Merging upstream version 256.4.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

23 files changed, 153 insertions, 52 deletions

diff --git a/test/README.testsuite b/test/README.testsuite
index 13ba157..22da1cd 100644
--- a/test/README.testsuite
+++ b/test/README.testsuite
@@ -14,23 +14,52 @@ We also need to make sure the required meson options are enabled:
 $ meson setup --reconfigure build -Dremote=enabled
 ```
 
-Next, we can build the integration test image:
+To make sure `mkosi` doesn't try to build systemd from source during the image build
+process, you can add the following to `mkosi.local.conf`:
+
+```
+[Content]
+Environment=NO_BUILD=1
+```
+
+You might also want to use the `PackageDirectories=` or `Repositories=` option to provide
+mkosi with a directory or repository containing the systemd packages that should be installed
+instead. If the repository containing the systemd packages is not a builtin repository known
+by mkosi, you can use the `PackageManagerTrees=` option to write an extra repository definition
+to /etc which is used when building the image instead.
+
+Next, we can build the integration test image with meson:
 
 ```shell
 $ meson compile -C build mkosi
 ```
 
+By default, the `mkosi` meson target which builds the integration test image depends on
+other meson targets to build various systemd tools that are used to build the image to make
+sure they are up-to-date. If you instead want the already installed systemd tools on the
+host to be used, you can run `mkosi` manually to build the image. To build the integration test
+image without meson, run the following:
+
+```shell
+$ mkosi -f
+```
+
+Note that by default we assume that `build/` is used as the meson build directory that will be used to run
+the integration tests. If you want to use another directory as the meson build directory, you will have to
+configure the mkosi build directory (`BuildDirectory=`), cache directory (`CacheDirectory=`) and output
+directory (`OutputDirectory=`) to point to the other directory using `mkosi.local.conf`.
+
 After the image has been built, the integration tests can be run with:
 
 ```shell
-$ SYSTEMD_INTEGRATION_TESTS=1 meson test -C build/ --suite integration-tests --num-processes "$(($(nproc) / 4))"
+$ SYSTEMD_INTEGRATION_TESTS=1 meson test -C build --no-rebuild --suite integration-tests --num-processes "$(($(nproc) / 4))"
 ```
 
 As usual, specific tests can be run in meson by appending the name of the test
 which is usually the name of the directory e.g.
 
 ```shell
-$ SYSTEMD_INTEGRATION_TESTS=1 meson test -C build/ -v TEST-01-BASIC
+$ SYSTEMD_INTEGRATION_TESTS=1 meson test -C build --no-rebuild -v TEST-01-BASIC
 ```
 
 See `meson introspect build --tests` for a list of tests.
@@ -40,7 +69,7 @@ To interactively debug a failing integration test, the `--interactive` option
 newer:
 
 ```shell
-$ SYSTEMD_INTEGRATION_TESTS=1 meson test -C build/ -i TEST-01-BASIC
+$ SYSTEMD_INTEGRATION_TESTS=1 meson test -C build --no-rebuild -i TEST-01-BASIC
 ```
 
 Due to limitations in meson, the integration tests do not yet depend on the
@@ -49,7 +78,7 @@ running the integration tests. To rebuild the image and rerun a test, the
 following command can be used:
 
 ```shell
-$ meson compile -C build mkosi && SYSTEMD_INTEGRATION_TESTS=1 meson test -C build -v TEST-01-BASIC
+$ meson compile -C build mkosi && SYSTEMD_INTEGRATION_TESTS=1 meson test -C build --no-rebuild -v TEST-01-BASIC
 ```
 
 The integration tests use the same mkosi configuration that's used when you run
diff --git a/test/TEST-06-SELINUX/meson.build b/test/TEST-06-SELINUX/meson.build
index 5036b64..fd670ae 100644
--- a/test/TEST-06-SELINUX/meson.build
+++ b/test/TEST-06-SELINUX/meson.build
@@ -3,11 +3,14 @@
 integration_tests += [
         integration_test_template + {
                 'name' : fs.name(meson.current_source_dir()),
-                'cmdline' : integration_test_template['cmdline'] + ['systemd.wants=autorelabel.service', 'selinux=1', 'lsm=selinux'],
+                'cmdline' : integration_test_template['cmdline'] + ['selinux=1', 'enforcing=0', 'lsm=selinux'],
                 # FIXME; Figure out why reboot sometimes hangs with 'linux' firmware.
                 # Use 'auto' to automatically fallback on non-uefi architectures.
                 'firmware' : 'auto',
                 'vm' : true,
+                # Make sure we don't mount anything with virtiofs as otherwise fixfiles will try to relabel
+                # it.
