rpms/systemd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

systemd-257-25

Browse Source 
Resolves: RHEL-171097, RHEL-155454, RHEL-128058, RHEL-155021, RHEL-72814, RHEL-153030
This commit is contained in:
Jan Macku 2026-05-12 10:49:28 +02:00
parent b7ebf97389
commit 832dd546a9
21 changed files with 2681 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
0662-core-cleanup-unit-s-dropin-directories-from-global-c.patch Normal file
View File

@ -0,0 +1,42 @@
From 391d1d3b7e0b47749369ea6d590991d19032fdab Mon Sep 17 00:00:00 2001
From: Michal Sekletar <msekleta@redhat.com>
Date: Wed, 25 Feb 2026 19:45:55 +0100
Subject: [PATCH] core: cleanup unit's dropin directories from global cache
When user creates dropin files via API (e.g. systemctl set-property ...)
we put the dropin directory path into unit_path_cache. Drop those
directories from the cache in unit_free() and prevent memory leak.
Follow-up for fce94c5c563b8f6ede2b8f7f283d2d2faff4e062.
(cherry picked from commit 0c98e432d1def1e8428dbead50dc629ed0645366)
Resolves: RHEL-171097
---
src/core/unit.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/core/unit.c b/src/core/unit.c
index 6b31599972..6a2f552483 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -653,6 +653,8 @@ static void unit_remove_transient(Unit *u) {
if (!u->transient)
return;
+ const char *dropin_directory = strjoina(u->id, ".d");
+
STRV_FOREACH(i, u->dropin_paths) {
_cleanup_free_ char *p = NULL, *pp = NULL;
@@ -666,6 +668,10 @@ static void unit_remove_transient(Unit *u) {
if (!path_equal(u->manager->lookup_paths.transient, pp))
continue;
+ /* Drop the transient drop-in directory also from unit path cache. */
+ if (path_equal(last_path_component(p), dropin_directory))
+ free(set_remove(u->manager->unit_path_cache, p));
+
(void) unlink(*i);
(void) rmdir(p);
}

89
0663-libsystemd-drop-const-decorators-on-public-inline-fu.patch Normal file
View File

@ -0,0 +1,89 @@
From e6ed6b793155ab22ee920b0cf3db4e1ada8df9c6 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 14 Oct 2025 11:17:27 +0200
Subject: [PATCH] libsystemd: drop "const" decorators on public inline
functions
The point of the "const" attribute is to give the compiler hints about
behaviour of functions if it only has the function prototype but no body
around. But inline functions are the ones where the compiler *always*
has the body around, hence the "const" decorator is really just noise:
the compuler can determine the constness on its own, just by looking at
the code.
Hence, drop the decorators, it's just noise. And a source of errors, as
675fa49f69943b0f009c973ed3d1e90afc1d88b1 has shown.
Follow-up for: #39289
(cherry picked from commit 86d9498c8cf7aa1584dae85f3e1a570e44a81cfc)
Related: RHEL-155454
---
src/systemd/_sd-common.h | 4 ----
src/systemd/sd-id128.h | 8 ++++----
src/systemd/sd-json.h | 2 +-
3 files changed, 5 insertions(+), 9 deletions(-)
diff --git a/src/systemd/_sd-common.h b/src/systemd/_sd-common.h
index 5792dd8106..dbe9fa035e 100644
--- a/src/systemd/_sd-common.h
+++ b/src/systemd/_sd-common.h
@@ -45,10 +45,6 @@ typedef void (*_sd_destroy_t)(void *userdata);
# define _sd_pure_ __attribute__((__pure__))
#endif
-#ifndef _sd_const_
-# define _sd_const_ __attribute__((__const__))
-#endif
-
/* Note that strictly speaking __deprecated__ has been available before GCC 6. However, starting with GCC 6
* it also works on enum values, which we are interested in. Since this is a developer-facing feature anyway
* (as opposed to build engineer-facing), let's hence conditionalize this to gcc 6, given that the developers
diff --git a/src/systemd/sd-id128.h b/src/systemd/sd-id128.h
index 7be690400d..d63e05e71d 100644
--- a/src/systemd/sd-id128.h
+++ b/src/systemd/sd-id128.h
@@ -117,17 +117,17 @@ int sd_id128_get_invocation_app_specific(sd_id128_t app_id, sd_id128_t *ret);
#define SD_ID128_MAKE_UUID_STR(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) \
#a #b #c #d "-" #e #f "-" #g #h "-" #i #j "-" #k #l #m #n #o #p
-_sd_const_ static __inline__ int sd_id128_equal(sd_id128_t a, sd_id128_t b) {
+static __inline__ int sd_id128_equal(sd_id128_t a, sd_id128_t b) {
return a.qwords[0] == b.qwords[0] && a.qwords[1] == b.qwords[1];
}
int sd_id128_string_equal(const char *s, sd_id128_t id);
-_sd_const_ static __inline__ int sd_id128_is_null(sd_id128_t a) {
+static __inline__ int sd_id128_is_null(sd_id128_t a) {
return a.qwords[0] == 0 && a.qwords[1] == 0;
}
-_sd_const_ static __inline__ int sd_id128_is_allf(sd_id128_t a) {
+static __inline__ int sd_id128_is_allf(sd_id128_t a) {
return a.qwords[0] == UINT64_C(0xFFFFFFFFFFFFFFFF) && a.qwords[1] == UINT64_C(0xFFFFFFFFFFFFFFFF);
}
@@ -146,7 +146,7 @@ _sd_const_ static __inline__ int sd_id128_in_setv(sd_id128_t a, va_list ap) {
}
}
-_sd_const_ static __inline__ int sd_id128_in_set_sentinel(sd_id128_t a, ...) {
+static __inline__ int sd_id128_in_set_sentinel(sd_id128_t a, ...) {
va_list ap;
int r;
diff --git a/src/systemd/sd-json.h b/src/systemd/sd-json.h
index 33817f2327..ac5a1b13e3 100644
--- a/src/systemd/sd-json.h
+++ b/src/systemd/sd-json.h
@@ -339,7 +339,7 @@ int sd_json_variant_strv(sd_json_variant *v, char ***ret);
int sd_json_variant_unbase64(sd_json_variant *v, void **ret, size_t *ret_size);
int sd_json_variant_unhex(sd_json_variant *v, void **ret, size_t *ret_size);
-_sd_const_ static __inline__ int sd_json_format_enabled(sd_json_format_flags_t flags) {
+static __inline__ int sd_json_format_enabled(sd_json_format_flags_t flags) {
return !(flags & SD_JSON_FORMAT_OFF);
}

30
0664-sd-id128-Drop-_sd_const_-from-sd_id128_in_setv.patch Normal file
View File

@ -0,0 +1,30 @@
From ee8dd04d1d9759e0266f0802b033936542a469fe Mon Sep 17 00:00:00 2001
From: Daan De Meyer <daan.j.demeyer@gmail.com>
Date: Mon, 13 Oct 2025 10:43:16 +0200
Subject: [PATCH] sd-id128: Drop _sd_const_ from sd_id128_in_setv()
Both the const and pure attributes disallow modifying input arguments
but sd_id128_in_setv() clearly modifies its ap input argument by iterating
over it with va_arg() so drop the _sd_const_ attribute from
sd_id128_in_setv().
(cherry picked from commit 675fa49f69943b0f009c973ed3d1e90afc1d88b1)
Related: RHEL-155454
---
src/systemd/sd-id128.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/systemd/sd-id128.h b/src/systemd/sd-id128.h
index d63e05e71d..8d4b6aec0a 100644
--- a/src/systemd/sd-id128.h
+++ b/src/systemd/sd-id128.h
@@ -134,7 +134,7 @@ static __inline__ int sd_id128_is_allf(sd_id128_t a) {
#define SD_ID128_NULL ((const sd_id128_t) { .qwords = { 0, 0 }})
#define SD_ID128_ALLF ((const sd_id128_t) { .qwords = { UINT64_C(0xFFFFFFFFFFFFFFFF), UINT64_C(0xFFFFFFFFFFFFFFFF) }})
-_sd_const_ static __inline__ int sd_id128_in_setv(sd_id128_t a, va_list ap) {
+static __inline__ int sd_id128_in_setv(sd_id128_t a, va_list ap) {
for (;;) {
sd_id128_t b = va_arg(ap, sd_id128_t);

57
0665-test-wrap-mount-umount-when-running-with-sanitizers.patch Normal file
View File

