Package: systemd / 241-7~deb10u1

Metadata

Package Version Patches format
systemd 241-7~deb10u1 3.0 (quilt)

Patch series

view the series file
Patch File delta Description
sd bus enforce a size limit on D Bus object paths.patch | (download)

src/libsystemd/sd-bus/bus-internal.c | 2 1 + 1 - 0 !
src/libsystemd/sd-bus/bus-internal.h | 4 4 + 0 - 0 !
src/libsystemd/sd-bus/bus-objects.c | 64 50 + 14 - 0 !
3 files changed, 55 insertions(+), 15 deletions(-)

 sd-bus: enforce a size limit on d-bus object paths

Replace stack with heap allocation. This avoids accessing/modifying
memory outside of the allocated stack region by sending specially
crafted D-Bus messages with very large object paths.

Vulnerability discovered by Chris Coulson <chris.coulson@canonical.com>,
patch provided by Riccardo Schirone <rschiron@redhat.com>.

CVE-2019-6454

udev network drop unused parent_driver argument from net_.patch | (download)

src/libsystemd-network/network-internal.c | 1 0 + 1 - 0 !
src/libsystemd-network/network-internal.h | 1 0 + 1 - 0 !
src/network/netdev/netdev.c | 2 1 + 1 - 0 !
src/network/networkd-network.c | 9 2 + 7 - 0 !
src/udev/net/link-config.c | 6 1 + 5 - 0 !
5 files changed, 4 insertions(+), 15 deletions(-)

 udev,network: drop unused parent_driver argument from
 net_match_config()

The argument has never been used.

(cherry picked from commit 4f4daf418f2e750caae6bc26cd49daafc23ad4de)

sd device also store properties read from udev database t.patch | (download)

src/libsystemd/sd-device/sd-device.c | 9 8 + 1 - 0 !
1 file changed, 8 insertions(+), 1 deletion(-)

 sd-device: also store properties read from udev database to
 sd_device::properties_db

Follow-up for a3ce813697bcc1c4644e097a2f1cd0459326d6ee and
5ce41697bd3ddc19cd6e1e6834751082ca0c8b02.

Before a3ce813697bcc1c4644e097a2f1cd0459326d6ee, all properties in
src->properties and src->properties_db are mixed and copied to
dst->properties_db by device_copy_properties().
So, it is not necessary to store data from udev database file to
sd_device::properties_db before copying properties.

But now, properties are not mixed. So, the read data need to be
stored to also ::properties_db.

Fixes #11721.

(cherry picked from commit 03dd7b7ddec1b0e06f254972a2e05f516a05edaf)

networkd test disable DNSSEC in domain restricted DNS tes.patch | (download)

test/networkd-test.py | 7 7 + 0 - 0 !
1 file changed, 7 insertions(+)

 networkd-test: disable dnssec in domain-restricted dns test

dnsmasq 2.80 changed behaviour when being queried by resolved with
enabled DNSSEC: It returns errors for SOA and DS queries which cause the
entire query to fail. As we don't configure DNSSEC in this test anyway,
just disable it so that we retain compatibility with old and new dnsmasq
versions.

(cherry picked from commit 6592c9c850675fb20236271efc4f65acbe3bfa00)

networkd test use a complete domain name in test_route_on.patch | (download)

test/networkd-test.py | 32 16 + 16 - 0 !
1 file changed, 16 insertions(+), 16 deletions(-)

 networkd-test: use a complete domain name in test_route_only_dns()

Since version 241 (commit ea4678?), querying MX type records for
single-label domains does not actually forward the query to the DNS
server any more. Use "example.com" instead, which is the recommended
test domain anyway.

(cherry picked from commit ca56805c8de43fc21ab4657cf5ebd1e0248527ac)

networkd test fix test_dropin.patch | (download)

test/networkd-test.py | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 networkd-test: fix test_dropin()

 - This test needs resolved, so make sure it is started. In some Debian
   environments it is not.
 - It was an unnecessary, and now failing assumption that name servers
   get atomically written to the resolved's resolv.conf. Wait until both
   expected name servers are in the file.

