[meta-oe][PATCH 1/3] systemd: remove 2 obsolete useradds

[meta-oe][PATCH 1/3] systemd: remove 2 obsolete useradds

[Adrian Freihofer]

- Users systemd-journal-remote and systemd-journal-upload are not used by
  systemd anymore. Systemd creates dynamic users for services without
  persistent data.
- Fix start of journal-remote

Signed-off-by: Adrian Freihofer <adrian.freihofer@gmail.com>
---
 meta/recipes-core/systemd/systemd_241.bb | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/meta/recipes-core/systemd/systemd_241.bb b/meta/recipes-core/systemd/systemd_241.bb
index 3a58f44a3b..8e493d5b55 100644
--- a/meta/recipes-core/systemd/systemd_241.bb
+++ b/meta/recipes-core/systemd/systemd_241.bb
@@ -334,9 +334,7 @@ SYSTEMD_PACKAGES = "${@bb.utils.contains('PACKAGECONFIG', 'binfmt', '${PN}-binfm
 SYSTEMD_SERVICE_${PN}-binfmt = "systemd-binfmt.service"
 
 USERADD_PACKAGES = "${PN} ${PN}-extra-utils \
-                    ${@bb.utils.contains('PACKAGECONFIG', 'microhttpd', '${PN}-journal-gateway', '', d)} \
                     ${@bb.utils.contains('PACKAGECONFIG', 'microhttpd', '${PN}-journal-remote', '', d)} \
-                    ${@bb.utils.contains('PACKAGECONFIG', 'journal-upload', '${PN}-journal-upload', '', d)} \
 "
 GROUPADD_PARAM_${PN} = "-r systemd-journal"
 USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'coredump', '--system -d / -M --shell /bin/nologin systemd-coredump;', '', d)}"
@@ -345,9 +343,7 @@ USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'polkit', '--syste
 USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'resolved', '--system -d / -M --shell /bin/nologin systemd-resolve;', '', d)}"
 USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'timesyncd', '--system -d / -M --shell /bin/nologin systemd-timesync;', '', d)}"
 USERADD_PARAM_${PN}-extra-utils = "--system -d / -M --shell /bin/nologin systemd-bus-proxy"
-USERADD_PARAM_${PN}-journal-gateway = "--system -d / -M --shell /bin/nologin systemd-journal-gateway"
 USERADD_PARAM_${PN}-journal-remote = "--system -d / -M --shell /bin/nologin systemd-journal-remote"
-USERADD_PARAM_${PN}-journal-upload = "--system -d / -M --shell /bin/nologin systemd-journal-upload"
 
 FILES_${PN}-analyze = "${bindir}/systemd-analyze"
 
@@ -401,7 +397,7 @@ FILES_${PN}-journal-remote = "${rootlibexecdir}/systemd/systemd-journal-remote \
                               ${systemd_system_unitdir}/systemd-journal-remote.service \
                               ${systemd_system_unitdir}/systemd-journal-remote.socket \
                              "
-SYSTEMD_SERVICE_${PN}-remote = "systemd-journal-remote.socket"
+SYSTEMD_SERVICE_${PN}-journal-remote = "systemd-journal-remote.socket"
 
 
 FILES_${PN}-container = "${sysconfdir}/dbus-1/system.d/org.freedesktop.import1.conf \
-- 
2.20.1

[meta-oe][PATCH 2/3] systemd: container remove rrecommend

[Adrian Freihofer]

nspawn, journal-upload, journal-remote and journal-gatewayd are
completely independent from each other. There is hardly any reason
why the user should install all three journal services when
installing nspawn. Especially since these services are network
clients or servers, they should not be installed automatically.

Signed-off-by: Adrian Freihofer <adrian.freihofer@gmail.com>
---
 meta/recipes-core/systemd/systemd_241.bb | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/meta/recipes-core/systemd/systemd_241.bb b/meta/recipes-core/systemd/systemd_241.bb
index 8e493d5b55..688cc0608e 100644
--- a/meta/recipes-core/systemd/systemd_241.bb
+++ b/meta/recipes-core/systemd/systemd_241.bb
@@ -431,12 +431,6 @@ FILES_${PN}-container = "${sysconfdir}/dbus-1/system.d/org.freedesktop.import1.c
                          ${datadir}/polkit-1/actions/org.freedesktop.machine1.policy \
                         "
 
-RRECOMMENDS_${PN}-container += "\
-                         ${PN}-journal-upload \
-                         ${PN}-journal-remote \
-                         ${PN}-journal-gatewayd \
-                        "
-
 FILES_${PN}-extra-utils = "\
                         ${base_bindir}/systemd-escape \
                         ${base_bindir}/systemd-inhibit \
-- 
2.20.1

[meta-oe][PATCH 3/3] runqemu: support non-bootable wic images

[Adrian Freihofer]

wic images are treated as vmtype images including a bootloader. The new
image type wic-nb (non-bootable) is handled as fstype image.
In comparison to existing fstype images such as ext4 wic-nb images
support more than one partition.
This is particularly useful in combination with -machine virt where the
bootloader as well as the devicetree is provided by Qemu.