@ -0,0 +1,57 @@
From bb4a13f0b861cad6d69b5dd0223412fb8fd4465e Mon Sep 17 00:00:00 2001
From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Wed, 22 Apr 2026 19:12:23 +0200
Subject: [PATCH] test: wrap mount/umount when running with sanitizers
On Fedora Rawhide mount/umount is linked against libsystemd, which then
breaks the binaries in sanitizer runs, as we try to run instrumented
code from an uninstrumented binary:
bash-5.3# ldd /usr/bin/mount
linux-vdso.so.1 (0x00007fa757ef9000)
libmount.so.1 => /lib64/libmount.so.1 (0x00007fa757e84000)
libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fa757e51000)
libc.so.6 => /lib64/libc.so.6 (0x00007fa757c56000)
libblkid.so.1 => /lib64/libblkid.so.1 (0x00007fa757c16000)
libsystemd.so.0 => /lib64/libsystemd.so.0 (0x00007fa757400000)
libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 (0x00007fa75734f000)
/lib64/ld-linux-x86-64.so.2 (0x00007fa757efb000)
libclang_rt.asan.so => /usr/lib/clang/22/lib/x86_64-redhat-linux-gnu/libclang_rt.asan.so (0x00007fa756800000)
libm.so.6 => /lib64/libm.so.6 (0x00007fa7566e4000)
libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fa7566b7000)
libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007fa756400000)
bash-5.3# mount
==458==ASan runtime does not come first in initial library list; you should either link runtime to your application or manually preload it with LD_PRELOAD.
This then breaks the whole machine, as mount is quite essential during
boot.
Let's just add mount/umount to the list of wrapped binaries to fix this.
(cherry picked from commit 8030e0b19ef7c0e823d84dd08ad38a2d88e0a230)
Related: RHEL-155454
---
mkosi.sanitizers/mkosi.postinst | 2 ++
1 file changed, 2 insertions(+)
diff --git a/mkosi.sanitizers/mkosi.postinst b/mkosi.sanitizers/mkosi.postinst
index e83d05c6bc..c984a91a5a 100755
--- a/mkosi.sanitizers/mkosi.postinst
+++ b/mkosi.sanitizers/mkosi.postinst
@@ -65,6 +65,7 @@ wrap=(
mdadm
mkfs.btrfs
mksquashfs
+ mount
multipath
multipathd
nvme
@@ -78,6 +79,7 @@ wrap=(
su
tar
tgtd
+ umount
useradd
userdel
veritysetup

93
0666-test-wrap-even-more-binaries-when-running-with-sanit.patch Normal file
View File

@ -0,0 +1,93 @@
From 1bc0a05e4e9a6611b00c1e3dcdb9f0b96cb755cb Mon Sep 17 00:00:00 2001
From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Thu, 23 Apr 2026 13:44:59 +0200
Subject: [PATCH] test: wrap even more binaries when running with sanitizers
Turns out that the util-linux dep on libsystemd caused more fun than I
originally anticipated:
$ lddtree /usr/bin/dfuzzer
dfuzzer => /usr/bin/dfuzzer (interpreter => /lib64/ld-linux-x86-64.so.2)
libgio-2.0.so.0 => /lib64/libgio-2.0.so.0
libgmodule-2.0.so.0 => /lib64/libgmodule-2.0.so.0
libz.so.1 => /lib64/libz.so.1
libmount.so.1 => /lib64/libmount.so.1
libblkid.so.1 => /lib64/libblkid.so.1
libsystemd.so.0 => /lib64/libsystemd.so.0
libm.so.6 => /lib64/libm.so.6
ld-linux-x86-64.so.2 => /lib64/ld-linux-x86-64.so.2
libselinux.so.1 => /lib64/libselinux.so.1
libpcre2-8.so.0 => /lib64/libpcre2-8.so.0
...
Also, the tpm2 utils now depend on libudev through libcurl -> libssh ->
libfido2 dep chain:
$ lddtree /usr/bin/tpm2_pcrread
tpm2_pcrread => /usr/bin/tpm2_pcrread (interpreter => /lib64/ld-linux-x86-64.so.2)
...
libcurl.so.4 => /lib64/libcurl.so.4
...
libssh.so.4 => /lib64/libssh.so.4
libfido2.so.1 => /lib64/libfido2.so.1
libcbor.so.0.13 => /lib64/libcbor.so.0.13
libudev.so.1 => /lib64/libudev.so.1
libgcc_s.so.1 => /lib64/libgcc_s.so.1
...
Follow-up for 8030e0b19ef7c0e823d84dd08ad38a2d88e0a230.
(cherry picked from commit a8400c8f1a61223e4905e2939f8d71be82831c8c)
Related: RHEL-155454
---
mkosi.sanitizers/mkosi.postinst | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/mkosi.sanitizers/mkosi.postinst b/mkosi.sanitizers/mkosi.postinst
index c984a91a5a..95f3f10a47 100755
--- a/mkosi.sanitizers/mkosi.postinst
+++ b/mkosi.sanitizers/mkosi.postinst
@@ -44,6 +44,7 @@ wrap=(
dbus-broker-launch
dbus-daemon
delv
+ dfuzzer
dhcpd
dig
dnf
@@ -55,17 +56,21 @@ wrap=(
getfacl
id
integritysetup
+ iscsiadm
iscsid
kpartx
logger
login
ls
lsblk
+ lsns
lvm
mdadm
mkfs.btrfs
+ mkfs.ext4
mksquashfs
mount
+ mountpoint
multipath
multipathd
nvme
@@ -77,8 +82,12 @@ wrap=(
sshd
stat
su
+ swapoff
+ swapon
tar
tgtd
+ # The tpm2 tools (tpm2_readpublic, tpm2_pcrextend, ...) all are symlinks to tpm2
+ tpm2
umount
useradd
userdel

71
0667-test-temporarily-ignore-sanitizer-warning-about-bloc.patch Normal file
View File

@ -0,0 +1,71 @@
From 6ab021ea77231db4e983db6ad6263e261731d680 Mon Sep 17 00:00:00 2001
From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Thu, 23 Apr 2026 15:11:01 +0200
Subject: [PATCH] test: temporarily ignore sanitizer warning about blocked
ptrace()
LLVM 22 introduced an additional check [0] for ptrace() syscall when
invoking sanitizers [0] which currently produces a false-positive
warning when running some of our units under sanitizers:
[ 47.524680] systemd-timedated[740]: ==740==WARNING: ptrace appears to be blocked (is seccomp enabled?). LeakSanitizer may hang.
[ 47.524680] systemd-timedated[740]: ==740==Child exited with signal 15.
...
[ 1555.734223] systemd-oomd[93]: ==93==WARNING: ptrace appears to be blocked (is seccomp enabled?). LeakSanitizer may hang.
[ 1555.734223] systemd-oomd[93]: ==93==Child exited with signal 15.
...
It is a false positive because we disable the seccomp filters
system-wide for our units in the sanitizer jobs.
Now, from what I've seen so far this happens only in
Type=notify(-reload) units that also utilize bus_event_loop_with_idle().
This, combined with the fact that the ptrace()-check child process from
[0] checks only if the child process was killed by _any_ signal, means
that if the systemd unit exits on its own after becoming idle and then
something sends it SIGTERM (either via explicit `systemctl stop` or
during system shutdown), this SIGTERM might hit the ptrace()-check child
process from the sanitizer handler (as we also send the signal to all
processes in the target cgroup), which the parent process then
mistakenly evaluates as a blocked ptrace() syscall, even though the
check process wasn't killed by SIGSYS.
I filed this as [1] to the LLVM project, but let's also temporarily
ignore the warning in the sanitizer report processing, as it currently
causes annoying test fails.
[0] https://github.com/llvm/llvm-project/commit/a708b4bf21d7c2298224cdacf7d424abc3c8fed4
[1] https://github.com/llvm/llvm-project/issues/193714
(cherry picked from commit 445f9805489a575c9b1bc74daa173c4fdf9b1bf7)
Related: RHEL-155454
---
test/integration-test-wrapper.py | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/test/integration-test-wrapper.py b/test/integration-test-wrapper.py
index 3e0cbbb678..064645223e 100755
--- a/test/integration-test-wrapper.py
+++ b/test/integration-test-wrapper.py
@@ -136,7 +136,19 @@ def process_sanitizer_report(args: argparse.Namespace, journal_file: Path) -> bo
fatal_end = re.compile(r'==[0-9]+==HINT:\s+\w+Sanitizer')
# 'Standard' errors:
- standard_begin = re.compile(r'([0-9]+: runtime error|==[0-9]+==.+?\w+Sanitizer)')
+ #
+ # TODO: there's currently a bug in LLVM 22 due to which certain systemd
+ # units can throw the following warning:
+ # [ 3366.747202] systemd-oomd[93]: ==93==WARNING: ptrace appears to be blocked (is seccomp enabled?).
+ # LeakSanitizer may hang.
+ # [ 3366.747202] systemd-oomd[93]: ==93==Child exited with signal 15.
+ #
+ # which is then picked up by the following regex and causes the test to
+ # fail. Let's, temporarily, exclude this warning from the regex to mitigate
+ # this.
+ #
+ # See: https://github.com/llvm/llvm-project/issues/193714
+ standard_begin = re.compile(r'([0-9]+: runtime error|==[0-9]+==(?!WARNING: ptrace).+?\w+Sanitizer)')
standard_end = re.compile(r'SUMMARY:\s+(\w+)Sanitizer')
# extract COMM