+                'mkosi-args' : integration_test_template['mkosi-args'] + ['--runtime-build-sources=no'],
         },
 ]
 
diff --git a/test/TEST-13-NSPAWN/test.sh b/test/TEST-13-NSPAWN/test.sh
index 9a0404f..5c85b0c 100755
--- a/test/TEST-13-NSPAWN/test.sh
+++ b/test/TEST-13-NSPAWN/test.sh
@@ -32,7 +32,7 @@ test_append_files() {
         ls \
         md5sum \
         mountpoint \
-        nc \
+        ncat \
         ps \
         seq \
         sleep \
diff --git a/test/TEST-46-HOMED/test.sh b/test/TEST-46-HOMED/test.sh
index 923e002..06034b7 100755
--- a/test/TEST-46-HOMED/test.sh
+++ b/test/TEST-46-HOMED/test.sh
@@ -24,6 +24,7 @@ test_append_files() {
     inst_binary ssh
     inst_binary sshd
     inst_binary ssh-keygen
+    image_install -o /usr/lib/ssh/sshd-session
 }
 
 do_test "$@"
diff --git a/test/TEST-55-OOMD/meson.build b/test/TEST-55-OOMD/meson.build
index adc0509..2566316 100644
--- a/test/TEST-55-OOMD/meson.build
+++ b/test/TEST-55-OOMD/meson.build
@@ -5,6 +5,9 @@ integration_tests += [
                 'name' : fs.name(meson.current_source_dir()),
                 'credentials' : integration_test_template['credentials'] + [
                         files('systemd.unit-dropin.init.scope'),
+                        # OpenSUSE disables all controller delegation for the user manager template. Mask the
+                        # dropin to make TEST-55-OOMD pass on OpenSUSE.
+                        'systemd.unit-dropin.user@.service~20-defaults-SUSE=',
                 ],
                 'vm' : true,
         },
diff --git a/test/TEST-55-OOMD/test.sh b/test/TEST-55-OOMD/test.sh
index 5e30963..3b2f471 100755
--- a/test/TEST-55-OOMD/test.sh
+++ b/test/TEST-55-OOMD/test.sh
@@ -14,7 +14,7 @@ TEST_NO_NSPAWN=1
 test_append_files() {
     local workspace="${1:?}"
 
-    image_install mkswap swapon swapoff stress
+    image_install mkswap swapon swapoff stress-ng
     image_install -o btrfs
 
     mkdir -p "${workspace:?}/etc/systemd/system/init.scope.d/"
diff --git a/test/TEST-64-UDEV-STORAGE/nvme_basic.configure b/test/TEST-64-UDEV-STORAGE/nvme_basic.configure
index 28ddfa4..b740c09 100755
--- a/test/TEST-64-UDEV-STORAGE/nvme_basic.configure
+++ b/test/TEST-64-UDEV-STORAGE/nvme_basic.configure
@@ -25,7 +25,7 @@ def add_drive(i: int, serial: str) -> None:
             "Options": "cache=unsafe",
         }
     ]
-    config["QemuArgs"] += ["-device", f"nvme,drive={id},serial={serial},num_queues=8"]
+    config["QemuArgs"] += ["-device", f"nvme,drive={id},serial={serial},max_ioqpairs=8"]
 
 for i in range(5):
     add_drive(i, serial=f"deadbeef{i}")
diff --git a/test/TEST-73-LOCALE/meson.build b/test/TEST-73-LOCALE/meson.build
index 8dec5f3..4f50d66 100644
--- a/test/TEST-73-LOCALE/meson.build
+++ b/test/TEST-73-LOCALE/meson.build
@@ -3,5 +3,6 @@
 integration_tests += [
         integration_test_template + {
                 'name' : fs.name(meson.current_source_dir()),
+                'priority' : 10,
         },
 ]
diff --git a/test/TEST-74-AUX-UTILS/test.sh b/test/TEST-74-AUX-UTILS/test.sh
index 2ee4a75..d47a0a2 100755
--- a/test/TEST-74-AUX-UTILS/test.sh
+++ b/test/TEST-74-AUX-UTILS/test.sh
@@ -31,6 +31,7 @@ test_append_files() {
     inst_binary ssh
     inst_binary sshd
     inst_binary ssh-keygen
+    image_install -o /usr/lib/ssh/sshd-session
