systemd

From Gentoo Wiki
Jump to: navigation, search
Other languages:
English • ‎español • ‎日本語 • ‎中文(中国大陆)‎

Resources

systemd is a modern SysV-style init and rc (run command)[1] replacement for Linux systems. It is supported in Gentoo as an alternate init system.

Pre-installation Configuration

Note
When updating from <=sys-apps/systemd-203 check the upgrade subpage.

Kernel

systemd makes use of many modern Linux kernel features. Right now, the lower bound on kernel version is set in the ebuild to 2.6.39. In recent versions of sys-kernel/gentoo-sources, there is a convenient way of selecting the mandatory and optional kernel options for systemd:

KERNEL Quick setup using gentoo-sources
Gentoo Linux --->
        Support for init systems, system and service managers --->
                [*] systemd

To configure the kernel options manually (which is the only option when not using sys-kernel/gentoo-sources), the following kernel configuration options are required or recommended:

KERNEL Mandatory options
General setup  --->
	[*] Control Group support
	[*] open by fhandle syscalls
	[ ] Enable deprecated sysfs features to support old userspace tools
	[*] Configure standard kernel features (expert users)  --->
		[*] Enable eventpoll support
		[*] Enable signalfd() system call
		[*] Enable timerfd() system call
[*] Networking support --->
Device Drivers  --->
	Generic Driver Options  --->
		[*] Maintain a devtmpfs filesystem to mount at /dev
File systems  --->
	[*] Inotify support for userspace
	Pseudo filesystems  --->
		[*] /proc file system support
		[*] sysfs file system support
KERNEL Recommended options
General setup  --->
	[*] Namespaces support  --->
		[*] Network namespace
[*] Enable the block layer  --->
	[*] Block layer SG support v4
Processor type and features  --->
	[*] Enable seccomp to safely compute untrusted bytecode
Networking support --->
	Networking options --->
		<*> The IPv6 protocol
Device Drivers  --->
	Generic Driver Options  --->
		()  path to uevent helper
		[ ] Fallback user-helper invocation for firmware loading
Firmware Drivers  --->
	[*] Export DMI identification via sysfs to userspace
File systems --->
	<*> Kernel automounter version 4 support (also supports v3)
	Pseudo filesystems --->
		[*] Tmpfs virtual memory file system support (former shm fs)
		[*]   Tmpfs POSIX Access Control Lists
		[*]   Tmpfs extended attributes

For an UEFI system also enable the following:

KERNEL UEFI support
[*] Enable the block layer  --->
	Partition Types  --->
		[*] Advanced partition selection
		[*]   EFI GUID Partition support
Processor type and features  --->
	[*] EFI runtime service support
Firmware Drivers  --->
        EFI (Extensible Firmware Interface) Support -->
	        <*> EFI Variable Support via sysfs

If the system is using the BFQ scheduler, it's recommended by BFQ upstream to enable "BFQ hierarchical scheduling support" under "Enable the block layer -> IO Schedulers".

For an up-to-date list, see section "REQUIREMENTS" in the upstream README file.

The /run directory

The /run directory is used by systemd and other applications as a non-persistent storage for runtime data like pid files, sockets and state files.

The systemd package will create the /run directory itself. However, please note that this change will trigger automatic mounting of it in OpenRC as well, and may trigger its use by different software packages.

/etc/mtab

Upstream only supports the /etc/mtab file being a symlink to /proc/self/mounts. Not creating this symlink will also cause problems with mount (bug #434090) and df (bug #477240). In the past some utilities wrote information (like mount options) into /etc/mtab and thus it was supposed to be a regular file. Nowadays all software is supposed to avoid this problem. Still, before switching the file to become a symbolic link, please check bug #477498 to be sure that the system is not affected by any reported regressions.

To create the symlink, run:

root #ln -sf /proc/self/mounts /etc/mtab

Ensure /usr is present at boot time

For a split /usr configuration, use an initramfs to mount /usr before starting systemd. See the Initramfs Gentoo Guide for instructions.