Example:
QB_DEFAULT_FSTYPE = "wic-nb"
QB_KERNEL_ROOT = "/dev/vda1"
QB_SYSTEM_NAME = "qemu-system-aarch64"
QB_MACHINE = "-machine virt"
QB_KERNEL_CMDLINE_APPEND = "console=ttyAMA0"
QB_SERIAL_OPT = ""
...

Signed-off-by: Adrian Freihofer <adrian.freihofer@gmail.com>
---
 scripts/runqemu | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/scripts/runqemu b/scripts/runqemu
index a4fc606e50..2cf68c834c 100755
--- a/scripts/runqemu
+++ b/scripts/runqemu
@@ -196,7 +196,8 @@ class BaseConfig(object):
         self.bitbake_e = ''
         self.snapshot = False
         self.fstypes = ('ext2', 'ext3', 'ext4', 'jffs2', 'nfs', 'btrfs',
-                        'cpio.gz', 'cpio', 'ramfs', 'tar.bz2', 'tar.gz')
+                        'cpio.gz', 'cpio', 'ramfs', 'tar.bz2', 'tar.gz',
+                        'wic-nb')
         self.vmtypes = ('hddimg', 'hdddirect', 'wic', 'wic.vmdk',
                         'wic.qcow2', 'wic.vdi', 'iso')
         self.network_device = "-device e1000,netdev=net0,mac=@MAC@"
@@ -560,14 +561,19 @@ class BaseConfig(object):
         if self.fstype == 'nfs':
             return
 
+        # Handle wic non-bootable images
+        rootfs_suffix = self.fstype
+        if rootfs_suffix == 'wic-nb':
+            rootfs_suffix = 'wic'
+
         if self.rootfs and not os.path.exists(self.rootfs):
             # Lazy rootfs
             self.rootfs = "%s/%s-%s.%s" % (self.get('DEPLOY_DIR_IMAGE'),
                     self.rootfs, self.get('MACHINE'),
-                    self.fstype)
+                    rootfs_suffix)
         elif not self.rootfs:
-            cmd_name = '%s/%s*.%s' % (self.get('DEPLOY_DIR_IMAGE'), self.get('IMAGE_NAME'), self.fstype)
-            cmd_link = '%s/%s*.%s' % (self.get('DEPLOY_DIR_IMAGE'), self.get('IMAGE_LINK_NAME'), self.fstype)
+            cmd_name = '%s/%s*.%s' % (self.get('DEPLOY_DIR_IMAGE'), self.get('IMAGE_NAME'), rootfs_suffix)
+            cmd_link = '%s/%s*.%s' % (self.get('DEPLOY_DIR_IMAGE'), self.get('IMAGE_LINK_NAME'), rootfs_suffix)
             cmds = (cmd_name, cmd_link)
             self.rootfs = get_first_file(cmds)
             if not self.rootfs:
-- 
2.20.1

Re: [meta-oe][PATCH 1/3] systemd: remove 2 obsolete useradds

[ChenQi]

On 04/14/2019 09:24 PM, Adrian Freihofer wrote:
> - Users systemd-journal-remote and systemd-journal-upload are not used by

I guess you mean 'systemd-journal-gateway'?
Anyway, I have some concern about this change.

Adding these users is not supposed to cause any runtime problem, as if 
the user has already exists, DynamicUser mechanism just does not try to 
create one.
I also can recall the systemd-timesync once had DynamicUser=yes, but 
then removed such setting.
So if there is no compelling reason (security?) why we should use 
DynamicUser, let's leave these two users there.

