From 5428b6e479985d0e3394bb13b0ca5f5d360ba089 Mon Sep 17 00:00:00 2001 From: Anita Zhang Date: Apr 01 2021 02:18:29 +0000 Subject: 247.3-5: backports to suppress logging - Backport PR#18621 (Ignore attempts at hidepid and subset for older kernels) - Downgrade sysv-generator warning about missing native systemd unit --- diff --git a/SOURCES/0001-sysv-generator-downgrade-log-warning-about-autogener.patch b/SOURCES/0001-sysv-generator-downgrade-log-warning-about-autogener.patch new file mode 100644 index 0000000..9f87fef --- /dev/null +++ b/SOURCES/0001-sysv-generator-downgrade-log-warning-about-autogener.patch @@ -0,0 +1,30 @@ +From 0c21535392bf6296d213c35fd1a0b0bc89dbddb3 Mon Sep 17 00:00:00 2001 +From: Anita Zhang +Date: Wed, 31 Mar 2021 14:04:09 -0700 +Subject: [PATCH] sysv-generator: downgrade log warning about autogenerated to + info + +--- + src/sysv-generator/sysv-generator.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/sysv-generator/sysv-generator.c b/src/sysv-generator/sysv-generator.c +index 8c7aef23c3..89599a69ee 100644 +--- a/src/sysv-generator/sysv-generator.c ++++ b/src/sysv-generator/sysv-generator.c +@@ -786,9 +786,9 @@ static int enumerate_sysv(const LookupPaths *lp, Hashmap *all_services) { + if (!fpath) + return log_oom(); + +- log_warning("SysV service '%s' lacks a native systemd unit file. " +- "Automatically generating a unit file for compatibility. " +- "Please update package to include a native systemd unit file, in order to make it more safe and robust.", fpath); ++ log_info("SysV service '%s' lacks a native systemd unit file. " ++ "Automatically generating a unit file for compatibility. " ++ "Please update package to include a native systemd unit file, in order to make it more safe and robust.", fpath); + + service = new(SysvStub, 1); + if (!service) +-- +2.30.2 + diff --git a/SOURCES/18621-fb.patch b/SOURCES/18621-fb.patch new file mode 100644 index 0000000..9bd802a --- /dev/null +++ b/SOURCES/18621-fb.patch @@ -0,0 +1,90 @@ +From 0762f129c6a9c7bbdb5d575c486d5cf4f7fdae8d Mon Sep 17 00:00:00 2001 +From: Richard Purdie +Date: Tue, 16 Feb 2021 12:17:36 +0000 +Subject: [PATCH] proc: dont trigger mount error with invalid options on old + kernels + +As of commit 4e39995371738b04d98d27b0d34ea8fe09ec9fab ("core: introduce +ProtectProc= and ProcSubset= to expose hidepid= and subset= procfs +mount options") kernels older than v5.8 generate multple warnings at +boot, as seen in this Yocto build from today: + + qemux86-64 login: root + [ 65.829009] proc: Bad value for 'hidepid' + root@qemux86-64:~# dmesg|grep proc: + [ 16.990706] proc: Bad value for 'hidepid' + [ 28.060178] proc: Bad value for 'hidepid' + [ 28.874229] proc: Bad value for 'hidepid' + [ 32.685107] proc: Bad value for 'hidepid' + [ 65.829009] proc: Bad value for 'hidepid' + root@qemux86-64:~# + +We see reports of the issue as in general its hard to someone to tell +the difference between an error in dmesg which they should worry about and +one that is harmless. This adds support burden to developers so Yocto +Project has added this patch. + +The commit that triggers this is systemd v247-rc1~378^2~3 -- so any +systemd 247 and above plus kernel v5.7 or older will need this. + +As noted in https://github.com/systemd/systemd/issues/16896 +it is possible changes could be backported to different kernel versions +so the test isn't 100% foolproof but does give better results than a +continual stream of bug reports. + +Signed-off-by: Richard Purdie + +Changes from Anita Zhang +- Use 5.6.13-0_fbk9 version comparison for FB build +--- + src/core/namespace.