15 files changed, 391 insertions, 0 deletions
diff --git a/tmpfiles.d/etc.conf.m4 b/tmpfiles.d/etc.conf.m4
new file mode 100644
index 0000000..f82e0b8
--- /dev/null
+++ b/tmpfiles.d/etc.conf.m4
@@ -0,0 +1,22 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+L /etc/os-release - - - - ../usr/lib/os-release
+L+ /etc/mtab - - - - ../proc/self/mounts
+m4_ifdef(`HAVE_SMACK_RUN_LABEL',
+t /etc/mtab - - - - security.SMACK64=_
+)m4_dnl
+m4_ifdef(`ENABLE_RESOLVE',
+L! /etc/resolv.conf - - - - ../run/systemd/resolve/stub-resolv.conf
+)m4_dnl
+C! /etc/nsswitch.conf - - - -
+m4_ifdef(`HAVE_PAM',
+C! /etc/pam.d - - - -
+)m4_dnl
+C! /etc/issue - - - -
diff --git a/tmpfiles.d/home.conf b/tmpfiles.d/home.conf
new file mode 100644
index 0000000..9f25b83
--- /dev/null
+++ b/tmpfiles.d/home.conf
@@ -0,0 +1,11 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+Q /home 0755 - - -
+q /srv 0755 - - -
diff --git a/tmpfiles.d/journal-nocow.conf b/tmpfiles.d/journal-nocow.conf
new file mode 100644
index 0000000..e32a388
--- /dev/null
+++ b/tmpfiles.d/journal-nocow.conf
@@ -0,0 +1,27 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+# Set the NOCOW attribute for directories of journal files. This flag
+# is inherited by their new files and sub-directories. Matters only
+# for btrfs filesystems.
+#
+# WARNING: Enabling the NOCOW attribute improves journal performance
+#     substantially, but also disables the btrfs checksum logic. In
+#     btrfs RAID filesystems the checksums are needed for rebuilding
+#     corrupted files. Without checksums such rebuilds are not
+#     possible.
+#
+# In a single-disk filesystem (or a filesystem without redundancy)
+# enabling the NOCOW attribute for journal files is safe, because
+# they have their own checksums and a rebuilding wouldn't be possible
+# in any case.
+
+h /var/log/journal - - - - +C
+h /var/log/journal/%m - - - - +C
+h /var/log/journal/remote - - - - +C
diff --git a/tmpfiles.d/legacy.conf b/tmpfiles.d/legacy.conf
new file mode 100644
index 0000000..62e2ae0
--- /dev/null
+++ b/tmpfiles.d/legacy.conf
@@ -0,0 +1,27 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+# These files are considered legacy and are unnecessary on legacy-free
+# systems.
+
+d /run/lock 0755 root root -
+L /var/lock - - - - ../run/lock
+
+# /run/lock/subsys is used for serializing SysV service execution, and
+# hence without use on SysV-less systems.
+
+d /run/lock/subsys 0755 root root -
+
+# /forcefsck, /fastboot and /forcequotacheck are deprecated in favor of the
+# kernel command line options 'fsck.mode=force', 'fsck.mode=skip' and
+# 'quotacheck.mode=force'
+
+r! /forcefsck
+r! /fastboot
+r! /forcequotacheck
diff --git a/tmpfiles.d/meson.build b/tmpfiles.d/meson.build
new file mode 100644
index 0000000..7322460
--- /dev/null
+++ b/tmpfiles.d/meson.build
@@ -0,0 +1,62 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+enable_tmpfiles = conf.get('ENABLE_TMPFILES') == 1
+
+tmpfiles = [['home.conf',            ''],
+            ['journal-nocow.conf',   ''],
+            ['systemd-nologin.conf', 'HAVE_PAM'],
+            ['systemd-nspawn.conf',  'ENABLE_MACHINED'],
+            ['systemd-tmp.conf',     ''],
+            ['portables.conf',       'ENABLE_PORTABLED'],
+            ['systemd-pstore.conf',  'ENABLE_PSTORE'],
+            ['tmp.conf',             ''],
+            ['x11.conf',             ''],
+            ['legacy.conf',          'HAVE_SYSV_COMPAT'],
+           ]
+
+foreach pair : tmpfiles
+        if not enable_tmpfiles
+                # do nothing
+        elif pair[1] == '' or conf.get(pair[1]) == 1
+                install_data(pair[0], install_dir : tmpfilesdir)
+        else
+                message('Not installing tmpfiles.d/@0@ because @1@ is @2@'
+                        .format(pair[0], pair[1], conf.get(pair[1], 0)))
+        endif
+endforeach
+
+in_files = ['static-nodes-permissions.conf']
+
+foreach file : in_files
+        gen = configure_file(
+                input : file + '.in',