37
0668-test-slightly-reduce-the-performance-memory-overhead.patch Normal file
View File

@ -0,0 +1,37 @@
From 6cb559be4ea76c36fc83abd9aef98b0033ad853e Mon Sep 17 00:00:00 2001
From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Sat, 25 Apr 2026 16:37:34 +0200
Subject: [PATCH] test: slightly reduce the performance/memory overhead for
wrapped binaries
Let's drop the quarantine that ASan uses for use-after-free detection,
as it's pointless in wrapped binaries and can consume up to 256 MiB of
memory (with the default configuration). Also, don't keep any stack
traces for allocations & deallocations, which should (slightly) help
with both memory & performance overhead.
(cherry picked from commit 035ba3ea571bad6772cf3731f6b5379ccb08267f)
Related: RHEL-155454
---
mkosi.sanitizers/mkosi.postinst | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/mkosi.sanitizers/mkosi.postinst b/mkosi.sanitizers/mkosi.postinst
index 95f3f10a47..c1377bba6f 100755
--- a/mkosi.sanitizers/mkosi.postinst
+++ b/mkosi.sanitizers/mkosi.postinst
@@ -114,8 +114,11 @@ for bin in "${wrap[@]}"; do
# Preload the ASan runtime DSO, otherwise ASAn will complain
export LD_PRELOAD="$ASAN_RT_PATH"
# Disable LSan to speed things up, since we don't care about leak reports
-# from 'external' binaries
-export ASAN_OPTIONS=detect_leaks=$enable_lsan
+# from 'external' binaries. In addition, disable quarantine (for use-after-free
+# detection) and malloc stack frame collection as we don't care about these in
+# 'external' binaries either, and they just unnecessarily hog up memory & cpu
+# cycles.
+export ASAN_OPTIONS=detect_leaks=$enable_lsan:quarantine_size_mb=0:malloc_context_size=0
# Set argv[0] to the original binary name without the ".orig" suffix
exec -a "\$0" -- "${target}.orig" "\$@"
EOF

324
0669-fstab-generator-support-swap-on-network-block-device.patch Normal file
View File