(cherry picked from commit f5cf985e9cc6fff747ca17acadb1b4751076103b)

networkd test ignore failures of test_route_only_dns in c.patch | (download)

test/networkd-test.py | 23 19 + 4 - 0 !
1 file changed, 19 insertions(+), 4 deletions(-)

 networkd-test: ignore failures of test_route_only_dns* in containers

This test exposes a race condition when running in LXC, see issue #11848
for details. Until that is understood and fixed, skip the test as it's
not a recent regression.

(cherry picked from commit 09b8826ea371e027c76a573a226bfd8f8c5652a2)

timedate fix emitted value when ntp client is enabled dis.patch | (download)

src/timedate/timedated.c | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 timedate: fix emitted value when ntp client is enabled/disabled
 (#11951)

This fixes a regression originall caused by cf3872bd2 and
triggered by b4356b5720a.

Fixes #11944

(cherry picked from commit 49942d6b1eac12f3157c628ee6249c3bbb3602aa)

cgtop Fix processing of controllers other than CPU.patch | (download)

src/cgtop/cgtop.c | 130 65 + 65 - 0 !
1 file changed, 65 insertions(+), 65 deletions(-)

 cgtop: fix processing of controllers other than cpu

After debugging the issue with gdb, I found that the following change

 94ddb08 "cgtop: Still try to get CPU statistics if controller-free"

has introduced a bug, which prevents process(..) method processing
memory and io controllers when cpu_accounting_is_cheap() is true.
The obvious fix is to move this branch to be the last one, keeping
the intended behavior of the above change, without having a negative
effect on the other controllers.

Fixes #11773 [systemd-cgtop no longer shows memory (and io) usage]

(cherry picked from commit 5fe74e893c7939a360dc4eb75dbf3f540526c968)

udev restore debug level when logging a failure in the ex.patch | (download)

src/udev/udev-rules.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 udev: restore debug level when logging a failure in the external
 prog called by IMPORT{program}

It was already the case before commit a75211421fc9366068e6d9446e8e567246c72feb,
which upgraded the log to warning.

This seems an unintended side effect as the commit message doesn't mention it
and the old behavior looks more appropriate.

(cherry picked from commit 3c37dadf627677eef62fcfc0c0f07cc67c748a9e)

remove . path components from required mount paths.patch | (download)

src/core/unit.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 remove "." path components from required mount paths

unit_require_mounts_for may be passed path arguments that contain "."
components like for user's home directories where "." is sometimes used
to specify some form of anchor point.

This change stops considering such path as an error and removes the "."
components instead.

Closes: #11910
(cherry picked from commit 106bf8e445a797f9d9c88b827ed42193f2f6b838)

Re add uaccess tag for dev dri renderD.patch | (download)

meson.build | 4 3 + 1 - 0 !
src/login/70-uaccess.rules.m4 | 4 4 + 0 - 0 !
2 files changed, 7 insertions(+), 1 deletion(-)

 re-add uaccess tag for /dev/dri/renderd*

Setting an access mode != 0666 is explicitly supported via -Dgroup-render-mode
In such a case, re-add the uaccess tag.

This is basically the same change that was done for /dev/kvm in
commit fa53e24130af3a389573acb9585eadbf7192955f and
ace5e3111c0b8d8bfd84b32f2c689b0a4d92c061
and partially reverts the changes from
4e15a7343cb389e97f3eb4f49699161862d8b8b2

(cherry picked from commit 055a083a47de968744c4988fe305592477118c86)

udev run programs in the specified order.patch | (download)

src/udev/udev-event.c | 6 3 + 3 - 0 !
src/udev/udev-node.c | 6 3 + 3 - 0 !
src/udev/udev-node.h | 2 1 + 1 - 0 !
src/udev/udev-rules.c | 12 6 + 6 - 0 !
src/udev/udev.h | 4 2 + 2 - 0 !
src/udev/udevadm-test.c | 2 1 + 1 - 0 !
6 files changed, 16 insertions(+), 16 deletions(-)

 udev: run programs in the specified order

This fixes bugs introduced by 29448498c724da7ade1b5efb20d7472c1b128d2c
and d838e14515c82b05a07f2bf393cce057b45b2b53.