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +diff --git a/src/core/namespace.c b/src/core/namespace.c +index d47531408b..8be8352a8e 100644 +--- a/src/core/namespace.c ++++ b/src/core/namespace.c +@@ -4,7 +4,9 @@ + #include + #include + #include ++#include + #include ++#include + #include + #include + +@@ -1018,12 +1020,28 @@ static int mount_procfs(const MountEntry *m, const NamespaceInfo *ns_info) { + _cleanup_free_ char *opts = NULL; + const char *entry_path; + int r, n; ++ struct utsname uts; ++ bool old = false; + + assert(m); + assert(ns_info); + +- if (ns_info->protect_proc != PROTECT_PROC_DEFAULT || +- ns_info->proc_subset != PROC_SUBSET_ALL) { ++ /* If uname says that the system is older than v5.6.13-0_fbk9, then the textual hidepid= stuff is not ++ * supported by the kernel, and thus the per-instance hidepid= neither, which means we ++ * really don't want to use it, since it would affect our host's /proc * mount. Hence let's ++ * gracefully fallback to a classic, unrestricted version. */ ++ ++ r = uname(&uts); ++ if (r < 0) ++ return -errno; ++ ++ if (strverscmp(uts.release, "5.6.13-0_fbk9") < 0) { ++ log_debug("Pre v5.6.13-0_fbk9 kernel detected [v%s] - skipping hidepid=", uts.release); ++ old = true; ++ } ++ ++ if (!old && (ns_info->protect_proc != PROTECT_PROC_DEFAULT || ++ ns_info->proc_subset != PROC_SUBSET_ALL)) { + + /* Starting with kernel 5.8 procfs' hidepid= logic is truly per-instance (previously it + * pretended to be per-instance but actually was per-namespace), hence let's make use of it +-- +2.30.2 + diff --git a/SOURCES/18621.patch b/SOURCES/18621.patch new file mode 100644 index 0000000..80bd969 --- /dev/null +++ b/SOURCES/18621.patch @@ -0,0 +1,84 @@ +From c225bc59b8907de11f389bd8efb82155ccde75a7 Mon Sep 17 00:00:00 2001 +From: Richard Purdie +Date: Tue, 16 Feb 2021 12:17:36 +0000 +Subject: [PATCH] proc: dont trigger mount error with invalid options on old + kernels + +As of commit 4e39995371738b04d98d27b0d34ea8fe09ec9fab ("core: introduce +ProtectProc= and ProcSubset= to expose hidepid= and subset= procfs +mount options") kernels older than v5.8 generate multple warnings at +boot, as seen in this Yocto build from today: + + qemux86-64 login: root + [ 65.829009] proc: Bad value for 'hidepid' + root@qemux86-64:~# dmesg|grep proc: + [ 16.990706] proc: Bad value for 'hidepid' + [ 28.060178] proc: Bad value for 'hidepid' + [ 28.874229] proc: Bad value for 'hidepid' + [ 32.685107] proc: Bad value for 'hidepid' + [ 65.829009] proc: Bad value for 'hidepid' + root@qemux86-64:~# + +We see reports of the issue as in general its hard to someone to tell +the difference between an error in dmesg which they should worry about and +one that is harmless. This adds support burden to developers so Yocto +Project has added this patch. + +The commit that triggers this is systemd v247-rc1~378^2~3 -- so any +systemd 247 and above plus kernel v5.7 or older will need this. + +As noted in https://github.com/systemd/systemd/issues/16896 +it is possible changes could be backported to different kernel versions +so the test isn't 100% foolproof but does give better results than a +continual stream of bug reports. + +Signed-off-by: Richard Purdie +--- + src/core/namespace.