@ -0,0 +1,324 @@
From 9864737eb2332696db1bb16b5049230af39badca Mon Sep 17 00:00:00 2001
From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Tue, 7 Apr 2026 11:16:42 +0200
Subject: [PATCH] fstab-generator: support swap on network block devices
Teach swap units to support the _netdev option as well, which should
make swaps on iSCSI possible. This mirrors the logic we already have for
regular mounts in both the fstab-generator and the core
(mount.c/swap.c).
Co-developed-by: Claude Opus 4.6 <noreply@anthropic.com>
(cherry picked from commit 3d5bd67a2259e7a4edc27476d4cae049653c4414)
Resolves: RHEL-128058
---
man/systemd.swap.xml | 30 ++++++++++--
src/core/swap.c | 46 ++++++++++++++++---
src/fstab-generator/fstab-generator.c | 16 +++++--
src/shared/generator.c | 2 +-
.../systemd-remount-fs.service | 0
.../sysroot.mount | 0
.../50-netdev-dependencies.conf | 5 ++
.../dev-sdx1.swap | 10 ++++
.../systemd-remount-fs.service | 0
.../remote-fs.target.requires/dev-sdx1.swap | 1 +
.../50-netdev-dependencies.conf | 5 ++
.../dev-sdx1.swap | 10 ++++
.../sysroot.mount | 0
.../remote-fs.target.requires/dev-sdx1.swap | 1 +
.../test-21-swap-netdev.fstab.input | 1 +
15 files changed, 113 insertions(+), 14 deletions(-)
create mode 100644 test/test-fstab-generator/test-21-swap-netdev.fstab.expected.container.sysroot/local-fs.target.wants/systemd-remount-fs.service
create mode 100644 test/test-fstab-generator/test-21-swap-netdev.fstab.expected.container/initrd-usr-fs.target.requires/sysroot.mount
create mode 100644 test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/dev-sdx1.device.d/50-netdev-dependencies.conf
create mode 100644 test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/dev-sdx1.swap
create mode 100644 test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/local-fs.target.wants/systemd-remount-fs.service
create mode 120000 test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/remote-fs.target.requires/dev-sdx1.swap
create mode 100644 test/test-fstab-generator/test-21-swap-netdev.fstab.expected/dev-sdx1.device.d/50-netdev-dependencies.conf
create mode 100644 test/test-fstab-generator/test-21-swap-netdev.fstab.expected/dev-sdx1.swap
create mode 100644 test/test-fstab-generator/test-21-swap-netdev.fstab.expected/initrd-usr-fs.target.requires/sysroot.mount
create mode 120000 test/test-fstab-generator/test-21-swap-netdev.fstab.expected/remote-fs.target.requires/dev-sdx1.swap
create mode 100644 test/test-fstab-generator/test-21-swap-netdev.fstab.input
diff --git a/man/systemd.swap.xml b/man/systemd.swap.xml
index f5e3c0742b..ccb6ca10cd 100644
--- a/man/systemd.swap.xml
+++ b/man/systemd.swap.xml
@@ -90,9 +90,15 @@
<para>The following dependencies are added unless <varname>DefaultDependencies=no</varname> is set:</para>
<itemizedlist>
- <listitem><para>Swap units automatically acquire a <varname>Conflicts=</varname> and a
+ <listitem><para>Local swap units automatically acquire a <varname>Conflicts=</varname> and a
<varname>Before=</varname> dependency on <filename>umount.target</filename> so that they are deactivated at
shutdown as well as a <varname>Before=swap.target</varname> dependency.</para></listitem>
+
+ <listitem><para>Network swap units (those with <option>_netdev</option> in their options) automatically acquire
+ <varname>After=</varname> dependencies on <filename>remote-fs-pre.target</filename> and
+ <filename>network.target</filename>, plus <varname>After=</varname> and <varname>Wants=</varname> dependencies
+ on <filename>network-online.target</filename>, and a <varname>Before=</varname> dependency on
+ <filename>remote-fs.target</filename> instead of <filename>swap.target</filename>.</para></listitem>
</itemizedlist>
</refsect2>
</refsect1>
@@ -124,7 +130,8 @@
<listitem><para>With <option>noauto</option>, the swap unit
will not be added as a dependency for
- <filename>swap.target</filename>. This means that it will not
+ <filename>swap.target</filename> (or <filename>remote-fs.target</filename> for network swap devices,
+ see <option>_netdev</option> below). This means that it will not
be activated automatically during boot, unless it is pulled in
by some other unit. The <option>auto</option> option has the
opposite meaning and is the default.</para>
@@ -138,8 +145,8 @@
<listitem><para>With <option>nofail</option>, the swap unit
will be only wanted, not required by
- <filename>swap.target</filename>. This means that the boot
- will continue even if this swap device is not activated
+ <filename>swap.target</filename> (or <filename>remote-fs.target</filename> for network swap
+ devices). This means that the boot will continue even if this swap device is not activated
successfully.</para>
<xi:include href="version-info.xml" xpointer="v218"/>
@@ -167,6 +174,21 @@
<xi:include href="version-info.xml" xpointer="v240"/></listitem>
</varlistentry>
+
+ <varlistentry>
+ <term><option>_netdev</option></term>
+
+ <listitem><para>Marks this swap device as requiring network access. This is useful for swap on
+ network block devices (e.g. iSCSI).</para>
+
+ <para>Network swap units are ordered between <filename>remote-fs-pre.target</filename> and
+ <filename>remote-fs.target</filename>, instead of being ordered before
+ <filename>swap.target</filename>. They also pull in <filename>network-online.target</filename> and
+ are ordered after it and <filename>network.target</filename>.</para>
+
+ <xi:include href="version-info.xml" xpointer="v261"/>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect1>
diff --git a/src/core/swap.c b/src/core/swap.c
index eb596105ba..531dca1033 100644
--- a/src/core/swap.c
+++ b/src/core/swap.c
@@ -220,6 +220,7 @@ static int swap_add_device_dependencies(Swap *s) {
}
static int swap_add_default_dependencies(Swap *s) {
+ SwapParameters *p;
int r;
assert(s);
@@ -233,13 +234,46 @@ static int swap_add_default_dependencies(Swap *s) {
if (detect_container() > 0)
return 0;
- /* swap units generated for the swap dev links are missing the
- * ordering dep against the swap target. */
- r = unit_add_dependency_by_name(UNIT(s), UNIT_BEFORE, SPECIAL_SWAP_TARGET, true, UNIT_DEPENDENCY_DEFAULT);
- if (r < 0)
- return r;
+ p = swap_get_parameters(s);
+
+ if (p && fstab_test_option(p->options, "_netdev\0")) {
+ /* Network swap devices (those with _netdev in options) are routed through
+ * remote-fs.target instead of swap.target, mirroring how network mounts use
+ * remote-fs.target instead of local-fs.target. This avoids an ordering cycle:
+ * swap.target is pulled in at sysinit.target time, but network-online.target
+ * only comes after basic.target which is after sysinit.target. */
+ r = unit_add_dependency_by_name(UNIT(s), UNIT_AFTER, SPECIAL_REMOTE_FS_PRE_TARGET,
+ /* add_reference= */ true, UNIT_DEPENDENCY_DEFAULT);
+ if (r < 0)
+ return r;
+
+ r = unit_add_dependency_by_name(UNIT(s), UNIT_BEFORE, SPECIAL_REMOTE_FS_TARGET,
+ /* add_reference= */ true, UNIT_DEPENDENCY_DEFAULT);
+ if (r < 0)
+ return r;
+
+ /* Pull in and order after network-online.target, analogous to
+ * mount_add_default_network_dependencies() for network mounts. */
+ r = unit_add_dependency_by_name(UNIT(s), UNIT_AFTER, SPECIAL_NETWORK_TARGET,
+ /* add_reference= */ true, UNIT_DEPENDENCY_DEFAULT);
+ if (r < 0)
+ return r;
+
+ r = unit_add_two_dependencies_by_name(UNIT(s), UNIT_WANTS, UNIT_AFTER, SPECIAL_NETWORK_ONLINE_TARGET,
+ /* add_reference= */ true, UNIT_DEPENDENCY_DEFAULT);
+ if (r < 0)
+ return r;
+ } else {
+ /* swap units generated for the swap dev links are missing the
+ * ordering dep against the swap target. */
+ r = unit_add_dependency_by_name(UNIT(s), UNIT_BEFORE, SPECIAL_SWAP_TARGET,
+ /* add_reference= */ true, UNIT_DEPENDENCY_DEFAULT);
+ if (r < 0)
+ return r;
+ }
- return unit_add_two_dependencies_by_name(UNIT(s), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_UMOUNT_TARGET, true, UNIT_DEPENDENCY_DEFAULT);
+ return unit_add_two_dependencies_by_name(UNIT(s), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_UMOUNT_TARGET,
+ /* add_reference= */ true, UNIT_DEPENDENCY_DEFAULT);
}
static int swap_verify(Swap *s) {
diff --git a/src/fstab-generator/fstab-generator.c b/src/fstab-generator/fstab-generator.c
index 590042e992..5c26c52666 100644
--- a/src/fstab-generator/fstab-generator.c
+++ b/src/fstab-generator/fstab-generator.c
@@ -217,6 +217,7 @@ static int add_swap(
_cleanup_free_ char *name = NULL;
_cleanup_fclose_ FILE *f = NULL;
+ bool is_network;
int r;
assert(what);
@@ -236,10 +237,12 @@ static int add_swap(
return true;
}
- log_debug("Found swap entry what=%s makefs=%s growfs=%s pcrfs=%s noauto=%s nofail=%s",
+ is_network = fstab_test_option(options, "_netdev\0");
+
+ log_debug("Found swap entry what=%s makefs=%s growfs=%s pcrfs=%s noauto=%s nofail=%s netdev=%s",
what,
yes_no(flags & MOUNT_MAKEFS), yes_no(flags & MOUNT_GROWFS), yes_no(flags & MOUNT_PCRFS),
- yes_no(flags & MOUNT_NOAUTO), yes_no(flags & MOUNT_NOFAIL));
+ yes_no(flags & MOUNT_NOAUTO), yes_no(flags & MOUNT_NOFAIL), yes_no(is_network));
r = unit_name_from_path(what, ".swap", &name);
if (r < 0)
@@ -280,6 +283,12 @@ static int add_swap(
if (r < 0)
return r;
+ if (is_network) {
+ r = generator_write_device_deps(arg_dest, what, /* where= */ NULL, options);
+ if (r < 0)
+ return r;
+ }
+
if (flags & MOUNT_MAKEFS) {
r = generator_hook_up_mkswap(arg_dest, what);
if (r < 0)
@@ -293,7 +302,8 @@ static int add_swap(
log_warning("%s: measuring swap devices is currently unsupported.", what);
if (!(flags & MOUNT_NOAUTO)) {
- r = generator_add_symlink(arg_dest, SPECIAL_SWAP_TARGET,
+ const char *target = is_network ? SPECIAL_REMOTE_FS_TARGET : SPECIAL_SWAP_TARGET;
+ r = generator_add_symlink(arg_dest, target,
(flags & MOUNT_NOFAIL) ? "wants" : "requires", name);
if (r < 0)
return r;
diff --git a/src/shared/generator.c b/src/shared/generator.c
index b3e57770aa..9011532d6b 100644
--- a/src/shared/generator.c
+++ b/src/shared/generator.c
@@ -435,7 +435,7 @@ int generator_write_device_deps(
_cleanup_free_ char *node = NULL, *unit = NULL;
int r;
- if (fstab_is_extrinsic(where, opts))
+ if (where && fstab_is_extrinsic(where, opts))
return 0;
if (!fstab_test_option(opts, "_netdev\0"))
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.container.sysroot/local-fs.target.wants/systemd-remount-fs.service b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.container.sysroot/local-fs.target.wants/systemd-remount-fs.service
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.container/initrd-usr-fs.target.requires/sysroot.mount b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.container/initrd-usr-fs.target.requires/sysroot.mount
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/dev-sdx1.device.d/50-netdev-dependencies.conf b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/dev-sdx1.device.d/50-netdev-dependencies.conf
new file mode 100644
index 0000000000..33d814c275
--- /dev/null
+++ b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/dev-sdx1.device.d/50-netdev-dependencies.conf
@@ -0,0 +1,5 @@
+# Automatically generated by systemd-fstab-generator
+
+[Unit]
+After=network-online.target network.target
+Wants=network-online.target
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/dev-sdx1.swap b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/dev-sdx1.swap
new file mode 100644
index 0000000000..32f276c9e1
--- /dev/null
+++ b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/dev-sdx1.swap
@@ -0,0 +1,10 @@
+# Automatically generated by systemd-fstab-generator
+
+[Unit]
+Documentation=man:fstab(5) man:systemd-fstab-generator(8)
+SourcePath=/etc/fstab
+After=blockdev@dev-sdx1.target
+
+[Swap]
+What=/dev/sdx1
+Options=_netdev
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/local-fs.target.wants/systemd-remount-fs.service b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/local-fs.target.wants/systemd-remount-fs.service
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/remote-fs.target.requires/dev-sdx1.swap b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/remote-fs.target.requires/dev-sdx1.swap
new file mode 120000
index 0000000000..00f0c5ce66
--- /dev/null
+++ b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected.sysroot/remote-fs.target.requires/dev-sdx1.swap
@@ -0,0 +1 @@
+../dev-sdx1.swap
\ No newline at end of file
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/dev-sdx1.device.d/50-netdev-dependencies.conf b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/dev-sdx1.device.d/50-netdev-dependencies.conf
new file mode 100644
index 0000000000..33d814c275
--- /dev/null
+++ b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/dev-sdx1.device.d/50-netdev-dependencies.conf
@@ -0,0 +1,5 @@
+# Automatically generated by systemd-fstab-generator
+
+[Unit]
+After=network-online.target network.target
+Wants=network-online.target
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/dev-sdx1.swap b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/dev-sdx1.swap
new file mode 100644
index 0000000000..32f276c9e1
--- /dev/null
+++ b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/dev-sdx1.swap
@@ -0,0 +1,10 @@
+# Automatically generated by systemd-fstab-generator
+
+[Unit]
+Documentation=man:fstab(5) man:systemd-fstab-generator(8)
+SourcePath=/etc/fstab
+After=blockdev@dev-sdx1.target
+
+[Swap]
+What=/dev/sdx1
+Options=_netdev
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/initrd-usr-fs.target.requires/sysroot.mount b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/initrd-usr-fs.target.requires/sysroot.mount
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/remote-fs.target.requires/dev-sdx1.swap b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/remote-fs.target.requires/dev-sdx1.swap
new file mode 120000
index 0000000000..00f0c5ce66
--- /dev/null
+++ b/test/test-fstab-generator/test-21-swap-netdev.fstab.expected/remote-fs.target.requires/dev-sdx1.swap
@@ -0,0 +1 @@
+../dev-sdx1.swap
\ No newline at end of file
diff --git a/test/test-fstab-generator/test-21-swap-netdev.fstab.input b/test/test-fstab-generator/test-21-swap-netdev.fstab.input
new file mode 100644
index 0000000000..5f719a4202
--- /dev/null
+++ b/test/test-fstab-generator/test-21-swap-netdev.fstab.input
@@ -0,0 +1 @@
+/dev/sdx1 none swap _netdev 0 0

