308 is not of any use to us (in an enterprise configuration using Thin Clients
309 or laptops with LUKS encryption, it could make sense though, but that isn't
310 the configuration that we natively support).
311
312 A few of the complications of systemd-homed include:
313 - SSH Logins
314 - Disk Space Assignments
315 - UID Assignments (chown() on login)
316 (See https://cfp.all-systems-go.io/media/homed-asg2019.pdf)
317
318 In an article I read when systemd-homed was originally unveiled, I remember
319 reading about systemd-homed causing problems with OpenSSH Private Key Auth
320 because the user would have to login at the console in order to unlock
321 their home directory, thus allowing the private key to be unlocked and
322 processed by OpenSSH. Since BLFS does not fully support encrypted disks,
323 and because systemd-homed is incompatible with our usage of useradd /
324 traditional UNIX users and groups, I advise that we take the following
325 approach to avoid any confusion:
326
327 - Leave the added Short Descriptions for homectl and userdbctl
328 - Add the above command explanations and restore the previous behavior
329
330 Should we decide to enable homed by default anytime in the future,
331 let's move cryptsetup to recommended or required.
332
333 I would be open to discussing this after the next systemd version when
334 systemd-homed has matured a bit more. -renodr -->
335
336 </sect2>
337
338 <sect2 role="configuration">
339 <title>Configuring systemd</title>
340
341 <para>
342 The <filename>/etc/pam.d/system-session</filename> file needs to
343 be modified and a new file needs to be created in order for
344 <command>systemd-logind</command> to work correctly. Run the following
345 commands as the <systemitem class="username">root</systemitem> user:
346 </para>
347
348<screen role="root"><userinput>grep 'pam_systemd' /etc/pam.d/system-session ||
349cat &gt;&gt; /etc/pam.d/system-session &lt;&lt; "EOF"
350<literal># Begin Systemd addition
351
352session required pam_loginuid.so
353session optional pam_systemd.so
354
355# End Systemd addition</literal>
356EOF
357
358cat &gt; /etc/pam.d/systemd-user &lt;&lt; "EOF"
359<literal># Begin /etc/pam.d/systemd-user
360
361account required pam_access.so
362account include system-account
363
364session required pam_env.so
365session required pam_limits.so
366session required pam_unix.so
367session required pam_loginuid.so
368session optional pam_keyinit.so force revoke
369session optional pam_systemd.so
370
371auth required pam_deny.so
372password required pam_deny.so
373
374# End /etc/pam.d/systemd-user</literal>
375EOF</userinput></screen>
376
377<!--
378 <para>
379 At this point, you should reload the systemd daemon, and reenter
380 multi-user mode with the following commands (as the
381 <systemitem class="username">root</systemitem> user). If a desktop
382 manager is installed and you wish to reenter the graphical mode,
383 replace <userinput>multi-user.target</userinput> with
384 <userinput>graphical.target</userinput>:
385 </para>
386
387<screen role="root"><userinput>systemctl daemon-reexec
388systemctl start multi-user.target</userinput></screen>-->
389
390 <warning>
391 <para>
392 If upgrading from a previous version of systemd and an
393 initrd is used for system boot, you should generate a new initrd before
394 rebooting the system.
395 </para>
396 </warning>
397
398 </sect2>
399
400 <sect2 role="content">
401 <title>Contents</title>
402
403 <para>
404 A list of the installed files, along with their short
405 descriptions can be found at
406 <ulink url="&lfs-root;/chapter08/systemd.html#contents-systemd"/>.
407 </para>
408
409 <para>
410 Listed below are the newly installed programs
411 along with short descriptions.
412 </para>
413
414 <segmentedlist>
415 <segtitle>Installed Programs</segtitle>
416
417 <seglistitem>
418 <seg>
419 <!-- maybe userdbd/userdbctl can go in LFS, try at next time -->
420 homectl (if <xref linkend="cryptsetup"/> is installed),
421 systemd-cryptenroll (if <xref linkend="cryptsetup"/> is installed),
422 and userdbctl (optionally)
423 </seg>
424 </seglistitem>
425 </segmentedlist>
426
427 <variablelist>
428 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
429 <?dbfo list-presentation="list"?>
430 <?dbhtml list-presentation="table"?>
431
432 <varlistentry id="homectl">
433 <term><command>homectl</command></term>
434 <listitem>
435 <para>
436 is a tool to create, remove, change, or inspect a home directory
437 managed by <command>systemd-homed</command>; note that it's
438 useless for the classic UNIX users and home directories which
439 we are using in LFS/BLFS book
440 </para>
441 <indexterm zone="systemd homectl">
442 <primary sortas="b-homectl">homectl</primary>
443 </indexterm>
444 </listitem>
445 </varlistentry>
446
447 <varlistentry id="systemd-cryptenroll">
448 <term><command>systemd-cryptenroll</command></term>
449 <listitem>
450 <para>
451 Is used to enroll or remove a system from full disk encryption,
452 as well as set and query private keys and recovery keys
453 </para>
454 <indexterm zone="systemd systemd-cryptenroll">
455 <primary sortas="b-systemd-cryptenroll">systemd-cryptenroll</primary>
456 </indexterm>
457 </listitem>
458 </varlistentry>
459
460 <varlistentry id="userdbctl">
461 <term><command>userdbctl</command></term>
462 <listitem>
463 <para>
464 inspects users, groups, and group memberships
465 </para>
466 <indexterm zone="systemd userdbctl">
467 <primary sortas="b-userdbctl">userdbctl</primary>
468 </indexterm>
469 </listitem>
470 </varlistentry>
471
472 <varlistentry id="pam_systemd">
473 <term><filename class="libraryfile">pam_systemd.so</filename></term>
474 <listitem>
475 <para>
476 is a PAM module used to register user sessions with the
477 <application>systemd</application> login manager,
478 <command>systemd-logind</command>
479 </para>
480 <indexterm zone="systemd pam_systemd">
481 <primary sortas="c-pam_systemd">pam_systemd.so</primary>
482 </indexterm>
483 </listitem>
484 </varlistentry>
485
486 </variablelist>
487
488 </sect2>
489
490</sect1>
Note: See TracBrowser for help on using the repository browser.