Best Regards,
Chen Qi

>    systemd anymore. Systemd creates dynamic users for services without
>    persistent data.
> - Fix start of journal-remote
>
> Signed-off-by: Adrian Freihofer <adrian.freihofer@gmail.com>
> ---
>   meta/recipes-core/systemd/systemd_241.bb | 6 +-----
>   1 file changed, 1 insertion(+), 5 deletions(-)
>
> diff --git a/meta/recipes-core/systemd/systemd_241.bb b/meta/recipes-core/systemd/systemd_241.bb
> index 3a58f44a3b..8e493d5b55 100644
> --- a/meta/recipes-core/systemd/systemd_241.bb
> +++ b/meta/recipes-core/systemd/systemd_241.bb
> @@ -334,9 +334,7 @@ SYSTEMD_PACKAGES = "${@bb.utils.contains('PACKAGECONFIG', 'binfmt', '${PN}-binfm
>   SYSTEMD_SERVICE_${PN}-binfmt = "systemd-binfmt.service"
>   
>   USERADD_PACKAGES = "${PN} ${PN}-extra-utils \
> -                    ${@bb.utils.contains('PACKAGECONFIG', 'microhttpd', '${PN}-journal-gateway', '', d)} \
>                       ${@bb.utils.contains('PACKAGECONFIG', 'microhttpd', '${PN}-journal-remote', '', d)} \
> -                    ${@bb.utils.contains('PACKAGECONFIG', 'journal-upload', '${PN}-journal-upload', '', d)} \
>   "
>   GROUPADD_PARAM_${PN} = "-r systemd-journal"
>   USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'coredump', '--system -d / -M --shell /bin/nologin systemd-coredump;', '', d)}"
> @@ -345,9 +343,7 @@ USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'polkit', '--syste
>   USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'resolved', '--system -d / -M --shell /bin/nologin systemd-resolve;', '', d)}"
>   USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'timesyncd', '--system -d / -M --shell /bin/nologin systemd-timesync;', '', d)}"
>   USERADD_PARAM_${PN}-extra-utils = "--system -d / -M --shell /bin/nologin systemd-bus-proxy"
> -USERADD_PARAM_${PN}-journal-gateway = "--system -d / -M --shell /bin/nologin systemd-journal-gateway"
>   USERADD_PARAM_${PN}-journal-remote = "--system -d / -M --shell /bin/nologin systemd-journal-remote"
> -USERADD_PARAM_${PN}-journal-upload = "--system -d / -M --shell /bin/nologin systemd-journal-upload"
>   
>   FILES_${PN}-analyze = "${bindir}/systemd-analyze"
>   
> @@ -401,7 +397,7 @@ FILES_${PN}-journal-remote = "${rootlibexecdir}/systemd/systemd-journal-remote \
>                                 ${systemd_system_unitdir}/systemd-journal-remote.service \
>                                 ${systemd_system_unitdir}/systemd-journal-remote.socket \
>                                "
> -SYSTEMD_SERVICE_${PN}-remote = "systemd-journal-remote.socket"
> +SYSTEMD_SERVICE_${PN}-journal-remote = "systemd-journal-remote.socket"
>   
>   
>   FILES_${PN}-container = "${sysconfdir}/dbus-1/system.d/org.freedesktop.import1.conf \

Re: [meta-oe][PATCH 1/3] systemd: remove 2 obsolete useradds

[adrian.freihofer]

On Mon, 2019-04-15 at 09:40 +0800, ChenQi wrote:
> On 04/14/2019 09:24 PM, Adrian Freihofer wrote:
> > - Users systemd-journal-remote and systemd-journal-upload are not
> > used by
> 
> I guess you mean 'systemd-journal-gateway'?
You are right. I will send a V2 if I can convince you of this change
after all. 
> Anyway, I have some concern about this change.
> 
> Adding these users is not supposed to cause any runtime problem, as
> if 
> the user has already exists, DynamicUser mechanism just does not try
> to 
> create one.
> I also can recall the systemd-timesync once had DynamicUser=yes, but 
> then removed such setting.
> So if there is no compelling reason (security?) why we should use 
> DynamicUser, let's leave these two users there.
> 
> Best Regards,
> Chen Qi
I agree with you, it works as it is. That's a strong argument.

However, traditional Unix user IDs are not ideal for embedded systems.
Especially with an image based firmware update and daemons writing to
persistent storage, traditional Unix user IDs are problematic.
With useradd-staticids enabled this problem can be addressed. But we
have to maintain static user IDs manually.
With this patch applied systemd would just generate the user IDs in any
case (static or dynamic users) without manual interaction.
Here we have the chance to get rid of two user IDs, which seems to me
to be an advantage anyway.

Another, weaker argument: Static user IDs are a rare ressource.

Are you still against this change or should I send V2 with fixed commit
comment of this third patch?

