units/systemd-sysusers.service

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Create System Users
Documentation=man:sysusers.d(5) man:systemd-sysusers.service(8)

DefaultDependencies=no
After=systemd-remount-fs.service
Before=sysinit.target systemd-update-done.service
Conflicts=shutdown.target
Before=shutdown.target

ConditionNeedsUpdate=|/etc
ConditionCredential=|sysusers.extra

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=systemd-sysusers
TimeoutSec=90s

# Optionally, pick up a root password and shell for the root user from a
# credential passed to the service manager. This is useful for importing this
# data from nspawn's --set-credential= switch.
LoadCredential=passwd.hashed-password.root
LoadCredential=passwd.plaintext-password.root
LoadCredential=passwd.shell.root

# Also, allow configuring extra sysusers lines via a credential
LoadCredential=sysusers.extra
license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 13:23:58 +09:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
Add SPDX license headers to unit files 2017-11-18 17:35:03 +01:00			`#`
units: rebuild /etc/passwd, the udev hwdb and the journal catalog files on boot Only when necessary of course, nicely guarded with the new ConditionNeedsUpdate= condition we added. 2014-06-13 13:10:30 +02:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
			`Description=Create System Users`
			`Documentation=man:sysusers.d(5) man:systemd-sysusers.service(8)`
units: reorder/split unit dependency blocks The block is reordered and split to have: 1. description + documentation 2. (optionally) conditions 3. all the dependencies I think it's easier to read the units this way. Also, the Conflicts+Before is seperated out to separate lines. The ordering dependency is "fake", because it could just as well be After=, we are adding it to force ordering wrt. shutdown.target, and it plays a different role than the other Before=, which are about a real ordering on boot. 2022-09-14 12:39:10 +01:00
units: rebuild /etc/passwd, the udev hwdb and the journal catalog files on boot Only when necessary of course, nicely guarded with the new ConditionNeedsUpdate= condition we added. 2014-06-13 13:10:30 +02:00			`DefaultDependencies=no`
readahead: wipe out readahead 2014-08-26 21:17:22 +02:00			`After=systemd-remount-fs.service`
units: reorder/split unit dependency blocks The block is reordered and split to have: 1. description + documentation 2. (optionally) conditions 3. all the dependencies I think it's easier to read the units this way. Also, the Conflicts+Before is seperated out to separate lines. The ordering dependency is "fake", because it could just as well be After=, we are adding it to force ordering wrt. shutdown.target, and it plays a different role than the other Before=, which are about a real ordering on boot. 2022-09-14 12:39:10 +01:00			`Before=sysinit.target systemd-update-done.service`
			`Conflicts=shutdown.target`
			`Before=shutdown.target`

sysusers: allow defining additional sysusers lines via credentials 2022-07-13 11:06:04 +02:00			`ConditionNeedsUpdate=\|/etc`
			`ConditionCredential=\|sysusers.extra`
units: rebuild /etc/passwd, the udev hwdb and the journal catalog files on boot Only when necessary of course, nicely guarded with the new ConditionNeedsUpdate= condition we added. 2014-06-13 13:10:30 +02:00
			`[Service]`
			`Type=oneshot`
			`RemainAfterExit=yes`
units: drop full paths for utilities in $PATH This makes things a bit simpler and the build a bit faster, because we don't have to rewrite files to do the trivial substitution. @rootbindir@ is always in our internal $PATH that we use for non-absolute paths, so there should be no functional change. 2019-12-18 09:14:57 +01:00			`ExecStart=systemd-sysusers`
units: specify timeouts for more oneshot services Even trivial service occasionally get stuck, for example when there's a problem with the journal. There's nothing more annoying that looking at the cylon eye for a job with an infinite timeout. Use standard 90s for jobs that do some work, and 30s for those which should be almost instantenous. 2015-04-16 21:41:18 -04:00			`TimeoutSec=90s`
sysusers: read passwords from the credentials logic Let's make use of our own credentials infrastructure in our tools: let's hook up systemd-sysusers with the credentials logic, so that the root password can be provisioned this way. This is really useful when working with stateless systems, in particular nspawn's "--volatile=yes" switch, as this works now: # systemd-nspawn -i foo.raw --volatile=yes --set-credential=passwd.plaintext-password:foo For the first time we have a nice, non-interactive way to provision the root password for a fully stateless system from the container manager. Yay! 2021-03-11 10:34:20 +01:00
			`# Optionally, pick up a root password and shell for the root user from a`
			`# credential passed to the service manager. This is useful for importing this`
			`# data from nspawn's --set-credential= switch.`
Revert "sysusers/firstboot: temporarily disable LoadCredential" This reverts commit 7c20dd4b6ef6e69862576722ac69b895d7a92dc9. Debian has now been updated to patch the issue, so SemaphoreCI should no longer fail. The fix has also been backported to the affected stable branches. 2021-05-02 16:05:48 +01:00			`LoadCredential=passwd.hashed-password.root`
			`LoadCredential=passwd.plaintext-password.root`
			`LoadCredential=passwd.shell.root`
sysusers: allow defining additional sysusers lines via credentials 2022-07-13 11:06:04 +02:00
			`# Also, allow configuring extra sysusers lines via a credential`
			`LoadCredential=sysusers.extra`