Previously, RUN and SECLABEL keys are stored in udev_list with its unique
flag is false. If the flag is false, then udev_list is just a linked
list and new entries are always added in the last.
So, we should use OrderedHashmap instead of Hashmap.

Fixes #11368.

(cherry picked from commit 39a15c8a8dad26deda140867f03e44a535b7bd8d)

bash completion use default completion for redirect opera.patch | (download)

shell-completion/bash/journalctl | 7 7 + 0 - 0 !
1 file changed, 7 insertions(+)

 bash-completion: use default completion for redirect operators

(cherry picked from commit 1413763ea540a897852494259cb949fe01e1e7e7)

networkd clarify that IPv6 RA uses our own stack no the k.patch | (download)

man/systemd.network.xml | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 networkd: clarify that ipv6 ra uses our own stack, no the kernel's

Fixes: #8906
(cherry picked from commit c4a05aa1a8338013108d099de805f3262a871c0f)

network remove routing policy rule from foreign rule data.patch | (download)

src/network/networkd-routing-policy-rule.c | 19 11 + 8 - 0 !
1 file changed, 11 insertions(+), 8 deletions(-)

 network: remove routing policy rule from foreign rule database when
 it is removed

Previously, When the first link configures rules, it removes all saved
rules, which were configured by networkd previously, in the foreign rule
database, but the rules themselves are still in the database.
Thus, when the second or later link configures rules, it errnously
treats the rules already exist.
This is the root of issue #11280.

This removes rules from the foreign database when they are removed.

Fixes #11280.

(cherry picked from commit 92cd00b9749141907a1110044cc7d1f01caff545)

network do not remove rule when it is requested by existi.patch | (download)

src/network/networkd-routing-policy-rule.c | 26 26 + 0 - 0 !
1 file changed, 26 insertions(+)

 network: do not remove rule when it is requested by existing links

Otherwise, the first link once removes all saved rules in the foreign
rule database, and the second or later links create again...

(cherry picked from commit 031fb59a984e5b51f3c72aa8125ecc50b08011fe)

pam systemd use secure_getenv rather than getenv.patch | (download)

src/login/pam_systemd.c | 13 10 + 3 - 0 !
1 file changed, 10 insertions(+), 3 deletions(-)

 pam-systemd: use secure_getenv() rather than getenv()

And explain why in a comment.

(cherry picked from commit 83d4ab55336ff8a0643c6aa627b31e351a24040a)

journal remote do not request Content Length if Transfer .patch | (download)

src/journal-remote/journal-remote-main.c | 41 27 + 14 - 0 !
1 file changed, 27 insertions(+), 14 deletions(-)

 journal-remote: do not request content-length if transfer-encoding
 is chunked

This fixes a bug introduced by 7fdb237f5473cb8fc2129e57e8a0039526dcb4fd.

Closes #11571.

(cherry picked from commit a289dfd69b3ff4bccdde93e84b67c947bafa27e1)

systemctl restore systemctl reboot ARG functionality.patch | (download)

src/core/emergency-action.c | 4 2 + 2 - 0 !
src/shared/reboot-util.c | 5 4 + 1 - 0 !
src/shared/reboot-util.h | 2 1 + 1 - 0 !
src/systemctl/systemctl.c | 4 2 + 2 - 0 !
4 files changed, 9 insertions(+), 6 deletions(-)

 systemctl: restore "systemctl reboot arg" functionality

Commit d85515edcf9700dc068201ab9f7103f04f3b25b2 changed logic how reboot is
executed. That commit changed behavior to use emergency action reboot code path
to perform the reboot.

This inadvertently broke rebooting with argument:
$ systemctl reboot custom-reason

Restore original behavior so that if reboot service unit similar to
systemd-reboot.service is executed it is possible to override reboot reason
with "systemctl reboot ARG".

When "systemctl reboot ARG" is executed ARG is placed in file
/run/systemd/reboot-param and reboot is issued using logind's Reboot
dbus-service.

