systemd: create wheel sysuser group offline
PATCH 1/1 systemd: create wheel sysuser group offline
The default systemd-tmpfiles config file expects to be able to create files etc belonging to the wheel system group. Currently the wheel group is created at run time by systemd-sysusers, but that doesn't happen if systemd-sysusers is disabled (as it currently is by default when building with musl libc).
--- meta/recipes-core/systemd/systemd_234.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
meta/recipes-core/systemd/systemd_234.bb +1 -1
@@ -333,7 +333,7 @@ USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'networkd', '--sys USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'coredump', '--system -d / -M --shell /bin/nologin systemd-coredump;', '', d)}" USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'resolved', '--system -d / -M --shell /bin/nologin systemd-resolve;', '', d)}" USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'polkit', '--system --no-create-home --user-group --home-dir ${sysconfdir}/polkit-1 polkitd;', '', d)}" -GROUPADD_PARAM_${PN} = "-r lock; -r systemd-journal" +GROUPADD_PARAM_${PN} = "-r lock; -r systemd-journal; -r wheel" USERADD_PARAM_${PN}-extra-utils += "--system -d / -M --shell /bin/nologin systemd-bus-proxy;" FILES_${PN}-analyze = "${bindir}/systemd-analyze"
Signature · 1 line
1.9.1
Quoted 5 lines · Andre McCurdy
The default systemd-tmpfiles config file expects to be able to create files etc belonging to the wheel system group. Currently the wheel group is created at run time by systemd-sysusers, but that doesn't happen if systemd-sysusers is disabled (as it currently is by default when building with musl libc).
Isn't this something that the systemd_create_users rootfs postprocess command in rootfs-postcommands.bbclass already takes care of?
I know that it is has issues (https://bugzilla.yoctoproject.org/show_bu
g.cgi?id=9789), but it should at least create the wheel group.
Signature · 6 lines
Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter.
Quoted 9 lines · Patrick Ohly
Quoted 5 lines · Andre McCurdy
The default systemd-tmpfiles config file expects to be able to create files etc belonging to the wheel system group. Currently the wheel group is created at run time by systemd-sysusers, but that doesn't happen if systemd-sysusers is disabled (as it currently is by default when building with musl libc).
Isn't this something that the
systemd_create_usersrootfs postprocess command in rootfs-postcommands.bbclass already takes care of?
systemd_create_users() does a build time pass over the systemd-sysusers config files, but those files are not installed if systemd is configured without sysusers support.
Quoted 5 lines
I know that it is has issues (https://bugzilla.yoctoproject.org/show_bu
g.cgi?id=9789), but it should at least create the wheel group.--
Best Regards, Patrick Ohly
Quoted 13 lines · Andre McCurdy
On Mon, Nov 13, 2017 at 6:48 AM, Patrick Ohly <[email protected]
Quoted 12 lines
wrote:
Quoted 9 lines · Andre McCurdy
The default systemd-tmpfiles config file expects to be able to create
files etc belonging to the wheel system group. Currently the wheel
group is created at run time by systemd-sysusers, but that doesn't
happen if systemd-sysusers is disabled (as it currently is by default
when building with musl libc).
Quoted 7 lines
Quoted 3 lines
Isn't this something that the
systemd_create_usersrootfs postprocess
command in rootfs-postcommands.bbclass already takes care of?
systemd_create_users()does a build time pass over the systemd-sysusers config files, but those files are not installed if systemd is configured without sysusers support.
I didn't know that this is optional. To me it sounds like an invalid (or let's say, unexpected) configuration to install tmpfiles config files but not the sysusers files, because as you said, the tmpfiles may depend on the sysusers.
Anyway, I just wanted to know because I was wondering whether it is really necessary to duplicate the user creation information in the systemd recipe.
Signature · 6 lines
Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter.
Quoted 18 lines · Patrick Ohly
Quoted 17 lines · Andre McCurdy
On Mon, Nov 13, 2017 at 6:48 AM, Patrick Ohly <[email protected]
Quoted 15 lines
wrote:
Quoted 9 lines · Andre McCurdy
The default systemd-tmpfiles config file expects to be able to create
files etc belonging to the wheel system group. Currently the wheel
group is created at run time by systemd-sysusers, but that doesn't
happen if systemd-sysusers is disabled (as it currently is by default
when building with musl libc).Isn't this something that the
systemd_create_usersrootfs postprocess
command in rootfs-postcommands.bbclass already takes care of?
Quoted 8 lines
Quoted 3 lines
systemd_create_users()does a build time pass over the systemd-sysusers config files, but those files are not installed if systemd is configured without sysusers support.I didn't know that this is optional. To me it sounds like an invalid (or let's say, unexpected) configuration to install tmpfiles config files but not the sysusers files, because as you said, the tmpfiles may depend on the sysusers.
In the current recipe, there's no control of tmpfiles (so it will always be enabled) and sysusers is controlled by PACKAGECONFIG (enabled by default - but only when building with glibc), so the recipe does allow that combination.
Quoted 4 lines
Anyway, I just wanted to know because I was wondering whether it is really necessary to duplicate the user creation information in the systemd recipe.