     inst_binary usermod
     instmods vmw_vsock_virtio_transport
     instmods vsock_loopback
diff --git a/test/integration-test-wrapper.py b/test/integration-test-wrapper.py
index 743a14c..d7a622a 100755
--- a/test/integration-test-wrapper.py
+++ b/test/integration-test-wrapper.py
@@ -134,7 +134,6 @@ def main():
         '--runtime-network=none',
         '--runtime-scratch=no',
         *args.mkosi_args,
-        '--append',
         '--qemu-firmware', args.firmware,
         '--qemu-kvm', "auto" if not bool(int(os.getenv("TEST_NO_KVM", "0"))) else "no",
         '--kernel-command-line-extra',
@@ -184,9 +183,8 @@ def main():
                     text=True,
                 ).stdout
             )
-            images = {image["Image"]: image for image in j["Images"]}
-            distribution = images["system"]["Distribution"]
-            release = images["system"]["Release"]
+            distribution = j["Images"][-1]["Distribution"]
+            release = j["Images"][-1]["Release"]
             artifact = f"ci-mkosi-{id}-{iteration}-{distribution}-{release}-failed-test-journals"
             ops += [f"gh run download {id} --name {artifact} -D ci/{artifact}"]
             journal_file = Path(f"ci/{artifact}/test/journal/{name}.journal")
diff --git a/test/test-execute/exec-set-credential.service b/test/test-execute/exec-set-credential.service
index 2263436..7f2e87f 100644
--- a/test/test-execute/exec-set-credential.service
+++ b/test/test-execute/exec-set-credential.service
@@ -5,7 +5,7 @@ Description=Test for SetCredential=
 [Service]
 ExecStart=sh -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
 ExecStartPost=sh -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
-ExecStop=sh -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
-ExecStopPost=sh -x -c 'test "$$(cat %d/test-execute.set-credential)" = "hoge"'
+ExecStop=bash -x -c '[[ ! -v CREDENTIALS_DIRECTORY ]]'
+ExecStopPost=bash -x -c '[[ ! -v CREDENTIALS_DIRECTORY ]]'
 Type=oneshot
 SetCredential=test-execute.set-credential:hoge
diff --git a/test/test-functions b/test/test-functions
index 03f188b..e219812 100644
--- a/test/test-functions
+++ b/test/test-functions
@@ -208,7 +208,7 @@ BASICTOOLS=(
     mount
     mountpoint
     mv
-    nc
+    ncat
     nproc
     ping
     pkill
diff --git a/test/test-network/systemd-networkd-tests.py b/test/test-network/systemd-networkd-tests.py
index 7c336ba..ba8e65e 100755
--- a/test/test-network/systemd-networkd-tests.py
+++ b/test/test-network/systemd-networkd-tests.py
@@ -7120,6 +7120,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
         self.assertGreater(prefixInfo[0]['PreferredLifetimeUSec'], 0)
         self.assertGreater(prefixInfo[0]['ValidLifetimeUSec'], 0)
 
+    @unittest.skipUnless(shutil.which('dhcpd'), reason="dhcpd is not available on CentOS Stream 10")
     def test_dhcp6pd_no_address(self):
         # For issue #29979.
         copy_network_unit('25-veth.netdev', '25-dhcp6pd-server.network', '25-dhcp6pd-upstream-no-address.network')
@@ -7136,6 +7137,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
 
         self.check_dhcp6_prefix('veth99')
 
+    @unittest.skipUnless(shutil.which('dhcpd'), reason="dhcpd is not available on CentOS Stream 10")
     def test_dhcp6pd_no_assign(self):
