Version 247.1

-container subpackage is for container *management*. Those files are
used *in* the container.

.gitignore

@@ -1,3 +1,4 @@
+*~
 /systemd-*/
 /.build-*.log
 /x86_64/

0001-dhcp-server-add-two-missing-OOM-checks.patch

@@ -1,38 +0,0 @@
-From 0c65886b122a26636ad049cf12b560865ffc62a6 Mon Sep 17 00:00:00 2001
-From: Lennart Poettering <lennart@poettering.net>
-Date: Thu, 9 Feb 2017 10:16:52 +0100
-Subject: [PATCH] dhcp-server: add two missing OOM checks
-
-(cherry picked from commit 357e1b17b901b48714fa5301c745ae5389661798)
----
- src/libsystemd-network/sd-dhcp-server.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/src/libsystemd-network/sd-dhcp-server.c b/src/libsystemd-network/sd-dhcp-server.c
-index 2890681..315cbf1 100644
---- a/src/libsystemd-network/sd-dhcp-server.c
-+++ b/src/libsystemd-network/sd-dhcp-server.c
-@@ -197,7 +197,11 @@ int sd_dhcp_server_new(sd_dhcp_server **ret, int ifindex) {
-         server->address = htobe32(INADDR_ANY);
-         server->netmask = htobe32(INADDR_ANY);
-         server->ifindex = ifindex;
-+
-         server->leases_by_client_id = hashmap_new(&client_id_hash_ops);
-+        if (!server->leases_by_client_id)
-+                return -ENOMEM;
-+
-         server->default_lease_time = DIV_ROUND_UP(DHCP_DEFAULT_LEASE_TIME_USEC, USEC_PER_SEC);
-         server->max_lease_time = DIV_ROUND_UP(DHCP_MAX_LEASE_TIME_USEC, USEC_PER_SEC);
- 
-@@ -857,6 +861,8 @@ int dhcp_server_handle_message(sd_dhcp_server *server, DHCPMessage *message,
- 
-                         if (!existing_lease) {
-                                 lease = new0(DHCPLease, 1);
-+                                if (!lease)
-+                                        return -ENOMEM;
-                                 lease->address = address;
-                                 lease->client_id.data = memdup(req->client_id.data,
-                                                                req->client_id.length);
--- 
-2.9.3
-

0001-test-path-util-do-not-fail-if-the-fd_is_mount_point-.patch

@@ -0,0 +1,70 @@
+From 2e9d763e7cbeb33954bbe3f96fd94de2cd62edf7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Thu, 12 Nov 2020 14:28:24 +0100
+Subject: [PATCH] test-path-util: do not fail if the fd_is_mount_point check
+ fails
+
+This test fails on i686 and ppc64le in koji:
+/* test_path */
+Assertion 'fd_is_mount_point(fd, "/", 0) > 0' failed at src/test/test-path-util.c:85, function test_path(). Aborting.
+
+I guess some permission error is the most likely.
+---
+ src/test/test-path-util.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/src/test/test-path-util.c b/src/test/test-path-util.c
+index f4f8d0550b..be428334f3 100644
+--- a/src/test/test-path-util.c
++++ b/src/test/test-path-util.c
+@@ -40,8 +40,6 @@ static void test_path_simplify(const char *in, const char *out, const char *out_
+ }
+ 
+ static void test_path(void) {
+-        _cleanup_close_ int fd = -1;
+-
+         log_info("/* %s */", __func__);
+ 
+         test_path_compare("/goo", "/goo", 0);
+@@ -80,10 +78,6 @@ static void test_path(void) {
+         assert_se(streq(basename("/aa///file..."), "file..."));
+         assert_se(streq(basename("file.../"), ""));
+ 
+-        fd = open("/", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY);
+-        assert_se(fd >= 0);
+-        assert_se(fd_is_mount_point(fd, "/", 0) > 0);
+-
+         test_path_simplify("aaa/bbb////ccc", "aaa/bbb/ccc", "aaa/bbb/ccc");
+         test_path_simplify("//aaa/.////ccc", "/aaa/./ccc", "/aaa/ccc");
+         test_path_simplify("///", "/", "/");
+@@ -120,6 +114,22 @@ static void test_path(void) {
+         assert_se(!path_equal_ptr(NULL, "/a"));
+ }
+ 
++static void test_path_is_mountpoint(void) {
++        _cleanup_close_ int fd = -1;
++        int r;
++
++        log_info("/* %s */", __func__);
++
++        fd = open("/", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY);
++        assert_se(fd >= 0);
++
++        r = fd_is_mount_point(fd, "/", 0);
++        if (r < 0)
++                log_warning_errno(r, "Failed to check if / is a mount point, ignoring: %m");
++        else
++                assert_se(r == 1);
++}
++
+ static void test_path_equal_root(void) {
+         /* Nail down the details of how path_equal("/", ...) works. */
+ 
+@@ -714,6 +724,7 @@ int main(int argc, char **argv) {
+ 
+         test_print_paths();
+         test_path();
++        test_path_is_mountpoint();
+         test_path_equal_root();
+         test_find_executable_full();
+         test_find_executable(argv[0]);

0001-test-path-util-ignore-test-failure.patch

@@ -0,0 +1,33 @@
+From e8bca4ba55f855260eda684a16e8feb5f20b1deb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Thu, 12 Nov 2020 15:06:12 +0100
+Subject: [PATCH] test-path-util: ignore test failure
+
+---
+ src/test/test-path-util.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/src/test/test-path-util.c b/src/test/test-path-util.c
+index be428334f3..207c659b8b 100644
+--- a/src/test/test-path-util.c
++++ b/src/test/test-path-util.c
+@@ -120,14 +120,17 @@ static void test_path_is_mountpoint(void) {
+ 
+         log_info("/* %s */", __func__);
+ 
++        (void) system("uname -a");
++        (void) system("mountpoint /");
++
+         fd = open("/", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY);
+         assert_se(fd >= 0);
+ 
+         r = fd_is_mount_point(fd, "/", 0);
+         if (r < 0)
+                 log_warning_errno(r, "Failed to check if / is a mount point, ignoring: %m");
+-        else
+-                assert_se(r == 1);
++        else if (r == 0)
++                log_warning("/ is not a mountpoint?");
+ }
+ 
+ static void test_path_equal_root(void) {

0002-import-bump-image-size-safety-limit-for-machinectl-p.patch

@@ -1,28 +0,0 @@
-From bd9bb2324adf9e16cdf4e6c3588ddc7778530fd8 Mon Sep 17 00:00:00 2001
-From: Dax Kelson <dkelson@gurulabs.com>
-Date: Sun, 5 Mar 2017 05:03:53 -0700
-Subject: [PATCH] import: bump image size safety limit for machinectl pull
- (#5535)
-
-We currenly use 40GB images in our environment
-(cherry picked from commit 055c521ad4e9d2f923e9373ac12e214a1e896cc7)
----
- src/import/pull-job.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/import/pull-job.c b/src/import/pull-job.c
-index e550df2..70aaa5c 100644
---- a/src/import/pull-job.c
-+++ b/src/import/pull-job.c
-@@ -527,7 +527,7 @@ int pull_job_new(PullJob **ret, const char *url, CurlGlue *glue, void *userdata)
-         j->glue = glue;
-         j->content_length = (uint64_t) -1;
-         j->start_usec = now(CLOCK_MONOTONIC);
--        j->compressed_max = j->uncompressed_max = 8LLU * 1024LLU * 1024LLU * 1024LLU; /* 8GB */
-+        j->compressed_max = j->uncompressed_max = 64LLU * 1024LLU * 1024LLU * 1024LLU; /* 64GB safety limit */
- 
-         j->url = strdup(url);
-         if (!j->url)
--- 
-2.9.3
-

0003-coredump-fix-handling-of-premature-eof-data-for-back.patch

@@ -1,44 +0,0 @@
-From 5b21af2bf21f57e9b7ae30217ed01545029256e8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Sun, 5 Mar 2017 10:35:44 -0500
-Subject: [PATCH] coredump: fix handling of premature-eof data for --backtrace
-
-We'd fail with an assert in journal_importer_process_data(),
-because that function requires the caller to handle EOF themselves.
-
-(cherry picked from commit d74dc4f2d00644c04ad9dc900ef43050fcadaa8b)
----
- src/basic/journal-importer.c | 2 +-
- src/coredump/coredump.c      | 3 ++-
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/src/basic/journal-importer.c b/src/basic/journal-importer.c
-index 4c13e46..d25fd35 100644
---- a/src/basic/journal-importer.c
-+++ b/src/basic/journal-importer.c
-@@ -314,7 +314,7 @@ int journal_importer_process_data(JournalImporter *imp) {
-                         return r;
-                 if (r == 0) {
-                         imp->state = IMPORTER_STATE_EOF;
--                        return r;
-+                        return 0;
-                 }
-                 assert(n > 0);
-                 assert(line[n-1] == '\n');
-diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c
-index 4c4f36a..5828e94 100644
---- a/src/coredump/coredump.c
-+++ b/src/coredump/coredump.c
-@@ -1326,7 +1326,8 @@ static int process_backtrace(int argc, char *argv[]) {
-                         log_error_errno(r, "Failed to parse journal entry on stdin: %m");
-                         goto finish;
-                 }
--                if (r == 1)
-+                if (r == 1 ||                        /* complete entry */
-+                    journal_importer_eof(&importer)) /* end of data */
-                         break;
-         }
- 
--- 
-2.9.3
-