27
0670-man-add-tags-for-the-next-few-versions.patch Normal file
View File

@ -0,0 +1,27 @@
From bd1621f973250525e4adef8f3466b56b98c4ff75 Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Fri, 6 Mar 2026 00:25:10 +0000
Subject: [PATCH] man: add tags for the next few versions
(cherry picked from commit acce28884dd2e651d2bf09621c53b767edd4a050)
Related: RHEL-128058
---
man/version-info.xml | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/man/version-info.xml b/man/version-info.xml
index c1138dfe22..ab0b122237 100644
--- a/man/version-info.xml
+++ b/man/version-info.xml
@@ -84,6 +84,10 @@
<para id="v258">Added in version 258.</para>
<para id="v259">Added in version 259.</para>
<para id="v260">Added in version 260.</para>
+ <para id="v261">Added in version 261.</para>
+ <para id="v262">Added in version 262.</para>
+ <para id="v263">Added in version 263.</para>
+ <para id="v264">Added in version 264.</para>
<para id="rhel-8.0">Added in rhel-8.0.</para>
<para id="rhel-8.1">Added in rhel-8.1.</para>
<para id="rhel-8.2">Added in rhel-8.2.</para>

29
0671-test-drop-some-extraneous-whitespaces.patch Normal file
View File

@ -0,0 +1,29 @@
From 553503cc7c263f2b22d8d3f2b9af608939e967ca Mon Sep 17 00:00:00 2001
From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Fri, 6 Mar 2026 16:09:21 +0100
Subject: [PATCH] test: drop some extraneous whitespaces
(cherry picked from commit 45830bc8d28513ebe7b57df178bfedeff75b80cf)
Related: RHEL-155021
---
test/units/TEST-74-AUX-UTILS.userdbctl.sh | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/test/units/TEST-74-AUX-UTILS.userdbctl.sh b/test/units/TEST-74-AUX-UTILS.userdbctl.sh
index c6ecc4ea63..ef56114453 100755
--- a/test/units/TEST-74-AUX-UTILS.userdbctl.sh
+++ b/test/units/TEST-74-AUX-UTILS.userdbctl.sh
@@ -19,9 +19,9 @@ u test-74-userdbctl - "Test user for TEST-74-AUX-UTILS.userdbctl.sh" / /bin/bash
EOF
# Make sure that -F shows same data as if we'd ask directly
-userdbctl user root -j | userdbctl -F- user | cmp - <(userdbctl user root)
-userdbctl user test-74-userdbctl -j | userdbctl -F- user | cmp - <(userdbctl user test-74-userdbctl)
-userdbctl user 65534 -j | userdbctl -F- user | cmp - <(userdbctl user 65534)
+userdbctl user root -j | userdbctl -F- user | cmp - <(userdbctl user root)
+userdbctl user test-74-userdbctl -j | userdbctl -F- user | cmp - <(userdbctl user test-74-userdbctl)
+userdbctl user 65534 -j | userdbctl -F- user | cmp - <(userdbctl user 65534)
userdbctl group root -j | userdbctl -F- group | cmp - <(userdbctl group root)
userdbctl group test-74-userdbctl -j | userdbctl -F- group | cmp - <(userdbctl group test-74-userdbctl)

52
0672-shared-fix-segfault-when-processing-matchHostname-fi.patch Normal file
View File

@ -0,0 +1,52 @@
From 3cf7e6cbb522532a87458036b6d3642500bfee3a Mon Sep 17 00:00:00 2001
From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Fri, 6 Mar 2026 16:09:35 +0100
Subject: [PATCH] shared: fix segfault when processing matchHostname field
Fix a typo which causes a segfault when processing a user record
with matchHostname when it's an array instead of a simple string:
$ echo '{"userName":"crashhostarray","perMachine":[{"matchHostname":["host1","host2"],"locked":false}]}' | userdbctl -F -
Segmentation fault (core dumped)
$ coredumpctl info
...
Message: Process 1172301 (userdbctl) of user 1000 dumped core.
Module libz.so.1 from rpm zlib-ng-2.3.3-1.fc43.x86_64
Module libcrypto.so.3 from rpm openssl-3.5.4-2.fc43.x86_64
Stack trace of thread 1172301:
#0 0x00007fded7b3a656 __strcmp_evex (libc.so.6 + 0x159656)
#1 0x00007fded7e95397 per_machine_hostname_match (libsystemd-shared-260.so + 0x295397)
#2 0x00007fded7e955b5 per_machine_match (libsystemd-shared-260.so + 0x2955b5)
#3 0x00007fded7e957c6 dispatch_per_machine (libsystemd-shared-260.so + 0x2957c6)
#4 0x00007fded7e96c97 user_record_load (libsystemd-shared-260.so + 0x296c97)
#5 0x000000000040572d display_user (/home/fsumsal/repos/@systemd/systemd/build/userdbctl + 0x572d)
#6 0x00007fded7ea9727 dispatch_verb (libsystemd-shared-260.so + 0x2a9727)
#7 0x000000000041077c run (/home/fsumsal/repos/@systemd/systemd/build/userdbctl + 0x1077c)
#8 0x00000000004107ce main (/home/fsumsal/repos/@systemd/systemd/build/userdbctl + 0x107ce)
#9 0x00007fded79e45b5 __libc_start_call_main (libc.so.6 + 0x35b5)
#10 0x00007fded79e4668 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x3668)
#11 0x00000000004038d5 _start (/home/fsumsal/repos/@systemd/systemd/build/userdbctl + 0x38d5)
ELF object binary architecture: AMD x86-64
(cherry picked from commit 1e2517bf2ee1b55c7c2406574f95b7d5788f6179)
Resolves: RHEL-155021
---
src/shared/user-record.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/shared/user-record.c b/src/shared/user-record.c
index 6a1813c402..38d14cbca5 100644
--- a/src/shared/user-record.c
+++ b/src/shared/user-record.c
@@ -1197,7 +1197,7 @@ int per_machine_hostname_match(sd_json_variant *hns, sd_json_dispatch_flags_t fl
continue;
}
- if (streq(sd_json_variant_string(hns), hn))
+ if (streq(sd_json_variant_string(e), hn))
return true;
}

57
0673-shared-don-t-exclude-valid-min-max-values-for-cgroup.patch Normal file
View File