         # Similar to test_dhcp6pd_no_assign(), but in this case UseAddress=yes (default),
         # However, the server does not provide IA_NA. For issue #31349.
@@ -7153,6 +7155,7 @@ class NetworkdDHCPPDTests(unittest.TestCase, Utilities):
 
         self.check_dhcp6_prefix('veth99')
 
+    @unittest.skipUnless(shutil.which('dhcpd'), reason="dhcpd is not available on CentOS Stream 10")
     def test_dhcp6pd(self):
         copy_network_unit('25-veth.netdev', '25-dhcp6pd-server.network', '25-dhcp6pd-upstream.network',
                           '25-veth-downstream-veth97.netdev', '25-dhcp-pd-downstream-veth97.network', '25-dhcp-pd-downstream-veth97-peer.network',
diff --git a/test/units/TEST-07-PID1.exec-context.sh b/test/units/TEST-07-PID1.exec-context.sh
index a3379ef..cf39af0 100755
--- a/test/units/TEST-07-PID1.exec-context.sh
+++ b/test/units/TEST-07-PID1.exec-context.sh
@@ -186,27 +186,27 @@ if ! systemd-detect-virt -cq; then
         )
 
         # We should fail with EPERM when trying to bind to a socket not on the allow list
-        # (nc exits with 2 in that case)
+        # (ncat exits with 2 in that case)
         systemd-run --wait -p SuccessExitStatus="1 2" --pipe "${ARGUMENTS[@]}" \
-            bash -xec 'timeout 1s nc -l 127.0.0.1 9999; exit 42'
+            bash -xec 'timeout 1s ncat -l 127.0.0.1 9999; exit 42'
         systemd-run --wait -p SuccessExitStatus="1 2" --pipe "${ARGUMENTS[@]}" \
-            bash -xec 'timeout 1s nc -l ::1 9999; exit 42'
+            bash -xec 'timeout 1s ncat -l ::1 9999; exit 42'
         systemd-run --wait -p SuccessExitStatus="1 2" --pipe "${ARGUMENTS[@]}" \
-            bash -xec 'timeout 1s nc -6 -u -l ::1 9999; exit 42'
+            bash -xec 'timeout 1s ncat -6 -u -l ::1 9999; exit 42'
         systemd-run --wait -p SuccessExitStatus="1 2" --pipe "${ARGUMENTS[@]}" \
-            bash -xec 'timeout 1s nc -4 -l 127.0.0.1 6666; exit 42'
+            bash -xec 'timeout 1s ncat -4 -l 127.0.0.1 6666; exit 42'
         systemd-run --wait -p SuccessExitStatus="1 2" --pipe -p SocketBindDeny=any \
-            bash -xec 'timeout 1s nc -l 127.0.0.1 9999; exit 42'
+            bash -xec 'timeout 1s ncat -l 127.0.0.1 9999; exit 42'
         # Consequently, we should succeed when binding to a socket on the allow list
         # and keep listening on it until we're killed by `timeout` (EC 124)
         systemd-run --wait --pipe -p SuccessExitStatus=124 "${ARGUMENTS[@]}" \
-            bash -xec 'timeout 1s nc -4 -l 127.0.0.1 1234; exit 1'
+            bash -xec 'timeout 1s ncat -4 -l 127.0.0.1 1234; exit 1'
         systemd-run --wait --pipe -p SuccessExitStatus=124 "${ARGUMENTS[@]}" \
-            bash -xec 'timeout 1s nc -4 -u -l 127.0.0.1 5678; exit 1'
+            bash -xec 'timeout 1s ncat -4 -u -l 127.0.0.1 5678; exit 1'
         systemd-run --wait --pipe -p SuccessExitStatus=124 "${ARGUMENTS[@]}" \
-            bash -xec 'timeout 1s nc -6 -l ::1 1234; exit 1'
+            bash -xec 'timeout 1s ncat -6 -l ::1 1234; exit 1'
         systemd-run --wait --pipe -p SuccessExitStatus=124 "${ARGUMENTS[@]}" \
-            bash -xec 'timeout 1s nc -6 -l ::1 6666; exit 1'
+            bash -xec 'timeout 1s ncat -6 -l ::1 6666; exit 1'
     fi
 
     losetup -d "$LODEV"
diff --git a/test/units/TEST-07-PID1.issue-2467.sh b/test/units/TEST-07-PID1.issue-2467.sh
index de0577b..083a1e7 100755
--- a/test/units/TEST-07-PID1.issue-2467.sh
+++ b/test/units/TEST-07-PID1.issue-2467.sh
@@ -8,7 +8,7 @@ set -o pipefail
 
 rm -f /tmp/nonexistent
 systemctl start issue2467.socket
-nc -i20 -w20 -U /run/test.ctl || :
+ncat -i20 -w20 -U /run/test.ctl || :
 
