systemd: 247.2 -> 247.3

[flokli]

Motivation for this change

Sync with latest upstream stable release.

Fixes:

1cb171695a sd-device: make TAGS= property prefixed and suffixed with ":"
0e0a165d72 sd-device: keep escaped strings in DEVLINK= property
ca3b974a55 sd-device: use set_strjoin()
041fe7dfee set: introduce set_strjoin()
fc398137fc tools: make update-dbus-docs compatible with Python 3.6
539e67159c man: fix small issue in AllowedMemoryNodes description
eb6910c8ab man: make it clear how systemd calculate the DefaultTasksMax.
ab9f7e1a51 resolved: use reference counting for DnsQueryCandidate objects
91ba2eac4b resolved: minor cleanups
fd76ba69a1 tools: make update-dbus-docs compatible with Python 3.7
c6d30eb104 network: drop wrong flag for neighbor entry
b3465837dd sysusers: flush nscd's caches whenever /etc/{passwd,group} are modified
b7e0ac754e tree-wide: ignore messages with too long control data
a054fe9c89 systemctl: warn when importing environment variables with control characters
288b980fe5 Allow control characters in environment variable values
57bc92bf08 systemctl: print a warning when trying to import a nonexistent variable
64317106ae resolved: fix use-after-free with queries hitting the cache
c97c62ed3d man: clarify what network scopes are
490b9ae9dd rpm: expose $systemd_util_dir also as rpm macro
c77f5629d7 systemctl-edit: Add missing ret_dropin_paths argument in retry path
71630f1187 systemctl-edit: fix abort in find_paths_to_edit()
e12b4112a8 import: mangle untarred OS images after pull-tar, too
d60de7d137 dhcp6: refuse zero length vendor class
a455e20118 dhcp6: refuse zero length dhcp user class
ead71a1a95 network: refuse zero length dhcp user class
5dbb9342a1 dhcp: length of each user class field must be positive
dc9ab43854 journal: send journald logs to kmsg again
f3997dd056 timedate: actually reset system time with new timezone
fc4eae72f8 wifi-util: do not ignore wifi iftype when SSID is not set
3885103672 wifi-util: cleanup header inclusion
b81e441b61 docs: `mesonconf` is not a valid command, `meson configure` is
95ee2c6b48 bpf: do not use structured initialization for bpf_attr
3dcf950663 test-xattr-util: don't insist that /usr supports xattrs
94bb28590b bpf: zero bpf_attr before initialization
6db2ae6618 shell-completion: fix systemctl set/unset/import-environment
d0a124c0af man: improve description of environment block creation
a2f0da2de0 stat-util: don't try to open path on path_is_temporary_fs()
7c63e5ed58 systemctl: have is-enabled return success for aliases when calling into pid1 too
d0b76f0738 man: fix path reference to unit file
1f39070e40 docs: fix the link to boot loader specification
b7db0461a6 network: fix possible memory leak
310fd03e07 resolve: field size in dns resource record may be zero
9401ed294d siphash: introduce siphash24_compress_safe()
5cb414f8c5 fuzzers: set maximum length for several fuzzers
efa8f49344 shared/dns: fix dlopen_idn return code check
4032a13588 man/systemd-nspawn: document hashing machine name for uid base
5dd2b56443 udev: fix memleak
cefb123e8a journal-importer: ignore invalid field at one more place
a580023f1d man/localtime: document default timezone
14475e0e79 man/systemd.netdev: clarify the wireguard AllowedIPs= setting
2a76d510d9 logs-show: refuse data which contain invalid fields
2c53886b4f journal: refuse data which contain invalid fields
b7f69284f1 journal: move journal_field_valid() to journal_file.c
b7171ae4bd test: use modern qemu numa arguments
36bc4a18fd bus-util: improve logging when we can't connect to the bus
a1b1ef65a4 sd-bus: make credential acquisition more graceful
a62421591e sd-bus: 'ret' parameter to sd_bus_query_sender_creds() is not optional, check for it
242fc1d261 network: fix IPv6PrivacyExtensions=kernel handling
2ba904a2e5 network: fix typo
a22eef68c0 dissect: fix root hash signature autodiscovery
6fa5ec5a41 cryptsetup: add support for workqueue options
4275f1c95e test-login: skip consistency checks when logind is not active

Also, nixpkgs-fmt the changes introduced in 494ed4d.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[andir]

Maybe add a comment to the top of the file that we expect this to be (re)formatted with nixpkgs-fmt otherwise we will end up with more of these reformatting commits.

[flokli]

I added a comment to the top.

[symphorien]

If I read correctly the changelog:

242fc1d261 network: fix IPv6PrivacyExtensions=kernel handling

it is now possible to revert the temporary solution of #106858

[flokli]

Good catch! I reverted the workaround and successfully ran nixosTests.networking.networkd.privacy.

[flokli]

With #110799 being merged, I pushed some cleanup fixes to remove the now-unused /etc/systemd-mutable/system paths and further simplify the amount of patching.

[flokli]

Aside from the fact that the systemd-mutable/ directory is considered a requirement (or an obstacle if you will) for Dysnomia (that by itself is not something you should consider an impediment for applying this change), it is also used by the Nix process management framework to make deployments of generated systemd units possible, both on NixOS and conventional Linux distributions that have systemd and Nix installed.

I don't think other distributions read from /etc/systemd-mutable/system either, but Dysnomia writes to /etc/systemd/system there. If you want to keep using /etc/systemd-mutable/system, you can still override systemd via systemd.package, to also read from that path, without having to recompile the world - but I don't think it belongs into the "vanilla systemd" we link so many packages with.

If you remove this feature, then there is no longer a mutable directory in which you can store arbitrary systemd units. Managing systemd units can only be done by installing packages in the global Nix profile or the system profile (that themselves are immutable), basically introducing an all or nothing approach when it comes to working with systemd (meaning you always have to use Nix, or you can't change systemd's state).
Although for most the most common NixOS' use cases this is typically fine. I also consider it a useful feature to still have the ability experiment with systemd and deploy experimental systemd units during development, without requiring me to continuously update and redeploy my system configuration. (For example: for certain development projects, I tend to use this directory to regularly check whether my systemd unit is still doing the right thing).

There still is a very mutable location, /run/systemd/system/*, which works for quick testing during development. Some part in dysnomia could also copy things over from some persistent, but mutable location to that place, to avoid having to use a custom systemd package on "dysnomia/nix-processmgmt" systems.

[erikarvstedt]

My extra-container utility also requires /etc/systemd-mutable for persistent or auto-starting containers. /run/systemd can't be used in this case.
A NixOS option like systemd.mutable might be a compromise. Let me know if I can help with the implementation.

[andir]

On 02:21 12.02.21, erikarvstedt wrote: My [extra-container](https://github.com/erikarvstedt/extra-container) utility also requires `/etc/systemd-mutable` for persistent or auto-starting containers. `/run/systemd` can't be used in this case. A NixOS option like `systemd.mutable` might be a compromise. Let me know if I can help with the implementation.

Why can't it be used?

[flokli]

Let's move the systemd-mutable discussion to another place. I'll drop the relevant commits from this PR, and will open a new one for that (and link from here).

[erikarvstedt]

Why can't it be used?

Because the container service definitions need to persist between reboots.
/run/systemd would be fine for ephemeral containers.

[flokli]

PR is open at #112891, and also proposes a solution for persistency across reboots. Let's do the discussion over there.