@ -0,0 +1,57 @@
From 08b4a2c4340aa8d4285f90b266aaae45cb3579aa Mon Sep 17 00:00:00 2001
From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Fri, 6 Mar 2026 16:36:52 +0100
Subject: [PATCH] shared: don't exclude valid min/max values for cgroup weight
fields
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
1 and 10000 are valid cgroup weight values, but the condition was
incorrectly excluding them:
$ echo '{"userName":"crashhostarray","cpuWeight":1}' | userdbctl -F -
<stdin>:1:42: JSON field 'cpuWeight' is not in valid range 1…10000.
$ echo '{"userName":"crashhostarray","cpuWeight":10000}' | userdbctl -F -
<stdin>:1:42: JSON field 'cpuWeight' is not in valid range 1…10000.
(cherry picked from commit 76ab7861ff8ce505cf8deff880ce2d6c1bd05e0c)
Related: RHEL-155021
---
src/shared/user-record.c | 6 +++---
test/units/TEST-74-AUX-UTILS.userdbctl.sh | 4 ++++
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/src/shared/user-record.c b/src/shared/user-record.c
index 38d14cbca5..ddfeaf6659 100644
--- a/src/shared/user-record.c
+++ b/src/shared/user-record.c
@@ -590,11 +590,11 @@ static int json_dispatch_weight(const char *name, sd_json_variant *variant, sd_j
return json_log(variant, flags, SYNTHETIC_ERRNO(EINVAL), "JSON field '%s' is not an integer.", strna(name));
k = sd_json_variant_unsigned(variant);
- if (k <= CGROUP_WEIGHT_MIN || k >= CGROUP_WEIGHT_MAX)
+ if (k < CGROUP_WEIGHT_MIN || k > CGROUP_WEIGHT_MAX)
return json_log(variant, flags, SYNTHETIC_ERRNO(ERANGE),
"JSON field '%s' is not in valid range %" PRIu64 "%s%" PRIu64 ".",
- strna(name), (uint64_t) CGROUP_WEIGHT_MIN,
- special_glyph(SPECIAL_GLYPH_ELLIPSIS), (uint64_t) CGROUP_WEIGHT_MAX);
+ strna(name), CGROUP_WEIGHT_MIN,
+ special_glyph(SPECIAL_GLYPH_ELLIPSIS), CGROUP_WEIGHT_MAX);
*weight = k;
return 0;
diff --git a/test/units/TEST-74-AUX-UTILS.userdbctl.sh b/test/units/TEST-74-AUX-UTILS.userdbctl.sh
index ef56114453..55963ccd43 100755
--- a/test/units/TEST-74-AUX-UTILS.userdbctl.sh
+++ b/test/units/TEST-74-AUX-UTILS.userdbctl.sh
@@ -26,3 +26,7 @@ userdbctl user 65534 -j | userdbctl -F- user | cmp - <(userdbctl user 65534)
userdbctl group root -j | userdbctl -F- group | cmp - <(userdbctl group root)
userdbctl group test-74-userdbctl -j | userdbctl -F- group | cmp - <(userdbctl group test-74-userdbctl)
userdbctl group 65534 -j | userdbctl -F- group | cmp - <(userdbctl group 65534)
+
+# Probe specific user records
+echo '{"userName":"weightmin","cpuWeight":1,"ioWeight":1}' | userdbctl -F -
+echo '{"userName":"weightmax","cpuWeight":10000,"ioWeight":10000}' | userdbctl -F -

75
0674-shared-don-t-leak-memory-from-array-fields.patch Normal file
View File

@ -0,0 +1,75 @@
From ef7a20ffd480b8c6021cf1277ac3f8c4293d48c1 Mon Sep 17 00:00:00 2001
From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Fri, 6 Mar 2026 17:16:31 +0100
Subject: [PATCH] shared: don't leak memory from array fields
The fido2_hmac_salt/fido2_hmac_credential/recovery_key fields kept
leaking memory as the array itself wasn't deallocated after deallocating
each of its elements data:
$ build-san/userdbctl -F fuzz-corpus-userdb/auth-fido2.json
...
=================================================================
==1292840==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 112 byte(s) in 1 object(s) allocated from:
#0 0x7f56f00e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b) (BuildId: 25975f766867e9e604dc5a71a8befeaed3301942)
#1 0x7f56ed869e42 in greedy_realloc ../src/basic/alloc-util.c:65
#2 0x7f56ed7ff5e9 in dispatch_fido2_hmac_salt ../src/shared/user-record.c:836
#3 0x7f56edd73cbc in sd_json_dispatch_full ../src/libsystemd/sd-json/sd-json.c:5204
#4 0x7f56edd745fc in sd_json_dispatch ../src/libsystemd/sd-json/sd-json.c:5276
#5 0x7f56ed80100b in dispatch_privileged ../src/shared/user-record.c:998
#6 0x7f56edd73cbc in sd_json_dispatch_full ../src/libsystemd/sd-json/sd-json.c:5204
#7 0x7f56edd745fc in sd_json_dispatch ../src/libsystemd/sd-json/sd-json.c:5276
#8 0x7f56ed80622c in user_record_load ../src/shared/user-record.c:1697
#9 0x000000408c15 in display_user ../src/userdb/userdbctl.c:447
#10 0x7f56ed83cc9a in dispatch_verb ../src/shared/verbs.c:137
#11 0x00000041df2b in run ../src/userdb/userdbctl.c:1908
#12 0x00000041dfbe in main ../src/userdb/userdbctl.c:1911
#13 0x7f56ec8105b4 in __libc_start_call_main (/lib64/libc.so.6+0x35b4) (BuildId: 2b5beec0fd24fe9c9f43eddfdd5facf0b8a1b805)
#14 0x7f56ec810667 in __libc_start_main@@GLIBC_2.34 (/lib64/libc.so.6+0x3667) (BuildId: 2b5beec0fd24fe9c9f43eddfdd5facf0b8a1b805)
#15 0x000000404a44 in _start (/home/fsumsal/repos/@systemd/systemd/build-san/userdbctl+0x404a44) (BuildId: 19e8b7e7b7038d2cea20bc18a55bea2a9e4406d5)
Direct leak of 64 byte(s) in 1 object(s) allocated from:
#0 0x7f56f00e5e4b in realloc.part.0 (/lib64/libasan.so.8+0xe5e4b) (BuildId: 25975f766867e9e604dc5a71a8befeaed3301942)
#1 0x7f56ed869e42 in greedy_realloc ../src/basic/alloc-util.c:65
#2 0x7f56ed7fe779 in dispatch_fido2_hmac_credential_array ../src/shared/user-record.c:775
#3 0x7f56edd73cbc in sd_json_dispatch_full ../src/libsystemd/sd-json/sd-json.c:5204
#4 0x7f56edd745fc in sd_json_dispatch ../src/libsystemd/sd-json/sd-json.c:5276
#5 0x7f56ed80622c in user_record_load ../src/shared/user-record.c:1697
#6 0x000000408c15 in display_user ../src/userdb/userdbctl.c:447
#7 0x7f56ed83cc9a in dispatch_verb ../src/shared/verbs.c:137
#8 0x00000041df2b in run ../src/userdb/userdbctl.c:1908
#9 0x00000041dfbe in main ../src/userdb/userdbctl.c:1911
#10 0x7f56ec8105b4 in __libc_start_call_main (/lib64/libc.so.6+0x35b4) (BuildId: 2b5beec0fd24fe9c9f43eddfdd5facf0b8a1b805)
#11 0x7f56ec810667 in __libc_start_main@@GLIBC_2.34 (/lib64/libc.so.6+0x3667) (BuildId: 2b5beec0fd24fe9c9f43eddfdd5facf0b8a1b805)
#12 0x000000404a44 in _start (/home/fsumsal/repos/@systemd/systemd/build-san/userdbctl+0x404a44) (BuildId: 19e8b7e7b7038d2cea20bc18a55bea2a9e4406d5)
SUMMARY: AddressSanitizer: 176 byte(s) leaked in 2 allocation(s).
(cherry picked from commit 3c7bd947b29775c6dd035a27462f445d5945447b)
Related: RHEL-155021
---
src/shared/user-record.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/shared/user-record.c b/src/shared/user-record.c
index ddfeaf6659..f4febcdebe 100644
--- a/src/shared/user-record.c
+++ b/src/shared/user-record.c
@@ -205,12 +205,15 @@ static UserRecord* user_record_free(UserRecord *h) {
for (size_t i = 0; i < h->n_fido2_hmac_credential; i++)
fido2_hmac_credential_done(h->fido2_hmac_credential + i);
+ free(h->fido2_hmac_credential);
for (size_t i = 0; i < h->n_fido2_hmac_salt; i++)
fido2_hmac_salt_done(h->fido2_hmac_salt + i);
+ free(h->fido2_hmac_salt);
strv_free(h->recovery_key_type);
for (size_t i = 0; i < h->n_recovery_key; i++)
recovery_key_done(h->recovery_key + i);
+ free(h->recovery_key);
strv_free(h->self_modifiable_fields);
strv_free(h->self_modifiable_blobs);

25
0675-man-fix-short-option-for-userdbctl-s-from-file.patch Normal file
View File

@ -0,0 +1,25 @@
From 66fb573d491e479eff79866d0709d0af29f6ba46 Mon Sep 17 00:00:00 2001
From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Fri, 6 Mar 2026 17:30:52 +0100
Subject: [PATCH] man: fix short option for userdbctl's --from-file=
(cherry picked from commit ad1c7df5f93a2602e73ba5673e483b3e5d1b5422)
Related: RHEL-155021
---
man/userdbctl.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/man/userdbctl.xml b/man/userdbctl.xml
index 4da9762ab0..aefeb740f2 100644
--- a/man/userdbctl.xml
+++ b/man/userdbctl.xml
@@ -254,7 +254,7 @@
<varlistentry>
<term><option>--from-file=PATH</option></term>
- <term><option>-f</option></term>
+ <term><option>-F</option></term>
<listitem><para>When used with the <command>user</command> or <command>group</command> command, read
the user definition in JSON format from the specified file, instead of querying it from the

