Notices by daandemeyer (daandemeyer@mastodon.social)

On top of loading every library we depend on with dlopen, in systemd 261 we also use dlsym() to probe all glibc symbols introduced in glibc versions newer than our baseline (2.34). This means it's possible to build systemd on a system with newer glibc and still be able to run it on systems with older glibc. We use the same approach for all other library symbols newer than the baseline version we require.

The goal is to make systemd run everywhere regardless of where it was built.

#systemd261

@chergert Are you using the typeof trick we use in systemd to make dlopen nice to use? We recently added sd-dlopen.h but I guess you'd want to copy its approach rather than link against libsystemd.

@chergert An example of usage is in https://github.com/systemd/systemd/blob/main/src%2Fshared%2Fcryptsetup-util.h. dlfcn-util.h has the implementation. I had a quick look at g_module and I think you can use the DLSYM macros to avoid repeating all the function signatures you need.

@cwebber the AI contributions will happen regardless. It's trivial to have e.g. opus 4.6 spit out prs that we would not be able to classify as being written by AI. In fact, by adding an AGENTS.md that instructs AIs to add disclosure, we probably make AI written prs more obvious. Anyway, if we know people are going to use AI to contribute in ways we cannot reliably detect, we may as well add instructions to make those prs as good as possible.

This is hooked up into nspawn via a new --private-users-delegate= switch to delegate N uid ranges into the nspawn container. With this we're very close to making nested nspawn work but this requires a few more changes to nspawn which will come in 261. I'm also hooking this up to mkosi so we can finally boot VMs and containers from directories unprivileged and without /etc/subuid. vmspawn also learned to boot from a directory using nsresourced in v260.

@pid_eins started his series again so let me add an entry. In v260, I've added support for delegating UID ranges to containers from nsresourced and mountfsd. This allows nested containers to acquire their own UID ranges from nsresourced without needing to set up /etc/subuid inside the container. You can also easily enter a user namespace now with the foreign UID range mapped in to create container rootfs trees for use with transient UID ranges from nsresourced.

#systemd260 #systemd

Let me be cheeky and preempt @pid_eins's systemd 259 posts:

In systemd 259, I'm making it possible to run commands that need privileges as your current user instead of as root. With "run0 --empower", you'll get a session as your current user in which you can do anything that root would be able to do, without actually being root.

This is very useful when you need to run something with privileges but still want all created files and directories to be owned by your current user.

#systemd259