Using LVM2 and initramfs

When sys-fs/lvm2 is used and the system is booted using an initramfs, the initramfs will have to be created using sys-kernel/genkernel-next by running:

root #genkernel --udev --lvm <target>

<target> is either initramfs or one of the other genkernel targets which imply the creation of an initramfs. For more information, look at the output of genkernel --help:

user $genkernel --help

When LVM is used, the lvmetad daemon needs to be started as well. Otherwise systemd will be unable to mount LVM volumes. lvmetad can be enabled in /etc/lvm/lvm.conf:

FILE /etc/lvm/lvm.confSnippet of required changes in lvm.conf
# Set use_lvmetad to '1' for systemd
use_lvmetad = 1
Note
Instead of modifying /etc/lvm/lvm.conf this could probably be achieved through a lvmetad.socket unit which activates a lvmetad.service, but current versions of sys-fs/lvm2 don't ship those yet.

Installation

sys-apps/systemd contains udev. Once installed, sys-fs/udev can be removed as systemd will be the provider for virtual/udev.

Enable the systemd USE flag globally (in make.conf). The consolekit USE flag should also be disabled to prevent conflicts with the systemd-logind service. It is also possible to switch to a systemd subprofile to use saner USE flags defaults in which case it is not necessary to change make.conf:

root #eselect profile list

Finally update the system with the new flags:

root #emerge -avDN @world

When dependency problems occur (such as sys-fs/udev blocking sys-apps/systemd), sys-fs/udev might be registered in the world file. Try to resolve this by deselecting it:

root #emerge --deselect sys-fs/udev

Booting with systemd

In order to run systemd, switch the init that the executable kernel (or the initramfs) uses.

Warning
The services that are set up for the previous service manager will not be automatically started. This is because the system is switching to a different service manager. In order to obtain back the functionality like networking or a login manager, these services will need to be enabled again. More information about this follows in the services section later in this article.
Note
In case the migration yields a broken state, it is always possible to boot back into the default service manager (OpenRC) by undoing this init change step. This allows safe return and a way to follow through the troubleshooting section at the end of this article to fix the problem.

The following subsections document how to switch the init in one of the boot managers or the kernel.

Grub Legacy (0.x)

The init=/usr/lib/systemd/systemd argument should be added to the kernel command-line. An example excerpt from grub.conf would look like so:

FILE /boot/grub/grub.confExample GRUB config for systemd
title=Gentoo with systemd
root (hd0,0)
kernel /vmlinuz root=/dev/sda2 init=/usr/lib/systemd/systemd

Should the system boot using OpenRC, try using real_init instead of init.

Grub 2

When grub2-mkconfig is used, add the init option to GRUB_CMDLINE_LINUX:

Note
This is not needed when using an initramfs generated by dracut with systemd inside as the initramfs already starts systemd.
FILE /etc/default/grubExample grub2-mkconfig config for systemd
# Append parameters to the linux kernel command line
GRUB_CMDLINE_LINUX="init=/usr/lib/systemd/systemd"

When the GRUB 2 configuration file is written by hand (experts only), append the init= parameter to the linux or linux16 command.

FILE /boot/grub/grub.cfgExample GRUB2 configuration fragment
linux /vmlinuz-3.10.9 root=UUID=508868e4-54c6-4e6b-84b0-b3b28b1656b6 init=/usr/lib/systemd/systemd

When using genkernel-next's initrd, use real_init instead of init.

In kernel config

The init configuration can also be hard-coded in the kernel configuration. See "Processor type and features -> Built-in kernel command line". Note that this technique works for both grub and grub2.

Setting root password

At this point don't forget to set the system's root password. If something goes wrong, systemd will prompt for the root password to go into maintenance mode.

Post-installation configuration

systemd supports a few system configuration files to set the most basic system details.

Note
While some system configuration parameters can be updated by modifying the appropriate configuration files, most settings are managed using utilities that require systemd to be running. In this case, it is safe to reboot the computer with systemd and use the hostnamectl, localectl and timedatectl utilities as required.

Hostname

To set the hostname, create/edit /etc/hostname and simply provide the desired hostname.

When booted using systemd, a tool called hostnamectl exists for editing /etc/hostname and /etc/machine-info. To change the hostname, run:

root #hostnamectl set-hostname <HOSTNAME>

Refer to man hostnamectl for more options.