If RebootArgument is specified in systemd-reboot.service it takes precedence
over what systemctl sets.

Fixes: #11828
(cherry picked from commit 77defcf5382a557189350f928967d676510e362c)

random util eat up bad RDRAND values seen on AMD CPUs.patch | (download)

src/basic/random-util.c | 15 14 + 1 - 0 !
1 file changed, 14 insertions(+), 1 deletion(-)

 random-util: eat up bad rdrand values seen on amd cpus

An ugly, ugly work-around for #11810. And no, we shouldn't have to do
this. This is something for AMD, the firmware or the kernel to
fix/work-around, not us. But nonetheless, this should do it for now.

Fixes: #11810
(cherry picked from commit 1c53d4a070edbec8ad2d384ba0014d0eb6bae077)

ask password prevent buffer overflow when reading from ke.patch | (download)

src/shared/ask-password-api.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 ask-password: prevent buffer overflow when reading from keyring

When we read from keyring, a temporary buffer is allocated in order to
determine the size needed for the entire data. However, when zeroing that area,
we use the data size returned by the read instead of the lesser size allocate
for the buffer.

That will cause memory corruption that causes systemd-cryptsetup to crash
either when a single large password is used or when multiple passwords have
already been pushed to the keyring.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
(cherry picked from commit 59c55e73eaee345e1ee67c23eace8895ed499693)

core unset HOME that the kernel gives us.patch | (download)

src/core/main.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 core: unset home=/ that the kernel gives us

Partially fixes #12389.

%h would return "/" in a machine, but "/root" in a container. Let's fix
this by resetting $HOME to the expected value.

(cherry picked from commit 9d48671c62de133a2b9fe7c31e70c0ff8e68f2db)

man add note that h u U are mostly useless.patch | (download)

man/systemd.unit.xml | 12 9 + 3 - 0 !
1 file changed, 9 insertions(+), 3 deletions(-)

 man: add note that %h/%u/%u are mostly useless

Fixes #12389.

(cherry picked from commit b4e2407716731d1ce099bad1c2778f7a4424ed2e)

sysctl util add sysctl_read_ip_property.patch | (download)

src/shared/sysctl-util.c | 22 22 + 0 - 0 !
src/shared/sysctl-util.h | 1 1 + 0 - 0 !
2 files changed, 23 insertions(+)

 sysctl-util: add sysctl_read_ip_property()

(cherry picked from commit a6b3b0aace152b77682d68d99b3e41580c955efb)

network check whether ipv6 is enabled in sysctl.patch | (download)

src/network/networkd-link.c | 12 12 + 0 - 0 !
src/network/networkd-manager.c | 18 18 + 0 - 0 !
src/network/networkd-manager.h | 4 4 + 0 - 0 !
3 files changed, 34 insertions(+)

 network: check whether ipv6 is enabled in sysctl

Currently, the value is read only once.

Fixes #11711.

(cherry picked from commit 4b600505dda8af6c43496f9e93e420a192d9a38b)

network ignore requested ipv6 addresses when ipv6 is disa.patch | (download)

src/network/networkd-address.c | 7 6 + 1 - 0 !
src/network/networkd-link.c | 4 2 + 2 - 0 !
src/network/networkd-ndisc.c | 4 2 + 2 - 0 !
3 files changed, 10 insertions(+), 5 deletions(-)

 network: ignore requested ipv6 addresses when ipv6 is disabled by
 sysctl

(cherry picked from commit 54a1a535bd60f13964bbddd8f381601e33e8e56f)

network ignore requested ipv6 route when ipv6 is disabled.patch | (download)

src/network/networkd-link.c | 4 2 + 2 - 0 !
src/network/networkd-ndisc.c | 12 6 + 6 - 0 !
src/network/networkd-route.c | 7 6 + 1 - 0 !
3 files changed, 14 insertions(+), 9 deletions(-)

 network: ignore requested ipv6 route when ipv6 is disabled by sysctl

(cherry picked from commit c442331750a2a9711036080f7590e190b9b0eb54)

network ignore requested ipv6 routing policy rule when ip.patch | (download)

src/network/networkd-link.c | 4 2 + 2 - 0 !
src/network/networkd-routing-policy-rule.c | 7 6 + 1 - 0 !
2 files changed, 8 insertions(+), 3 deletions(-)

 network: ignore requested ipv6 routing policy rule when ipv6 is
 disabled by sysctl

(cherry picked from commit 7ef7e5509b637e660e89ba8a938930ec01de6e54)

network read link specific sysctl value.patch | (download)

src/network/networkd-address.c | 2 1 + 1 - 0 !
src/network/networkd-link.c | 24 20 + 4 - 0 !
src/network/networkd-link.h | 4 4 + 0 - 0 !
src/network/networkd-manager.c | 17 0 + 17 - 0 !
src/network/networkd-manager.h | 4 0 + 4 - 0 !
src/network/networkd-route.c | 2 1 + 1 - 0 !
src/network/networkd-routing-policy-rule.c | 2 1 + 1 - 0 !
7 files changed, 27 insertions(+), 28 deletions(-)

 network: read link specific sysctl value

This introduce link_sysctl_ipv6_enabled() and replaces
manager_sysctl_ipv6_enabled() with it.

(cherry picked from commit bafa9641446852f7fa15ca12d08a223d345c78ea)

networkd fix link_up 12505.patch | (download)

src/network/networkd-link.c | 15 15 + 0 - 0 !
1 file changed, 15 insertions(+)

 networkd: fix link_up() (#12505)

Fillup IFLA_INET6_ADDR_GEN_MODE while we do link_up.

Fixes the following error:
```
dummy-test: Could not bring up interface: Invalid argument
```

After reading the kernel code when we do a link up
```
net/core/rtnetlink.c
IFLA_AF_SPEC
 af_ops->set_link_af(dev, af);
  inet6_set_link_af
   if (tb[IFLA_INET6_ADDR_GEN_MODE])
             Here it looks for IFLA_INET6_ADDR_GEN_MODE
```
Since link up we didn't filling up that it's failing.

Closes #12504.

(cherry picked from commit 4eb086a38712ea98faf41e075b84555b11b54362)

network do not send ipv6 token to kernel.patch | (download)

src/network/networkd-link.c | 51 6 + 45 - 0 !
1 file changed, 6 insertions(+), 45 deletions(-)

 network: do not send ipv6 token to kernel

We disabled kernel RA support. Then, we should not send
IFLA_INET6_TOKEN.
Thus, we do not need to send IFLA_INET6_ADDR_GEN_MODE twice.

Follow-up for 0e2fdb83bb5e22047e0c7cc058b415d0e93f02cf and
4eb086a38712ea98faf41e075b84555b11b54362.

(cherry picked from commit 9f6e82e6eb3b6e73d66d00d1d6eee60691fb702f)

meson make nologin path build time configurable.patch | (download)

man/nss-mymachines.xml | 4 2 + 2 - 0 !
man/sysusers.d.xml | 4 2 + 2 - 0 !
meson.build | 1 1 + 0 - 0 !
meson_options.txt | 1 1 + 0 - 0 !
src/basic/user-util.c | 4 2 + 2 - 0 !
src/nss-mymachines/nss-mymachines.c | 4 2 + 2 - 0 !
src/nss-systemd/nss-systemd.c | 4 2 + 2 - 0 !
src/sysusers/sysusers.c | 2 1 + 1 - 0 !
src/test/test-user-util.c | 4 2 + 2 - 0 !
test/TEST-21-SYSUSERS/test-1.expected-passwd | 2 1 + 1 - 0 !
test/TEST-21-SYSUSERS/test-10.expected-passwd | 4 2 + 2 - 0 !
test/TEST-21-SYSUSERS/test-11.expected-passwd | 2 1 + 1 - 0 !
test/TEST-21-SYSUSERS/test-12.expected-passwd | 2 1 + 1 - 0 !
test/TEST-21-SYSUSERS/test-2.expected-passwd | 2 1 + 1 - 0 !
test/TEST-21-SYSUSERS/test-3.expected-passwd | 8 4 + 4 - 0 !
test/TEST-21-SYSUSERS/test-4.expected-passwd | 4 2 + 2 - 0 !
test/TEST-21-SYSUSERS/test-5.expected-passwd | 34 17 + 17 - 0 !
test/TEST-21-SYSUSERS/test-6.expected-passwd | 2 1 + 1 - 0 !
test/TEST-21-SYSUSERS/test-7.expected-passwd | 10 5 + 5 - 0 !
test/TEST-21-SYSUSERS/test-8.expected-passwd | 2 1 + 1 - 0 !
test/TEST-21-SYSUSERS/test-9.expected-passwd | 4 2 + 2 - 0 !
test/TEST-21-SYSUSERS/test.sh | 9 8 + 1 - 0 !
22 files changed, 61 insertions(+), 52 deletions(-)