1376
0676-fuzz-add-a-fuzzer-for-user-records.patch Normal file
View File

File diff suppressed because it is too large Load Diff

81
0677-user-record-extract-user_record_image_is_blockdev-co.patch Normal file
View File

@ -0,0 +1,81 @@
From fc1337e72cc8c224ddf0e99297b1db6f15be622a Mon Sep 17 00:00:00 2001
From: Mike Yuan <me@yhndnzj.com>
Date: Fri, 6 Mar 2026 22:07:31 +0100
Subject: [PATCH] user-record: extract user_record_image_is_blockdev() common
helper
(cherry picked from commit a7f1670f62cc8bc37f52acee94d2209eff66cd10)
Related: RHEL-155021
---
src/shared/user-record.c | 20 +++++++++++--------
.../crash-empty-image-path.json | 4 ++++
2 files changed, 16 insertions(+), 8 deletions(-)
create mode 100644 test/fuzz/fuzz-user-record/crash-empty-image-path.json
diff --git a/src/shared/user-record.c b/src/shared/user-record.c
index f4febcdebe..df65df72fa 100644
--- a/src/shared/user-record.c
+++ b/src/shared/user-record.c
@@ -1856,6 +1856,16 @@ const char* user_record_image_path(UserRecord *h) {
user_record_home_directory_real(h) : NULL;
}
+static bool user_record_image_is_blockdev(UserRecord *h) {
+ assert(h);
+
+ const char *p = user_record_image_path(h);
+ if (!p)
+ return false;
+
+ return path_startswith(p, "/dev/");
+}
+
const char* user_record_cifs_user_name(UserRecord *h) {
assert(h);
@@ -1907,24 +1917,18 @@ const char* user_record_real_name(UserRecord *h) {
}
bool user_record_luks_discard(UserRecord *h) {
- const char *ip;
-
assert(h);
if (h->luks_discard >= 0)
return h->luks_discard;
- ip = user_record_image_path(h);
- if (!ip)
- return false;
-
/* Use discard by default if we are referring to a real block device, but not when operating on a
* loopback device. We want to optimize for SSD and flash storage after all, but we should be careful
* when storing stuff on top of regular file systems in loopback files as doing discard then would
* mean thin provisioning and we should not do that willy-nilly since it means we'll risk EIO later
* on should the disk space to back our file systems not be available. */
- return path_startswith(ip, "/dev/");
+ return user_record_image_is_blockdev(h);
}
bool user_record_luks_offline_discard(UserRecord *h) {
@@ -2090,7 +2094,7 @@ int user_record_removable(UserRecord *h) {
return -1;
/* For now consider only LUKS home directories with a reference by path as removable */
- return storage == USER_LUKS && path_startswith(user_record_image_path(h), "/dev/");
+ return storage == USER_LUKS && user_record_image_is_blockdev(h);
}
uint64_t user_record_ratelimit_interval_usec(UserRecord *h) {
diff --git a/test/fuzz/fuzz-user-record/crash-empty-image-path.json b/test/fuzz/fuzz-user-record/crash-empty-image-path.json
new file mode 100644
index 0000000000..0506a71fc2
--- /dev/null
+++ b/test/fuzz/fuzz-user-record/crash-empty-image-path.json
@@ -0,0 +1,4 @@
+{
+ "userName": "root",
+ "storage": "luks"
+}

58
0678-udev-net_id-introduce-naming-scheme-for-RHEL-9.9.patch Normal file
View File

@ -0,0 +1,58 @@
From 8f011c16cc4fffd1c94211a081f571554bb19103 Mon Sep 17 00:00:00 2001
From: Jan Macku <jamacku@redhat.com>
Date: Mon, 4 May 2026 10:00:28 +0200
Subject: [PATCH] udev/net_id: introduce naming scheme for RHEL-9.9
rhel-only: policy
Resolves: RHEL-72814
---
man/systemd.net-naming-scheme.xml | 9 +++++++++
src/shared/netif-naming-scheme.c | 1 +
src/shared/netif-naming-scheme.h | 1 +
3 files changed, 11 insertions(+)
diff --git a/man/systemd.net-naming-scheme.xml b/man/systemd.net-naming-scheme.xml
index 3c4d67cce3..623296a381 100644
--- a/man/systemd.net-naming-scheme.xml
+++ b/man/systemd.net-naming-scheme.xml
@@ -679,6 +679,15 @@
<xi:include href="version-info.xml" xpointer="rhel-9.8"/>
</listitem>
</varlistentry>
+
+ <varlistentry>
+ <term><constant>rhel-9.9</constant></term>
+
+ <listitem><para>Same as naming scheme <constant>rhel-9.8</constant>.</para>
+
+ <xi:include href="version-info.xml" xpointer="rhel-9.9"/>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect2>
diff --git a/src/shared/netif-naming-scheme.c b/src/shared/netif-naming-scheme.c
index 18b012b8c8..00f1e2960f 100644
--- a/src/shared/netif-naming-scheme.c
+++ b/src/shared/netif-naming-scheme.c
@@ -45,6 +45,7 @@ static const NamingScheme naming_schemes[] = {
{ "rhel-9.6", NAMING_RHEL_9_6 },
{ "rhel-9.7", NAMING_RHEL_9_7 },
{ "rhel-9.8", NAMING_RHEL_9_8 },
+ { "rhel-9.9", NAMING_RHEL_9_9 },
{ "rhel-10.0-beta", NAMING_RHEL_10_0_BETA },
{ "rhel-10.0", NAMING_RHEL_10_0 },
{ "rhel-10.1", NAMING_RHEL_10_1 },
diff --git a/src/shared/netif-naming-scheme.h b/src/shared/netif-naming-scheme.h
index eab374fb9a..ec3bd96114 100644
--- a/src/shared/netif-naming-scheme.h
+++ b/src/shared/netif-naming-scheme.h
@@ -87,6 +87,7 @@ typedef enum NamingSchemeFlags {
NAMING_RHEL_9_6 = NAMING_RHEL_9_5,
NAMING_RHEL_9_7 = NAMING_RHEL_9_5,
NAMING_RHEL_9_8 = NAMING_RHEL_9_5 | NAMING_FIRMWARE_NODE_SUN,
+ NAMING_RHEL_9_9 = NAMING_RHEL_9_8,
NAMING_RHEL_10_0_BETA = NAMING_V255,
NAMING_RHEL_10_0 = NAMING_V257,

58
0679-udev-net_id-introduce-naming-scheme-for-RHEL-10.3.patch Normal file
View File

@ -0,0 +1,58 @@
From f7ad5e9f0e96751e7e8084ecf23813bababc2def Mon Sep 17 00:00:00 2001
From: Jan Macku <jamacku@redhat.com>
Date: Mon, 4 May 2026 10:02:45 +0200
Subject: [PATCH] udev/net_id: introduce naming scheme for RHEL-10.3
rhel-only: policy
Resolves: RHEL-72814
---
man/systemd.net-naming-scheme.xml | 9 +++++++++
src/shared/netif-naming-scheme.c | 1 +
src/shared/netif-naming-scheme.h | 1 +
3 files changed, 11 insertions(+)
diff --git a/man/systemd.net-naming-scheme.xml b/man/systemd.net-naming-scheme.xml
index 623296a381..19ad5c2340 100644
--- a/man/systemd.net-naming-scheme.xml
+++ b/man/systemd.net-naming-scheme.xml
@@ -576,6 +576,15 @@
<xi:include href="version-info.xml" xpointer="rhel-10.2"/>
</listitem>
</varlistentry>
+
+ <varlistentry>
+ <term><constant>rhel-10.3</constant></term>
+
+ <listitem><para>Same as naming scheme <constant>rhel-10.0</constant>.</para>
+
+ <xi:include href="version-info.xml" xpointer="rhel-10.3"/>
+ </listitem>
+ </varlistentry>
</variablelist>
<para>By default <constant>rhel-10.0</constant> is used.</para>
diff --git a/src/shared/netif-naming-scheme.c b/src/shared/netif-naming-scheme.c
index 00f1e2960f..2faa57f1f5 100644
--- a/src/shared/netif-naming-scheme.c
+++ b/src/shared/netif-naming-scheme.c
@@ -50,6 +50,7 @@ static const NamingScheme naming_schemes[] = {
{ "rhel-10.0", NAMING_RHEL_10_0 },
{ "rhel-10.1", NAMING_RHEL_10_1 },
{ "rhel-10.2", NAMING_RHEL_10_2 },
+ { "rhel-10.3", NAMING_RHEL_10_3 },
/* … add more schemes here, as the logic to name devices is updated … */
EXTRA_NET_NAMING_MAP
diff --git a/src/shared/netif-naming-scheme.h b/src/shared/netif-naming-scheme.h
index ec3bd96114..8fae83f61a 100644
--- a/src/shared/netif-naming-scheme.h
+++ b/src/shared/netif-naming-scheme.h
@@ -93,6 +93,7 @@ typedef enum NamingSchemeFlags {
NAMING_RHEL_10_0 = NAMING_V257,
NAMING_RHEL_10_1 = NAMING_RHEL_10_0,
NAMING_RHEL_10_2 = NAMING_RHEL_10_0,
+ NAMING_RHEL_10_3 = NAMING_RHEL_10_0,
EXTRA_NET_NAMING_SCHEMES