Locale

Usually, locales will be properly migrated from OpenRC when installing systemd. When required, the locale can be set in /etc/locale.conf as per the Gentoo handbook instructions:

FILE /etc/locale.confSystem locale configuration
LANG="en_US.utf8"

Once booted with systemd, the tool localectl is used to set locale and console or X11 keymaps. To change the system locale, run the following command:

root #localectl set-locale LANG=<LOCALE>

To change the virtual console keymap:

root #localectl set-keymap <KEYMAP>

And finally, to set the X11 layout:

root #localectl set-x11-keymap <LAYOUT>

If needed the model, variant and options can be specified as well:

root #localectl set-x11-keymap <LAYOUT> <MODEL> <VARIANT> <OPTIONS>

Time and date

Time and date can be set using the timedatectl utility. That will also allow users to set up synchronization without needing to rely on net-misc/ntp or other providers than systemd's own implementation.

To learn how to use timedatectl simply run:

root #timedatectl --help

Automatic module loading

Automatic module loading is configured in a different file, or rather directory of files. The configuration files are stored in /etc/modules-load.d. On boot every file with a list of modules will be loaded. The file format is a list of modules separated by newlines and can have any name as long as it ends with .conf. The module loading can be separated by program, service or whatever way that fits personal preference. An example virtualbox.conf is listed below:

FILE /etc/modules-load.d/virtualbox.confExample file for the virtualbox modules
vboxdrv
vboxnetflt
vboxnetadp
vboxpci

Network

systemd-networkd

systemd-networkd is useful for simple configuration of wired network interfaces. It is disabled by default.

To configure systemd-networkd, create a *.network file under /etc/systemd/network. See systemd.network(5) for reference. A simple DHCP configuration is given below:

FILE /etc/systemd/network/50-dhcp.network
[Match]
Name=en*
 
[Network]
DHCP=yes
root #systemctl enable systemd-networkd.service
root #systemctl start systemd-networkd.service

Note that systemd-networkd does not update resolv.conf by default. To have systemd manage the DNS settings, replace resolv.conf with a symlink and start systemd-resolved.

root #ln -snf /run/systemd/resolve/resolv.conf /etc/resolv.conf
root #systemctl enable systemd-resolved.service
root #systemctl start systemd-resolved.service

NetworkManager

Often NetworkManager is used to configure network settings. For that purpose, simply run the following command when using an X11-powered desktop:

root #nm-connection-editor

If that is not the case and the network needs to be configured from console, give nmcli a try, or follow a guided configuration process through nmtui:

root #nmtui

nmtui is a curses frontend that will guide the user in the process while running in console mode.

Handling of log files

systemd has its own way of handling log files without needing to rely on any external log system (like app-admin/syslog-ng or app-admin/rsyslog). Messages can now be read with journalctl. Anyway, it can still be configured to use a preferred external tool for handling them. Please type man journald.conf for learning about how to configure journald to suit personal needs.

/tmp is now in tmpfs

Unless some other filesystem is explicitly mounted to /tmp in /etc/fstab, systemd will mount /tmp as tmpfs. That means it will be emptied on every boot and its size will be limited to 50% of the system's RAM size. To know why this is the desired behavior and how to modify it, take a look at API File Systems.

Configure verbosity of boot process

When migrating to systemd users usually notice differences regarding verbosity of boot process:

  • The boot option quiet not only influences the kernel output, but also that of systemd itself. Then, while setting up systemd for the machine, drop the option to see any errors could arise more easily. After that, add it back to get a quiet (and faster) boot.
  • Even passing the quiet boot option, systemd can still be configured to show its status by also passing systemd.show_status=1.
  • When not using the quiet boot option, some messages might be overwriting consoles. That is caused by the kernel configuration (see man 5 proc and look for /proc/sys/kernel/printk). To tweak it pass the loglevel=5 boot parameter to the kernel (and update the value according to preference, for instance set a lower value like 1).

Services

At some point the system will need to be rebooted in order to get systemd running (in system mode). Be sure to read all of this document to ensure systemd is configured as completely as possible before rebooting. Note that journalctl works with systemd not running, but that systemctl will not do anything useful without systemd running. Complete the service configuration (enabling and starting of services) after logging in to the system running systemd.

OpenRC services

Although systemd originally intended to support running old init.d scripts, that support is not suited well for a dependency-based RC like OpenRC and thus is completely disabled on Gentoo. OpenRC provides additional measures to ensure that init.d scripts can't be run when OpenRC was not used to boot the system (otherwise the results would be unpredictable).