 meson: make nologin path build time configurable

Some distros install nologin as /usr/sbin/nologin, others as
/sbin/nologin.
Since we can't really on merged-usr everywhere (where the path wouldn't
matter), make the path build time configurable via -Dnologin-path=.

Closes #13028

(cherry picked from commit 6db904625d413739c480ddbe7667d3f40acc4ae0)

debian/Use Debian specific config files.patch | (download)

src/basic/time-util.c | 21 19 + 2 - 0 !
src/core/locale-setup.c | 21 21 + 0 - 0 !
src/locale/keymap-util.c | 209 104 + 105 - 0 !
src/timedate/timedated.c | 10 10 + 0 - 0 !
4 files changed, 154 insertions(+), 107 deletions(-)

 use debian specific config files

Use /etc/default/locale instead of /etc/locale.conf for locale settings.

Use /etc/default/keyboard instead of /etc/X11/xorg.conf.d/00-keyboard.conf for
keyboard configuration.

Read/write /etc/timezone if /etc/localtime does not exist.

debian/Bring tmpfiles.d tmp.conf in line with Debian defaul.patch | (download)

tmpfiles.d/tmp.conf | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 bring tmpfiles.d/tmp.conf in line with debian defaults

Closes: #675422

debian/Make run lock tmpfs an API fs.patch | (download)

src/core/mount-setup.c | 2 2 + 0 - 0 !
tmpfiles.d/legacy.conf | 1 0 + 1 - 0 !
2 files changed, 2 insertions(+), 1 deletion(-)

 make /run/lock tmpfs an api fs

The /run/lock directory is world-writable in Debian due to historic
reasons. To avoid user processes filling up /run, we mount a separate
tmpfs for /run/lock. As this directory needs to be available during
early boot, we make it an API fs.

Drop it from tmpfiles.d/legacy.conf to not clobber the permissions.

Closes: #751392

debian/Revert udev network device renaming immediately give.patch | (download)

src/udev/udev-event.c | 51 46 + 5 - 0 !
1 file changed, 46 insertions(+), 5 deletions(-)

 revert "udev: network device renaming - immediately give up if the
 target name isn't available"

This reverts commit 97595710b77aa162ca5e20da57d0a1ed7355eaad.

We need to keep supporting systems with 75-persistent-net-generator.rules
generated names for a while after switching to net.ifnames. Re-apply this old
hack to make the renaming less likely to fail.

debian/Add support for TuxOnIce hibernation.patch | (download)

src/shared/sleep-config.c | 6 6 + 0 - 0 !
1 file changed, 6 insertions(+)

 add support for tuxonice hibernation

systemd does not support non-mainline kernel features so upstream rejected this
patch.
It is however required for systemd integration by tuxonice-userui package.

debian/Re enable journal forwarding to syslog.patch | (download)

man/journald.conf.xml | 2 1 + 1 - 0 !
src/journal/journald-server.c | 1 1 + 0 - 0 !
src/journal/journald.conf | 2 1 + 1 - 0 !
3 files changed, 3 insertions(+), 2 deletions(-)

 re-enable journal forwarding to syslog

Revert upstream commit 46b131574fdd7d77 for now, until Debian's sysloggers
can/do all read from the journal directly. See

  http://lists.freedesktop.org/archives/systemd-devel/2014-November/025550.html

for details. Once we grow a journal.conf.d/ directory, sysloggers can be moved
to pulling from the journal one by one and disable forwarding again in such a
conf.d snippet.

debian/Don t enable audit by default.patch | (download)

src/journal/journald-audit.c | 5 0 + 5 - 0 !
1 file changed, 5 deletions(-)

 don't enable audit by default

It causes flooding of dmesg and syslog, suppressing actually important
messages.