0004-cgtop-use-PRIu64-to-print-uint64_t-5544.patch

@@ -1,28 +0,0 @@
-From fe9d0ba1f8e60fbea433f75319d0487e5b58c79b Mon Sep 17 00:00:00 2001
-From: "Thomas H. P. Andersen" <phomes@gmail.com>
-Date: Tue, 7 Mar 2017 07:47:18 +0100
-Subject: [PATCH] cgtop: use PRIu64 to print uint64_t (#5544)
-
-Commit 59f448cf replaced usage of off_t with uint64_t. Change the
-format string to use PRIu64 to match it.
-(cherry picked from commit 557e36934d21b08acafbe2baf6ebfde761fbae25)
----
- src/cgtop/cgtop.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/cgtop/cgtop.c b/src/cgtop/cgtop.c
-index a1c0f48..67f3a99 100644
---- a/src/cgtop/cgtop.c
-+++ b/src/cgtop/cgtop.c
-@@ -118,7 +118,7 @@ static const char *maybe_format_bytes(char *buf, size_t l, bool is_valid, uint64
-         if (!is_valid)
-                 return "-";
-         if (arg_raw) {
--                snprintf(buf, l, "%jd", t);
-+                snprintf(buf, l, "%" PRIu64, t);
-                 return buf;
-         }
-         return format_bytes(buf, l, t);
--- 
-2.9.3
-

0005-man-fix-typo-5556.patch

@@ -1,26 +0,0 @@
-From 9283e138a2a9347d9df9bc1d0371cff74d09d43f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Torstein=20Huseb=C3=B8?= <torstein@huseboe.net>
-Date: Wed, 8 Mar 2017 13:54:22 +0100
-Subject: [PATCH] man: fix typo (#5556)
-
-(cherry picked from commit 6cf5a9648928be1e2b8fcdbf2903761000f6e803)
----
- man/systemd.exec.xml | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
-index 5d4986b..fb64cd6 100644
---- a/man/systemd.exec.xml
-+++ b/man/systemd.exec.xml
-@@ -138,7 +138,7 @@
-       <varlistentry>
-         <term><varname>RootImage=</varname></term>
-         <listitem><para>Takes a path to a block device node or regular file as argument. This call is similar to
--        <varname>RootDirectory=</varname> however mounts a file system hierarchy from a block device node or loopack
-+        <varname>RootDirectory=</varname> however mounts a file system hierarchy from a block device node or loopback
-         file instead of a directory. The device node or file system image file needs to contain a file system without a
-         partition table, or a file system within an MBR/MS-DOS or GPT partition table with only a single
-         Linux-compatible partition, or a set of file systems within a GPT partition table that follows the <ulink
--- 
-2.9.3
-

0006-Fix-typo-in-function-name-5565.patch

@@ -1,49 +0,0 @@
-From e05b13d4d4d5f076b9741e446640d75370bbf878 Mon Sep 17 00:00:00 2001
-From: Michal Sekletar <msekletar@users.noreply.github.com>
-Date: Fri, 10 Mar 2017 15:16:24 +0100
-Subject: [PATCH] Fix typo in function name (#5565)
-
-(cherry picked from commit 8feabc46263079cffba8a39c4082563320aeffc0)
----
- man/sd_journal_get_fd.xml    | 4 ++--
- man/sd_login_monitor_new.xml | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/man/sd_journal_get_fd.xml b/man/sd_journal_get_fd.xml
-index 61293f7..2e686ca 100644
---- a/man/sd_journal_get_fd.xml
-+++ b/man/sd_journal_get_fd.xml
-@@ -146,7 +146,7 @@ if (t == (uint64_t) -1)
- else {
-   struct timespec ts;
-   uint64_t n;
--  clock_getttime(CLOCK_MONOTONIC, &amp;ts);
-+  clock_gettime(CLOCK_MONOTONIC, &amp;ts);
-   n = (uint64_t) ts.tv_sec * 1000000 + ts.tv_nsec / 1000;
-   msec = t > n ? (int) ((t - n + 999) / 1000) : 0;
- }</programlisting>
-@@ -304,7 +304,7 @@ int wait_for_changes(sd_journal *j) {
-   else {
-     struct timespec ts;
-     uint64_t n;
--    clock_getttime(CLOCK_MONOTONIC, &amp;ts);
-+    clock_gettime(CLOCK_MONOTONIC, &amp;ts);
-     n = (uint64_t) ts.tv_sec * 1000000 + ts.tv_nsec / 1000;
-     msec = t > n ? (int) ((t - n + 999) / 1000) : 0;
-   }
-diff --git a/man/sd_login_monitor_new.xml b/man/sd_login_monitor_new.xml
-index 5625ab9..129c99f 100644
---- a/man/sd_login_monitor_new.xml
-+++ b/man/sd_login_monitor_new.xml
-@@ -203,7 +203,7 @@ if (t == (uint64_t) -1)
- else {
-          struct timespec ts;
-          uint64_t n;
--         clock_getttime(CLOCK_MONOTONIC, &amp;ts);
-+         clock_gettime(CLOCK_MONOTONIC, &amp;ts);
-          n = (uint64_t) ts.tv_sec * 1000000 + ts.tv_nsec / 1000;
-          msec = t > n ? (int) ((t - n + 999) / 1000) : 0;
- }</programlisting>
--- 
-2.9.3
-

0007-resolve-add-missing-space-in-output-message-5574.patch

@@ -1,28 +0,0 @@
-From fd46fb0d1606468232c6c74aa6a02c77c8d5934c Mon Sep 17 00:00:00 2001
-From: Yu Watanabe <watanabe.yu+github@gmail.com>
-Date: Mon, 13 Mar 2017 09:12:03 +0900
-Subject: [PATCH] resolve: add missing space in output message (#5574)
-
-(cherry picked from commit 44ccb3d72315f68d0b4b07217c99bad35b055ec3)
----
- src/resolve/resolve-tool.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/resolve/resolve-tool.c b/src/resolve/resolve-tool.c
-index 32537ce..c620589 100644
---- a/src/resolve/resolve-tool.c
-+++ b/src/resolve/resolve-tool.c
-@@ -114,8 +114,8 @@ static void print_source(uint64_t flags, usec_t rtt) {
-                        flags & SD_RESOLVED_DNS ? " DNS" :"",
-                        flags & SD_RESOLVED_LLMNR_IPV4 ? " LLMNR/IPv4" : "",
-                        flags & SD_RESOLVED_LLMNR_IPV6 ? " LLMNR/IPv6" : "",
--                       flags & SD_RESOLVED_MDNS_IPV4 ? "mDNS/IPv4" : "",
--                       flags & SD_RESOLVED_MDNS_IPV6 ? "mDNS/IPv6" : "");
-+                       flags & SD_RESOLVED_MDNS_IPV4 ? " mDNS/IPv4" : "",
-+                       flags & SD_RESOLVED_MDNS_IPV6 ? " mDNS/IPv6" : "");
- 
-         assert_se(format_timespan(rtt_str, sizeof(rtt_str), rtt, 100));
- 
--- 
-2.9.3
-

0008-headers-check-that-__INCLUDE_LEVEL__-is-defined-befo.patch

@@ -1,31 +0,0 @@
-From c1e4a9e5f7839fa35661069e2aaf600a915f0c6b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Mon, 13 Mar 2017 03:11:24 -0400
-Subject: [PATCH] headers: check that __INCLUDE_LEVEL__ is defined before using
- it (#5575)
-
-That macro is a gcc extension, and while widely supported, not ubiquitous.
-In particular the coverity scanner is having trouble with it.
-(cherry picked from commit 1070d271fa8fa553d57dd5f74dd1e3f60732d0b9)
----
- src/systemd/_sd-common.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/systemd/_sd-common.h b/src/systemd/_sd-common.h
-index 3bb886b..97c3943 100644
---- a/src/systemd/_sd-common.h
-+++ b/src/systemd/_sd-common.h
-@@ -22,8 +22,8 @@
- 
- /* This is a private header; never even think of including this directly! */
- 
--#if __INCLUDE_LEVEL__ <= 1
--#error "Do not include _sd-common.h directly; it is a private header."
-+#if defined(__INCLUDE_LEVEL__) && __INCLUDE_LEVEL__ <= 1
-+#  error "Do not include _sd-common.h directly; it is a private header."
- #endif
- 
- #ifndef _sd_printf_
--- 
-2.9.3
-

0009-journal-prevent-integer-overflow-while-validating-he.patch

@@ -1,58 +0,0 @@
-From 112d963a0542b1280667e2eb2727a8946d9bcf8d Mon Sep 17 00:00:00 2001
-From: Tobias Stoeckmann <stoeckmann@users.noreply.github.com>
-Date: Mon, 13 Mar 2017 08:14:42 +0100
-Subject: [PATCH] journal: prevent integer overflow while validating header
- (#5569)
-
-It is possible to overflow uint64_t while validating the header of
-a journal file. To prevent this, the addition itself is checked to
-be within the limits of UINT64_MAX first.
-
-To keep this readable, I have introduced two stack variables which
-hold the converted values during validation.
-(cherry picked from commit 6f94e420e8355421fc31713a0df760d6b20473ac)
----
- src/journal/journal-file.c | 12 +++++++++---
- 1 file changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/src/journal/journal-file.c b/src/journal/journal-file.c
-index a6ccb67..14cb01a 100644
---- a/src/journal/journal-file.c
-+++ b/src/journal/journal-file.c
-@@ -546,6 +546,8 @@ static bool warn_wrong_flags(const JournalFile *f, bool compatible) {
- }
- 
- static int journal_file_verify_header(JournalFile *f) {
-+        uint64_t arena_size, header_size;
-+
-         assert(f);
-         assert(f->header);
- 
-@@ -564,17 +566,21 @@ static int journal_file_verify_header(JournalFile *f) {
-         if (f->header->state >= _STATE_MAX)
-                 return -EBADMSG;
- 
-+        header_size = le64toh(f->header->header_size);
-+
-         /* The first addition was n_data, so check that we are at least this large */
--        if (le64toh(f->header->header_size) < HEADER_SIZE_MIN)
-+        if (header_size < HEADER_SIZE_MIN)
-                 return -EBADMSG;
- 
-         if (JOURNAL_HEADER_SEALED(f->header) && !JOURNAL_HEADER_CONTAINS(f->header, n_entry_arrays))
-                 return -EBADMSG;
- 
--        if ((le64toh(f->header->header_size) + le64toh(f->header->arena_size)) > (uint64_t) f->last_stat.st_size)
-+        arena_size = le64toh(f->header->arena_size);
-+
-+        if (UINT64_MAX - header_size < arena_size || header_size + arena_size > (uint64_t) f->last_stat.st_size)
-                 return -ENODATA;
- 
--        if (le64toh(f->header->tail_object_offset) > (le64toh(f->header->header_size) + le64toh(f->header->arena_size)))
-+        if (le64toh(f->header->tail_object_offset) > header_size + arena_size)
-                 return -ENODATA;
- 
-         if (!VALID64(le64toh(f->header->data_hash_table_offset)) ||
--- 
-2.9.3
-

0010-machinectl-don-t-return-1-in-case-we-couldn-t-figure.patch

@@ -1,30 +0,0 @@
-From 51ad3c9829dfee2051fc97bd904d9ac6b191970c Mon Sep 17 00:00:00 2001
-From: Michal Sekletar <msekletar@users.noreply.github.com>
-Date: Tue, 14 Mar 2017 22:38:19 +0100
-Subject: [PATCH] machinectl: don't return 1 in case we couldn't figure out
- container IP addresses (#5587)
-
-This is in spirit very similar to commit
-4b2419165ce409ee55ce96a926302f89685f2293.
-
-Fixes: #5581
-(cherry picked from commit 3c302cddfb2e921578d1238ebcc0cb5ff34fbebe)
----
- src/machine/machinectl.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c
-index 2838428..3031ed5 100644
---- a/src/machine/machinectl.c
-+++ b/src/machine/machinectl.c
-@@ -340,6 +340,7 @@ static int list_machines(int argc, char *argv[], void *userdata) {
-                         printf("No machines.\n");
-         }
- 
-+        r = 0;
- out:
-         clean_machine_info(machines, n_machines);
-         return r;
--- 
-2.9.3
-

0011-man-Document-when-pam_systemd-sets-XDG_RUNTIME_DIR-5.patch

@@ -1,37 +0,0 @@
-From 6c03191c817094b67352a8553b5df9850eaecd88 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Adrian=20Heine=20n=C3=A9=20Lang?= <mail@adrianheine.de>
-Date: Tue, 14 Mar 2017 22:42:18 +0100
-Subject: [PATCH] man: Document when pam_systemd sets XDG_RUNTIME_DIR (#5570)
-
-https://github.com/systemd/systemd/blob/f97b34a6/src/login/pam_systemd.c#L439
-(cherry picked from commit 5c50321ca9c660dac39976ab29ed2f28f872628d)
----
- man/pam_systemd.xml | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/man/pam_systemd.xml b/man/pam_systemd.xml
-index 6e1aa0d..cef5445c 100644
---- a/man/pam_systemd.xml
-+++ b/man/pam_systemd.xml
-@@ -88,7 +88,7 @@
-       and so will the user's slice unit.</para></listitem>
- 
-       <listitem><para>If the last concurrent session of a user ends,
--      the <varname>$XDG_RUNTIME_DIR</varname> directory and all its
-+      the user runtime directory <filename>/run/user/$UID</filename> and all its
-       contents are removed, too.</para></listitem>
-     </orderedlist>
- 
-@@ -192,7 +192,8 @@
-         offers the greatest possible file system feature set the
-         operating system provides. For further details, see the <ulink
-         url="http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html">XDG
--        Base Directory Specification</ulink>.</para></listitem>
-+        Base Directory Specification</ulink>. <varname>$XDG_RUNTIME_DIR</varname>
-+        is not set if the current user is not the original user of the session.</para></listitem>
-       </varlistentry>
- 
-     </variablelist>
--- 
-2.9.3
-

0012-man-Fix-a-simple-grammar-error-in-systemd.service.xm.patch

@@ -1,27 +0,0 @@
-From dd8b6fa3f53ff9912f3ffdfeaedf79612e5f8395 Mon Sep 17 00:00:00 2001
-From: AlexanderKurtz <alexander@kurtz.be>
-Date: Thu, 16 Mar 2017 01:33:56 +0100
-Subject: [PATCH] man: Fix a simple grammar error in systemd.service.xml
- (#5594)
-
-(cherry picked from commit bda99fab3104095420d3ee03593d07469153f6c4)
----
- man/systemd.service.xml | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/man/systemd.service.xml b/man/systemd.service.xml
-index 52eb2bb..a452e3a 100644
---- a/man/systemd.service.xml
-+++ b/man/systemd.service.xml
-@@ -184,7 +184,7 @@
-         process has to exit before systemd starts follow-up units.
-         <varname>RemainAfterExit=</varname> is particularly useful for
-         this type of service. This is the implied default if neither
--        <varname>Type=</varname> or <varname>ExecStart=</varname> are
-+        <varname>Type=</varname> nor <varname>ExecStart=</varname> are
-         specified.</para>
- 
-         <para>Behavior of <option>dbus</option> is similar to
--- 
-2.9.3
-

0998-resolved-create-etc-resolv.conf-symlink-at-runtime.patch

@@ -1,51 +0,0 @@
-From 108c060c5521309b9448e3a7905b50dd505f36a8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Fri, 11 Mar 2016 17:06:17 -0500
-Subject: [PATCH] resolved: create /etc/resolv.conf symlink at runtime
-
-If the symlink doesn't exists, and we are being started, let's
-create it to provie name resolution.
-
-If it exists, do nothing. In particular, if it is a broken symlink,
-we cannot really know if the administator configured it to point to
-a location used by some service that hasn't started yet, so we
-don't touch it in that case either.
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1313085
----
- src/resolve/resolved.c | 4 ++++
- tmpfiles.d/etc.conf.m4 | 3 ---
- 2 files changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
-index deb75f9ae5..914d3b8a2d 100644
---- a/src/resolve/resolved.c
-+++ b/src/resolve/resolved.c
-@@ -67,6 +67,10 @@ int main(int argc, char *argv[]) {
-                 goto finish;
-         }
- 
-+        r = symlink("../run/systemd/resolve/resolv.conf", "/etc/resolv.conf");
-+        if (r < 0 && errno != EEXIST)
-+                log_warning_errno(errno, "Could not create /etc/resolv.conf symlink: %m");
-+
-         /* Drop privileges, but keep three caps. Note that we drop those too, later on (see below) */
-         r = drop_privileges(uid, gid,
-                             (UINT64_C(1) << CAP_NET_RAW)|          /* needed for SO_BINDTODEVICE */
-diff --git a/tmpfiles.d/etc.conf.m4 b/tmpfiles.d/etc.conf.m4
-index 064eae94f1..928105ea8d 100644
---- a/tmpfiles.d/etc.conf.m4
-+++ b/tmpfiles.d/etc.conf.m4
-@@ -13,9 +13,6 @@ L+ /etc/mtab - - - - ../proc/self/mounts
- m4_ifdef(`HAVE_SMACK_RUN_LABEL',
- t /etc/mtab - - - - security.SMACK64=_
- )m4_dnl
--m4_ifdef(`ENABLE_RESOLVED',
--L! /etc/resolv.conf - - - - ../usr/lib/systemd/resolv.conf
--)m4_dnl
- C /etc/nsswitch.conf - - - -
- m4_ifdef(`HAVE_PAM',
- C /etc/pam.d - - - -
--- 
-2.9.2
-

20-grubby.install

@@ -47,5 +47,5 @@ esac
 
 # skip other installation plugins, if we can't find a boot loader spec conforming setup
 if ! [[ -d /boot/loader/entries || -L /boot/loader/entries ]]; then
-    exit 77 
+    exit 77
 fi

85-display-manager.preset

@@ -1,11 +0,0 @@
-# We enable all display managers by default. Since only one can
-# actually be enabled at the same time the one which is installed
-# first wins
-
-enable gdm.service
-enable lightdm.service
-enable slim.service
-enable lxdm.service
-enable sddm.service
-enable kdm.service
-enable xdm.service

90-default.preset

@@ -1,126 +0,0 @@
-# Also see:
-# https://fedoraproject.org/wiki/Starting_services_by_default
-
-# On Fedora we deviate from some upstream defaults
-disable systemd-timesyncd.service
-disable systemd-networkd.service
-disable systemd-resolved.service
-
-# System stuff
-enable sshd.service
-enable atd.*
-enable crond.*
-enable chronyd.service
-enable NetworkManager.service
-enable NetworkManager-dispatcher.service
-enable ModemManager.service
-enable auditd.service
-enable restorecond.service
-enable bluetooth.*
-enable avahi-daemon.*
-enable cups.*
-
-# The various syslog implementations
-enable rsyslog.*
-enable syslog-ng.*
-enable sysklogd.*
-
-# Network facing
-enable firewalld.service
-enable libvirtd.service
-enable xinetd.service
-enable ladvd.service
-
-# Storage
-enable multipathd.service
-enable libstoragemgmt.service
-enable lvm2-monitor.*
-enable lvm2-lvmetad.*
-enable dm-event.*
-enable dmraid-activation.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=855372
-enable mdmonitor.service
-enable mdmonitor-takeover.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=876237
-enable spice-vdagentd.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=885406
-enable qemu-guest-agent.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=928726
-enable dnf-makecache.timer
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=929403
-enable initial-setup-graphical.service
-enable initial-setup-text.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=957135
-enable vmtoolsd.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=976315
-enable dkms.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=961878
-enable ipmi.service
-enable ipmievd.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=1039351
-enable x509watch.timer
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=1060754
-enable dnssec-triggerd.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=1095353
-enable uuidd.socket
-
-# Hardware
-enable gpm.*
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=1066421
-enable gpsd.socket
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=1141607
-enable x2gocleansessions.service
-
-# https://fedoraproject.org/wiki/Changes/UEFISecureBootBlacklistUpdates
-#
-enable dbxtool.service
-
-enable irqbalance.service
-enable lm_sensors.service
-enable mcelog.*
-enable acpid.*
-enable smartd.service
-enable pcscd.socket
-enable rngd.service
-
-# Other stuff
-enable abrtd.service
-enable abrt-ccpp.service
-enable abrt-oops.service
-enable abrt-xorg.service
-enable abrt-vmcore.service
-enable lttng-sessiond.service
-enable ksm.service
-enable ksmtuned.service
-enable rootfs-resize.service
-enable sysstat.service
-enable sysstat-collect.timer
-enable sysstat-summary.timer
-enable uuidd.service
-enable xendomains.service
-enable xenstored.service
-enable xenconsoled.service
-
-# Desktop stuff
-enable accounts-daemon.service
-enable rtkit-daemon.service
-enable upower.service
-enable udisks2.service
-enable polkit.service
-enable packagekit-offline-update.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=1187072
-enable timedatex.service

99-default-disable.preset

@@ -1 +0,0 @@
-disable *

f58b96d3e8d1cb0dd3666bc74fa673918b586612.patch

@@ -0,0 +1,129 @@
+From f58b96d3e8d1cb0dd3666bc74fa673918b586612 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Mon, 14 Sep 2020 17:58:03 +0200
+Subject: [PATCH] test-mountpointutil-util: do not assert in test_mnt_id()
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1803070
+
+I *think* this a kernel bug: the mnt_id as listed in /proc/self/mountinfo is different
+than the one we get from /proc/self/fdinfo/. This only matters when both statx and
+name_to_handle_at are unavailable and we hit the fallback path that goes through fdinfo:
+
+(gdb) !uname -r
+5.6.19-200.fc31.ppc64le
+
+(gdb) !cat /proc/self/mountinfo
+697 664 253:0 /var/lib/mock/fedora-31-ppc64le/root / rw,relatime shared:298 master:1 - xfs /dev/mapper/fedora_rh--power--vm14-root rw,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota
+698 697 253:0 /var/cache/mock/fedora-31-ppc64le/yum_cache /var/cache/yum rw,relatime shared:299 master:1 - xfs /dev/mapper/fedora_rh--power--vm14-root rw,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota
+699 697 253:0 /var/cache/mock/fedora-31-ppc64le/dnf_cache /var/cache/dnf rw,relatime shared:300 master:1 - xfs /dev/mapper/fedora_rh--power--vm14-root rw,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota
+700 697 0:32 /mock-selinux-plugin.7me9bfpi /proc/filesystems rw,nosuid,nodev shared:301 master:18 - tmpfs tmpfs rw,seclabel <==========================================================
+701 697 0:41 / /sys ro,nosuid,nodev,noexec,relatime shared:302 - sysfs sysfs ro,seclabel
+702 701 0:21 / /sys/fs/selinux ro,nosuid,nodev,noexec,relatime shared:306 master:8 - selinuxfs selinuxfs rw
+703 697 0:42 / /dev rw,nosuid shared:303 - tmpfs tmpfs rw,seclabel,mode=755
+704 703 0:43 / /dev/shm rw,nosuid,nodev shared:304 - tmpfs tmpfs rw,seclabel
+705 703 0:45 / /dev/pts rw,nosuid,noexec,relatime shared:307 - devpts devpts rw,seclabel,gid=5,mode=620,ptmxmode=666
+706 703 0:6 /btrfs-control /dev/btrfs-control rw,nosuid shared:308 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+707 703 0:6 /loop-control /dev/loop-control rw,nosuid shared:309 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+708 703 0:6 /loop0 /dev/loop0 rw,nosuid shared:310 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+709 703 0:6 /loop1 /dev/loop1 rw,nosuid shared:311 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+710 703 0:6 /loop10 /dev/loop10 rw,nosuid shared:312 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+711 703 0:6 /loop11 /dev/loop11 rw,nosuid shared:313 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+712 703 0:6 /loop2 /dev/loop2 rw,nosuid shared:314 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+713 703 0:6 /loop3 /dev/loop3 rw,nosuid shared:315 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+714 703 0:6 /loop4 /dev/loop4 rw,nosuid shared:316 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+715 703 0:6 /loop5 /dev/loop5 rw,nosuid shared:317 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+716 703 0:6 /loop6 /dev/loop6 rw,nosuid shared:318 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+717 703 0:6 /loop7 /dev/loop7 rw,nosuid shared:319 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+718 703 0:6 /loop8 /dev/loop8 rw,nosuid shared:320 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+719 703 0:6 /loop9 /dev/loop9 rw,nosuid shared:321 master:9 - devtmpfs devtmpfs rw,seclabel,size=4107840k,nr_inodes=64185,mode=755
+720 697 0:44 / /run rw,nosuid,nodev shared:305 - tmpfs tmpfs rw,seclabel,mode=755
+721 720 0:25 /systemd/nspawn/propagate/9cc8a155d0244558b273f773d2b92142 /run/systemd/nspawn/incoming ro master:12 - tmpfs tmpfs rw,seclabel,mode=755
+722 697 0:32 /mock-resolv.dvml91hp /etc/resolv.conf rw,nosuid,nodev shared:322 master:18 - tmpfs tmpfs rw,seclabel
+725 697 0:47 / /proc rw,nosuid,nodev,noexec,relatime shared:323 - proc proc rw
+603 725 0:47 /sys /proc/sys ro,nosuid,nodev,noexec,relatime shared:323 - proc proc rw
+604 725 0:44 /systemd/inaccessible/reg /proc/kallsyms ro,nosuid,nodev,noexec shared:305 - tmpfs tmpfs rw,seclabel,mode=755
+605 725 0:44 /systemd/inaccessible/reg /proc/kcore ro,nosuid,nodev,noexec shared:305 - tmpfs tmpfs rw,seclabel,mode=755
+606 725 0:44 /systemd/inaccessible/reg /proc/keys ro,nosuid,nodev,noexec shared:305 - tmpfs tmpfs rw,seclabel,mode=755
+607 725 0:44 /systemd/inaccessible/reg /proc/sysrq-trigger ro,nosuid,nodev,noexec shared:305 - tmpfs tmpfs rw,seclabel,mode=755
+608 725 0:44 /systemd/inaccessible/reg /proc/timer_list ro,nosuid,nodev,noexec shared:305 - tmpfs tmpfs rw,seclabel,mode=755
+609 725 0:47 /bus /proc/bus ro,nosuid,nodev,noexec,relatime shared:323 - proc proc rw
+610 725 0:47 /fs /proc/fs ro,nosuid,nodev,noexec,relatime shared:323 - proc proc rw
+611 725 0:47 /irq /proc/irq ro,nosuid,nodev,noexec,relatime shared:323 - proc proc rw
+612 725 0:47 /scsi /proc/scsi ro,nosuid,nodev,noexec,relatime shared:323 - proc proc rw
+613 703 0:46 / /dev/mqueue rw,nosuid,nodev,noexec,relatime shared:324 - mqueue mqueue rw,seclabel
+614 701 0:26 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime shared:325 - cgroup2 cgroup rw,seclabel,nsdelegate
+615 603 0:44 /.#proc-sys-kernel-random-boot-id4fbdce67af46d1c2//deleted /proc/sys/kernel/random/boot_id ro,nosuid,nodev,noexec shared:305 - tmpfs tmpfs rw,seclabel,mode=755
+616 725 0:44 /.#proc-sys-kernel-random-boot-id4fbdce67af46d1c2//deleted /proc/sys/kernel/random/boot_id rw,nosuid,nodev shared:305 - tmpfs tmpfs rw,seclabel,mode=755
+617 725 0:44 /.#proc-kmsg5b7a8bcfe6717139//deleted /proc/kmsg rw,nosuid,nodev shared:305 - tmpfs tmpfs rw,seclabel,mode=755
+
+The test process does
+name_to_handle_at("/proc/filesystems") which returns -EOPNOTSUPP, and then
+openat(AT_FDCWD, "/proc/filesystems") which returns 4, and then
+read(open("/proc/self/fdinfo/4", ...)) which gives
+"pos:\t0\nflags:\t012100000\nmnt_id:\t725\n"
+
+and the "725" is clearly inconsistent with "700" in /proc/self/mountinfo.
+
+We could either drop the fallback path (and fail name_to_handle_at() is not
+avaliable) or ignore the error in the test. Not sure what is better. I think
+this issue only occurs sometimes and with older kernels, so probably continuing
+with the current flaky implementation is better than ripping out the fallback.
+
+Another strace:
+writev(2</dev/pts/0>, [{iov_base="mnt ids of /proc/sys is 603", iov_len=27}, {iov_base="\n", iov_len=1}], 2mnt ids of /proc/sys is 603
+) = 28
+name_to_handle_at(AT_FDCWD, "/", {handle_bytes=128 => 12, handle_type=129, f_handle=0x52748401000000008b93e20d}, [697], 0) = 0
+writev(2</dev/pts/0>, [{iov_base="mnt ids of / is 697", iov_len=19}, {iov_base="\n", iov_len=1}], 2mnt ids of / is 697
+) = 20
+name_to_handle_at(AT_FDCWD, "/proc/kcore", {handle_bytes=128 => 12, handle_type=1, f_handle=0x92ddcfcd2e802d0100000000}, [605], 0) = 0
+writev(2</dev/pts/0>, [{iov_base="mnt ids of /proc/kcore is 605", iov_len=29}, {iov_base="\n", iov_len=1}], 2mnt ids of /proc/kcore is 605
+) = 30
+name_to_handle_at(AT_FDCWD, "/dev", {handle_bytes=128 => 12, handle_type=1, f_handle=0x8ae269160c802d0100000000}, [703], 0) = 0
+writev(2</dev/pts/0>, [{iov_base="mnt ids of /dev is 703", iov_len=22}, {iov_base="\n", iov_len=1}], 2mnt ids of /dev is 703
+) = 23
+name_to_handle_at(AT_FDCWD, "/proc/filesystems", {handle_bytes=128}, 0x7fffe36ddb84, 0) = -1 EOPNOTSUPP (Operation not supported)
+openat(AT_FDCWD, "/proc/filesystems", O_RDONLY|O_NOFOLLOW|O_CLOEXEC|O_PATH) = 4</proc/filesystems>
+openat(AT_FDCWD, "/proc/self/fdinfo/4", O_RDONLY|O_CLOEXEC) = 5</proc/20/fdinfo/4>
+fstat(5</proc/20/fdinfo/4>, {st_mode=S_IFREG|0400, st_size=0, ...}) = 0
+fstat(5</proc/20/fdinfo/4>, {st_mode=S_IFREG|0400, st_size=0, ...}) = 0
+read(5</proc/20/fdinfo/4>, "pos:\t0\nflags:\t012100000\nmnt_id:\t725\n", 2048) = 36
+read(5</proc/20/fdinfo/4>, "", 1024)    = 0
+close(5</proc/20/fdinfo/4>)             = 0
+close(4</proc/filesystems>)             = 0
+writev(2</dev/pts/0>, [{iov_base="mnt ids of /proc/filesystems are 700, 725", iov_len=41}, {iov_base="\n", iov_len=1}], 2mnt ids of /proc/filesystems are 700, 725
+) = 42
+writev(2</dev/pts/0>, [{iov_base="the other path for mnt id 725 is /proc", iov_len=38}, {iov_base="\n", iov_len=1}], 2the other path for mnt id 725 is /proc
+) = 39
+writev(2</dev/pts/0>, [{iov_base="Assertion 'path_equal(p, t)' failed at src/test/test-mountpoint-util.c:94, function test_mnt_id(). Aborting.", iov_len=108}, {iov_base="\n", iov_len=1}], 2Assertion 'path_equal(p, t)' failed at src/test/test-mountpoint-util.c:94, function test_mnt_id(). Aborting.
+) = 109
+rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
+rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [], 8) = 0
+getpid()                                = 20
+gettid()                                = 20
+tgkill(20, 20, SIGABRT)                 = 0
+rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
+--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=20, si_uid=0} ---
++++ killed by SIGABRT (core dumped) +++
+---
+ src/test/test-mountpoint-util.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/src/test/test-mountpoint-util.c b/src/test/test-mountpoint-util.c
+index 30b00ae4d8b..ffe5144b04a 100644
+--- a/src/test/test-mountpoint-util.c
++++ b/src/test/test-mountpoint-util.c
+@@ -89,8 +89,12 @@ static void test_mnt_id(void) {
+                 /* The ids don't match? If so, then there are two mounts on the same path, let's check if
+                  * that's really the case */
+                 char *t = hashmap_get(h, INT_TO_PTR(mnt_id2));
+-                log_debug("the other path for mnt id %i is %s\n", mnt_id2, t);
+-                assert_se(path_equal(p, t));
++                log_debug("Path for mnt id %i from /proc/self/mountinfo is %s\n", mnt_id2, t);
++
++                if (!path_equal(p, t))
++                        /* Apparent kernel bug in /proc/self/fdinfo */
++                        log_warning("Bad mount id given for %s: %d, should be %d",
++                                    p, mnt_id2, mnt_id);
+         }
+ }
+ 

libsystemd-shared.abignore

@@ -0,0 +1,3 @@
+[suppress_file]
+# This shared object is private to systemd
+file_name_regexp=libsystemd-shared-.*.so

macros.sysusers

@@ -0,0 +1,10 @@
+# RPM macros for packages creating system accounts
+#
+# Turn a sysusers.d file into macros specified by
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/UsersAndGroups/#_dynamic_allocation
+
+%sysusers_requires_compat Requires(pre): shadow-utils
+
+%sysusers_create_compat() \
+%(%{_rpmconfigdir}/sysusers.generate-pre.sh %{?*}) \
+%{nil}

purge-nobody-user

@@ -0,0 +1,101 @@
+#!/bin/bash -eu
+
+if [ $UID -ne 0 ]; then
+    echo "WARNING: This script needs to run as root to be effective"
+    exit 1
+fi
+
+export SYSTEMD_NSS_BYPASS_SYNTHETIC=1
+
+if [ "${1:-}" = "--ignore-journal" ]; then
+    shift
+    ignore_journal=1
+else
+    ignore_journal=0
+fi
+
+echo "Checking processes..."
+if ps h -u 99 | grep .; then
+    echo "ERROR: ps reports processes with UID 99!"
+    exit 2
+fi
+echo "... not found"
+
+echo "Checking UTMP..."
+if w -h 199 | grep . ; then
+    echo "ERROR: w reports UID 99 as active!"
+    exit 2
+fi
+if w -h nobody | grep . ; then
+    echo "ERROR: w reports user nobody as active!"
+    exit 2
+fi
+echo "... not found"
+
+echo "Checking the journal..."
+if [ "$ignore_journal" = 0 ] && journalctl -q -b -n10 _UID=99 | grep . ; then
+    echo "ERROR: journalctl reports messages from UID 99 in current boot!"
+    exit 2
+fi
+echo "... not found"
+
+echo "Looking for files in /etc, /run, /tmp, and /var..."
+if find /etc /run /tmp /var -uid 99 -print | grep -m 10 . ; then
+    echo "ERROR: found files belonging to UID 99"
+    exit 2
+fi
+echo "... not found"
+
+echo "Checking if nobody is defined correctly..."
+if getent passwd nobody |
+	grep '^nobody:[x*]:65534:65534:.*:/:/sbin/nologin';
+then
+    echo "OK, nothing to do."
+    exit 0
+else
+    echo "NOTICE: User nobody is not defined correctly"
+fi
+
+echo "Checking if nfsnobody or something else is using the uid..."
+if getent passwd 65534 | grep . ; then
+    echo "NOTICE: will have to remove this user"
+else
+    echo "... not found"
+fi
+
+if [ "${1:-}" = "-x" ]; then
+    if getent passwd nobody >/dev/null; then
+	# this will remove both the user and the group.
+	( set -x
+   	  userdel nobody
+	)
+    fi
+
+    if getent passwd 65534 >/dev/null; then
+	# Make sure the uid is unused. This should free gid too.
+	name="$(getent passwd 65534 | cut -d: -f1)"
+	( set -x
+	  userdel "$name"
+	)
+    fi
+
+    if grep -qE '^(passwd|group):.*\bsss\b' /etc/nsswitch.conf; then
+	echo "Sleeping, so sss can catch up"
+	sleep 3
+    fi
+
+    if getent group 65534; then
+	# Make sure the gid is unused, even if uid wasn't.
+	name="$(getent group 65534 | cut -d: -f1)"
+	( set -x
+	  groupdel "$name"
+	)
+    fi
+
+    # systemd-sysusers uses the same gid and uid
+    ( set -x
+      systemd-sysusers --inline 'u nobody 65534 "Kernel Overflow User" / /sbin/nologin'
+    )
+else
+    echo "Pass '-x' to perform changes"
+fi

sources

@@ -1 +1 @@
-SHA512 (systemd-233.tar.gz) = 5ad5329ea116d973cf67096f7e7ad28e9ea0905696e9451291f1d25e5064f4a9bfcfae87e912996c6a38397e9f4a148d4ccecfa9b70f7ecdf04deadb61784c8e
+SHA512 (systemd-247.1.tar.gz) = 2a737afcee4409c2be073d8cb650c3465a25c101b3c3072ea6e6a0614d06e3ed7ae55c84f9ae60555915ad1480b3a13aa72fef4b9210139afe6b0d7a7629385a

split-files.py

@@ -0,0 +1,143 @@
+import re, sys, os, collections
+
+buildroot = sys.argv[1]
+known_files = sys.stdin.read().splitlines()
+known_files = {line.split()[-1]:line for line in known_files}
+
+def files(root):
+    os.chdir(root)
+    todo = collections.deque(['.'])
+    while todo:
+        n = todo.pop()
+        files = os.scandir(n)
+        for file in files:
+            yield file
+            if file.is_dir() and not file.is_symlink():
+                todo.append(file)
+
+o_libs = open('.file-list-libs', 'w')
+o_udev = open('.file-list-udev', 'w')
+o_pam = open('.file-list-pam', 'w')
+o_rpm_macros = open('.file-list-rpm-macros', 'w')
+o_devel = open('.file-list-devel', 'w')
+o_container = open('.file-list-container', 'w')
+o_networkd = open('.file-list-networkd', 'w')
+o_remote = open('.file-list-remote', 'w')
+o_tests = open('.file-list-tests', 'w')
+o_standalone_tmpfiles = open('.file-list-standalone-tmpfiles', 'w')
+o_standalone_sysusers = open('.file-list-standalone-sysusers', 'w')
+o_rest = open('.file-list-rest', 'w')
+for file in files(buildroot):
+    n = file.path[1:]
+    if re.match(r'''/usr/(share|include)$|
+                    /usr/share/man(/man.|)$|
+                    /usr/share/zsh(/site-functions|)$|
+                    /usr/share/dbus-1$|
+                    /usr/share/dbus-1/system.d$|
+                    /usr/share/dbus-1/(system-|)services$|
+                    /usr/share/polkit-1(/actions|/rules.d|)$|
+                    /usr/share/pkgconfig$|
+                    /usr/share/bash-completion(/completions|)$|
+                    /usr(/lib|/lib64|/bin|/sbin|)$|
+                    /usr/lib.*/(security|pkgconfig)$|
+                    /usr/lib/rpm(/macros.d|)$|
+                    /usr/lib/firewalld(/services|)$|
+                    /usr/share/(locale|licenses|doc)|             # no $
+                    /etc(/pam\.d|/xdg|/X11|/X11/xinit|/X11.*\.d|)$|
+                    /etc/(dnf|dnf/protected.d)$|
+                    /usr/(src|lib/debug)|                         # no $
+                    /run$|
+                    /var(/cache|/log|/lib|/run|)$
+    ''', n, re.X):
+        continue
+    if '/security/pam_' in n or '/man8/pam_' in n:
+        o = o_pam
+    elif '/rpm/' in n:
+        o = o_rpm_macros
+    elif '/usr/lib/systemd/tests' in n:
+        o = o_tests
+    elif re.search(r'/lib.*\.pc|/man3/|/usr/include|(?<!/libsystemd-shared-...).so$', n):
+        o = o_devel
+    elif re.search(r'''journal-(remote|gateway|upload)|
+                       systemd-remote\.conf|
+                       /usr/share/systemd/gatewayd|
+                       /var/log/journal/remote
+    ''', n, re.X):
+        o = o_remote
+    elif re.search(r'''mymachines|
+                       machinectl|
+                       systemd-nspawn|
+                       import-pubring.gpg|
+                       systemd-(machined|import|pull)|
+                       /machine.slice|
+                       /machines.target|
+                       var-lib-machines.mount|
+                       org.freedesktop.(import|machine)1
+    ''', n, re.X):
+        o = o_container
+    elif re.search(r'''/usr/lib/systemd/network/80-|
+                       networkd|
+                       networkctl|
+                       org.freedesktop.network1
+    ''', n, re.X):
+        o = o_networkd
+    elif '.so.' in n:
+        o = o_libs
+    elif re.search(r'''udev(?!\.pc)|
+                       hwdb|
+                       bootctl|
+                       sd-boot|systemd-boot\.|loader.conf|
+                       bless-boot|
+                       boot-system-token|
+                       kernel-install|
+                       vconsole|
+                       backlight|
+                       rfkill|
+                       random-seed|
+                       modules-load|
+                       timesync|
+                       cryptsetup|
+                       kmod|
+                       quota|
+                       pstore|
+                       sleep|suspend|hibernate|
+                       systemd-tmpfiles-setup-dev|
+                       network/99-default.link|
+                       growfs|makefs|makeswap|mkswap|
+                       fsck|
+                       repart|
+                       gpt-auto|
+                       volatile-root|
+                       verity-setup|
+                       remount-fs|
+                       /boot$|
+                       /boot/efi|
+                       /kernel/|
+                       /kernel$|
+                       /modprobe.d
+    ''', n, re.X):
+        o = o_udev
+    elif n.endswith('.standalone'):
+        if 'tmpfiles' in n:
+            o = o_standalone_tmpfiles
+        elif 'sysusers' in n:
+            o = o_standalone_sysusers
+        else:
+            assert False, 'Found .standalone not belonging to known packages'
+    else:
+        o = o_rest
+
+    if n in known_files:
+        prefix = ' '.join(known_files[n].split()[:-1])
+        if prefix:
+            prefix += ' '
+    elif file.is_dir() and not file.is_symlink():
+        prefix = '%dir '
+    elif n.startswith('/etc'):
+        prefix = '%config(noreplace) '
+    else:
+        prefix = ''
+
+    suffix = '*' if '/man/' in n else ''
+
+    print(f'{prefix}{n}{suffix}', file=o)