 # TriggerLimitIntervalSec= by default is set to 2s. A "sleep 10" should give
 # systemd enough time even on slower machines, to reach the trigger limit.
diff --git a/test/units/TEST-07-PID1.issue-3171.sh b/test/units/TEST-07-PID1.issue-3171.sh
index 374df54..e1a4b64 100755
--- a/test/units/TEST-07-PID1.issue-3171.sh
+++ b/test/units/TEST-07-PID1.issue-3171.sh
@@ -30,21 +30,21 @@ EOF
 systemctl start issue-3171.socket
 systemctl is-active issue-3171.socket
 [[ "$(stat --format='%G' /run/issue-3171.socket)" == adm ]]
-echo A | nc -w1 -U /run/issue-3171.socket
+echo A | ncat -w1 -U /run/issue-3171.socket
 
 mv $U ${U}.disabled
 systemctl daemon-reload
 systemctl is-active issue-3171.socket
 [[ "$(stat --format='%G' /run/issue-3171.socket)" == adm ]]
-echo B | nc -w1 -U /run/issue-3171.socket && exit 1
+echo B | ncat -w1 -U /run/issue-3171.socket && exit 1
 
 mv ${U}.disabled $U
 systemctl daemon-reload
 systemctl is-active issue-3171.socket
-echo C | nc -w1 -U /run/issue-3171.socket && exit 1
+echo C | ncat -w1 -U /run/issue-3171.socket && exit 1
 [[ "$(stat --format='%G' /run/issue-3171.socket)" == adm ]]
 
 systemctl restart issue-3171.socket
 systemctl is-active issue-3171.socket
-echo D | nc -w1 -U /run/issue-3171.socket
+echo D | ncat -w1 -U /run/issue-3171.socket
 [[ "$(stat --format='%G' /run/issue-3171.socket)" == adm ]]
diff --git a/test/units/TEST-07-PID1.issue-33672.sh b/test/units/TEST-07-PID1.issue-33672.sh
new file mode 100755
index 0000000..370497c
--- /dev/null
+++ b/test/units/TEST-07-PID1.issue-33672.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+# ex: ts=8 sw=4 sts=4 et filetype=sh
+
+set -eux
+set -o pipefail
+
+# shellcheck source=test/units/util.sh
+. "$(dirname "$0")"/util.sh
+
+# systemctl status always shows daemon-reload warning for a masked service with drop-ins
+# Issue: https://github.com/systemd/systemd/issues/33672
+
+UNIT=test-23-NeedDaemonReload.service
+
+cleanup() {
+    rm -rf /run/systemd/system/"$UNIT" /run/systemd/system/"$UNIT".d
+    systemctl daemon-reload
+}
+
+trap cleanup EXIT
+
+cat > /run/systemd/system/"$UNIT" <<EOF
+[Service]
+ExecStart=/usr/bin/true
+EOF
+
+mkdir /run/systemd/system/"$UNIT".d
+cat > /run/systemd/system/"$UNIT".d/desc.conf <<EOF
+[Unit]
+Description=Test NeedDaemonReload status of a masked unit with drop-ins
+EOF
+
+systemctl daemon-reload
+systemctl unmask "$UNIT"
+assert_eq "$(systemctl show -P NeedDaemonReload "$UNIT")" no
+
+systemctl mask "$UNIT"
+assert_eq "$(systemctl show -P NeedDaemonReload "$UNIT")" no
diff --git a/test/units/TEST-13-NSPAWN.nspawn.sh b/test/units/TEST-13-NSPAWN.nspawn.sh
index 7901e98..ee0fef8 100755
--- a/test/units/TEST-13-NSPAWN.nspawn.sh
+++ b/test/units/TEST-13-NSPAWN.nspawn.sh
@@ -179,6 +179,10 @@ elif [[ $1 == initgroups ]]; then
 fi
 EOF
     chmod +x "$root/bin/getent"
+    # The useradd is important here so the user is added to /etc/passwd. If the user is not in /etc/passwd,
+    # bash will end up loading libnss_systemd.so which breaks when libnss_systemd.so is built with sanitizers
+    # as bash isn't invoked with the necessary environment variables for that.