Don't enable it for now, until a better solution is found:
http://lists.freedesktop.org/archives/systemd-devel/2014-December/026591.html

Bug-Debian: https://bugs.debian.org/773528

debian/Only start logind if dbus is installed.patch | (download)

units/systemd-logind.service.in | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 only start logind if dbus is installed

logind fails to start in environments without dbus, such as LXC containers or
servers. Add a startup condition to avoid the very noisy startup failure.

Part of #772700

debian/fsckd daemon for inter fsckd communication.patch | (download)

man/rules/meson.build | 1 1 + 0 - 0 !
man/systemd-fsckd.service.xml | 162 162 + 0 - 0 !
meson.build | 8 8 + 0 - 0 !
po/POTFILES.in | 1 1 + 0 - 0 !
src/fsckd/fsckd.c | 690 690 + 0 - 0 !
units/meson.build | 2 2 + 0 - 0 !
units/systemd-fsck-root.service.in | 2 2 + 0 - 0 !
units/systemd-fsck@.service.in | 3 2 + 1 - 0 !
units/systemd-fsckd.service.in | 17 17 + 0 - 0 !
units/systemd-fsckd.socket | 15 15 + 0 - 0 !
10 files changed, 900 insertions(+), 1 deletion(-)

 fsckd daemon for inter-fsckd communication

Global logic:
Add systemd-fsckd multiplexer which accepts multiple (via systemd-fsck's
/run/systemd/fsck.progress socket) fsck instances to connect to it and sends
progress report. systemd-fsckd then computes and writes to /dev/console the
number of devices currently being checked and the minimum fsck progress.

Plymouth and user interaction:
Forward the progress to plymouth and support canellation of in progress fsck.
Try to connect and send to plymouth (if running) some checked report progress,
using direct plymouth protocole.

Update message is the following:
fsckd:<num_devices>:<progress>:<string>
* num_devices corresponds to the current number of devices being checked (int)
* progress corresponds to the current minimum percentage of all devices being
  checked (float, from 0 to 100)
* string is a translated message ready to be displayed by the plymouth theme
  displaying the information above. It can be overridden by plymouth themes
  supporting i18n.

Grab in fsckd plymouth watch key Control+C, and propagate this cancel request
to systemd-fsck which will terminate fsck.

Send a message to signal to user what key we are grabbing for fsck cancel.

Message is: fsckd-cancel-msg:<string>
Where string is a translated string ready to be displayed by the plymouth theme
indicating that Control+C can be used to cancel current checks. It can be
overridden (matching only fsckd-cancel-msg prefix) for themes supporting i18n.

Misc:
systemd-fsckd stops on idle when no fsck is connected.
Add man page explaining the plymouth theme protocol, usage of the daemon
as well as the socket activation part. Adapt existing fsck man page.

Note that fsckd had lived in the upstream tree for a while, but was removed.
More information at
http://lists.freedesktop.org/archives/systemd-devel/2015-April/030175.html
-

debian/Skip filesystem check if already done by the initram.patch | (download)

src/fstab-generator/fstab-generator.c | 11 8 + 3 - 0 !
units/systemd-fsck-root.service.in | 1 1 + 0 - 0 !
2 files changed, 9 insertions(+), 3 deletions(-)

 skip filesystem check if already done by the initramfs

Newer versions of initramfs-tools already fsck and mount / and /usr in
the initramfs. Skip the filesystem check in this case.

Based on a previous patch by Michael Biebl <biebl@debian.org>.

