diff --git a/1084-user-sessions-do-not-remove-etc-nologin.patch b/1084-user-sessions-do-not-remove-etc-nologin.patch new file mode 100644 index 0000000..2eca84a --- /dev/null +++ b/1084-user-sessions-do-not-remove-etc-nologin.patch @@ -0,0 +1,77 @@ +From fd2ed473d872003e19179f734a94c07112aa1ebf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Sat, 25 Mar 2023 11:34:47 +0100 +Subject: [PATCH] user-sessions: do not remove /etc/nologin + +pam_nologin looks for /etc/nologin and /run/nologin. +user-sessions creates (and removes) /run/nologin, but also removes +/etc/nologin. (This behaviour is unchanged since the introduction +of the binary in e92787416c691c3f34f47349e5eae3fa68eae856.) + +By not removing pam_nologin we fully drop compatibility with PAM < 1.1. +This has the advantage that now /etc/nologin can be used by administrator to +disable user logins, e.g. for extended maintanance. We already specified +PAM >= 1.1.2 as dependency, so this was already covered. + +The makes the code match the man page. + +Fixes #26965. + +(cherry picked from commit a78413baae0e999384b535d327203ebf417b1e24) + +Resolves: RHEL-85520 +--- + src/basic/fileio-label.c | 12 +++++++++--- + src/user-sessions/user-sessions.c | 7 ++----- + 2 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/src/basic/fileio-label.c b/src/basic/fileio-label.c +index 5f8d8af9af..0b52657757 100644 +--- a/src/basic/fileio-label.c ++++ b/src/basic/fileio-label.c +@@ -55,9 +55,15 @@ int fopen_temporary_label(const char *target, + int create_shutdown_run_nologin_or_warn(void) { + int r; + +- /* This is used twice: once in systemd-user-sessions.service, in order to block logins when we actually go +- * down, and once in systemd-logind.service when shutdowns are scheduled, and logins are to be turned off a bit +- * in advance. We use the same wording of the message in both cases. */ ++ /* This is used twice: once in systemd-user-sessions.service, in order to block logins when we ++ * actually go down, and once in systemd-logind.service when shutdowns are scheduled, and logins are ++ * to be turned off a bit in advance. We use the same wording of the message in both cases. ++ * ++ * Traditionally, there was only /etc/nologin, and we managed that. Then, in PAM 1.1 ++ * support for /run/nologin was added as alternative ++ * (https://github.com/linux-pam/linux-pam/commit/e9e593f6ddeaf975b7fe8446d184e6bc387d450b). ++ * 13 years later we stopped managing /etc/nologin, leaving it for the administrator to manage. ++ */ + + r = write_string_file_atomic_label("/run/nologin", + "System is going down. Unprivileged users are not permitted to log in anymore. " +diff --git a/src/user-sessions/user-sessions.c b/src/user-sessions/user-sessions.c +index 89c4b0005d..8ac4826f83 100644 +--- a/src/user-sessions/user-sessions.c ++++ b/src/user-sessions/user-sessions.c +@@ -12,7 +12,7 @@ + #include "util.h" + + int main(int argc, char*argv[]) { +- int r, k; ++ int r; + + if (argc != 2) { + log_error("This program requires one argument."); +@@ -27,12 +27,9 @@ int main(int argc, char*argv[]) { + + mac_selinux_init(); + ++ /* We only touch /run/nologin. See create_shutdown_run_nologin_or_warn() for details. */ + if (streq(argv[1], "start")) { + r = unlink_or_warn("/run/nologin"); +- k = unlink_or_warn("/etc/nologin"); +- if (k < 0 && r >= 0) +- r = k; +- + } else if (streq(argv[1], "stop")) + r = create_shutdown_run_nologin_or_warn(); + else { diff --git a/1085-core-allow-manager_serialize-to-fail-correctly.patch b/1085-core-allow-manager_serialize-to-fail-correctly.patch new file mode 100644 index 0000000..c0438d7 --- /dev/null +++ b/1085-core-allow-manager_serialize-to-fail-correctly.patch @@ -0,0 +1,134 @@ +From d489e6c6315d20f695d6ed269de15fb3c204d082 Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Tue, 9 Oct 2018 16:45:33 +0200 +Subject: [PATCH] core: allow manager_serialize() to fail correctly + +If manager_serialize() fails in the middle (which it hopefully doesn't) +make sure to fix up m->n_reloading correctly again so that