Listing available services

All available service units can be listed using the list-units argument of systemctl:

root #systemctl list-units
UNIT                               LOAD   ACTIVE SUB       DESCRIPTION
boot.automount                     loaded active waiting   EFI System Partition Automount
proc-sys-fs-binfmt_misc.automount  loaded active waiting   Arbitrary Executable File Formats File System Automount Point
...

The following file suffixes are of interest:

Suffix Description
.service plain service files (e.g. ones just running a daemon directly),
.socket socket listeners (much like inetd),
.path filesystem triggers for services (running services when files change etc.).

Alternatively the systemctl tool can be used to list all services (including implicit ones):

root #systemctl --all --full

And finally check for services that failed to start:

root #systemctl --failed

Enabling, disabling, starting, and stopping services

The usual way of enabling a service is using the following command:

root #systemctl enable foo.service

Services can be disabled likewise:

root #systemctl disable foo.service

These commands enable services using their default name in default target (both specified in "Install" section of the service file). However, sometimes services either don't provide that information or users prefer to have another name/target.

Note that these commands only enable or disable the system to be started on a next boot; to start the service right now, use:

root #systemctl start foo.service

Services can be stopped likewise:

root #systemctl stop foo.service

Installing custom unit files

Custom unit files can be placed in /etc/systemd/system, where they will be recognized after running systemctl daemon-reload:

root #systemctl daemon-reload

/usr/lib/systemd/system is reserved for service files installed by the package manager.

Customizing unit files

When only minor changes to a unit are needed, there's no need to create a full copy of the original unit file in /etc/systemd/system. Overriding settings in a package management provided unit can be achieved by drop-in files in a *.d directory named after the original unit (e.g. apache2.d) in /etc/systemd/system/.

FILE /etc/systemd/system/apache2.d/mem-limit.confExample of adding/overriding settings in a service file
[Service]
MemoryLimit=1G

A reload of systemd is needed to inform it of the changes:

root #systemctl daemon-reload

Then the service needs to be restarted to apply the changes:

root #systemctl restart apache2

Verify that the changed property was applied to the service:

root #systemctl show --property=MemoryLimit apache2
MemoryLimit=1074000000

Enabling a service under a custom name

When the name provided by "Alias" in the unit's "[Install]" section does not meet the expectations and providing a permanent new value for this through a customization is not desired, a symlink can be created manually in /etc/systemd/system/*.wants/. The name of the *.wants directory can either specify a target or another service which will depend on the new one.

For example, to install mysqld.service as db.service in the multi-user.target:

root #ln -s /usr/lib/systemd/system/mysqld.service /etc/systemd/system/multi-user.target.wants/db.service

To disable the service, just remove the symlink:

root #rm /etc/systemd/system/multi-user.target.wants/db.service

Native services

Some of Gentoo packages already install systemd unit files. For these services, it is enough to enable them. A quick summary of packages installing unit files can be seen on systemd eclass users list.

The following table lists systemd services matching OpenRC ones:

Migration chart
Gentoo package OpenRC service systemd unit Notes
sys-apps/openrc bootmisc systemd-tmpfiles-setup.service always enabled, uses tmpfiles.d
consolefont systemd-vconsole-setup.service always enabled, uses vconsole.conf
devfs
dmesg
fsck fsck*.service pulled in implicitly by mounts
functions.sh See note bug #373219
hostname (builtin) /etc/hostname
hwclock See note always enabled as part of systemd (ie It is baked in and is not a unit)
keymaps systemd-vconsole-setup.service always enabled, uses vconsole.conf
killprocs
local
localmount local-fs.target actual units are created implicitly from fstab
modules systemd-modules-load.service always enabled, uses /etc/modules-load.d/*.conf
mount-ro
mtab
netmount remote-fs.target
numlock
procfs (builtin)
root remount-rootfs.service
savecache n/a OpenRC internals
staticroute
swap swap.target actual units are created implicitly from fstab
swclock
sysctl systemd-sysctl.service sysctl.conf and sysctl.d/
sysfs (builtin)
termencoding systemd-vconsole-setup.service always enabled, uses vconsole.conf
urandom systemd-random-seed-load.service
systemd-random-seed-save.service
app-admin/rsyslog rsyslog rsyslog.service
app-admin/syslog-ng syslog-ng syslog-ng.service
media-sound/alsa-utils alsasound alsa-store.service (enabled by default)
alsa-restore.socket (enabled by default)
net-misc/dhcpcd dhcpcd dhcpcd.service
net-misc/netifrc net.* net@.service systemd wrapper for net.* scripts (comes with net-misc/netifrc)
netctl@.service net-misc/netctl is originally an Arch Linux tool.
NetworkManager.service For <networkmanager-0.9.8.4 : enable NetworkManager-dispatcher.service for dispatcher.d scripts to work.
Enable NetworkManager-wait-online.service to detect that the system has a working internet connection.
Disable all other managers (e.g., wicd, dhcpcd) and wpa_supplicant.
dhcpcd.service Provided by net-misc/dhcpcd
systemd.networkd.service Part of systemd
net-misc/openntpd ntpd ntpd.service
net-misc/openssh sshd sshd.service runs sshd as a daemon
sshd.socket runs sshd on a inetd-like basis (for each incoming connection)
net-misc/wpa_supplicant wpa-supplicant wpa_supplicant.service D-Bus controlled daemon (e.g. for NetworkManager)
wpa_supplicant@.service interface-specific wpa_supplicant (used like wpa_supplicant@wlan0.service)
net-print/cups cupsd cups.service classic on-boot start up service
cups.socket socket and path activation (cups only started on-demand)
cups.path
net-wireless/bluez bluetooth bluetooth.service
sys-apps/dbus dbus dbus.service
dbus.socket
sys-apps/irqbalance irqbalance irqbalance.service supports daemon mode only
sys-apps/microcode-ctl microcode_ctl Configure microcode as a module to let it load the microcode itself. Go to "Processor type and features" -> "CPU microcode loading support" and remember to add the option you need depending on you having intel or amd processor.
sys-fs/udev udev udev.service
udev-mount (builtin) /dev is mounted as tmpfs
udev-postmount udev-trigger.service
udev-settle.service
sys-power/acpid acpid acpid.service Most of its functionality is done by systemd itself, then, maybe you could consider to stop enabling this
x11-apps/xdm (xdm) xdm.service OpenRC uses common xdm init.d installed by x11-base/xorg-server. With systemd you will need to enable corresponding unit file for each DM (gdm.service, kdm.service...)
net-firewall/iptables iptables iptables-store.service
iptables-restore.service

Timer services

Since version 197 systemd supports timers, making cron unnecessary on a systemd system. Since version 212 persistent services are supported, replacing even anacron. Persistent timers are run at the next opportunity if the system was powered down when the timer was scheduled.

The following is an example on how to make a simple timer that runs in the context of a user. It will even run if the user is not logged in. Every timed service needs a timer and a service file that is activated by the timer as follows:

FILE ~/.local/share/systemd/user/backup-work.timerExample of a timer running every working day
[Unit]
Description=daily backup work
RefuseManualStart=no
RefuseManualStop=no
 
[Timer]
Persistent=false
OnCalendar=Mon-Fri *-*-* 11:30:00
Unit=backup-work.service
 
[Install]
WantedBy=default.target
FILE ~/.local/share/systemd/user/backup-work.serviceExample of a service triggering backup
[Unit]
Description=daily backup work
RefuseManualStart=no
RefuseManualStop=yes
 
[Service]
Type=oneshot
ExecStart=/home/<user>/scripts/backup-work.sh

Firstly, tell systemd to rescan the service files:

user $systemctl --user daemon-reload

It is possible to trigger the backup manually by running the following command:

user $systemctl --user start backup-work.service

Start and stop the timer manually as follows:

user $systemctl --user start backup-work.timer
user $systemctl --user stop backup-work.timer

Finally, to activate the timer at every system start, run:

user $systemctl --user enable backup-work.timer

To check the last results of running the service:

user $systemctl --user list-timers

Emailing failures

If a timed service runs and fails an e-mail can be send out to inform the user or administrator. This is possible with the "OnFailure" stanza which specifies what should happen if a service fails. A failure is detected by a non-zero return code of the invoked script.

