rpms/systemd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

systemd-239-82.19

Browse Source 
Resolves: RHEL-85520, RHEL-112550
This commit is contained in:
Jan Macku 2026-07-27 09:42:11 +02:00
parent 6a2d6f8427
commit 753124574a
3 changed files with 218 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
1084-user-sessions-do-not-remove-etc-nologin.patch Normal file
View File

@ -0,0 +1,77 @@
From fd2ed473d872003e19179f734a94c07112aa1ebf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Sat, 25 Mar 2023 11:34:47 +0100
Subject: [PATCH] user-sessions: do not remove /etc/nologin
pam_nologin looks for /etc/nologin and /run/nologin.
user-sessions creates (and removes) /run/nologin, but also removes
/etc/nologin. (This behaviour is unchanged since the introduction
of the binary in e92787416c691c3f34f47349e5eae3fa68eae856.)
By not removing pam_nologin we fully drop compatibility with PAM < 1.1.
This has the advantage that now /etc/nologin can be used by administrator to
disable user logins, e.g. for extended maintanance. We already specified
PAM >= 1.1.2 as dependency, so this was already covered.
The makes the code match the man page.
Fixes #26965.
(cherry picked from commit a78413baae0e999384b535d327203ebf417b1e24)
Resolves: RHEL-85520
---
src/basic/fileio-label.c | 12 +++++++++---
src/user-sessions/user-sessions.c | 7 ++-----
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/src/basic/fileio-label.c b/src/basic/fileio-label.c
index 5f8d8af9af..0b52657757 100644
--- a/src/basic/fileio-label.c
+++ b/src/basic/fileio-label.c
@@ -55,9 +55,15 @@ int fopen_temporary_label(const char *target,
int create_shutdown_run_nologin_or_warn(void) {
int r;
- /* This is used twice: once in systemd-user-sessions.service, in order to block logins when we actually go
- * down, and once in systemd-logind.service when shutdowns are scheduled, and logins are to be turned off a bit
- * in advance. We use the same wording of the message in both cases. */
+ /* This is used twice: once in systemd-user-sessions.service, in order to block logins when we
+ * actually go down, and once in systemd-logind.service when shutdowns are scheduled, and logins are
+ * to be turned off a bit in advance. We use the same wording of the message in both cases.
+ *
+ * Traditionally, there was only /etc/nologin, and we managed that. Then, in PAM 1.1
+ * support for /run/nologin was added as alternative
+ * (https://github.com/linux-pam/linux-pam/commit/e9e593f6ddeaf975b7fe8446d184e6bc387d450b).
+ * 13 years later we stopped managing /etc/nologin, leaving it for the administrator to manage.
+ */
r = write_string_file_atomic_label("/run/nologin",
"System is going down. Unprivileged users are not permitted to log in anymore. "
diff --git a/src/user-sessions/user-sessions.c b/src/user-sessions/user-sessions.c
index 89c4b0005d..8ac4826f83 100644
--- a/src/user-sessions/user-sessions.c
+++ b/src/user-sessions/user-sessions.c
@@ -12,7 +12,7 @@
#include "util.h"
int main(int argc, char*argv[]) {
- int r, k;
+ int r;
if (argc != 2) {
log_error("This program requires one argument.");
@@ -27,12 +27,9 @@ int main(int argc, char*argv[]) {
mac_selinux_init();
+ /* We only touch /run/nologin. See create_shutdown_run_nologin_or_warn() for details. */
if (streq(argv[1], "start")) {
r = unlink_or_warn("/run/nologin");
- k = unlink_or_warn("/etc/nologin");
- if (k < 0 && r >= 0)
- r = k;
-
} else if (streq(argv[1], "stop"))
r = create_shutdown_run_nologin_or_warn();
else {

134
1085-core-allow-manager_serialize-to-fail-correctly.patch Normal file
View File

