Skip to content

Conversation

arnaldo2792
Copy link
Contributor

Issue number:

Part of #660

Description of changes:

This series provides the whippet policies translated from the configurations provided by systemd for logind, networkd and resolved.

As part of this change, the XML configurations for the dbus-launcher are now provided in a subpackage, so that the correct configurations are selected depending on the packages available in the variant.

Testing done:

In combination with #677 and #661:

  • I modified the aws-dev variant, to include whippet in the list of installed packages. I confirmed that the whippet configuration files were installed and the dbus-launcher configuration files weren't
  • Without modifications to the aws-k8s-1.33 variant, I confirmed that the dbus-launcher configuration files were installed, and the whippet configuration files weren't

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

Provide dbus-launcher and whippet configuration files as subpackages,
favoring the dbus-launcher configuration files with a higher epoch
number.

Signed-off-by: Arnaldo Garcia Rincon <[email protected]>
Provide dbus-launcher and whippet configuration files as subpackages,
favoring the dbus-launcher configuration files with a higher epoch
number.

Signed-off-by: Arnaldo Garcia Rincon <[email protected]>
@vigh-m
Copy link
Contributor

vigh-m commented Oct 2, 2025

If the configs are the same for both versions of systemd, does it make sense to include them in the release package instead.

Comment on lines +1 to +4
# Generated programatically, serde/toml doesn't allow to force the "compact"
# format on serialization:
# [user.root]
# rules = []
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand this comment - did the programmatic generator write it and write out the commented lines? What program was used?

Provides: %{name}(dbus-config) = 1:
Provides: %{name}-resolved(dbus-config) = 0:
Provides: %{name}-networkd(dbus-config) = 0:
Conflicts: (%{_cross_os}dbus-broker-launcher or %{name}-dbus-launcher-config)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: this conflict is doing too much work. It also feels like a bug that whippet-config doesn't require whippet and dbus-launcher-config doesn't require dbus-broker-launcher.

You can just ensure that dbus-broker-launcher and whippet - the respective dependencies - conflict with each other, and that these config packages conflict with each other, and that each depends on its launcher.

Suggested change
Conflicts: (%{_cross_os}dbus-broker-launcher or %{name}-dbus-launcher-config)
Requires: %{_cross_os}whippet
Conflicts: %{name}-dbus-launcher-config

%package whippet-config
Summary: Whippet configuration files
Requires: %{name}
Provides: %{name}(dbus-config) = 1:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this provided at priority 1 instead of 0?

Comment on lines +182 to +184
Provides: %{name}(dbus-config) = 1:
Provides: %{name}-resolved(dbus-config) = 1:
Provides: %{name}-networkd(dbus-config) = 1:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure there's much value in these separate capabilities if they're always provided as a group.

Suggested change
Provides: %{name}(dbus-config) = 1:
Provides: %{name}-resolved(dbus-config) = 1:
Provides: %{name}-networkd(dbus-config) = 1:
Provides: %{name}(dbus-config) = 1:

Comment on lines +811 to +823
%files dbus-launcher-config
%{_cross_datadir}/dbus-1/system.d/org.freedesktop.login1.conf
%{_cross_datadir}/dbus-1/system.d/org.freedesktop.network1.conf
%{_cross_datadir}/dbus-1/system.d/org.freedesktop.systemd1.conf
%{_cross_datadir}/dbus-1/system.d/org.freedesktop.resolve1.conf
%{_cross_datadir}/dbus-1/system-services
%{_cross_datadir}/dbus-1/services/org.freedesktop.systemd1.service

%files whippet-config
%{_cross_datadir}/whippet/policies.d/org.freedesktop.login1.toml
%{_cross_datadir}/whippet/policies.d/org.freedesktop.network1.toml
%{_cross_datadir}/whippet/policies.d/org.freedesktop.systemd1.toml
%{_cross_datadir}/whippet/policies.d/org.freedesktop.resolve1.toml
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be less work overall to just ship both the XML and TOML configs in the same packages that previously just shipped the XML configs. Then which one is used only depends on which launcher binary gets installed.

[[default.rules]]
receive_sender = "org.freedesktop.login1"
allow = true

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: programmatic generator should not add superfluous empty lines at the end of the file 😀

Suggested change

Comment on lines +1 to +4
# Generated programatically, serde/toml doesn't allow to force the "compact"
# format on serialization:
# [user.root]
# rules = []
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also missing systemd 257 methods like QueueSignal.

Comment on lines +1 to +4
# Generated programatically, serde/toml doesn't allow to force the "compact"
# format on serialization:
# [user.root]
# rules = []
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For systemd 257, this is missing:

  • ListSessionsEx
  • Sleep
  • ReleaseSession
  • SetTTY

Comment on lines +44 to +54
[[default.rules]]
send_destination = "org.freedesktop.login1"
send_interface = "org.freedesktop.login1.Manager"
send_member = "GetSession"
allow = true

[[default.rules]]
send_destination = "org.freedesktop.login1"
send_interface = "org.freedesktop.login1.Manager"
send_member = "GetSessionByPID"
allow = true
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a blocker but these rules would be a lot easier to read if we allowed a list of methods per (destination, interface).

[[default.rules]]
send_destination = "org.freedesktop.login1"
send_interface = "org.freedesktop.login1.Manager"
send_members = [
  "GetSession",
  "GetSessionByPID",
]
allow = true

That would significantly reduce the boilerplate in these files.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants