systemd/units/systemd-tmpfiles-setup.service

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Create Volatile Files and Directories
Documentation=man:tmpfiles.d(5) man:systemd-tmpfiles(8)

DefaultDependencies=no
After=local-fs.target systemd-sysusers.service systemd-journald.service
Before=sysinit.target
Conflicts=shutdown.target initrd-switch-root.target
Before=shutdown.target initrd-switch-root.target
RefuseManualStop=yes

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev
SuccessExitStatus=DATAERR CANTCREAT
ImportCredential=tmpfiles.*
ImportCredential=login.motd
ImportCredential=login.issue
ImportCredential=network.hosts
ImportCredential=ssh.authorized_keys.root
license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 04:23:58 +00:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
Add SPDX license headers to unit files 2017-11-18 16:35:03 +00:00			`#`
units: ship unit file for systemd-tmpfiles by default 2010-09-28 23:30:41 +00:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends. 2012-04-11 22:20:58 +00:00			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
units: ship unit file for systemd-tmpfiles by default 2010-09-28 23:30:41 +00:00			`# (at your option) any later version.`

			`[Unit]`
tmpfiles: introduce the concept of unsafe operations Various operations done by systemd-tmpfiles may only be safely done at boot (e.g. removal of X lockfiles in /tmp, creation of /run/nologin). Other operations may be done at any point in time (e.g. setting the ownership on /{run,var}/log/journal). This distinction is largely orthogonal to the type of operation. A new switch --unsafe is added, and operations which should only be executed during bootup are marked with an exclamation mark in the configuration files. systemd-tmpfiles.service is modified to use this switch, and guards are added so it is hard to re-start it by mistake. If we install a new version of systemd, we actually want to enforce some changes to tmpfiles configuration immediately. This should now be possible to do safely, so distribution packages can be modified to execute the "safe" subset at package installation time. /run/nologin creation is split out into a separate service, to make it easy to override. https://bugzilla.redhat.com/show_bug.cgi?id=1043212 https://bugzilla.redhat.com/show_bug.cgi?id=1045849 2013-12-21 01:25:39 +00:00			`Description=Create Volatile Files and Directories`
man: link systemd-tmpfiles-setup-dev.service 2013-04-23 07:56:32 +00:00			`Documentation=man:tmpfiles.d(5) man:systemd-tmpfiles(8)`
units: reorder/split unit dependency blocks The block is reordered and split to have: 1. description + documentation 2. (optionally) conditions 3. all the dependencies I think it's easier to read the units this way. Also, the Conflicts+Before is seperated out to separate lines. The ordering dependency is "fake", because it could just as well be After=, we are adding it to force ordering wrt. shutdown.target, and it plays a different role than the other Before=, which are about a real ordering on boot. 2022-09-14 11:39:10 +00:00
units: ship unit file for systemd-tmpfiles by default 2010-09-28 23:30:41 +00:00			`DefaultDependencies=no`
tmpfiles: Order tmpfiles-setup after journald systemd-tmpfiles-setup.service needs to be ordered after systemd-journald.service, so entries in /run/log/journal are already created when systemd-tmpfiles tries to adjust its permissions. This is specially problematic for setups using a volatile journal where the initrd does not ship a machine-id (i.e. OSTree-based systems), where logs from the initrd will be inaccessible for users in the systemd-journal group. It also has a side effect of `journalctl --user` failing with "No journal files were opened due to insufficient permissions". Fixes #10128. 2018-09-18 22:03:54 +00:00			`After=local-fs.target systemd-sysusers.service systemd-journald.service`
Revert "unit: make udev rules really take precedence over tmpfiles" This reverts commits 112a41b6ece19d03e951d886fe2f26512ab31fab, 3178698bb5352989e4bff866641838b1c2a0efcb, and b768379e8b494b025f41946205944a6f3a1a553f. The commit 112a41b6ece19d03e951d886fe2f26512ab31fab introduces #28765, as systemd-tmpfiles-setup.service has ordering after local-fs.target, but usually the target requires block devices processed by udevd. Hence, the service can only start after the block devices timed out. Fixes #28765. 2023-08-11 04:45:25 +00:00			`Before=sysinit.target`