we don't +leave it > 0 when it really shouldn't be. + +(cherry picked from commit 4daf832afaeac471085e56445a05218217bf5107) + +Resolves: RHEL-112550 +--- + src/core/manager.c | 56 +++++++++++++++++++++++++++++----------------- + 1 file changed, 35 insertions(+), 21 deletions(-) + +diff --git a/src/core/manager.c b/src/core/manager.c +index f242f0cc00..406dad07b2 100644 +--- a/src/core/manager.c ++++ b/src/core/manager.c +@@ -3099,7 +3099,12 @@ int manager_open_serialization(Manager *m, FILE **_f) { + return 0; + } + +-int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) { ++int manager_serialize( ++ Manager *m, ++ FILE *f, ++ FDSet *fds, ++ bool switching_root) { ++ + ManagerTimestamp q; + const char *t; + Iterator i; +@@ -3145,8 +3150,10 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) { + int copy; + + copy = fdset_put_dup(fds, m->notify_fd); +- if (copy < 0) +- return copy; ++ if (copy < 0) { ++ r = copy; ++ goto finish; ++ } + + fprintf(f, "notify-fd=%i\n", copy); + fprintf(f, "notify-socket=%s\n", m->notify_socket); +@@ -3156,8 +3163,10 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) { + int copy; + + copy = fdset_put_dup(fds, m->cgroups_agent_fd); +- if (copy < 0) +- return copy; ++ if (copy < 0) { ++ r = copy; ++ goto finish; ++ } + + fprintf(f, "cgroups-agent-fd=%i\n", copy); + } +@@ -3166,12 +3175,16 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) { + int copy0, copy1; + + copy0 = fdset_put_dup(fds, m->user_lookup_fds[0]); +- if (copy0 < 0) +- return copy0; ++ if (copy0 < 0) { ++ r = copy0; ++ goto finish; ++ } + + copy1 = fdset_put_dup(fds, m->user_lookup_fds[1]); +- if (copy1 < 0) +- return copy1; ++ if (copy1 < 0) { ++ r = copy1; ++ goto finish; ++ } + + fprintf(f, "user-lookup=%i %i\n", copy0, copy1); + } +@@ -3180,14 +3193,14 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) { + + r = dynamic_user_serialize(m, f, fds); + if (r < 0) +- return r; ++ goto finish; + + manager_serialize_uid_refs(m, f); + manager_serialize_gid_refs(m, f); + + r = exec_runtime_serialize(m, f, fds); + if (r < 0) +- return r; ++ goto finish; + + (void) fputc('\n', f); + +@@ -3200,24 +3213,25 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) { + fputc('\n', f); + + r = unit_serialize(u, f, fds, !switching_root); +- if (r < 0) { +- m->n_reloading--; +- return r; +- } ++ if (r < 0) ++ goto finish; + } + +- assert(m->n_reloading > 0); +- m->n_reloading--; +- + r = fflush_and_check(f); + if (r < 0) +- return r; ++ goto finish; + + r = bus_fdset_add_all(m, fds); + if (r < 0) +- return r; ++ goto finish; + +- return 0; ++ r = 0; ++ ++finish: ++ assert(m->n_reloading > 0); ++ m->n_reloading--; ++ ++ return r; + } + + int manager_deserialize(Manager *m, FILE *f, FDSet *fds) { diff --git a/systemd.spec b/systemd.spec index f7f6e61..b801ed7 100644 --- a/systemd.spec +++ b/systemd.spec @@ -13,7 +13,7 @@ Name: systemd Url: http://www.freedesktop.org/wiki/Software/systemd Version: 239 -Release: 82%{?dist}.18 +Release: 82%{?dist}.19 # For a breakdown of the licensing, see README License: LGPLv2+ and MIT and GPLv2+ Summary: System and Service Manager @@ -1133,6 +1133,8 @@ Patch1080: 1080-core-when-a-unit-state-changes-only-propagate-to-job.patch Patch1081: 1081-core-extend-comments-regarding-coldplug-vs.-catchup.patch Patch1082: 1082-execute-make-sure-to-call-into-PAM-after-initializin.patch Patch1083: 1083-pager-also-check-for-SUDO_UID.patch +Patch1084: 1084-user-sessions-do-not-remove-etc-nologin.patch +Patch1085: 1085-core-allow-manager_serialize-to-fail-correctly.patch %ifarch %{ix86} x86_64 aarch64 %global have_gnu_efi 1 @@ -1759,6 +1761,10 @@ fi %files tests -f .file-list-tests %changelog +* Mon Jul 27 2026 systemd maintenance team - 239-82.19 +- user-sessions: do not remove /etc/nologin (RHEL-85520) +- core: allow manager_serialize() to fail correctly (RHEL-112550) + * Tue Jul 21 2026 systemd maintenance team - 239-82.18 - execute: make sure to call into PAM after initializing resource limits (RHEL-5986) - pager: also check for $SUDO_UID (RHEL-102942)