Closes: #782522
Closes: #810748

debian/Revert core one step back again for nspawn we actual.patch | (download)

src/core/unit.c | 11 1 + 10 - 0 !
1 file changed, 1 insertion(+), 10 deletions(-)

 revert "core: one step back again,
 for nspawn we actually can't wait for cgroups running empty since systemd
 will get exactly zero notifications about it"

This reverts commit 743970d2ea6d08aa7c7bff8220f6b7702f2b1db7.

Bug-Debian: https://bugs.debian.org/784720
Bug-Ubuntu: https://launchpad.net/bugs/1448259
Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1141137

debian/Revert core set RLIMIT_CORE to unlimited by default.patch | (download)

src/core/main.c | 2 0 + 2 - 0 !
sysctl.d/50-coredump.conf.in | 2 1 + 1 - 0 !
2 files changed, 1 insertion(+), 3 deletions(-)

 revert "core: set rlimit_core to unlimited by default"

Partially revert commit 15a900327ab as this completely breaks core dumps
without systemd-coredump. It's also contradicting core(8), and it's not
systemd's place to redefine the kernel definitions of core files.

Commit bdfd7b2c now honours the process' RLIMIT_CORE for systemd-coredump. This
isn't what RLIMIT_CORE is supposed to do (it limits the size of the core
*file*, but the kernel deliberately ignores it for piping), so set a static
2^63 core size limit for systemd-coredump to go back to the previous behaviour
(otherwise the change above would break systemd-coredump).

Bug-Debian: https://bugs.debian.org/815020

debian/Revert core enable TasksMax for all services by default a.patch | (download)

man/systemd-system.conf.xml | 3 1 + 2 - 0 !
src/core/system.conf.in | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 3 deletions(-)

 revert "core: enable tasksmax= for all services by default,
 and set it to 512"

This reverts commit 9ded9cd14cc03c67291b10a5c42ce5094ba0912f.

Introducing a default limit on number of threads broke a lot of software which
regularly needs more, such as MySQL and RabbitMQ, or services that spawn off an
indefinite number of subtasks that are not in a scope, like LXC or cron.

15% is way too much for most "simple" services, and it's too little for others
such as the ones mentioned above. There is also no particular rationale about
any particular global limit, so even if we'd bump it higher we'd just make the
limit even less useful while still breaking software.

It is both much safer and also much more effective in terms of guarding against
berserk programs/bugs/unintended fork bombs etc. to set limits in units
individually. Once someone looks at one, this is then a great time to also flip
on the other resource and privilege limitations that systemd offers.

Bug: https://github.com/systemd/systemd/issues/3211
Bug-Debian: https://bugs.debian.org/823530
Bug-Ubuntu: https://launchpad.net/bugs/1578080

debian/Let graphical session pre.target be manually started.patch | (download)

units/user/graphical-session-pre.target | 1 0 + 1 - 0 !
1 file changed, 1 deletion(-)

 let graphical-session-pre.target be manually started

This is needed until https://github.com/systemd/systemd/issues/3750 is fixed.

debian/Add env variable for machine ID path.patch | (download)

src/libsystemd/sd-id128/sd-id128.c | 2 1 + 1 - 0 !
src/test/test-fs-util.c | 11 7 + 4 - 0 !
2 files changed, 8 insertions(+), 5 deletions(-)

 add env variable for machine id path

During package build, in minimal chroots, or other systems which do not already
have an /etc/machine-id we get six test failures. Introduce a
$SYSTEMD_MACHINE_ID_PATH environment variable which can specify a location
other than /etc/machine-id, so that the unit tests are independent from the
environment.

Also adjust test-fs-util to not assume that /etc/machine-id exists. Use
/etc/passwd instead which is created by base-files.

Closes: #851445

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=62344

debian/Drop seccomp system call filter for udev.patch | (download)

units/systemd-udevd.service.in | 2 0 + 2 - 0 !
1 file changed, 2 deletions(-)

 drop seccomp system call filter for udev

The seccomp based system call whitelist requires at least systemd 239 to
be the active init and during a dist-upgrade we can't guarantee that
systemd has been fully configured before udev is restarted.

This partially reverts upstream commit
ee8f26180d01e3ddd4e5f20b03b81e5e737657ae.

Once buster is released, this patch can be dropped.

Closes: #903224