Best Regards,
Adrian
> 
> >    systemd anymore. Systemd creates dynamic users for services
> > without
> >    persistent data.
> > - Fix start of journal-remote
> > 
> > Signed-off-by: Adrian Freihofer <adrian.freihofer@gmail.com>
> > ---
> >   meta/recipes-core/systemd/systemd_241.bb | 6 +-----
> >   1 file changed, 1 insertion(+), 5 deletions(-)
> > 
> > diff --git a/meta/recipes-core/systemd/systemd_241.bb
> > b/meta/recipes-core/systemd/systemd_241.bb
> > index 3a58f44a3b..8e493d5b55 100644
> > --- a/meta/recipes-core/systemd/systemd_241.bb
> > +++ b/meta/recipes-core/systemd/systemd_241.bb
> > @@ -334,9 +334,7 @@ SYSTEMD_PACKAGES = "${@bb.utils.contains('PACKA
> > GECONFIG', 'binfmt', '${PN}-binfm
> >   SYSTEMD_SERVICE_${PN}-binfmt = "systemd-binfmt.service"
> >   
> >   USERADD_PACKAGES = "${PN} ${PN}-extra-utils \
> > -                    ${@bb.utils.contains('PACKAGECONFIG',
> > 'microhttpd', '${PN}-journal-gateway', '', d)} \
> >                       ${@bb.utils.contains('PACKAGECONFIG',
> > 'microhttpd', '${PN}-journal-remote', '', d)} \
> > -                    ${@bb.utils.contains('PACKAGECONFIG',
> > 'journal-upload', '${PN}-journal-upload', '', d)} \
> >   "
> >   GROUPADD_PARAM_${PN} = "-r systemd-journal"
> >   USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG',
> > 'coredump', '--system -d / -M --shell /bin/nologin systemd-
> > coredump;', '', d)}"
> > @@ -345,9 +343,7 @@ USERADD_PARAM_${PN} += "${@bb.utils.contains('P
> > ACKAGECONFIG', 'polkit', '--syste
> >   USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG',
> > 'resolved', '--system -d / -M --shell /bin/nologin systemd-
> > resolve;', '', d)}"
> >   USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG',
> > 'timesyncd', '--system -d / -M --shell /bin/nologin systemd-
> > timesync;', '', d)}"
> >   USERADD_PARAM_${PN}-extra-utils = "--system -d / -M --shell
> > /bin/nologin systemd-bus-proxy"
> > -USERADD_PARAM_${PN}-journal-gateway = "--system -d / -M --shell
> > /bin/nologin systemd-journal-gateway"
> >   USERADD_PARAM_${PN}-journal-remote = "--system -d / -M --shell
> > /bin/nologin systemd-journal-remote"
> > -USERADD_PARAM_${PN}-journal-upload = "--system -d / -M --shell
> > /bin/nologin systemd-journal-upload"
> >   
> >   FILES_${PN}-analyze = "${bindir}/systemd-analyze"
> >   
> > @@ -401,7 +397,7 @@ FILES_${PN}-journal-remote =
> > "${rootlibexecdir}/systemd/systemd-journal-remote \
> >                                 ${systemd_system_unitdir}/systemd-
> > journal-remote.service \
> >                                 ${systemd_system_unitdir}/systemd-
> > journal-remote.socket \
> >                                "
> > -SYSTEMD_SERVICE_${PN}-remote = "systemd-journal-remote.socket"
> > +SYSTEMD_SERVICE_${PN}-journal-remote = "systemd-journal-
> > remote.socket"
> >   
> >   
> >   FILES_${PN}-container = "${sysconfdir}/dbus-
> > 1/system.d/org.freedesktop.import1.conf \
> 
> 

Re: [meta-oe][PATCH 1/3] systemd: remove 2 obsolete useradds

[ChenQi]

On 04/16/2019 05:49 AM, adrian.freihofer@gmail.com wrote:
> On Mon, 2019-04-15 at 09:40 +0800, ChenQi wrote:
>> On 04/14/2019 09:24 PM, Adrian Freihofer wrote:
>>> - Users systemd-journal-remote and systemd-journal-upload are not
>>> used by
>> I guess you mean 'systemd-journal-gateway'?
> You are right. I will send a V2 if I can convince you of this change
> after all.
>> Anyway, I have some concern about this change.
>>
>> Adding these users is not supposed to cause any runtime problem, as
>> if
>> the user has already exists, DynamicUser mechanism just does not try
>> to
>> create one.
>> I also can recall the systemd-timesync once had DynamicUser=yes, but
>> then removed such setting.
>> So if there is no compelling reason (security?) why we should use
>> DynamicUser, let's leave these two users there.
>>
>> Best Regards,
>> Chen Qi
> I agree with you, it works as it is. That's a strong argument.
>
> However, traditional Unix user IDs are not ideal for embedded systems.
> Especially with an image based firmware update and daemons writing to
> persistent storage, traditional Unix user IDs are problematic.
> With useradd-staticids enabled this problem can be addressed. But we
> have to maintain static user IDs manually.
> With this patch applied systemd would just generate the user IDs in any
> case (static or dynamic users) without manual interaction.
> Here we have the chance to get rid of two user IDs, which seems to me
> to be an advantage anyway.
>
> Another, weaker argument: Static user IDs are a rare ressource.
>
> Are you still against this change or should I send V2 with fixed commit
> comment of this third patch?