+    useradd --root="$root" --uid 1000 --user-group --create-home testuser
     systemd-nspawn --directory="$root" bash -xec '[[ $USER == root ]]'
     systemd-nspawn --directory="$root" --user=testuser bash -xec '[[ $USER == testuser ]]'
 
@@ -672,8 +676,10 @@ fi
 EOF
     chmod +x "$root/bin/getent"
 
-    mkdir -p "$root/home/testuser"
-    chown 1010:1010 "$root/home/testuser"
+    # The useradd is important here so the user is added to /etc/passwd. If the user is not in /etc/passwd,
+    # bash will end up loading libnss_systemd.so which breaks when libnss_systemd.so is built with sanitizers
+    # as bash isn't invoked with the necessary environment variables for that.
+    useradd --root="$root" --uid 1010 --user-group --create-home testuser
 
     cmd='PERMISSIONS=$(stat -c "%u:%g" /home/testuser/file); if [[ $PERMISSIONS != "1010:1010" ]]; then echo "*** wrong permissions: $PERMISSIONS"; return 1; fi; touch /home/testuser/other_file'
     if ! SYSTEMD_LOG_TARGET=console \
@@ -702,7 +708,7 @@ EOF
 testcase_notification_socket() {
     # https://github.com/systemd/systemd/issues/4944
     local root
-    local cmd='echo a | nc -U -u -w 1 /run/host/notify'
+    local cmd='echo a | ncat -U -u -w 1 /run/host/notify'
 
     root="$(mktemp -d /var/lib/machines/TEST-13-NSPAWN.check_notification_socket.XXX)"
     create_dummy_container "$root"
diff --git a/test/units/TEST-29-PORTABLE.sh b/test/units/TEST-29-PORTABLE.sh
index b4dcd5a..41dce4d 100755
--- a/test/units/TEST-29-PORTABLE.sh
+++ b/test/units/TEST-29-PORTABLE.sh
@@ -355,15 +355,16 @@ portablectl "${ARGS[@]}" attach --copy=symlink --now --runtime /tmp/rootdir mini
 portablectl detach --now --runtime --enable /tmp/rootdir minimal-app0
 
 # The wrong file should be ignored, given the right one has the xattr set
-mkdir -p /tmp/wrongext/usr/lib/extension-release.d /tmp/wrongext/usr/lib/systemd/system/
-echo "[Service]" > /tmp/wrongext/usr/lib/systemd/system/app0.service
-touch /tmp/wrongext/usr/lib/extension-release.d/extension-release.wrongext_somethingwrong.txt
-cp /tmp/rootdir/usr/lib/os-release /tmp/wrongext/usr/lib/extension-release.d/extension-release.app0
-setfattr -n user.extension-release.strict -v "false" /tmp/wrongext/usr/lib/extension-release.d/extension-release.app0
-portablectl "${ARGS[@]}" attach --runtime --extension /tmp/wrongext /tmp/rootdir app0
+trap 'rm -rf /var/cache/wrongext' EXIT
+mkdir -p /var/cache/wrongext/usr/lib/extension-release.d /var/cache/wrongext/usr/lib/systemd/system/
+echo "[Service]" > /var/cache/wrongext/usr/lib/systemd/system/app0.service
+touch /var/cache/wrongext/usr/lib/extension-release.d/extension-release.wrongext_somethingwrong.txt
+cp /tmp/rootdir/usr/lib/os-release /var/cache/wrongext/usr/lib/extension-release.d/extension-release.app0
+setfattr -n user.extension-release.strict -v "false" /var/cache/wrongext/usr/lib/extension-release.d/extension-release.app0
+portablectl "${ARGS[@]}" attach --runtime --extension /var/cache/wrongext /tmp/rootdir app0
 status="$(portablectl is-attached --extension wrongext rootdir)"
 [[ "${status}" == "attached-runtime" ]]
-portablectl detach --runtime --extension /tmp/wrongext /tmp/rootdir app0
+portablectl detach --runtime --extension /var/cache/wrongext /tmp/rootdir app0
 
 umount /tmp/rootdir
 umount /tmp/app0
diff --git a/test/units/TEST-55-OOMD-testbloat.service b/test/units/TEST-55-OOMD-testbloat.service
index ba4f2bc..70c8772 100644
--- a/test/units/TEST-55-OOMD-testbloat.service
+++ b/test/units/TEST-55-OOMD-testbloat.service
@@ -3,8 +3,8 @@
 Description=Create a lot of memory pressure
 
 [Service]
-# A VERY small memory.high will cause the 'stress' (trying to use a lot of memory)
+# A VERY small memory.high will cause the 'stress-ng' (trying to use a lot of memory)