systemd-user

@@ -4,9 +4,7 @@
 
 account  include system-auth
 
-m4_ifdef(`HAVE_SELINUX',
 session  required pam_selinux.so close
 session  required pam_selinux.so nottys open
-)m4_dnl
 session  required pam_loginuid.so
 session  include system-auth

systemd.rpmlintrc

@@ -0,0 +1,50 @@
+# Just kill all warnings about README being wrong in every possible way
+addFilter(r'README')
+
+addFilter(r'missing-call-to-(chdir-with-chroot|setgroups-before-setuid)')
+
+addFilter(r'executable-marked-as-config-file /etc/X11/xinit/xinitrc.d/50-systemd-user.sh')
+
+addFilter(r'non-readable /etc/crypttab')
+
+addFilter(r'non-conffile-in-etc /etc/inittab')
+
+addFilter(r'systemd-unit-in-etc /etc/systemd/.*\.wants')
+
+addFilter(r'dangling-relative-symlink /usr/lib/environment.d/99-environment.conf ../../../etc/environment')
+
+addFilter(r'devel-file-in-non-devel-package /usr/share/pkgconfig/(systemd|udev).pc')
+
+addFilter(r'non-standard-dir-perm /var/cache/private 700')
+
+addFilter(r'non-root-group-log-file /var/log/btmp utmp')
+
+addFilter(r'non-standard-dir-perm /var/log/private 700')
+
+addFilter(r'non-root-group-log-file /var/log/wtmp utmp')
+
+addFilter(r'dangerous-command-in-')
+
+addFilter(r'summary-not-capitalized C systemd')
+
+addFilter(r'obsolete-not-provided')
+
+addFilter(r'postin-without-ldconfig')
+
+addFilter(r'systemd-rpm-macros.noarch: W: only-non-binary-in-usr-lib')
+
+addFilter(r'systemd-rpm-macros.noarch: W: no-documentation')
+
+addFilter(r'systemd-tests\..*: W: no-documentation')
+
+addFilter(r'systemd-tests.*: E: zero-length /usr/lib/systemd/tests/testdata/test-umount/empty.mountinfo')
+
+addFilter(r'hardcoded-library-path in.*(firewalld|install.d|lib/systemd)')
+
+# everybody does it this way: systemd, syslog-ng, rsyslog
+addFilter(r'unversioned-explicit-provides syslog')
+
+# systemd-machine-id-setup requires libssl
+addFilter(r'explicit-lib-dependency openssl-libs')
+
+addFilter(r'systemd.src:.*strange-permission')

sysusers.attr

@@ -0,0 +1,2 @@
+%__sysusers_provides	%{_rpmconfigdir}/sysusers.prov
+%__sysusers_path	^%{_sysusersdir}/.*\\.conf$

sysusers.generate-pre.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+
+# This script turns sysuser.d files into scriptlets mandated by Fedora
+# packaging guidelines. The general idea is to define users using the
+# declarative syntax but to turn this into traditional scriptlets.
+
+user() {
+    user="$1"
+    uid="$2"
+    desc="$3"
+    group="$4"
+    home="$5"
+    shell="$6"
+
+[ "$desc" = '-' ] && desc=
+[ "$home" = '-' -o "$home" = '' ] && home=/
+[ "$shell" = '-' -o "$shell" = '' ] && shell=/sbin/nologin
+
+if [ "$uid" = '-' -o "$uid" = '' ]; then
+    cat <<EOF
+getent passwd '$user' >/dev/null || \\
+    useradd -r -g '$group' -d '$home' -s '$shell' -c '$desc' '$user'
+EOF
+else
+    cat <<EOF
+if ! getent passwd '$user' >/dev/null ; then
+    if ! getent passwd '$uid' >/dev/null ; then
+        useradd -r -u '$uid' -g '$group' -d '$home' -s /sbin/nologin -c '$desc' '$user'
+    else
+        useradd -r -g '$group' -d '$home' -s /sbin/nologin -c '$desc' '$user'
+    fi
+fi
+
+EOF
+fi
+}
+
+group() {
+    group="$1"
+    gid="$2"
+if [ "$gid" = '-' ]; then
+    cat <<EOF
+getent group '$group' >/dev/null || groupadd -r '$group'
+EOF
+else
+    cat <<EOF
+getent group '$group' >/dev/null || groupadd -f -g '$gid' -r '$group'
+EOF
+fi
+}
+
+parse() {
+    while read line || [ "$line" ]; do
+        [ "${line:0:1}" = '#' -o "${line:0:1}" = ';' ] && continue
+        line="${line## *}"
+        [ -z "$line" ] && continue
+        eval arr=( $line )
+        case "${arr[0]}" in
+            ('u')
+                group "${arr[1]}" "${arr[2]}"
+                user "${arr[1]}" "${arr[2]}" "${arr[3]}" "${arr[1]}" "${arr[4]}" "${arr[5]}"
+                # TODO: user:group support
+                ;;
+            ('g')
+                group "${arr[1]}" "${arr[2]}"
+                ;;
+            ('m')
+                group "${arr[2]}" "-"
+                user "${arr[1]}" "-" "" "${arr[2]}"
+                ;;
+        esac
+    done
+}
+
+for fn in "$@"; do
+    [ -e "$fn" ] || continue
+    echo "# generated from $(basename $fn)"
+    parse < "$fn"
+done

sysusers.prov

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+parse() {
+    while read line; do
+        [ "${line:0:1}" = '#' -o "${line:0:1}" = ';' ] && continue
+        line="${line## *}"
+        [ -z "$line" ] && continue
+        set -- $line
+        case "$1" in
+            ('u')
+                echo "user($2)"
+                echo "group($2)"
+                # TODO: user:group support
+                ;;
+            ('g')
+                echo "group($2)"
+                ;;
+            ('m')
+                echo "user($2)"
+                echo "group($3)"
+                ;;
+        esac
+    done
+}
+
+while read fn; do
+    parse < "$fn"
+done

tests/tests-reboot.yml

@@ -0,0 +1,50 @@
+---
+- hosts: localhost
+  vars:
+  - artifacts: "{{ lookup('env', 'TEST_ARTIFACTS')|default('./artifacts', true) }}"
+  tags:
+  - classic
+  tasks:
+  # switch SELinux to permissive mode
+  - name: Get default kernel
+    command: "grubby --default-kernel"
+    register: default_kernel
+  - debug: msg="{{ default_kernel.stdout }}"
+  - name: Set permissive mode
+    command: "grubby --args=enforcing=0 --update-kernel {{ default_kernel.stdout }}"
+
+  - name: reboot
+    block:
+      - name: restart host
+        shell: sleep 2 && shutdown -r now "Ansible updates triggered"
+        async: 1
+        poll: 0
+        ignore_errors: true
+
+      - name: wait for host to come back
+        wait_for_connection:
+          delay: 10
+          timeout: 300
+
+      - name: Re-create /tmp/artifacts
+        command: mkdir /tmp/artifacts
+
+      - name: Gather SELinux denials since boot
+        shell: |
+            result=pass
+            dmesg | grep -i -e type=1300 -e type=1400 > /tmp/avc.log && result=fail
+            ausearch -m avc -m selinux_err -m user_avc -ts boot &>> /tmp/avc.log
+            grep -q '<no matches>' /tmp/avc.log || result=fail
+            echo -e "\nresults:\n- test: reboot and collect AVC\n  result: $result\n  logs:\n  - avc.log\n\n" > /tmp/results.yml
+            ( [ $result = "pass" ] && echo PASS test-reboot || echo FAIL test-reboot ) > /tmp/test.log
+
+    always:
+      - name: Pull out the artifacts
+        fetch:
+          dest: "{{ artifacts }}/"
+          src: "{{ item }}"
+          flat: yes
+        with_items:
+          - /tmp/test.log
+          - /tmp/avc.log
+          - /tmp/results.yml

triggers.systemd

@@ -1,8 +1,10 @@
 #  -*- Mode: rpm-spec; indent-tabs-mode: nil -*- */
+#  SPDX-License-Identifier: LGPL-2.1+
 #
 #  This file is part of systemd.
 #
 #  Copyright 2015 Zbigniew Jędrzejewski-Szmek
+#  Copyright 2018 Neal Gompa
 #
 #  systemd is free software; you can redistribute it and/or modify it
 #  under the terms of the GNU Lesser General Public License as published by
@@ -18,47 +20,92 @@
 #  along with systemd; If not, see <http://www.gnu.org/licenses/>.
 
