nixos/systemd: pick more upstream tmpfiles confs#69295
Merged
edolstra merged 1 commit intoNixOS:masterfrom Sep 23, 2019
Merged
Conversation
In NixOS#68792 it was discovered that /dev/fuse doesn't have wordl-read-writeable permissions anymore. The cause of this is that the tmpfiles examples in systemd were reorganized and split into more files. We thus lost some of the configuration we were depending on. In this commit some of the new tmpfiles configuration that are applicable to us are added which also makes wtmp/lastlog in the pam module not necessary anymore. Rationale for the new tmpfile configs: - `journal-nowcow.conf`: Contains chattr +C for journald logs which makes sense on copy-on-write filesystems like Btrfs. Other filesystems shouldn't do anything funny when that flag is set. - `static-nodes-permissions.conf`: Contains some permission overrides for some device nodes like audio, loop, tun, fuse and kvm. - `systemd-nspawn.conf`: Makes sure `/var/lib/machines` exists and old snapshots are properly removed. - `systemd-tmp.conf`: Removes systemd services related private tmp folders and temporary coredump files. - `var.conf`: Creates some useful directories in `/var` which we would create anyway at some point. Also includes `/var/log/{wtmp,btmp,lastlog}`. Fixes NixOS#68792.
fpletz
added
the
9.needs: port to stable
Member
Author
Member
Author
|
Here's the direct link to the tmpfiles for easier review: https://github.com/NixOS/systemd/tree/nixos-v243/tmpfiles.d |
ofborg
bot
added
6.topic: nixos
ofborg
bot
added
10.rebuild-darwin: 0
flokli
reviewed
Sep 24, 2019
| "tmpfiles.d/systemd.conf".source = "${systemd}/example/tmpfiles.d/systemd.conf"; | ||
| "tmpfiles.d/systemd-nspawn.conf".source = "${systemd}/example/tmpfiles.d/system-nspawn.conf"; | ||
| "tmpfiles.d/systemd-tmp.conf".source = "${systemd}/example/tmpfiles.d/system-tmp.conf"; | ||
| "tmpfiles.d/var.conf".source = "${systemd}/example/tmpfiles.d/var.conf"; |
Member
There was a problem hiding this comment.
We probably should add some logic extracting tmpfiles.d from common locations into the systemd module, like we already do for udev files for everything added to systemd.packages.
This would be useful for #66856 (comment), too.
Member
There was a problem hiding this comment.
That is a great idea @flokli . Lets open a new issue for that?
Contributor
|
For 19.09, can this just be cherry-picked or is there more to it? |
Member
|
Done: ad36169 |
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation for this change
In #68792 it was discovered that /dev/fuse doesn't have
wordl-read-writeable permissions anymore. The cause of this is that the
tmpfiles examples in systemd were reorganized and split into more files.
We thus lost some of the configuration we were depending on.
In this commit some of the new tmpfiles configuration that are
applicable to us are added which also makes wtmp/lastlog in the pam
module not necessary anymore.
Rationale for the new tmpfile configs:
journal-nowcow.conf: Contains chattr +C for journald logs whichmakes sense on copy-on-write filesystems like Btrfs. Other filesystems
shouldn't do anything funny when that flag is set.
static-nodes-permissions.conf: Contains some permission overridesfor some device nodes like audio, loop, tun, fuse and kvm.
systemd-nspawn.conf: Makes sure/var/lib/machinesexists and oldsnapshots are properly removed.
systemd-tmp.conf: Removes systemd services related private tmpfolders and temporary coredump files.
var.conf: Creates some useful directories in/varwhich we wouldcreate anyway at some point. Also includes
/var/log/{wtmp,btmp,lastlog}.Fixes #68792.
Things done
Ran systemd & installer tests successfully.