 # to throttle and be put under heavy pressure.
 MemoryHigh=3M
 Slice=TEST-55-OOMD-workload.slice
-ExecStart=stress --timeout 3m --vm 10 --vm-bytes 200M --vm-keep --vm-stride 1
+ExecStart=stress-ng --timeout 3m --vm 10 --vm-bytes 200M --vm-keep
diff --git a/test/units/TEST-55-OOMD-testmunch.service b/test/units/TEST-55-OOMD-testmunch.service
index 5659906..79bd018 100644
--- a/test/units/TEST-55-OOMD-testmunch.service
+++ b/test/units/TEST-55-OOMD-testmunch.service
@@ -5,4 +5,4 @@ Description=Create some memory pressure
 [Service]
 MemoryHigh=12M
 Slice=TEST-55-OOMD-workload.slice
-ExecStart=stress --timeout 3m --vm 10 --vm-bytes 200M --vm-keep --vm-stride 1
+ExecStart=stress-ng --timeout 3m --vm 10 --vm-bytes 200M --vm-keep
diff --git a/test/units/TEST-55-OOMD.sh b/test/units/TEST-55-OOMD.sh
index b04ebca..944067c 100755
--- a/test/units/TEST-55-OOMD.sh
+++ b/test/units/TEST-55-OOMD.sh
@@ -6,14 +6,6 @@ set -o pipefail
 # shellcheck source=test/units/util.sh
  . "$(dirname "$0")"/util.sh
 
-. /etc/os-release
-# OpenSUSE does not have the stress tool packaged. It does have stress-ng but the stress-ng does not support
-# --vm-stride which this test uses.
-if [[ "$ID" =~ "opensuse" ]]; then
-    echo "Skipping due to missing stress package in OpenSUSE" >>/skipped
-    exit 77
-fi
-
 systemd-analyze log-level debug
 
 # Ensure that the init.scope.d drop-in is applied on boot
diff --git a/test/units/TEST-73-LOCALE.sh b/test/units/TEST-73-LOCALE.sh
index 18539b8..06c8c56 100755
--- a/test/units/TEST-73-LOCALE.sh
+++ b/test/units/TEST-73-LOCALE.sh
@@ -657,6 +657,29 @@ testcase_locale_gen_leading_space() {
 # running on.
 export SYSTEMD_KBD_MODEL_MAP=/usr/lib/systemd/tests/testdata/test-keymap-util/kbd-model-map
 
+# On Debian and derivatives writing calls to localed are blocked as other tools are used to change settings,
+# override that policy
+mkdir -p /etc/dbus-1/system.d/
+cat >/etc/dbus-1/system.d/systemd-localed-read-only.conf <<EOF
+<?xml version="1.0"?>
+<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+        "https://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+        <policy user="root">
+                <allow send_member="SetLocale"/>
+                <allow send_member="SetVConsoleKeyboard"/>
+                <allow send_member="SetX11Keyboard"/>
+        </policy>
+        <policy context="default">
+                <allow send_member="SetLocale"/>
+                <allow send_member="SetVConsoleKeyboard"/>
+                <allow send_member="SetX11Keyboard"/>
+        </policy>
+</busconfig>
+EOF
+trap 'rm -f /etc/dbus-1/system.d/systemd-localed-read-only.conf' EXIT
+systemctl reload dbus.service
+
 enable_debug
 run_testcases