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +diff --git a/src/core/namespace.c b/src/core/namespace.c +index 4ed0991b56d1..3fa2d4e9d640 100644 +--- a/src/core/namespace.c ++++ b/src/core/namespace.c +@@ -4,7 +4,9 @@ + #include + #include + #include ++#include + #include ++#include + #include + #include + +@@ -881,12 +883,28 @@ static int mount_procfs(const MountEntry *m, const NamespaceInfo *ns_info) { + _cleanup_free_ char *opts = NULL; + const char *entry_path; + int r, n; ++ struct utsname uts; ++ bool old = false; + + assert(m); + assert(ns_info); + +- if (ns_info->protect_proc != PROTECT_PROC_DEFAULT || +- ns_info->proc_subset != PROC_SUBSET_ALL) { ++ /* If uname says that the system is older than v5.8, then the textual hidepid= stuff is not ++ * supported by the kernel, and thus the per-instance hidepid= neither, which means we ++ * really don't want to use it, since it would affect our host's /proc * mount. Hence let's ++ * gracefully fallback to a classic, unrestricted version. */ ++ ++ r = uname(&uts); ++ if (r < 0) ++ return -errno; ++ ++ if (strverscmp(uts.release, "5.8") < 0) { ++ log_debug("Pre v5.8 kernel detected [v%s] - skipping hidepid=", uts.release); ++ old = true; ++ } ++ ++ if (!old && (ns_info->protect_proc != PROTECT_PROC_DEFAULT || ++ ns_info->proc_subset != PROC_SUBSET_ALL)) { + + /* Starting with kernel 5.8 procfs' hidepid= logic is truly per-instance (previously it + * pretended to be per-instance but actually was per-namespace), hence let's make use of it diff --git a/SPECS/systemd.spec b/SPECS/systemd.spec index b45e60c..1541b9a 100644 --- a/SPECS/systemd.spec +++ b/SPECS/systemd.spec @@ -26,7 +26,7 @@ Name: systemd Url: https://www.freedesktop.org/wiki/Software/systemd Version: 247.3 -Release: 5%{?dist} +Release: 6%{?dist} # For a breakdown of the licensing, see README License: LGPLv2+ and MIT and GPLv2+ Summary: System and Service Manager @@ -77,20 +77,28 @@ GIT_DIR=../../src/systemd/.git git diffab -M v233..master@{2017-06-15} -- hwdb/[ Patch0000: https://github.com/systemd/systemd/pull/18211.patch # 17872: Fixes using PrivateUsers=yes with other sandboxing properties Patch0001: https://github.com/systemd/systemd/pull/17872.patch -%if 0%{?facebook} -# 17495: Fixes BPF pinning post-coldplug -Patch0002: https://github.com/systemd/systemd/pull/17495.patch -# 18886: systemd-shutdown logs to /dev/console not stderr -Patch0003: https://github.com/systemd/systemd/pull/18886.patch -%endif # Commit to make #18955 apply cleanly Patch0004: https://github.com/systemd/systemd/commit/fa67d9c0d652dc41574b546f542909e9c8157237.patch #18955: Fixes fstab parsing Patch0005: https://github.com/systemd/systemd/pull/18955.patch +%if 0%{?facebook} +# 17495: Fixes BPF pinning post-coldplug +Patch0101: https://github.com/systemd/systemd/pull/17495.patch +# 18886: systemd-shutdown logs to /dev/console not stderr +Patch0102: https://github.com/systemd/systemd/pull/18886.patch +#18621: FB variant of quieting "proc: Bad value for 'hidepid'" messages +Patch0103: 18621-fb.patch +%else +#18621: Quiet "proc: Bad value for 'hidepid'" messages +Patch0103: https://github.com/systemd/systemd/pull/18621.patch +%endif + # Downstream-only patches (0500–9999) # https://github.com/systemd/systemd/pull/17050 Patch0501: https://github.com/systemd/systemd/pull/17050/commits/f58b96d3e8d1cb0dd3666bc74fa673918b586612.patch +# Downgrade sysv-generator messages from warning to info +Patch0502: 0001-sysv-generator-downgrade-log-warning-about-autogener.patch %ifarch %{ix86} x86_64 aarch64 %global have_gnu_efi 1 @@ -949,6 +957,10 @@ fi %endif %changelog +* Wed Mar 31 2021 Anita Zhang - 247.3-6 +- Backport PR#18621 (Ignore attempts at hidepid and subset for older kernels) +- Downgrade sysv-generator warning about missing native systemd unit + * Wed Mar 31 2021 Davide Cavalca - 247.3-5 - Add selinux subpackage