+                output : file,
+                configuration : substs)
+        if enable_tmpfiles
+                install_data(gen,
+                             install_dir : tmpfilesdir)
+        endif
+endforeach
+
+m4_files = ['etc.conf',
+            'systemd.conf',
+            'var.conf']
+
+foreach file : m4_files
+        if enable_tmpfiles
+                custom_target(
+                        'tmpfiles.d_' + file,
+                         input : file + '.m4',
+                         output: file,
+                         command : [meson_apply_m4, config_h, '@INPUT@'],
+                         capture : true,
+                         install : true,
+                         install_dir : tmpfilesdir)
+        endif
+endforeach
+
+if enable_tmpfiles and install_sysconfdir
+        meson.add_install_script(
+                'sh', '-c',
+                mkdir_p.format(join_paths(sysconfdir, 'tmpfiles.d')))
+endif
diff --git a/tmpfiles.d/portables.conf b/tmpfiles.d/portables.conf
new file mode 100644
index 0000000..3fd0c7d
--- /dev/null
+++ b/tmpfiles.d/portables.conf
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# See tmpfiles.d(5) for details
+
+Q /var/lib/portables 0700
diff --git a/tmpfiles.d/static-nodes-permissions.conf.in b/tmpfiles.d/static-nodes-permissions.conf.in
new file mode 100644
index 0000000..50cffe2
--- /dev/null
+++ b/tmpfiles.d/static-nodes-permissions.conf.in
@@ -0,0 +1,17 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# This file adds permissions on top of static-nodes.conf generated by
+# kmod-static-nodes.service. Rules specified here should match the
+# permissions specified for udev in 50-udev-default.rules.
+
+z /dev/snd/seq      0660 - audio -
+z /dev/snd/timer    0660 - audio -
+z /dev/loop-control 0660 - disk  -
+z /dev/net/tun      0666 - -     -
+z /dev/fuse         0666 - -     -
+z /dev/kvm          @DEV_KVM_MODE@ - kvm -
diff --git a/tmpfiles.d/systemd-nologin.conf b/tmpfiles.d/systemd-nologin.conf
new file mode 100644
index 0000000..39cfd06
--- /dev/null
+++ b/tmpfiles.d/systemd-nologin.conf
@@ -0,0 +1,11 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5), systemd-user-sessions.service(8) and pam_nologin(8).
+# This file has special suffix so it is not run by mistake.
+
+F! /run/nologin 0644 - - - "System is booting up. Unprivileged users are not permitted to log in yet. Please come back later. For technical details, see pam_nologin(8)."
diff --git a/tmpfiles.d/systemd-nspawn.conf b/tmpfiles.d/systemd-nspawn.conf
new file mode 100644
index 0000000..78bd1c6
--- /dev/null
+++ b/tmpfiles.d/systemd-nspawn.conf
@@ -0,0 +1,23 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+Q /var/lib/machines 0700 - - -
+
+# Remove old temporary snapshots, but only at boot. Ideally we'd have
+# "self-destroying" btrfs snapshots that go away if the last
+# reference to it does. To mimic a scheme like this at least remove
+# the old snapshots on fresh boots, where we know they cannot be
+# referenced anymore. Note that we actually remove all temporary files
+# in /var/lib/machines/ at boot, which should be safe since the
+# directory has defined semantics. In the root directory (where
+# systemd-nspawn --ephemeral places snapshots) we are more strict, to
+# avoid removing unrelated temporary files.
+
+R! /var/lib/machines/.#*
+R! /.#machine.*
diff --git a/tmpfiles.d/systemd-pstore.conf b/tmpfiles.d/systemd-pstore.conf
new file mode 100644
index 0000000..e6540b5
--- /dev/null
+++ b/tmpfiles.d/systemd-pstore.conf
@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
+# The systemd-pstore.service(1) archives the contents of /sys/fs/pstore
+# upon boot so that there is room for a subsequent dump. This service
+# is enabled with:
+#  systemctl enable systemd-pstore
+#
+# With the service enabled, the kernel still needs to be configured
+# to write data into the pstore. The kernel has two parameters,
+# crash_kexec_post_notifiers and printk.always_kmsg_dump, that
+# control writes into pstore.