units: add ordering dependencies on initrd-switch-root.target For shutdown, we queue shutdown.target/start, so in every unit which should be stopped before shutdown, we need both Conflicts and an ordering dependency with shutdown.target (either Before= or After= would work, because stop jobs are always ordered before start jobs). For initrd transition, we queue initrd-switch-root.service/isolate. This automatically creates a /stop job for every running unit without IgnoreOnIsolate. But no ordering dependency is created, unless the unit has a (possibly transitive) ordering dependency on initrd-switch-root.service. Since most units must stop before the transition, we should add the ordering dependency. It is nicer to use Before=initrd-switch-root.target for this. initrd-switch-root.target is ordered before initrd-switch-root.service, so the effect it the same when both are in a transaction. Fixes #23745. To also cover the case where somebody is emergency mode in the initrd and queues initrd-switch-root.service/start (not isolate), also add Conflicts=initrd-switch-root.target, so various units are stopped properly. This extends 2525682565b372b9b83c848bfe89c025fed47a1d to cover all the other services that are touched. It could be consider "operator error", but it's easy to make and it's nicer if we can make this more foolproof. 2022-09-14 11:39:10 +00:00			`Conflicts=shutdown.target initrd-switch-root.target`
			`Before=shutdown.target initrd-switch-root.target`
tmpfiles: introduce the concept of unsafe operations Various operations done by systemd-tmpfiles may only be safely done at boot (e.g. removal of X lockfiles in /tmp, creation of /run/nologin). Other operations may be done at any point in time (e.g. setting the ownership on /{run,var}/log/journal). This distinction is largely orthogonal to the type of operation. A new switch --unsafe is added, and operations which should only be executed during bootup are marked with an exclamation mark in the configuration files. systemd-tmpfiles.service is modified to use this switch, and guards are added so it is hard to re-start it by mistake. If we install a new version of systemd, we actually want to enforce some changes to tmpfiles configuration immediately. This should now be possible to do safely, so distribution packages can be modified to execute the "safe" subset at package installation time. /run/nologin creation is split out into a separate service, to make it easy to override. https://bugzilla.redhat.com/show_bug.cgi?id=1043212 https://bugzilla.redhat.com/show_bug.cgi?id=1045849 2013-12-21 01:25:39 +00:00			`RefuseManualStop=yes`
units: ship unit file for systemd-tmpfiles by default 2010-09-28 23:30:41 +00:00
			`[Service]`
			`Type=oneshot`
			`RemainAfterExit=yes`
units: introduce systemd-tmpfiles-setup-dev-early.service This makes tmpfiles, sysusers, and udevd invoked in the following order: 1. systemd-tmpfiles-setup-dev-early.service Create device nodes gracefully, that is, create device nodes anyway by ignoring unknown users and groups. 2. systemd-sysusers.service Create users and groups, to make later invocations of tmpfiles and udevd can resolve necessary users and groups. 3. systemd-tmpfiles-setup-dev.service Adjust owners of previously created device nodes. 4. systemd-udevd.service Process all devices. Especially to make block devices active and can be mountable. 5. systemd-tmpfiles-setup.service Setup basic filesystem. Follow-up for b42482af904ae0b94a6e4501ec595448f0ba1c06. Fixes #28653. Replaces #28681 and #28732. 2023-08-11 22:54:32 +00:00			`ExecStart=systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev`
units: use symbolic exit code names (nspawn uses 133 which doesn't have a name. That's reasonable, because there's less chance of conflict with a return value from the payload.) 2019-07-28 13:00:08 +00:00			`SuccessExitStatus=DATAERR CANTCREAT`
units: Use ImportCredential= where applicable 2023-06-08 12:09:36 +00:00			`ImportCredential=tmpfiles.*`
			`ImportCredential=login.motd`
			`ImportCredential=login.issue`
			`ImportCredential=network.hosts`
			`ImportCredential=ssh.authorized_keys.root`