@ -0,0 +1,134 @@
From d489e6c6315d20f695d6ed269de15fb3c204d082 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 9 Oct 2018 16:45:33 +0200
Subject: [PATCH] core: allow manager_serialize() to fail correctly
If manager_serialize() fails in the middle (which it hopefully doesn't)
make sure to fix up m->n_reloading correctly again so that we don't
leave it > 0 when it really shouldn't be.
(cherry picked from commit 4daf832afaeac471085e56445a05218217bf5107)
Resolves: RHEL-112550
---
src/core/manager.c | 56 +++++++++++++++++++++++++++++-----------------
1 file changed, 35 insertions(+), 21 deletions(-)
diff --git a/src/core/manager.c b/src/core/manager.c
index f242f0cc00..406dad07b2 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -3099,7 +3099,12 @@ int manager_open_serialization(Manager *m, FILE **_f) {
return 0;
}
-int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) {
+int manager_serialize(
+ Manager *m,
+ FILE *f,
+ FDSet *fds,
+ bool switching_root) {
+
ManagerTimestamp q;
const char *t;
Iterator i;
@@ -3145,8 +3150,10 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) {
int copy;
copy = fdset_put_dup(fds, m->notify_fd);
- if (copy < 0)
- return copy;
+ if (copy < 0) {
+ r = copy;
+ goto finish;
+ }
fprintf(f, "notify-fd=%i\n", copy);
fprintf(f, "notify-socket=%s\n", m->notify_socket);
@@ -3156,8 +3163,10 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) {
int copy;
copy = fdset_put_dup(fds, m->cgroups_agent_fd);
- if (copy < 0)
- return copy;
+ if (copy < 0) {
+ r = copy;
+ goto finish;
+ }
fprintf(f, "cgroups-agent-fd=%i\n", copy);
}
@@ -3166,12 +3175,16 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) {
int copy0, copy1;
copy0 = fdset_put_dup(fds, m->user_lookup_fds[0]);
- if (copy0 < 0)
- return copy0;
+ if (copy0 < 0) {
+ r = copy0;
+ goto finish;
+ }
copy1 = fdset_put_dup(fds, m->user_lookup_fds[1]);
- if (copy1 < 0)
- return copy1;
+ if (copy1 < 0) {
+ r = copy1;
+ goto finish;
+ }
fprintf(f, "user-lookup=%i %i\n", copy0, copy1);
}
@@ -3180,14 +3193,14 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) {
r = dynamic_user_serialize(m, f, fds);
if (r < 0)
- return r;
+ goto finish;
manager_serialize_uid_refs(m, f);
manager_serialize_gid_refs(m, f);
r = exec_runtime_serialize(m, f, fds);
if (r < 0)
- return r;
+ goto finish;
(void) fputc('\n', f);
@@ -3200,24 +3213,25 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) {
fputc('\n', f);
r = unit_serialize(u, f, fds, !switching_root);
- if (r < 0) {
- m->n_reloading--;
- return r;
- }
+ if (r < 0)
+ goto finish;
}
- assert(m->n_reloading > 0);
- m->n_reloading--;
-
r = fflush_and_check(f);
if (r < 0)
- return r;
+ goto finish;
r = bus_fdset_add_all(m, fds);
if (r < 0)
- return r;
+ goto finish;
- return 0;
+ r = 0;
+
+finish:
+ assert(m->n_reloading > 0);
+ m->n_reloading--;
+
+ return r;
}
int manager_deserialize(Manager *m, FILE *f, FDSet *fds) {

8
systemd.spec
View File

@ -13,7 +13,7 @@
Name: systemd
Url: http://www.freedesktop.org/wiki/Software/systemd
Version: 239
Release: 82%{?dist}.18
Release: 82%{?dist}.19
# For a breakdown of the licensing, see README
License: LGPLv2+ and MIT and GPLv2+
Summary: System and Service Manager
@ -1133,6 +1133,8 @@ Patch1080: 1080-core-when-a-unit-state-changes-only-propagate-to-job.patch
Patch1081: 1081-core-extend-comments-regarding-coldplug-vs.-catchup.patch
Patch1082: 1082-execute-make-sure-to-call-into-PAM-after-initializin.patch
Patch1083: 1083-pager-also-check-for-SUDO_UID.patch
Patch1084: 1084-user-sessions-do-not-remove-etc-nologin.patch
Patch1085: 1085-core-allow-manager_serialize-to-fail-correctly.patch
%ifarch %{ix86} x86_64 aarch64
%global have_gnu_efi 1
@ -1759,6 +1761,10 @@ fi
%files tests -f .file-list-tests
%changelog
* Mon Jul 27 2026 systemd maintenance team <systemd-maint@redhat.com> - 239-82.19
- user-sessions: do not remove /etc/nologin (RHEL-85520)
- core: allow manager_serialize() to fail correctly (RHEL-112550)
* Tue Jul 21 2026 systemd maintenance team <systemd-maint@redhat.com> - 239-82.18
- execute: make sure to call into PAM after initializing resource limits (RHEL-5986)
- pager: also check for $SUDO_UID (RHEL-102942)