redhat-plumbers / systemd-rhel9 Goto Github PK

https://github.com/openSUSE/systemd/blob/6c83054c0133eb53245e479d71589dceff76cf74/TODO#L957

based on https://www.freedesktop.org/software/systemd/man/crypttab.html

NUL RANDOM /cryptsetup/ VOLUME
In other words: a NUL byte (as required for abstract namespace sockets), followed by a random string (consisting of alphanumeric characters only), followed by the literal string "/cryptsetup/", followed by the name of the volume to acquire they key for. For example, for the volume "myvol":

\0d7067f78d9827418/cryptsetup/myvol

and my /etc/crypttab is

# <target name>        <source device>                <key file>        <options>
rootfs UUID=a5ba171f-d9a1-4874-b898-931ffd29a017 \0volcengine/cryptsetup/rootfs luks

but when update-initramfs, i see the following warns:

cryptsetup: WARNING: rootfs: keyfile 'volcengine/cryptsetup/rootfs' not found
cryptsetup: WARNING: Skipping root target rootfs: uses a key file

and /cryptroot/crypttab in the generated initrd.img is empty

It would be great to have this in RHEL 9 (especially for making tests more reliable, like TEST-64-UDEV-STORAGE and TEST-58-REPART), however, it might pull in a lot of other stuff.

Main PRs:

• systemd/systemd#22872
• systemd/systemd#22867

Follow-ups:

• systemd/systemd#22960 (depends on systemd/systemd#22745)
• systemd/systemd#22964
• systemd/systemd#22996
• and more (probably)

Once https://gitlab.com/redhat/centos-stream/rpms/systemd/-/merge_requests/26 is merged we need to force push main branch in this repo to make sure that state of c9s dist-git and this repository correspond to each other.

In the MR I've dropped all current downstream patches except patch from #5. Hence the new state of this repo should be systemd-v249 plus one commit from #5.

Recently we have merged couple of PRs into main that contained incorrect bug references. Commit messages in those PRs referred to bugs for RHEL-9 Beta while they should have referred to RHEL-9.0 clones. In order to not create confusion we should revert those, force push the main branch and resubmit all those PRs.

This is the tracker where I will summarise work items that need to happen in order to successfully deliver new systemd version v250 in RHEL-9.

TODO

• Create rebase bug in Red Hat Bugzilla
  https://bugzilla.redhat.com/show_bug.cgi?id=2047768
• Prepare new content of the main branch (systemd-stable/v250-stable + RHEL-only patches)
  https://github.com/msekletar/rhel-9/commits/main
• Rebase main to v250.3 + downstream patches (i.e. content from previous item)
  https://github.com/redhat-plumbers/systemd-rhel9/commits/main
• Upload new sources to CentOS Stream 9 look aside cache
• Prepare CentOS stream merge request with the rebase
  https://gitlab.com/redhat/centos-stream/rpms/systemd/-/merge_requests/42
  scratch build: https://kojihub.stream.rdu2.redhat.com/koji/taskinfo?taskID=914983
• Review and merge CentOS Stream 9 PR
  merged
• Review all currently proposed PRs and figure out whether they are still relevant, if so then rebase them on top of main
• Verify CI configuration
• Change spec file to use the same version numbering scheme as in RHEL-8 (SAP request)
  https://gitlab.com/redhat/centos-stream/rpms/systemd/-/merge_requests/43
• Add rhel-9.0.0 network naming scheme
  #68

Referenced bug was for RHEL 9.0.0, but main is already tracking RHEL 9.1.0.

PR: #72 \cc @mrc0mmand

@jamacku we need to wait with this one until systemd/systemd#25661 is sorted out. On top of that we will need to change rpm macros and add --no-warn to systemctl invocations.

Originally posted by @msekletar in #124 (comment)

systemd version the issue has been seen with

latest main

Used distribution

CentOS 8 Stream

I'm not sure what's changed, but when running CentOS CI on the latest main, systemd-nspawn keep dying when running tests in unprivileged containers:

+ env --unset=UNIFIED_CGROUP_HIERARCHY --unset=SYSTEMD_NSPAWN_UNIFIED_HIERARCHY timeout --foreground 600 /root/systemd/build/systemd-nspawn --register=no --kill-signal=SIGKILL --directory=/var/tmp/systemd-test-TEST-01-BASIC/unprivileged-nspawn-root --setenv=SYSTEMD_UNIT_PATH=/usr/lib/systemd/tests/testdata/testsuite-01.units:/usr/lib/systemd/tests/testdata/units: -U --private-network --machine=TEST-01-BASIC /usr/lib/systemd/systemd systemd.unit=testsuite.target systemd.wants=testsuite-01.service systemd.wants=end.service user_namespace.enable=1 systemd.unified_cgroup_hierarchy=0 systemd.legacy_systemd_cgroup_controller=1
Spawning container TEST-01-BASIC on /var/tmp/systemd-test-TEST-01-BASIC/unprivileged-nspawn-root.
Press ^] three times within 1s to kill container.
Selected user namespace base 590217216 and range 65536.
Failed to set up ID mapped mounts: Operation not permitted
Short read while reading cgroup mode (0 bytes). The child is most likely dead.
E: nspawn failed with exit code 1

Example jobs:

• https://jenkins-systemd.apps.ocp.ci.centos.org/job/rhel9-centos9/90/artifact//systemd-centos-ci/index.html
• https://jenkins-systemd.apps.ocp.ci.centos.org/job/rhel9-centos9/91/artifact//systemd-centos-ci/index.html
• https://jenkins-systemd.apps.ocp.ci.centos.org/job/rhel9-centos9/92/artifact//systemd-centos-ci/index.html
• https://jenkins-systemd.apps.ocp.ci.centos.org/job/rhel9-centos9/93/artifact//systemd-centos-ci/index.html

/cc @dtardon @jamacku

Note that there are specfile changes that need be introduced to fully fix the issue reported in https://bugzilla.redhat.com/show_bug.cgi?id=1972223

Originally posted by @msekletar in #24 (comment)

see #252 (comment). Opening this mainly as a reminder for myself to look into it.

Following issues popped up in upstream that we should probably patch in 9.2 as well. I'm opening a tracker issue instead of doing the backports directly, because the patches are not yet merged in upstream.

• Issue: systemd/systemd#26872

  • Patch: systemd/systemd#26875

• Issue: systemd/systemd#24452 (comment)

  • Patch: systemd/systemd#26887

• Issue: systemd/systemd#26912

  • Patch: systemd/systemd#26927