+#
+# The crash_kexec_post_notifiers parameter enables the kernel to write
+# dmesg (including stack trace) into pstore upon a panic even if kdump
+# is loaded, only needed if you want to use pstore with kdump. Without
+# this parameter, kdump could block writing to pstore for stability
+# reason. Note this increases the risk of kdump failure even if pstore
+# is not available.
+#
+# The printk.always_kmsg_dump parameter enables the kernel to write dmesg
+# upon a normal shutdown (shutdown, reboot, halt).
+#
+# To configure the kernel parameters, uncomment the appropriate
+# line(s) below. The value written is either 'Y' to enable the
+# kernel parameter, or 'N' to disable the kernel parameter.
+#
+# After making a change to this file, do:
+#  systemd-tmpfiles --create path/to/tmpfiles.d/systemd-pstore.conf
+#
+# These changes are automatically applied on future re-boots.
+
+d /var/lib/systemd/pstore 0755 root root 14d
+#w- /sys/module/printk/parameters/always_kmsg_dump - - - - Y
+#w- /sys/module/kernel/parameters/crash_kexec_post_notifiers - - - - Y
diff --git a/tmpfiles.d/systemd-tmp.conf b/tmpfiles.d/systemd-tmp.conf
new file mode 100644
index 0000000..d47d468
--- /dev/null
+++ b/tmpfiles.d/systemd-tmp.conf
@@ -0,0 +1,23 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+# Exclude namespace mountpoints created with PrivateTmp=yes
+x /tmp/systemd-private-%b-*
+X /tmp/systemd-private-%b-*/tmp
+x /var/tmp/systemd-private-%b-*
+X /var/tmp/systemd-private-%b-*/tmp
+
+# Remove top-level private temporary directories on each boot
+R! /tmp/systemd-private-*
+R! /var/tmp/systemd-private-*
+
+# Handle lost systemd-coredump temp files. They could be lost on old filesystems,
+# for example, after hard reboot.
+x  /var/lib/systemd/coredump/.#core*.%b*
+r! /var/lib/systemd/coredump/.#*
diff --git a/tmpfiles.d/systemd.conf.m4 b/tmpfiles.d/systemd.conf.m4
new file mode 100644
index 0000000..11d87d2
--- /dev/null
+++ b/tmpfiles.d/systemd.conf.m4
@@ -0,0 +1,74 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+d /run/user 0755 root root -
+m4_ifdef(`ENABLE_UTMP',
+F! /run/utmp 0664 root utmp -
+)m4_dnl
+
+d /run/systemd/ask-password 0755 root root -
+d /run/systemd/seats 0755 root root -
+d /run/systemd/sessions 0755 root root -
+d /run/systemd/users 0755 root root -
+d /run/systemd/machines 0755 root root -
+d /run/systemd/shutdown 0755 root root -
+m4_ifdef(`ENABLE_NETWORKD',
+d /run/systemd/netif 0755 systemd-network systemd-network -
+d /run/systemd/netif/links 0755 systemd-network systemd-network -
+d /run/systemd/netif/leases 0755 systemd-network systemd-network -
+d /run/systemd/netif/lldp 0755 systemd-network systemd-network -
+)m4_dnl
+
+d /run/log 0755 root root -
+
+z /run/log/journal 2755 root systemd-journal - -
+Z /run/log/journal/%m ~2750 root systemd-journal - -
+m4_ifdef(`HAVE_ACL',`m4_dnl
+m4_ifdef(`ENABLE_ADM_GROUP',`m4_dnl
+m4_ifdef(`ENABLE_WHEEL_GROUP',``
+a+ /run/log/journal    - - - - d:group::r-x,d:group:adm:r-x,d:group:wheel:r-x,group::r-x,group:adm:r-x,group:wheel:r-x
+a+ /run/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x,group:adm:r-x,group:wheel:r-x
+a+ /run/log/journal/%m/*.journal* - - - - group:adm:r--,group:wheel:r--
+'',``
+a+ /run/log/journal    - - - - d:group::r-x,d:group:adm:r-x,group::r-x,group:adm:r-x
+a+ /run/log/journal/%m - - - - d:group:adm:r-x,group:adm:r-x
+a+ /run/log/journal/%m/*.journal* - - - - group:adm:r--
+'')',`m4_dnl
+m4_ifdef(`ENABLE_WHEEL_GROUP',``
+a+ /run/log/journal    - - - - d:group::r-x,d:group:wheel:r-x,group::r-x,group:wheel:r-x
+a+ /run/log/journal/%m - - - - d:group:wheel:r-x,group:wheel:r-x
+a+ /run/log/journal/%m/*.journal* - - - - group:wheel:r--
+'')')')m4_dnl
+
+z /var/log/journal 2755 root systemd-journal - -
+z /var/log/journal/%m 2755 root systemd-journal - -
+z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
+m4_ifdef(`HAVE_ACL',`m4_dnl
+m4_ifdef(`ENABLE_ADM_GROUP',`m4_dnl
+m4_ifdef(`ENABLE_WHEEL_GROUP',``
+a+ /var/log/journal    - - - - d:group::r-x,d:group:adm:r-x,d:group:wheel:r-x,group::r-x,group:adm:r-x,group:wheel:r-x
+a+ /var/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x,group:adm:r-x,group:wheel:r-x
+a+ /var/log/journal/%m/system.journal - - - - group:adm:r--,group:wheel:r--
+'', ``
+a+ /var/log/journal    - - - - d:group::r-x,d:group:adm:r-x,group::r-x,group:adm:r-x
+a+ /var/log/journal/%m - - - - d:group:adm:r-x,group:adm:r-x
+a+ /var/log/journal/%m/system.journal - - - - group:adm:r--
+'')',`m4_dnl
+m4_ifdef(`ENABLE_WHEEL_GROUP',``
+a+ /var/log/journal    - - - - d:group::r-x,d:group:wheel:r-x,group::r-x,group:wheel:r-x
+a+ /var/log/journal/%m - - - - d:group:wheel:r-x,group:wheel:r-x
+a+ /var/log/journal/%m/system.journal - - - - group:wheel:r--
+'')')')m4_dnl
+
+d /var/lib/systemd 0755 root root -
+d /var/lib/systemd/coredump 0755 root root 3d
+
+d /var/lib/private 0700 root root -
+d /var/log/private 0700 root root -
+d /var/cache/private 0700 root root -
diff --git a/tmpfiles.d/tmp.conf b/tmpfiles.d/tmp.conf
new file mode 100644
index 0000000..fe5225d
--- /dev/null
+++ b/tmpfiles.d/tmp.conf
@@ -0,0 +1,12 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+# Clear tmp directories separately, to make them easier to override
+q /tmp 1777 root root 10d
+q /var/tmp 1777 root root 30d
diff --git a/tmpfiles.d/var.conf.m4 b/tmpfiles.d/var.conf.m4
new file mode 100644
index 0000000..0e2c509
--- /dev/null
+++ b/tmpfiles.d/var.conf.m4
@@ -0,0 +1,25 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+q /var 0755 - - -
+
+L /var/run - - - - ../run
+
+d /var/log 0755 - - -
+m4_ifdef(`ENABLE_UTMP',
+f /var/log/wtmp 0664 root utmp -
+f /var/log/btmp 0660 root utmp -
+f /var/log/lastlog 0664 root utmp -
+)m4_dnl
+
+d /var/cache 0755 - - -
+
+d /var/lib 0755 - - -
+
+d /var/spool 0755 - - -
diff --git a/tmpfiles.d/x11.conf b/tmpfiles.d/x11.conf
new file mode 100644
index 0000000..f63184e
--- /dev/null
+++ b/tmpfiles.d/x11.conf
@@ -0,0 +1,19 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+# Make sure these are created by default so that nobody else can
+# or empty them at startup
+D! /tmp/.X11-unix 1777 root root 10d
+D! /tmp/.ICE-unix 1777 root root 10d
+D! /tmp/.XIM-unix 1777 root root 10d
+D! /tmp/.font-unix 1777 root root 10d
+D! /tmp/.Test-unix 1777 root root 10d
+
+# Unlink the X11 lock files
+r! /tmp/.X[0-9]*-lock