Quoted 28 lines · Andre McCurdy
Quoted 18 lines · Patrick Ohly
Quoted 17 lines · Andre McCurdy
On Mon, Nov 13, 2017 at 6:48 AM, Patrick Ohly <[email protected]
Quoted 15 lines
wrote:
Quoted 9 lines · Andre McCurdy
The default systemd-tmpfiles config file expects to be able to create
files etc belonging to the wheel system group. Currently the wheel
group is created at run time by systemd-sysusers, but that doesn't
happen if systemd-sysusers is disabled (as it currently is by default
when building with musl libc).Isn't this something that the
systemd_create_usersrootfs postprocess
command in rootfs-postcommands.bbclass already takes care of?Quoted 8 lines
Quoted 3 lines
systemd_create_users()does a build time pass over the systemd-sysusers config files, but those files are not installed if systemd is configured without sysusers support.I didn't know that this is optional. To me it sounds like an invalid (or let's say, unexpected) configuration to install tmpfiles config files but not the sysusers files, because as you said, the tmpfiles may depend on the sysusers.
Quoted 9 lines
In the current recipe, there's no control of tmpfiles (so it will always be enabled) and sysusers is controlled by PACKAGECONFIG (enabled by default - but only when building with glibc), so the recipe does allow that combination.
Quoted 4 lines
Anyway, I just wanted to know because I was wondering whether it is really necessary to duplicate the user creation information in the systemd recipe.
Ping.
Ross, it looks like you've started to stage the later systemd + musl cleanups in mut. This fix is needed too.
Quoted 5 lines · Andre McCurdy
The default systemd-tmpfiles config file expects to be able to create files etc belonging to the wheel system group. Currently the wheel group is created at run time by systemd-sysusers, but that doesn't happen if systemd-sysusers is disabled (as it currently is by default when building with musl libc).
For sysvinit, we follow the Debian rule which doesn't have wheel group in the system. Should we have to break this rule for systemd? Is this necessary to use this group in systemd?
//Yi
Quoted 19 lines
Signed-off-by Andre McCurdy <[email protected]>--- meta/recipes-core/systemd/systemd_234.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)meta/recipes-core/systemd/systemd_234.bb +1
-1@@ -333,7 +333,7 @@ USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'networkd', '--sys USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'coredump', '--system -d / -M --shell /bin/nologin systemd-coredump;', '', d)}" USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'resolved', '--system -d / -M --shell /bin/nologin systemd-resolve;', '', d)}" USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'polkit', '--system --no-create-home --user-group --home-dir ${sysconfdir}/polkit-1 polkitd;', '', d)}" -GROUPADD_PARAM_${PN} = "-r lock; -r systemd-journal" +GROUPADD_PARAM_${PN} = "-r lock; -r systemd-journal; -r wheel" USERADD_PARAM_${PN}-extra-utils += "--system -d / -M --shell /bin/nologin systemd-bus-proxy;" FILES_${PN}-analyze = "${bindir}/systemd-analyze"
Quoted 11 lines · Yi Zhao
Quoted 6 lines · Andre McCurdy
The default systemd-tmpfiles config file expects to be able to create files etc belonging to the wheel system group. Currently the wheel group is created at run time by systemd-sysusers, but that doesn't happen if systemd-sysusers is disabled (as it currently is by default when building with musl libc).
For sysvinit, we follow the Debian rule which doesn't have wheel group in the system. Should we have to break this rule for systemd? Is this necessary to use this group in systemd?
The default systemd-tmpfiles config file expects to be able to create files etc belonging to the wheel system group. Unless we patch or over-ride the default systemd-tmpfiles config file to change that then yes, the wheel group appears to be necessary for systemd.
Quoted 9 lines · Andre McCurdy
Quoted 8 lines · Yi Zhao
Quoted 6 lines · Andre McCurdy
The default systemd-tmpfiles config file expects to be able to create files etc belonging to the wheel system group. Currently the wheel group is created at run time by systemd-sysusers, but that doesn't happen if systemd-sysusers is disabled (as it currently is by default when building with musl libc).
Quoted 8 lines
Quoted 3 lines
For sysvinit, we follow the Debian rule which doesn't have wheel group in the system. Should we have to break this rule for systemd? Is this necessary to use this group in systemd?
The default systemd-tmpfiles config file expects to be able to create files etc belonging to the wheel system group. Unless we patch or over-ride the default systemd-tmpfiles config file to change that then yes, the wheel group appears to be necessary for systemd.
Ping.
This is needed for rocko (assuming systemd with musl is expected to work with rocko?) so unless there are still strong objections I recommend merging as-is.
More significant re-work (e.g. preventing systemd-tmpfiles from being enabled without systemd-sysusers or patching systemd to remove any dependency on the wheel group) would not be suitable for rocko, so should be considered separately.
Quoted 21 lines · Andre McCurdy
Quoted 9 lines · Andre McCurdy
Quoted 8 lines · Yi Zhao
Quoted 6 lines · Andre McCurdy
The default systemd-tmpfiles config file expects to be able to create files etc belonging to the wheel system group. Currently the wheel group is created at run time by systemd-sysusers, but that doesn't happen if systemd-sysusers is disabled (as it currently is by default when building with musl libc).
Quoted 8 lines
Quoted 3 lines
For sysvinit, we follow the Debian rule which doesn't have wheel group in the system. Should we have to break this rule for systemd? Is this necessary to use this group in systemd?
The default systemd-tmpfiles config file expects to be able to create files etc belonging to the wheel system group. Unless we patch or over-ride the default systemd-tmpfiles config file to change that then yes, the wheel group appears to be necessary for systemd.
Ping.
Quoted 8 lines
This is needed for rocko (assuming systemd with musl is expected to work with rocko?) so unless there are still strong objections I recommend merging as-is.
More significant re-work (e.g. preventing systemd-tmpfiles from being enabled without systemd-sysusers or patching systemd to remove any dependency on the wheel group) would not be suitable for rocko, so should be considered separately.
Ping again.