I'm not against this change.
I don't use journal-gateway/journal-upload, so I think you have more 
real-world experience.
V2 with the fixed commit is OK.

Best Regards,
Chen Qi


> Best Regards,
> Adrian
>>>     systemd anymore. Systemd creates dynamic users for services
>>> without
>>>     persistent data.
>>> - Fix start of journal-remote
>>>
>>> Signed-off-by: Adrian Freihofer <adrian.freihofer@gmail.com>
>>> ---
>>>    meta/recipes-core/systemd/systemd_241.bb | 6 +-----
>>>    1 file changed, 1 insertion(+), 5 deletions(-)
>>>
>>> diff --git a/meta/recipes-core/systemd/systemd_241.bb
>>> b/meta/recipes-core/systemd/systemd_241.bb
>>> index 3a58f44a3b..8e493d5b55 100644
>>> --- a/meta/recipes-core/systemd/systemd_241.bb
>>> +++ b/meta/recipes-core/systemd/systemd_241.bb
>>> @@ -334,9 +334,7 @@ SYSTEMD_PACKAGES = "${@bb.utils.contains('PACKA
>>> GECONFIG', 'binfmt', '${PN}-binfm
>>>    SYSTEMD_SERVICE_${PN}-binfmt = "systemd-binfmt.service"
>>>    
>>>    USERADD_PACKAGES = "${PN} ${PN}-extra-utils \
>>> -                    ${@bb.utils.contains('PACKAGECONFIG',
>>> 'microhttpd', '${PN}-journal-gateway', '', d)} \
>>>                        ${@bb.utils.contains('PACKAGECONFIG',
>>> 'microhttpd', '${PN}-journal-remote', '', d)} \
>>> -                    ${@bb.utils.contains('PACKAGECONFIG',
>>> 'journal-upload', '${PN}-journal-upload', '', d)} \
>>>    "
>>>    GROUPADD_PARAM_${PN} = "-r systemd-journal"
>>>    USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG',
>>> 'coredump', '--system -d / -M --shell /bin/nologin systemd-
>>> coredump;', '', d)}"
>>> @@ -345,9 +343,7 @@ USERADD_PARAM_${PN} += "${@bb.utils.contains('P
>>> ACKAGECONFIG', 'polkit', '--syste
>>>    USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG',
>>> 'resolved', '--system -d / -M --shell /bin/nologin systemd-
>>> resolve;', '', d)}"
>>>    USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG',
>>> 'timesyncd', '--system -d / -M --shell /bin/nologin systemd-
>>> timesync;', '', d)}"
>>>    USERADD_PARAM_${PN}-extra-utils = "--system -d / -M --shell
>>> /bin/nologin systemd-bus-proxy"
>>> -USERADD_PARAM_${PN}-journal-gateway = "--system -d / -M --shell
>>> /bin/nologin systemd-journal-gateway"
>>>    USERADD_PARAM_${PN}-journal-remote = "--system -d / -M --shell
>>> /bin/nologin systemd-journal-remote"
>>> -USERADD_PARAM_${PN}-journal-upload = "--system -d / -M --shell
>>> /bin/nologin systemd-journal-upload"
>>>    
>>>    FILES_${PN}-analyze = "${bindir}/systemd-analyze"
>>>    
>>> @@ -401,7 +397,7 @@ FILES_${PN}-journal-remote =
>>> "${rootlibexecdir}/systemd/systemd-journal-remote \
>>>                                  ${systemd_system_unitdir}/systemd-
>>> journal-remote.service \
>>>                                  ${systemd_system_unitdir}/systemd-
>>> journal-remote.socket \
>>>                                 "
>>> -SYSTEMD_SERVICE_${PN}-remote = "systemd-journal-remote.socket"
>>> +SYSTEMD_SERVICE_${PN}-journal-remote = "systemd-journal-
>>> remote.socket"
>>>    
>>>    
>>>    FILES_${PN}-container = "${sysconfdir}/dbus-
>>> 1/system.d/org.freedesktop.import1.conf \
>>
>