For that change the script as follows:

FILE ~/.local/share/systemd/user/backup-work.serviceExample of a service triggering backup
[Unit]
Description=daily backup work
RefuseManualStart=no
RefuseManualStop=yes
OnFailure=failure-email@%i.service
 
[Service]
Type=oneshot
ExecStart=/home/<user>/scripts/backup-work.sh

This requires to have the service failure-email@.service installed, which can be found in kylemanna's systemd-utils repository.

Replacing cron

The above timer and service files can also be added to /usr/lib/systemd/system to make them available system-wide. The install section should then say WantedBy=multi-user.target to enable the service at system start.

However, cron also runs the scripts in /etc/cron.daily and other locations. Several packages place scripts there that they expect to be run daily. This behavior can be emulated with systemd by installing sys-process/systemd-cron. Then activate the new cron replacement with the following commands:

root #systemctl enable cron.target
root #systemctl start cron.target

Troubleshooting

Graphical sessions opened in random places

By default systemd only launches a getty process when it's going to be used. This causes some display managers (like GDM) to use the remaining TTYs for opening graphical sessions on demand, which can result in having consoles and graphical sessions placed randomly depending on the order they were used.

To stick with a more "classical" behavior (i.e, consoles placed from tty1 to tty6 and graphical sessions using the remaining TTYs) force it to always launch getty on those:

root #systemctl enable getty@tty{2,3,4,5,6}.service

lvm

When switching from OpenRC to systemd and lvm is needed to properly mount the system volumes, activate the lvm service:

root #systemctl enable lvm2-monitor.service

While it might not be needed for activation of the root volume (if lvm is integrated into the initramfs) it might not work for other lvm volumes, unless the service is activated.

systemd-bootchart

KERNEL systemd-bootchart support
File systems  --->
	Pseudo filesystems --->
	[*] /proc file system support
Kernel hacking  --->
	[*] Kernel debugging
	[*] Collect scheduler debugging info
	[*] Collect scheduler statistics

As systemd-bootchart attempts to start /sbin/init, reconfigure it to invoke systemd instead:

FILE /etc/systemd/bootchart.conf
...
Init=/usr/lib/systemd/systemd
...

The result of the bootchart is a report in SVG format located in /run/log/.

syslog-ng conflicts with systemd

systemd creates /dev/log as datagram socket [2] [3] so syslog-ng needs to be told to read from a unix-dgram instead of a unix-stream as otherwise syslog-ng would be using a "wrong" stream:

FILE /etc/syslog-ng/syslog-ng.conf
# By default syslog-ng uses unix-stream. Comment this out and add unix-dgram instead.
# unix-stream('/dev/log');
unix-dgram('/dev/log');

sys-fs/cryptsetup configuration

systemd does not seem to respect /etc/conf.d/dmcrypt (see bug #429966) so it needs to be configured through the /etc/crypttab file:

FILE /etc/crypttabConfiguration file for encrypted block devices
crypt-home UUID=c25dd0f3-ecdd-420e-99a8-0ff2eaf3f391 -

Check for units that failed to start

Check for units that failed to start with:

root #systemctl --failed

Enable Debug Mode

To get more informations set the following in /etc/systemd/system.conf:

FILE /etc/systemd/system.conf
LogLevel=debug

Or enable the debug-shell, that opens a terminal at tty9. This helps to debug services during the boot process.

root #systemctl enable debug-shell.service

e4rat usage

Please remember to edit /etc/e4rat.conf setting 'init' to /usr/lib/systemd/systemd, otherwise it will keep booting OpenRC.

GRSecurity hardening

With grsecurity enabled, systemd-networkd might log the following error:

CODE systemd-networkd error
could not find udev device: Permission denied

The error raises due to systemd-networkd working under a non-root user with grsecurity refusing access to the complete /sys structure for such users. To disable this option, disable the kernel option CONFIG_GRKERNSEC_SYSFS_RESTRICT.

See also

External resources

References

  1. Eric S. Raymond. http://www.catb.org/jargon/html/R/rc-file.html Retrieved on June 27th, 2015
  2. Jose Pedro Oliveira. Note about custom syslog-ng configurations files, Red Hat Bugzilla, January 11, 2012. Retrieved on January 12th, 2015
  3. Systemd and syslog-ng interaction problems: system freezes / syslog-ng fails to start, Fedora Project Wiki. Retrieved on January 12th, 2015