28
0680-Tag-accel-devices-for-uaccess-render.patch Normal file
View File

@ -0,0 +1,28 @@
From db3cce5b588ff3f005fa3757101c328a83362dd3 Mon Sep 17 00:00:00 2001
From: "Mario Limonciello (AMD)" <superm1@kernel.org>
Date: Sun, 15 Feb 2026 07:28:47 -0600
Subject: [PATCH] Tag accel devices for uaccess-render
accel devices are used for things like NPUs and should be tagged
for the logged in user just like GPUs are.
(cherry picked from commit e30c044c23c1dc7ef44ccb3892d942dc256d1b02)
Resolves: RHEL-153030
---
rules.d/70-uaccess.rules.in | 2 ++
1 file changed, 2 insertions(+)
diff --git a/rules.d/70-uaccess.rules.in b/rules.d/70-uaccess.rules.in
index 046f169e44..6ba4200ff9 100644
--- a/rules.d/70-uaccess.rules.in
+++ b/rules.d/70-uaccess.rules.in
@@ -47,6 +47,8 @@ SUBSYSTEM=="drm", KERNEL=="card*", TAG+="uaccess"
{% if GROUP_RENDER_UACCESS %}
# DRI render nodes
SUBSYSTEM=="drm", KERNEL=="renderD*", TAG+="uaccess"
+# DRI accel nodes
+SUBSYSTEM=="accel", KERNEL=="accel*", TAG+="uaccess", TAG+="xaccess-accel"
{% endif %}
{% if DEV_KVM_UACCESS %}
# KVM

29
0681-udev-tag-kfd-devices-for-xaccess-render-40888.patch Normal file
View File

@ -0,0 +1,29 @@
From 9041d136f9d72358233b9b66eef13a7906e1c794 Mon Sep 17 00:00:00 2001
From: Mario Limonciello <superm1@kernel.org>
Date: Sun, 1 Mar 2026 21:32:50 -0600
Subject: [PATCH] udev: tag kfd devices for xaccess-render (#40888)
The kfd device is used for running compute workloads on AMD
GPUs. Users that are logged in should be able to run compute
so tag them like other DRM and ACCEL devices are.
(cherry picked from commit 9d3b73d9bf181e6adf2e900739c4d998e3450a12)
Resolves: RHEL-153030
---
rules.d/70-uaccess.rules.in | 2 ++
1 file changed, 2 insertions(+)
diff --git a/rules.d/70-uaccess.rules.in b/rules.d/70-uaccess.rules.in
index 6ba4200ff9..8c05bd3454 100644
--- a/rules.d/70-uaccess.rules.in
+++ b/rules.d/70-uaccess.rules.in
@@ -49,6 +49,8 @@ SUBSYSTEM=="drm", KERNEL=="card*", TAG+="uaccess"
SUBSYSTEM=="drm", KERNEL=="renderD*", TAG+="uaccess"
# DRI accel nodes
SUBSYSTEM=="accel", KERNEL=="accel*", TAG+="uaccess", TAG+="xaccess-accel"
+# AMD KFD nodes
+SUBSYSTEM=="kfd", KERNEL=="kfd", TAG+="uaccess", TAG+="xaccess-render"
{% endif %}
{% if DEV_KVM_UACCESS %}
# KVM

44
systemd.spec
View File

@ -48,7 +48,7 @@ Url: https://systemd.io
# Allow users to specify the version and release when building the rpm by
# setting the %%version_override and %%release_override macros.
Version: %{?version_override}%{!?version_override:257}
Release: 24%{?dist}
Release: 25%{?dist}
%global stable %(c="%version"; [ "$c" = "${c#*.*}" ]; echo $?)
@ -771,6 +771,26 @@ Patch0658: 0658-user-runtime-dir-correct-quota-size-calculation.patch
Patch0659: 0659-test-display-quota-add-a-little-helper-binary-to-sho.patch
Patch0660: 0660-TEST-46-HOMED-check-for-support-on-dev-shm-and-tmp-s.patch
Patch0661: 0661-TEST-46-HOMED-conditionally-skip-usrquota-tests.patch
Patch0662: 0662-core-cleanup-unit-s-dropin-directories-from-global-c.patch
Patch0663: 0663-libsystemd-drop-const-decorators-on-public-inline-fu.patch
Patch0664: 0664-sd-id128-Drop-_sd_const_-from-sd_id128_in_setv.patch
Patch0665: 0665-test-wrap-mount-umount-when-running-with-sanitizers.patch
Patch0666: 0666-test-wrap-even-more-binaries-when-running-with-sanit.patch
Patch0667: 0667-test-temporarily-ignore-sanitizer-warning-about-bloc.patch
Patch0668: 0668-test-slightly-reduce-the-performance-memory-overhead.patch
Patch0669: 0669-fstab-generator-support-swap-on-network-block-device.patch
Patch0670: 0670-man-add-tags-for-the-next-few-versions.patch
Patch0671: 0671-test-drop-some-extraneous-whitespaces.patch
Patch0672: 0672-shared-fix-segfault-when-processing-matchHostname-fi.patch
Patch0673: 0673-shared-don-t-exclude-valid-min-max-values-for-cgroup.patch
Patch0674: 0674-shared-don-t-leak-memory-from-array-fields.patch
Patch0675: 0675-man-fix-short-option-for-userdbctl-s-from-file.patch
Patch0676: 0676-fuzz-add-a-fuzzer-for-user-records.patch
Patch0677: 0677-user-record-extract-user_record_image_is_blockdev-co.patch
Patch0678: 0678-udev-net_id-introduce-naming-scheme-for-RHEL-9.9.patch
Patch0679: 0679-udev-net_id-introduce-naming-scheme-for-RHEL-10.3.patch
Patch0680: 0680-Tag-accel-devices-for-uaccess-render.patch
Patch0681: 0681-udev-tag-kfd-devices-for-xaccess-render-40888.patch
# Downstream-only patches (9000–9999)
%endif
@ -1722,6 +1742,28 @@ rm -f .file-list-*
rm -f %{name}.lang
%changelog
* Tue May 12 2026 systemd maintenance team <systemd-maint@redhat.com> - 257-25
- core: cleanup unit's dropin directories from global cache (RHEL-171097)
- libsystemd: drop "const" decorators on public inline functions (RHEL-155454)
- sd-id128: Drop _sd_const_ from sd_id128_in_setv() (RHEL-155454)
- test: wrap mount/umount when running with sanitizers (RHEL-155454)
- test: wrap even more binaries when running with sanitizers (RHEL-155454)
- test: temporarily ignore sanitizer warning about blocked ptrace() (RHEL-155454)
- test: slightly reduce the performance/memory overhead for wrapped binaries (RHEL-155454)
- fstab-generator: support swap on network block devices (RHEL-128058)
- man: add tags for the next few versions (RHEL-128058)
- test: drop some extraneous whitespaces (RHEL-155021)
- shared: fix segfault when processing matchHostname field (RHEL-155021)
- shared: don't exclude valid min/max values for cgroup weight fields (RHEL-155021)
- shared: don't leak memory from array fields (RHEL-155021)
- man: fix short option for userdbctl's --from-file= (RHEL-155021)
- fuzz: add a fuzzer for user records (RHEL-155021)
- user-record: extract user_record_image_is_blockdev() common helper (RHEL-155021)
- udev/net_id: introduce naming scheme for RHEL-9.9 (RHEL-72814)
- udev/net_id: introduce naming scheme for RHEL-10.3 (RHEL-72814)
- Tag accel devices for uaccess-render (RHEL-153030)
- udev: tag kfd devices for xaccess-render (#40888) (RHEL-153030)
* Thu Apr 16 2026 systemd maintenance team <systemd-maint@redhat.com> - 257-24
- ci: re-enable bpf-framework option for build and unit test jobs (RHEL-155454)
- ci: add bpftool workaround to codeql job too (RHEL-155454)