 # The contents of this are an example to be copied into systemd.spec.
+#
+# Minimum rpm version supported: 4.13.0
 
-%transfiletriggerin -P 900900 -p <lua> -- /usr/lib/systemd/system /etc/systemd/system
--- This script will run after any package is initially installed or
--- upgraded. We care about the case where a package is initially
--- installed, because other cases are covered by the *un scriptlets,
--- so sometimes we will reload needlessly.
+%transfiletriggerin -P 900900 -- /usr/lib/systemd/system /etc/systemd/system
+# This script will run after any package is initially installed or
+# upgraded. We care about the case where a package is initially
+# installed, because other cases are covered by the *un scriptlets,
+# so sometimes we will reload needlessly.
+if test -d /run/systemd/system; then
+  %{_bindir}/systemctl daemon-reload
+fi
 
-pid = posix.fork()
-if pid == 0 then
-    assert(posix.exec("%{_bindir}/systemctl", "daemon-reload"))
-elseif pid > 0 then
-    posix.wait(pid)
-end
+%transfiletriggerun -- /usr/lib/systemd/system /etc/systemd/system
+# On removal, we need to run daemon-reload after any units have been
+# removed. %transfiletriggerpostun would be ideal, but it does not get
+# executed for some reason.
+# On upgrade, we need to run daemon-reload after any new unit files
+# have been installed, but before %postun scripts in packages get
+# executed. %transfiletriggerun gets the right list of files
+# but it is invoked too early (before changes happen).
+# %filetriggerpostun happens at the right time, but it fires for
+# every package.
+# To execute the reload at the right time, we create a state
+# file in %transfiletriggerun and execute the daemon-reload in
+# the first %filetriggerpostun.
 
-%transfiletriggerun -p <lua> -- /usr/lib/systemd/system /etc/systemd/system
--- On removal, we need to run daemon-reload after any units have been
--- removed. %transfiletriggerpostun would be ideal, but it does not get
--- executed for some reason.
--- On upgrade, we need to run daemon-reload after any new unit files
--- have been installed, but before %postun scripts in packages get
--- executed. %transfiletriggerun gets the right list of files
--- but it is invoked too early (before changes happen).
--- %filetriggerpostun happens at the right time, but it fires for
--- every package.
--- To execute the reload at the right time, we create a state
--- file in %transfiletriggerun and execute the daemon-reload in
--- the first %filetriggerpostun.
+if test -d "/run/systemd/system"; then
+    mkdir -p "%{_localstatedir}/lib/rpm-state/systemd"
+    touch "%{_localstatedir}/lib/rpm-state/systemd/needs-reload"
+fi
 
-posix.mkdir("%{_localstatedir}/lib")
-posix.mkdir("%{_localstatedir}/lib/rpm-state")
-posix.mkdir("%{_localstatedir}/lib/rpm-state/systemd")
-io.open("%{_localstatedir}/lib/rpm-state/systemd/needs-reload", "w")
+%filetriggerpostun -P 1000100 -- /usr/lib/systemd/system /etc/systemd/system
+if test -f "%{_localstatedir}/lib/rpm-state/systemd/needs-reload"; then
+    rm -rf "%{_localstatedir}/lib/rpm-state/systemd"
+    %{_bindir}/systemctl daemon-reload
+fi
 
-%filetriggerpostun -P 1000100 -p <lua> -- /usr/lib/systemd/system /etc/systemd/system
-if posix.access("%{_localstatedir}/lib/rpm-state/systemd/needs-reload") then
-    posix.unlink("%{_localstatedir}/lib/rpm-state/systemd/needs-reload")
-    posix.rmdir("%{_localstatedir}/lib/rpm-state/systemd")
-    pid = posix.fork()
-    if pid == 0 then
-        assert(posix.exec("%{_bindir}/systemctl", "daemon-reload"))
-    elseif pid > 0 then
-        posix.wait(pid)
-    end
-end
+%transfiletriggerin -P 100700 -- /usr/lib/sysusers.d
+# This script will process files installed in /usr/lib/sysusers.d to create
+# specified users automatically. The priority is set such that it
+# will run before the tmpfiles file trigger.
+if test -d /run/systemd/system; then
+  %{_bindir}/systemd-sysusers || :
+fi
+
+%transfiletriggerin -P 100500 -- /usr/lib/tmpfiles.d
+# This script will process files installed in /usr/lib/tmpfiles.d to create
+# tmpfiles automatically. The priority is set such that it will run
+# after the sysusers file trigger, but before any other triggers.
+if test -d /run/systemd/system; then
+  %{_bindir}/systemd-tmpfiles --create || :
+fi
+
+%transfiletriggerin udev -- /usr/lib/udev/hwdb.d
+# This script will automatically invoke hwdb update if files have been
+# installed or updated in /usr/lib/udev/hwdb.d.
+if test -d /run/systemd/system; then
+  %{_bindir}/systemd-hwdb update || :
+fi
+
+%transfiletriggerin -- /usr/lib/systemd/catalog
+# This script will automatically invoke journal catalog update if files
+# have been installed or updated in /usr/lib/systemd/catalog.
+if test -d /run/systemd/system; then
+  %{_bindir}/journalctl --update-catalog || :
+fi
+
+%transfiletriggerin udev -- /usr/lib/udev/rules.d
+# This script will automatically update udev with new rules if files
+# have been installed or updated in /usr/lib/udev/rules.d.
+if test -e /run/udev/control; then
+  %{_bindir}/udevadm control --reload || :
+fi
+
+%transfiletriggerin -- /usr/lib/sysctl.d
+# This script will automatically apply sysctl rules if files have been
+# installed or updated in /usr/lib/sysctl.d.
+if test -d /run/systemd/system; then
+  /usr/lib/systemd/systemd-sysctl || :
+fi
+
+%transfiletriggerin -- /usr/lib/binfmt.d
+# This script will automatically apply binfmt rules if files have been
+# installed or updated in /usr/lib/binfmt.d.
+if test -d /run/systemd/system; then
+  # systemd-binfmt might fail if binfmt_misc kernel module is not loaded
+  # during install
+  /usr/lib/systemd/systemd-binfmt || :
+fi

use-bfq-scheduler.patch

@@ -0,0 +1,40 @@
+From 223ea50950f97ed4e67311dfcffed7ffc27a7cd3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Wed, 14 Aug 2019 15:57:42 +0200
+Subject: [PATCH] udev: use bfq as the default scheduler
+
+As requested in https://bugzilla.redhat.com/show_bug.cgi?id=1738828.
+Test results are that bfq seems to behave better and more consistently on
+typical hardware. The kernel does not have a configuration option to set
+the default scheduler, and it currently needs to be set by userspace.
+
+See the bug for more discussion and links.
+---
+ rules.d/60-block-scheduler.rules | 5 +++++
+ rules.d/meson.build              | 1 +
+ 2 files changed, 6 insertions(+)
+ create mode 100644 rules.d/60-block-scheduler.rules
+
+diff --git a/rules.d/60-block-scheduler.rules b/rules.d/60-block-scheduler.rules
+new file mode 100644
+index 0000000000..480b941761
+--- /dev/null
++++ b/rules.d/60-block-scheduler.rules
+@@ -0,0 +1,5 @@
++# do not edit this file, it will be overwritten on update
++
++ACTION=="add", SUBSYSTEM=="block", \
++  KERNEL=="mmcblk*[0-9]|msblk*[0-9]|mspblk*[0-9]|sd*[!0-9]|sr*", \
++  ATTR{queue/scheduler}="bfq"
+diff --git a/rules.d/meson.build b/rules.d/meson.build
+index ca4445d774..38d6aa6970 100644
+--- a/rules.d/meson.build
++++ b/rules.d/meson.build
+@@ -3,6 +3,7 @@
+ rules = files('''
+         60-autosuspend.rules
+         60-block.rules
++        60-block-scheduler.rules
+         60-cdrom_id.rules
+         60-drm.rules
+         60-evdev.rules