Split out of #38728
(background: os tree "mangling" is what we do if a tarball with an OS
image inside it if is nested inside an extra top-level dir inside the
tarball, which we need to "mangle" and move everything inside one level
up)
Follow up for fe0342edf4
This also drops the mkosi testuser from the wheel and systemd-journal
groups as the integration tests rely on the testuser not being to read
the full journal.
Hardcoding total size of the array is error-prone, especially
considering the exeuctable_fd is added far below, so the '4' is
not entirely obvious. Also we seldomly do VLAs.
If socket is used as stdio, we'd currently imply EXEC_PASS_FDS
and dump the whole set of fds to the control processes. This is
pretty much unexpected and unnecessary though, instead let's
pass only the socket fds.
Yes, this is a compat break, but a relatively minor one I'd
argue. And we can always revisit things if users do complain.
The distinction between fdstore and extra fds is only meaningful
to struct Service. As far as executor is concerned they're just
some fds to pass to the service. Let's just merge it hence,
for the sake of simplicity.
According to systemd.exec(5):
> The fd:name option connects standard input to a specific, named
> file descriptor provided *by a socket unit*. ...
Currently however we're looking at the whole fd array passed,
fix it.
--empower gives full privileges to a non-root user. Currently this
includes all capabilities but we leave the option open to add more
privileges via this option in the future.
Why is this useful? When running privileged development or debugging
commands from your home directory (think bpftrace, strace and such),
you want any files written by these tools to be owned by your current
user, and not by the root user. run0 --empower will allow you to run
all privileged operations (assuming the tools check for capabilities
and not UIDs), while any files written by the tools will still be owned
by the current user.
This creates a chicken-and-egg problem: we stuff the pcrlock policy into
a credential in the ESP, but credentials get measured into PCR 12, hence
PCR 12 is both input and output of the pcrlock logic, which makes
impossible to calculate.
Let's drop PCR 12 for now.
(We might want to pass the policy some other way one day, to avoid this,
but that's something for another day.)
Note that this still allows locking to PCR12 if people want to (for
example because they don't need this for the rootfs, and hence need no
cred passing via the ESP), this hence only changes the default, nothing
more.
Fixes: #33546
All other cases, settings on different interfaces are completely
independent. But IPMasquerade=yes on an interface enables the global
IPv6Forwarding= setting, and hence affects other interfaces.
Let's log about that.
Prompted by https://github.com/systemd/systemd/issues/39304#issuecomment-3430382233.
* ea1d871ecd Add missing networkd socket units
* b76b5da2e6 Merge #214 `Drop backwards compat logic from integration tests script`
* 7208fa2b1b Require systemd-rpm-macros for build
* 2e1a6c7474 Require python3-zstandard in ELN
* 79c9db1bc8 Require systemd-libs and systemd-shared to be in the same version
* db38445a7e Drop two patches with workaround (selinux, kernel)
* 593a204189 Version 258.1
* a3e9e27982 Change '%{systemd}' to systemd in Conflicts/Provides/Requires/Recommends
* 88877a4184 Require systemd-networkd and systemd-udev to be in the same version
* 8a446daec7 Version 258 💝
* cceac93491 Pre-create /etc/userdb directory
* b442086d5f Version 258~rc4
* 327e54e421 Add to patch to create userdb root directory with correct label
* 2289d65726 Fix unit name in scriptlet
* 5acde9f1fd Add workaround patch to hopefully pass podman CI tests
* 1f5ed0da1f Version 258~rc3
* 50936458a7 obs: move recipe files in place
* 1bdb4efe40 obs: switch to xz for compression
* be7a4d0863 Version 258~rc2
* 2ace9416e8 obs: also use version with tilde for Source0
* 8d1645af75 Use again %{version} when building in OBS
* 98cc5fd91a Version 258~rc1
* ed7d2f1132 Add "test" that LTO effectively removes unused code from shared lib
* 40b38a04d2 Build docs on 64-bit architectures only
* 5d30fd3b26 Version 257.7
